Peter Sankauskas's questions

I have tried installing MCollective on the latest version of Ubuntu, and out of the box, it does not seem to be working. I am curious what I have missed, and where the correct place to file a bug is, assuming it is a bug.

Steps so far:

$ apt-get install mcollective-middleware mcollective mcollective-client
$ mc-find-hosts 
/usr/lib/ruby/1.8/mcollective.rb:1:in `require': no such file to load -- rubygems (LoadError)
    from /usr/lib/ruby/1.8/mcollective.rb:1
    from /usr/sbin/mc-find-hosts:3:in `require'
    from /usr/sbin/mc-find-hosts:3

At this point, it looks like the rubygems package should have been listed as a dependency. OK, so lets install that:

$ apt-get install rubygems
$ mc-find-hosts
$

Now it is just failing silently after a short delay.

Anyone experienced this or know of a way to solved it?

I have been learning Puppet (as in, the last 24 hours) and have come up with the following module to install Tomcat. It works great, but I can't help but feel like this is not the most optimal way to do this - particularly around the name[1-4] part and steps/dependencies. If a "Puppet Master" :) could take a look at what I am doing and suggest improvements, I would be most appreciative.

class tomcat {
  ####                                                                                
  # Tomcat                                                                            

  # Variables                                                                         
  $tomcatVersionedDir="/usr/local/apache-tomcat-6.0.29"
  $tomcatDir="/usr/local/tomcat"
  $tomcatBinDir="${tomcatDir}/bin"
  $tomcatDaemonSrcDir="${tomcatBinDir}/commons-daemon-1.0.2-native-src"

  # 1) Get the package                                                                
  file { "/root/tomcat6.tgz":
    ensure => "file",
    source => "puppet://puppet/tomcat/tomcat6.tgz",
  }

  # 2) Untar the package                                                              
  define tomcat_expand() {
    exec { "/bin/tar xzf /root/tomcat6.tgz":
      cwd => "/usr/local",
      creates => $tomcatVersionedDir,
    }
  }
  tomcat_expand { name1:
    require => File["/root/tomcat6.tgz"],
  }

  # 3) Create the symlink                                                             
  file { "${tomcatDir}":
    ensure => $tomcatVersionedDir,
    require => Tomcat_expand["name1"],
  }

  # 4) Daemon source expand                                                           
  define tomcat_daemon_expand() {
    exec { "/bin/tar xzf commons-daemon-native.tar.gz":
      cwd => "${tomcatDir}/bin",
      creates => "${tomcatDaemonSrcDir}",
    }
  }
  tomcat_daemon_expand { name2:
    require => File["${tomcatDir}"],
  }

  # 5) Configure daemon                                                               
  define tomcat_daemon_config() {
    exec { "./configure > puppet-config.out":
      path => "/bin:/usr/bin:.",
      cwd => "${tomcatDaemonSrcDir}/unix",
      creates => "${tomcatDaemonSrcDir}/unix/puppet-config.out",
    }
  }
  tomcat_daemon_config { name3:
    require => Tomcat_daemon_expand["name2"],
  }

  # 6) Compile daemon                                                                 
  define tomcat_daemon_compile() {
    exec { "make clean && make":
      path => "/bin:/usr/bin:.",
      cwd => "${tomcatDaemonSrcDir}/unix",
      creates => "${tomcatDaemonSrcDir}/unix/jsvc",
    }
  }
  tomcat_daemon_compile { name4:
    require => Tomcat_daemon_config["name3"],
  }

  # 7) Copy jsvc to bin directory                                                     
  file { "${tomcatBinDir}/jsvc":
    source => "${tomcatDaemonSrcDir}/unix/jsvc",
    require => Tomcat_daemon_compile["name4"],
  }
}

Is this style OK?

Another thing... since this is doing things like unpacking code for one task, is there a good way to do clean up, while still maintaining the flow through the steps? For example, deleting the commons-daemon-1.0.2-native-src directory after jsvc has been copied to bin?

I have Apache acting as a load balancer in front of 3 Tomcat servers. Occasionally, Apache returns 503 responses, which I would like to remove completely. All 4 servers are not under significant load in terms of CPU, memory, or disk, so I am a little unsure what is reaching it's limits or why. 503s are returned when all workers are in error state - whatever that means. Here are the details:

Apache config:

<IfModule mpm_prefork_module>
  StartServers           30
  MinSpareServers        30
  MaxSpareServers        60
  MaxClients            200
  MaxRequestsPerChild  1000
</IfModule>

...

