cstan.io

Short tip: Update Delock WLAN Easy USB Switch 11828 Tasmota firmware

Sat, 06 Dec 2025 00:00:00 +0000

For little money, the Delock WLAN EasyUSB 11828 is a small USB A socket that can be switched via WLAN (2.4 GHz). The ports not only carry the power pins – USB 2.0 is also supported. The device is based on the ESP8266 and supports MQTT in addition to HTTP.

After my switch had been gathering dust on the shelf for a long time, it was finally put to use and was to be integrated into Home Assistant. Thanks to the Tasmota firmware used, this shouldn't have been a problem – but in my case, the device was not recognised.

Short tip: transactional-update and breaking post-scripts

Tue, 12 Aug 2025 00:00:00 +0000

I recently updated an openSUSE Leap Micro 6.1 machine running Uyuni 2025.05 before upgrading to Uyuni 2025.07:

1# transactional-update
2# reboot

After running transactional-update (as suggested by the Uyuni documentation) and rebooting the system, Uyuni couldn't be started anymore:

1# mgradm start
24:36PM INF Welcome to mgradm
34:36PM INF Executing command: start
4Error: failed to start systemd uyuni-db.service: exit status 1; failed to start systemd uyuni-server.service: exit status 1
5
6# podman ps
7CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

I found out that Podman isn't able to start the containers anymore:

Red Hat Summit 2025

Sun, 01 Jun 2025 00:00:00 +0000

From 19.05 to 22.05 the Red Hat Summit took place contrary to the first announcement again in Boston and not in Orlando. The conference again centred on announcements and current developments from within the company's own ranks. Approximately 7,000 participants attended the event.

Note 🎙️

On the occasion of the Red Hat Summit 2025, a special episode was published in the Urlaub im Userspace podcast.

Location

The event was held in the almost 5 hectare Boston Convention & Exhibition Centre. There was plenty of space for the 457 presentations, workshops and hands-on labs. Compared to previous years, the Red Hat Event Guide app was revised and now also offered indoor navigation. It was also essential to plan your own agenda in the form of a calendar in advance, as particularly popular sessions were usually fully booked before the start of the event. This year, however, we were reminded several times by e-mail to plan your own agenda.

Short tip: Nextcloud 31 - Incorrect row format found in your database

Thu, 15 May 2025 00:00:00 +0000

After upgrading to Nextcloud 31 I came across the following warning in the admin overview:

