David Gardner's questions

I have some systems which currently use Likewise Open to integrate into an AD environment, but this creates UIDs/GIDs which are not compatible with the Unix UIDs/GIDs which some other systems use.

One suggestion has been to use the central AD as an LDAP and Kerberos server, and to have local information on the users and groups (with the correct UIDs/GIDs) shared out with NIS.

Since the NIS server would then not be giving out any password hashes, would this still be terribly insecure?

(I understand that NIS doesn't do host authentication, and the information travels over the wire unencrypted, but since this information is essentially public within this network I don't see those as problems in this case)

I've been looking at our backups recently and noticed that the tape throughput is a lot lower when writing lots of small files, so was thinking of tarring those small files up into one big tar file and the writing that to tape instead of the small files directly. (Much like Tar: avoid archiving of files larger than certain size)

However, when I then write this tar file to tape am I going to have problems if there is a tape error during it? I mean, am I going to lose that whole (large) file containing a lot of smaller files, or will I just lose a particular block of that tar file and be able to recover the rest of the files?

Also, how do backup programs like Amanda or Bacula cope with lots of small files? Do they just write the files individually to tape or do they do something like this pre-tarring into larger files which will write faster?

Note : It might just be that our staging disks are too slow, but I'm assuming that small files cause a backup performance problem like this for most people.

Having managed to kill sshd on a remote machine (by running a script which used all available memory in the machine, oops...) which I have no access to other than visiting the hosting for[1], I was considering ways to ensure that sshd is always kept running.

Other than a hacky cron job to restart sshd every n minutes or hours, using inittab to get init to keep sshd running seems like a good idea.

Are there any drawbacks from this approach? It would seem like something which it would be sensible for Linux distros to do by default, since sshd is often the only available method of access for a machine..

Additionally, are there any other daemons which I should be using this approach for? Perhaps a monitoring agent such as nrpe for nagios?

[1] Yes, management cards or a network power switch would be a good idea, but they were deemed "unnecessary" at the time...

Related to this question about using an SSD for system and HDD for data, except I would like my system to do this automatically...

Is it possible to have several layers of storage and push items automatically between them, using preferably free, open-source software?

I know of hugely expensive enterprise-class solutions like the EMC SAN->EMC Centera automatic archiving, but I was wondering if this sort of staged storage is possible to do automatically.

It would be nice to be able to have several layers in this : Memory->SSD->HDD->slower HDD or tape or some other archive solution.

Are there any filesystems which can do this automatically? (ZFS, Btrfs, HAMMER?)

Any Unix-variants are fine, as I'm interested in how this works and whether it's likely to be portable to Linux or other flavours (BSD etc).

I regularly but randomly get the following error message when I run the puppet client on machines (non-daemonized):

err: Could not create : Parameter path failed: File paths must be fully qualified
warning: Not using cache on failed catalog
warning: Configuration could not be instantiated: Parameter path failed: File paths must be fully qualified

It seems moderately clear what it means -- that I don't have a fully-qualified path in a parameter. However, it doesn't tell me where I can find this to fix it, or even which parameter is wrong :(

(If I use the debug option it consistently works, so it seems like a problem with the caching of the manifests... It would be nice to get rid of this for production use, still)

Note : I cannot make this happen consistently :/

This is a long-shot, as I can't think of any way you can stop such scams, but...

Is there anything I can do about scam job postings[1] being posted on various free-ads sites online, claiming to be from the company I work for, and giving an email address at yahoo or gmail or some such? If I can get full email headers then I can get the email accounts closed at the various free providers, but this is just a game of whack-a-mole which will go on forever.

What else can I do (if anything)? This clearly isn't good for the company name, and given the current economic situation there are a lot of people who will reply to a "job" which says they can get easy money. And, of course, being the sysadmin you're put with the task of somehow stopping these fake job postings giving people the wrong idea about your company...

[1] Looks like cheque/check fraud, getting you to pay it in and then transfer the non-existent money to elsewhere. Then it gets reversed and you're massively out of pocket.