<Proxy *>
  AddDefaultCharset Off
  Order deny,allow
  Allow from all
</Proxy>

# Tomcat HA cluster
<Proxy balancer://mycluster>
  BalancerMember ajp://10.176.201.9:8009 keepalive=On retry=1 timeout=1 ping=1
  BalancerMember ajp://10.176.201.10:8009 keepalive=On retry=1 timeout=1 ping=1
  BalancerMember ajp://10.176.219.168:8009 keepalive=On retry=1 timeout=1 ping=1
</Proxy>

# Passes thru track. or api.
ProxyPreserveHost On
ProxyStatus On

# Original tracker
ProxyPass /m  balancer://mycluster/m
ProxyPassReverse /m balancer://mycluster/m

Tomcat config:

<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JasperListener" />
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />

  <Service name="Catalina">
    <Connector port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />

    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

    <Engine name="Catalina" defaultHost="localhost">
      <Host name="localhost"  appBase="webapps"
          unpackWARs="true" autoDeploy="true"
          xmlValidation="false" xmlNamespaceAware="false">
    </Engine>
  </Service>
</Server>

Apache error log:

[Mon Mar 22 18:39:47 2010] [error] (70007)The timeout specified has expired: proxy: AJP: attempt to connect to 10.176.201.10:8009 (10.176.201.10) failed
[Mon Mar 22 18:39:47 2010] [error] ap_proxy_connect_backend disabling worker for (10.176.201.10)
[Mon Mar 22 18:39:47 2010] [error] proxy: AJP: failed to make connection to backend: 10.176.201.10
[Mon Mar 22 18:39:47 2010] [error] (70007)The timeout specified has expired: proxy: AJP: attempt to connect to 10.176.201.9:8009 (10.176.201.9) failed
[Mon Mar 22 18:39:47 2010] [error] ap_proxy_connect_backend disabling worker for (10.176.201.9)
[Mon Mar 22 18:39:47 2010] [error] proxy: AJP: failed to make connection to backend: 10.176.201.9
[Mon Mar 22 18:39:47 2010] [error] (70007)The timeout specified has expired: proxy: AJP: attempt to connect to 10.176.219.168:8009 (10.176.219.168) failed
[Mon Mar 22 18:39:47 2010] [error] ap_proxy_connect_backend disabling worker for (10.176.219.168)
[Mon Mar 22 18:39:47 2010] [error] proxy: AJP: failed to make connection to backend: 10.176.219.168
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state
[Mon Mar 22 18:39:47 2010] [error] proxy: BALANCER: (balancer://mycluster). All workers are in error state

Load balancer top info:

top - 23:44:11 up 210 days,  4:32,  1 user,  load average: 0.10, 0.11, 0.09
Tasks: 135 total,   2 running, 133 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.1%us,  0.2%sy,  0.0%ni, 99.2%id,  0.1%wa,  0.0%hi,  0.1%si,  0.3%st
Mem:    524508k total,   517132k used,     7376k free,     9124k buffers
Swap:  1048568k total,      352k used,  1048216k free,   334720k cached

Tomcat top info:

top - 23:47:12 up 210 days,  3:07,  1 user,  load average: 0.02, 0.04, 0.00
Tasks:  63 total,   1 running,  62 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.2%us,  0.0%sy,  0.0%ni, 99.8%id,  0.1%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   2097372k total,  2080888k used,    16484k free,    21464k buffers
Swap:  4194296k total,      380k used,  4193916k free,  1520912k cached

Catalina.out does not have any error messages in it.

According to Apache's server status, it seems to be maxing out at 143 requests/sec. I believe the servers can handle substantially more load than they are, so any hints about low default limits or other reasons why this setup would be maxing out would be greatly appreciated.

We have exim4 set up on Debian as a smarthost to send mail via Google's mail servers. We use Google Apps for everything else, so this made sense. Problem is, the password for the smart host account was changed, causing exim to bounce the messages back and then freeze them. Now I have a large collection of unsent mail in /var/spool/exim4/[input|msglog].

I have tried running:

exim -d -M 1Mx6IS-0006bC-3h

but that causes the bounced message to be sent, not the original. I can see a copy of the original message in /var/spool/exim4/input/1Mx6IS-0006bC-3h-D under the line

------ This is a copy of the message, including all the headers. ------

...but I have not figured out a way to take this frozen bounced message, and convert it back to the original message so it can be retried.

Any ideas?

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd).

I notice that if I run:

ldapsearch -x -W -b 'dc=example,dc=com' -H 'ldap://127.0.0.1:389/' 'objectclass=*'

and just press ENTER when it prompts for a password, that I get a list of directory entries. Anonymous access is not acceptable if I am opening this up to the internet, but cannot find a way to disable anonymous access.