1Incorrect row format found in your database. ROW_FORMAT=Dynamic offers the best database performances for Nextcloud. Please update row format on the following list: oc_notes_meta, oc_profile_config, oc_twofactor_providers, oc_comments, oc_circles_remote, oc_accounts_data, oc_polls_share, oc_systemtag, oc_mail_provisionings, oc_calendar_appt_bookings, oc_group_user, oc_notifications_settings, oc_circles_membership, oc_authtoken, oc_vcategory_to_object, oc_direct_edit, oc_file_locks, oc_calendar_resources_md, oc_groups, oc_richdocuments_wopi, oc_whats_new, oc_text_sessions, oc_federated_reshares, oc_cards, oc_polls_notif, oc_polls_votes, oc_talk_rooms, oc_oauth2_clients, oc_flow_checks, oc_mail_tags, oc_login_flow_v2, oc_text_steps, oc_comments_read_markers, oc_polls_comments, oc_vcategory, oc_properties, oc_share, oc_group_admin, oc_circles_share_lock, oc_flow_operations_scope, oc_systemtag_group, oc_appconfig, oc_circles_member, oc_richdocuments_assets, oc_storages, oc_talk_bridges, oc_text_documents, oc_polls_log, oc_addressbookchanges, oc_mail_trusted_senders, oc_cards_properties, oc_polls_options, oc_directlink, oc_mounts, oc_migrations, oc_circles_circle, oc_circles_mountpoint, oc_users, oc_ratelimit_entries, oc_storages_credentials, oc_calendar_resources, oc_bruteforce_attempts, oc_calendarobjects_props, oc_webauthn, oc_mail_coll_addresses, oc_talk_sessions, oc_calendarsubscriptions, oc_recent_contact, oc_flow_operations, oc_mail_classifiers, oc_collres_resources, oc_calendar_rooms, oc_filecache, oc_systemtag_object_mapping, oc_mail_accounts, oc_calendarchanges, oc_filecache_extended, oc_talk_commands, oc_dav_cal_proxy, oc_oauth2_access_tokens, oc_circles_token, oc_mail_recipients, oc_mail_attachments, oc_preferences, oc_calendar_appt_configs, oc_calendar_rooms_md, oc_talk_attendees, oc_calendar_reminders, oc_calendar_invitations, oc_twofactor_backupcodes, oc_mimetypes, oc_known_users, oc_richdocuments_direct, oc_notifications_pushhash, oc_calendars, oc_calendarobjects, oc_jobs, oc_circles_mount, oc_schedulingobjects, oc_talk_internalsignaling, oc_accounts, oc_circles_event, oc_dav_shares, oc_user_transfer_owner, oc_activity, oc_mail_messages, oc_mail_mailboxes, oc_activity_mq, oc_files_trash, oc_mail_message_tags, oc_polls_polls, oc_notifications, oc_collres_accesscache, oc_trusted_servers, oc_collres_collections, oc_polls_preferences, oc_share_external, oc_user_status, oc_authorized_groups, oc_twofactor_totp_secrets, oc_mail_aliases, oc_privacy_admins, oc_addressbooks. Weitere Informationen findest du in der Dokumentation.

The InnoDB storage engine supports various formats used by Nextcloud by default to store row information:

SUSECON 2025

Mon, 07 Apr 2025 00:00:00 +0000

From 10.03 to 14.03.2025 the SUSECON took place in Orlando. Compared to the previous iteration of the conference, the 13th event of its kind lasted almost 2 days longer. The first day consisted of an exclusive event for partners, the last day ended for most participants at noon after some final presentations. The motto was once again "Choice happens".

Note 🎙️

On the occasion of SUSECON 2025, a special was published in the FOCUS ON: Linux-Podcast. In addition to a Recap, there is also an Interview with parts of the SUSE Multi-Linux Manager team.

Use Twinkly offline with Home Assistant

Tue, 17 Dec 2024 00:00:00 +0000

When the annual holiday is coming up, it's not just a good time to bring the year to a close - technical gadgets should not be neglected either. One such gimmick is the programmable RGB fairy lights from Twinkly. These are available in various shapes (stars, hearts, candles, pearls) and lengths (100, 250, 400 or 600 LEDs) and can be controlled via WLAN.

Unfortunately, the manufacturer has only provided for this via its own app. This takes over the initial WLAN configuration and controls the light chain via a HTTP API. Another function is the creation of your own animations. Unfortunately, an account is incomprehensibly required for this.

First experiences with Uyuni and SUSE Manager Podman images

Sun, 24 Nov 2024 00:00:00 +0000

As announced at this year's SUSECON, the new containerized SUSE Manager 5.0 was released in mid-July. The Uyuni project also offers images for the container version since version 2023.10. The most recently released version 2024.08 is the last one that is also offered as a classic RPM version.

Immutable

Compared to the previous versions, SLE Micro 5.5 and openSUSE Leap Micro 5.5 are now used - two immtuable distributions from our own ranks.

Note 💡

Unfortunately, there are currently no download links for openSUSE Leap Micro 5.5 on the corresponding project page. Here you can find the ISO image and the SHA256 checksum.

SUBSCRIBE 11

Thu, 24 Oct 2024 00:00:00 +0000

After a 5-year break, the SUBSCRIBE took place again from 18.10 to 20.10.2024. The 11th edition of the conference took place on the premises of the Bildungs- und Kulturzentrum Peter Edel in Berlin and was once again all about the independent podcasting scene. The program included numerous lectures and workshops. In contrast to other podcasting conferences, Subscribe sees itself as a community meeting and enables very personal networking - 150 participants took up the offer. It was my first podcasting conference.

Uyuni/SUSE Manager: Error synchronizing Oracle Linux 8 YUM repositories

Wed, 04 Sep 2024 00:00:00 +0000

In Uyuni 2024.07 and 2024.08 the synchronization of Oracle Linux 8 repositories is not possible without errors. The cause of the problem lies in the repositories, which do not correctly adhere to the specifications of modular repositories. The following error therefore appears during synchronization using spacewalk-repo-sync:

 1# spacewalk-repo-sync -c oraclelinux8-appstream-x86_64
 209:15:06 ======================================
 309:15:06 | Channel: oraclelinux8-appstream-x86_64
 409:15:06 ======================================
 509:15:06 Sync of channel started.
 6Retrieving repository 'oraclelinux8-appstream-x86_64' metadata .....[done]
 7Building repository 'oraclelinux8-appstream-x86_64' cache ..........[done]
 8All repositories have been refreshed.
 909:15:19
1009:15:19   Importing modules file 72532a5ca796febe70f0b6b2122739db1d79a7b72a5b1a6139e34e2594778204-modules.yaml.gz.
1109:15:19 *** NOTE: Importing modules file for the channel 'oraclelinux8-appstream-x86_64'. Previous modules will be discarded.
1209:15:20 An error occurred while reading module metadata: An error occurred while indexing a module entry:
1309:15:20     Failed to parse buildorder in component: 18446744073709551615: The integer value is larger than 9223372036854775807 [line 158 col 9]
1409:15:20     Failed to parse buildorder in component: 18446744073709551615: The integer value is larger than 9223372036854775807 [line 158 col 9]
1509:15:20     Failed to parse buildorder in component: 18446744073709551615: The integer value is larger than 9223372036854775807 [line 170 col 9]
1609:15:20     Failed to parse buildorder in component: 18446744073709551615: The integer value is larger than 9223372036854775807 [line 175 col 9]
1709:15:20     Failed to parse buildorder in component: 18446744073709551615: The integer value is larger than 9223372036854775807 [line 157 col 9]

A workaround is documented in the project's bug tracker. Until the openSUSE project delivers the updated version of the libmodulemd library (2.15.0, 2.13.0 is installed), a new version can be manually compiled on a second system.

FrOSCon 2024

Thu, 22 Aug 2024 00:00:00 +0000

Last weekend, the 19th FrOSCon conference took place as a hybrid event at Bonn-Rhein-Sieg University of Applied Sciences in Sankt Augustin on 17/18 August 2024. The programme again consisted of many lectures and workshops, numerous stands and the obligatory Social Event on Saturday evening invited participants to exchange ideas. Around 1,500 people took part in the event - 200 more than last year.

Talks

The lecture programme was once again extensive with 83 workshops and lectures - and, as always, free of charge. For me, there were some exciting presentations on both days - much more exciting than in previous years. The backlog of presentations that I want to look at afterwards has also not yet been fully processed. As usual, the individual sessions were streamed live by the Chaos Computer Club video team (C3VOC) streamed live and made available online at short notice (via own mirror server).

SUSECON 2024

Wed, 26 Jun 2024 00:00:00 +0000

From 17.06 to 19.06 the SUSECON took place in Berlin. Compared to the previous iteration of the conference, the event took place exclusively in presence.

Hinweis 🎙️

On the occasion of SUSECON 2024, a special was published in the FOCUS ON: Linux-Podcast. In addition to a wrap-up, there is also an interview with parts of the SUSE Manager team.

Location

The event took place at the Estrel Berlin - Germany's largest and busiest hotel.

Red Hat Summit 2024

Sun, 19 May 2024 00:00:00 +0000

From 06.05 to 09.05 the Red Hat Summit took place in Denver. The conference once again focused on the latest developments and announcements from the company's own ranks. Approximately 6000 participants attended the event in Colorado.