I have tried modifying /etc/ldap/slapd.conf to the following:

access to *
    by dn="cn=admin,dc=example,dc=com" write
    by * none

... but that doesn't do the trick.

After this, I will get it running over TLS, but it is pointless doing that step while still allowing anonymous access.

Any ideas?

I was hoping someone out there would be able to look at this and let me know what I have missed. I have 4 machines and for some reason, only 1 of them can talk to the other 3 via their private IP address (on eth1).

The 4 machines are:

    mach01    10.176.193.17
    mach02    10.176.193.92
    mach03    10.176.193.27
    mach04    10.176.195.9

All of the machines are Debian lenny. From mach02, I can ping the other 3 machines no problem, and from the other machines, I can ping mach02. However, from mach01, mach03 and mach04 I can only ping mach02.

The results from "iptables --list" on all machines is:

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

So I do not believe there is a firewall issue. The routing tables for eth1 on all machines is:

    10.176.192.0    *               255.255.224.0   U     0      0        0 eth1
    10.191.192.0    10.176.192.1    255.255.192.0   UG    0      0        0 eth1
    10.176.0.0      10.176.192.1    255.248.0.0     UG    0      0        0 eth1

So that looks fine as well. For some reason, ARP requests are failing from mach03 to anywhere other than mach02, and similarly for other machines.

    mach03$ arping -c 1 -I eth1 10.176.193.17
    ARPING 10.176.193.17

    --- 10.176.193.17 statistics ---
    1 packets transmitted, 0 packets received, 100% unanswered

I do not see any reason why ARP would fail like this, and have run out of ideas and places to look. Does anyone else with more experience in troubleshooting networking have any ideas?

Thanks

EDIT

After trying to ping mach01 from mach03, the following is in the ARP cache:

    $ arp -a
    ? (10.176.193.17) at <incomplete> on eth1
    ? (67.23.45.1) at 00:00:0C:07:AC:01 [ether] on eth0

And the other way around (so from mach03 to mach01):

    ? (10.176.193.92) at 40:40:FA:77:D7:94 [ether] on eth1
    ? (10.176.193.27) at <incomplete> on eth1
    ? (67.23.45.1) at 00:00:0C:07:AC:01 [ether] on eth0

And more details on eth1:

    $ ip addr show dev eth1
    3: eth1:  mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
        link/ether 40:40:16:e0:f3:dd brd ff:ff:ff:ff:ff:ff
        inet 10.176.193.17/19 brd 10.176.223.255 scope global eth1
        inet6 fe80::4240:16ff:fee0:f3dd/64 scope link
           valid_lft forever preferred_lft forever

I am relatively new to LDAP, and have seen two types of examples of how to set up your structure.

One method is to have the base being: dc=example,dc=com while other examples have the base being o=Example. Continuing along, you can have a group looking like:

    dn: cn=team,ou=Group,dc=example,dc=com
    cn: team
    objectClass: posixGroup
    memberUid: user1
    memberUid: user2

... or using the "O" style:

    dn: cn=team, o=Example
    objectClass: posixGroup
    memberUid: user1
    memberUid: user2

My questions are:

1. Are there any best practices that dictate using one method over the other?
2. Is it just a matter of preference which style you use?
3. Are there any advantages to using one over the other?
4. Is one method the old style, and one the new-and-improved version?

So far, I have gone with the dc=example,dc=com style. Any advice the community could give on the matter would be greatly appreciated.

This is probably a noob question, but how can I determine if the public SSH key someone gives me has a passphrase or not?

We have a situation where I am not generating the SSH keys for users, but I want to make sure every SSH key I put on a server has a passphrase, but I get the feeling the passphrase is only part of the private key.

Thanks!

I am in the process of setting up an new Tomcat deployment, and want it to be as secure as possible.

I have created a 'jakarta' user and have jsvc running Tomcat as a daemon. Any tips on directory permissions and such to limit access to Tomcat's files?

I know I will need to remove the default webapps - docs, examples, etc... are there any best practices I should be using here? What about all the config XML files? Any tips there?

Is it worth enabling the Security manager so that webapps run in a sandbox? Has anyone had experience setting this up?

I have seen examples of people running two instances of Tomcat behind Apache. It seems this can be done using mod_jk or with mod_proxy... any pros/cons of either? Is it worth the trouble?

In case it matters, the OS is Debian lenny. I am not using apt-get because lenny only offers tomcat 5.5 and we require 6.x.

Thanks!