Note

On the occasion of the Red Hat Summit 2024, a two-part special was published in the FOCUS ON: Linux podcast. In addition to a wrap-up, there are also numerous interviews with experts.

Location

The event took place in the almost 20-hectare Colorado Convention Center - the number of hands-on labs, presentations and workshops on offer rose to 485. Compared to last year, it was even easier to get lost - the Red Hat Event Guide app was absolutely necessary to find your way around. Visitors were well advised to reserve desired lectures in advance in the schedule - lecture rooms and waiting lists were quickly exhausted. In the exhibition area there were community stands (e.g. Ansible, CentOS, Fedora) as well as numerous manufacturers who answered questions and also presented new products.

Mirror Ubuntu Pro packages without Landscape

Sat, 27 Apr 2024 00:00:00 +0000

What is Ubuntu Pro?

Ubuntu Pro is a not uncontroversial additional offer from Canonical for Ubuntu users. This extends - for a fee - the support time window of LTS releases from 5 to up to 10 years. For private use, the offer can be used free of charge for up to 5 computers - Ubuntu members can even refuel up to 50 computers. For older releases, support for up to 12 years has been offered since 2024, for which an additional - not officially known - fee must be paid. In addition to the main repository, some packages from the universe pool are also included in Ubuntu Pro as part of Expanded Security Maintenance (ESM). There is no specific list - however, according to the website, the focus seems to be on server applications and programming languages. Other offerings include Kernel Live Patching and security modules such as FIPS and USG. Canonical thus offers a similar range to SUSE Linux Enterprise Server and Red Hat Enterprise Linux - which should be of particular interest to enterprise customers.

Short tip: Remove Nextcloud File Locks

Sat, 27 Apr 2024 00:00:00 +0000

To prevent accidental overwriting of files during synchronization - especially between multiple users and clients - Nextcloud relies on File Locking. This function is implemented at application level and therefore has no special requirements for the file system used.

However, with large amounts of data and network problems, a dead lock can sometimes occur: Files cannot be deleted even though they are no longer in use. Corresponding error messages in the web interface and the corresponding clients show that the file is locked.

Chemnitzer Linux Tage 2024

Sun, 24 Mar 2024 00:00:00 +0000

Last weekend, the 19th Chemnitz Linux Days took place at Chemnitz University of Technology under the motto "Setting an example". The conference is one of the oldest and largest Linux and open source events in the German-speaking world. For me it was an absolute novelty, the distance had always put me off. There were 3200 participants on site and 300 viewers for the live streams.

Talks and workshops

As usual, the program was extensive and consisted of a total of 94 talks, 10 workshops and 8 courses for children. The content quality of the talks was generally very high and exceeded what I was used to from other conferences. The recordings were available on media.ccc.de within a short time.

Short tip: Remove gnome-text-editor session

Wed, 14 Feb 2024 00:00:00 +0000

gnome-text-editor, the default editor of the GNOME desktop, usually remembers recently opened documents and reopens them on startup after a crash. This is particularly impractical if the crash is caused by opening a file that is too large (e.g. 20 MB JSON dump) or unsupported (e.g. binary file):

Unfortunately, the parameters -i or --ignore-session do not help to solve the problem. One option is to remove the erroneous session so that the editor can be started again without errors:

Short tip: Control King Smith WalkingPad with QWalkingPad

Thu, 18 Jan 2024 00:00:00 +0000

I have owned a foldable King Smith WalkingPad R1 Pro treadmill for the home office for some time now. This is controlled with a remote control via BLE (Bluetooth Low Energy). Unfortunately, this seems to consume quite a lot of power - at least the CR2032 battery in my treadmill always runs out after a short time.

Since I always use the treadmill when I'm at the computer anyway, I can also control it via the computer. With QWalkingPad there is a Qt-based utility for exactly this purpose.

Caution: Proxmox VE and OCFS2 Shared Storage

Wed, 17 Jan 2024 00:00:00 +0000

Proxmox VE (Virtual Environment) is enjoying a great deal of interest, not least because of the Broadcom/VMware deal. For many, the hypervisor is a welcome alternative to vSphere ESXi - but differs in terms of storage. Here you usually have the choice between:

NFS/CIFS
iSCSI
Btrfs (technical preview)
LVM
ZFS
CephFS/Ceph RBD
Gluster

However, snapshot functionality is not supported for all storage types - ideally, the following should be selected:

Short tip: EL9 VMs boot into Kernel Panic under QEMU/KVM

Sat, 25 Nov 2023 00:00:00 +0000

When deploying a new AlmaLinux 9.3 VM under QEMU/KVM, I encountered the following error during the first boot:

Unfortunately, the error message is not very informative.

After I had ruled out a bug in the golden image I was using (manual deployments work), I came across a valuable hint in the Proxmox forum:

EL9 requires CPU architecture x86_64-v2 or newer - but the Terraform provider bpg/proxmox I use defaults to qemu64.

The first Event-driven Ansible plugin

Wed, 25 Oct 2023 00:00:00 +0000

During the Red Hat Summit in May this year, an interesting extension of the popular Infrastructure as Code solution was presented with Event-driven Ansible. With EDA, Ansible is extended by a proactive component that allows it to react dynamically to events. This focuses on the previous unique selling point of SaltStack (Event-driven infrastructure).

The central component of the extension are so-called rulebooks, in which events to be monitored are defined. If such an event occurs, a corresponding countermeasure can be defined - for example, the execution of playbooks. For monitoring, corresponding Event Source Plugins are required. With a manageable number of plug-ins, the variety of possibilities is currently still somewhat limited and cannot quite compete with the more mature SaltStack EDI. Infrastructure-related plug-ins, for example for local services or hard disk utilisation, are still in vain.

Uyuni Ansible-Collection

Wed, 11 Oct 2023 00:00:00 +0000

When it comes to managing larger system landscapes, SUSE Manager and the open source upstream project Uyuni are useful tools. They can be used to set up new systems, deploy patches and also support Infrastructure as Code via SaltStack.

In the context of customer projects, I have carried out numerous installations and configurations and have thus been looking for automation. On the one hand to reduce my workload (to have more time to watch cat videos) - on the other hand to prevent volatility errors**. The Uyuni project provides a salt formula for this - but most customers actually rely on Ansible. Uyuni also provides rudimentary Ansible integration to control managed client systems with Ansible. However, I was looking for exactly the opposite way: to install and control Uyuni via Ansible.

Short tip: NetworkManager, 802.1x and SELinux

Thu, 05 Oct 2023 00:00:00 +0000

IEEE 802.1X is a standard for authentication and authorisation of devices in networks. Thus, physical LAN ports, VLANs or WLANs can only connect to the network after successful authentication, for example via RADIUS. Communication can be encrypted via TLS or PPP-EAP-TLS, for example.

If this network configuration is to be used in connection with NetworkManager and SELinux, the storage location of the required user certificate and key is essential. Ideally, these should be located in the folder ~/.cert - even if this is not mentioned in the documentation:

MRMCD 2023

Wed, 27 Sep 2023 00:00:00 +0000

From 01.09 - 03.09.2023, the 19th MRMCD (MetaRheinMainChaosDays) took place on the premises of TU Darmstadt. The event is organised by the registered association of the same name, regional hackspaces and universities. As a special feature, each conference is held under a motto determined in advance, which is also reflected in the decoration of the premises. For me, it was the first CCC-related event - and a clear contrast to other open source and vendor conferences I have attended so far.

Create Execution Environments for Ansible Automation Platform

Mon, 18 Sep 2023 00:00:00 +0000

Red Hat Ansible Automation Platform (AAP), the commercial variant of the AWX project, is used to orchestrate and execute Ansible content in large and distributed system landscapes. A web interface facilitates the use in teams, while the actual execution takes place in specially adapted Podman containers - also called Ansible Execution Environments (EEs). Thanks to predefined EEs, you can get started straight away - however, required dependencies (roles and collections defined in roles/requirements.yml and collections/requirements.yml) are downloaded first when the project is updated. If the project is updated every time it is started, the result is that the execution of the code is seriously delayed.

FrOSCon 2023

Sat, 12 Aug 2023 00:00:00 +0000

Last weekend on 05/06.08.2023, the 18th FrOSCon conference took place as usual as a hybrid event at the Bonn-Rhein-Sieg University of Applied Sciences in Sankt Augustin. Due to scheduling conflicts with the Chaos Communication Camp 2023, the date was brought forward by a few weeks. This year's programme again consisted of numerous lectures and workshops. Numerous exhibitor stands and the obligatory Social Event on Saturday evening invited to networking and exchange. Compared to last year, the number of visitors rose from 750 to approx. 1,300, which is almost back to the pre-Covid level.

Short tip: amdgpu freezes with Steam under Pop!_OS 22.04

Mon, 10 Jul 2023 00:00:00 +0000

Recently I noticed that the entire graphical interface crashes after a few seconds as soon as a game is streamed via Steam - for example via a Steam Link or Apple TV box.

I'm using Pop!_OS version 22.04 LTS, the kernel used was 6.2.6-76060206 - but the older version 6.1 and 6.0 seem to be affected.

The whole thing is reproducible independent of the started game and is possibly documented in the log:

SUSECON 2023

Thu, 29 Jun 2023 00:00:00 +0000

From 20.06 to 22.06 the SUSECON took place in Munich. This was the first time since 2020 that the manufacturer's own conference was held in presence again. For well-known reasons, the last three conferences were held as pure online events. Since 28.06, the keynotes as well as many other exclusive presentations that did not make it into the main program for logistical reasons can be viewed as part of SUSECON Digital.

Red Hat Summit 2023

Fri, 23 Jun 2023 00:00:00 +0000

From 23.05 to 25.05 the Red Hat Summit took place in Boston. The manufacturer's own conference thus took place - for well-known reasons - for the first time since 2020 in presence. For me it was the first Red Hat conference.

notice

On the occasion of Red Hat Summit 2023, a three-part special was published in the FOCUS ON: Linux Podcast. In addition to a wrap-up, there are also interviews on oVirt and RHEL and UX and Fedora.

Augsburg Linux Info Day 2023

Thu, 04 May 2023 00:00:00 +0000

Last Saturday, the long-awaited Augsburg Linux Infoday 2023 took place at the premises of Augsburg University of Applied Sciences. It was the first event since 2019 - for reasons we all know.

Admission was free, visitors:inside could choose between 25 lectures, 6 workshops and 11 booths. A lot of program for a conference day that lasted from 09:30 to 17:00. In addition to beginners, advanced users were also invited to exchange ideas. The event has been organized by the Linux User Group Augsburg e.V. (LUGA) since 2001, making it one of the oldest Linux events in southern Germany. About 350 visitors were counted.

Short tip: Windows 10 VMs under QEMU/KVM

Mon, 24 Apr 2023 00:00:00 +0000

Although there are now fewer and fewer reasons to use Windows for classic application programs, the Redmond operating system is unfortunately still needed, especially for supposed "enterprise software".

The installation of the operating system is quickly done thanks to virt-install or virt-manager. For screen resolutions higher than 1920x1080, it is recommended to configure the QXL type graphics card. This also supports an automatic adjustment of the screen resolution (as offered e.g. in virt-manager). The Windows SPICE Guest Tools are also required for this.

Random freezes under Fedora (amdgpu)

Sun, 23 Apr 2023 00:00:00 +0000

I've been using Fedora 37 (and more recently 38) on two ThinkPads (T14 G3, P14s G3) with AMD Ryzen SoC (6850U) for a few months now.

Fedora 37 originally came with the Linux kernel in version 6.0.7. Later updates brought the versions 6.1 and 6.2. The latter unfortunately also introduced random freezes on my systems. Regardless of the applications running, power profile and system load, the system simply froze and had to be shut down violently. The firmware was always up to date.

Create SLES 15 SP4 Vagrantbox

Tue, 14 Feb 2023 00:00:00 +0000

Vagrant is very popular, especially for development purposes. Unfortunately, SUSE has decided to no longer offer such boxes for SLES 15 SP4 - for the previous releases SP2 and SP3 there were still corresponding downloads. An inquiry with the support has confirmed this assumption - unfortunately a corresponding reference is missing in the Release Notes.

If you need such a Vagrantbox, you can use the templates of the generic project to build your own Vagrantboxes with Packer. Another less time-consuming and complex option is to update the existing SP3 Vagrantbox.

Short tip: WireGuard VPN via FRITZ!Box and Network Manager

Thu, 12 Jan 2023 00:00:00 +0000

The biggest highlight of the recently released FRITZ!OS version 7.50 is the added WireGuard support. Compared to the previous IPSec standard, which can still be used, VPN connections can be set up significantly easier on different platforms. It also offers stronger cryptographic algorithms and better performance because it is provided directly as a kernel module.

Setting up IPSec VPN clients didn't work for my FRITZ!Box 7530, even though I followed the instructions exactly - I suspect IPv6 and DSLite-related problems here, but couldn't find any evidence for this. All the better that there is now a better alternative with WireGuard.

Lessons Learned: Vagrant + libvirt under Fedora

Thu, 06 Oct 2022 00:00:00 +0000

Vagrant is a popular tool when it comes to creating virtual machines on short notice and without further intervention.

Vagrant should not be installed via the official Hashicorp- but via the Fedora repositories - otherwise plugins (like the libvirt integration) have to be compiled manually. I also had compatibility problems here:

1# dnf install vagrant{,-libvirt}

Molecule on the other hand should be installed via pip:

1$ pip3 install --user molecule molecule-vagrant

Simple Vagrant machines without additional or private networks work without problems via the automatically selected user connection (qemu:///session). However, if additional networks are used, the following error usually appears:

Short tip: Rootless Podman + docker-compose under Fedora

Thu, 29 Sep 2022 00:00:00 +0000

Since 2018, there has been a very elegant and lean container runtime, Podman, as an alternative to Docker. Podman offers a smaller attack surface due to omitted background services and is also often pre-installed on Red Hat-like operating systems. With a few tricks, existing docker-compose configurations can still be used.

First, Podman must be installed including Docker compatibility and docker-compose - if not already done:

1# dnf install podman podman-docker docker-compose

For privileged containers, the system-wide socket must be enabled and made available under another name. Podman does not need a socket, Docker does - so docker-compose expects a socket for communication.

Short tip: brltty interferes with esptool.py under Pop!_OS

Sun, 28 Aug 2022 00:00:00 +0000

When using ESPHome or esptool.py under Pop!_OS 22.04 I recently encountered the problem that development boards (ESP8266, ESP32) could not be flashed:

 1$ esphome upload hurrdurr.yml
 2INFO Reading configuration hurrdurr.yml...
 3esptool.py v3.3.1
 4Serial port /dev/ttyUSB0
 5Connecting....
 6Chip is ESP8266EX
 7Features: WiFi
 8Crystal is 26MHz
 9...
10Writing at 0x000123da... (22 %)
11ERROR Running command failed: Could not configure port: (5, 'Input/output error')
12ERROR Please try running esptool.py --before default_reset --after hard_reset --baud 460800 --port /dev/ttyUSB0 --chip esp8266 write_flash -z --flash_size detect 0x0 /home/[...]/firmware.bin locally.

In the kernel logs, the connected development board briefly appeared via the expected device node /dev/ttyUSB0, but then disappeared after a few seconds:

FrOSCon 2022 - back to normal?

Wed, 24 Aug 2022 00:00:00 +0000

Last weekend on 20/21.08.2022 it was finally time - the 17th FrOSCon conference in presence took place. After two years of pandemic online events, lectures and workshops took place again at the Bonn-Rhein-Sieg University of Applied Sciences in Sankt Augustin. Exhibitor booths and the obligatory social event on Saturday evening invited to networking and exchange - which was actively used by the 750 visitors.

Talks

The lecture program was - as usual - extensive. Visitors could choose between 70 workshops and lectures - and, as usual, free of charge. While I was usually present only one day in the last years, this year's program was significantly more interesting for me, so I attended lectures on both days. There were some very interesting presentations and so I still have to watch one or the other presentation afterwards, as they were running in parallel.

Deploy Gitea Podman container unattended via Ansible

Tue, 29 Mar 2022 00:00:00 +0000

Gitea is a popular, lightweight Git frontend that can also be deployed quickly thanks to the Docker image . However, after the container is started, the initial configuration (network options, permissions, database) is done via web interface by default. This is unattractive if you want an unattended and automated installation - for example, because you set up many Gitea instances.

Fortunately, various environment variables can be assigned to the Gitea container to define most of the settings - a complete list of variable fragments can be found in the documentation.

Node-RED Flow backups using Git

Wed, 09 Feb 2022 00:00:00 +0000

Node-RED is particularly popular in home automation. For example, the free framework can be used to playfully create processes ("turn on light") that react dynamically to events ("if it's evening") - and that with low-code. The logic clicked together via drag & drop can then be exported via JSON, for example, and saved as a backup - if you think of it.

Note

Newer Node-RED versions include projects functionality which already serves Git integration - so the following steps aren't needed, anymore!

Short tip: Partial Commits with VSCode

Tue, 25 Jan 2022 00:00:00 +0000

One of the most important Git best practices is to write commits as atomic as possible - that is, to submit as few changes as possible, but as many as necessary. The advantage is obvious: commits can be reverted individually using git revert. If you mix bug fixes and new features wildly in one commit, you will undo more than you originally wanted in case of an error.

It becomes problematic if you have been working on different topics all day and have forgotten to submit your changes in between. Quickly many different changes are collected in one file and at the latest at the evening commit you are faced with a challenge.

Short tip: Nextcloud + 2FA + CalDAV and CardDAV under iOS

Sat, 22 Jan 2022 00:00:00 +0000

While setting up my Nextcloud calendar on an iOS device the other day, I encountered the following error:

1CalDAV account verification failed

The error also affected contacts via CardDav - the usual troubleshooting options failed:

Password reset
Using another device
Use different URL and port combinations

Finally, I created another new user, which worked without problems - that's when I noticed that 2FA is also a potential source of errors. In fact, iOS devices seem to have problems here - I don't recall a similar error on an Android device, my memory may be wrong here.

Linux year in review 2021 - my highlights

Wed, 22 Dec 2021 00:00:00 +0000

As the year draws to a close, there has once again been a lot going on in the Linux world. In the recently published episode of the FOCUS ON:DevOps podcast, we spent two whole hours discussing all the news in detail.

Time to take a slightly deeper look at my personal top 5.

Probably the biggest highlight for most people was the 30th anniversary of Linux - I already reported on this in another article. I was also able to contribute to two special episodes of the FOCUS ON: DevOps podcast.

Short tip: Shelly Plug does not find newer firmware

Sat, 04 Dec 2021 00:00:00 +0000

The Shelly Plug WLAN socket adapters from the Bulgarian manufacturer Allterco are very popular. They are inexpensive and - unlike other alternatives - also allow switching without cloud constraints via their own MQTT broker. However, some devices come with severely outdated firmware, for which the search for updates fails. Manual searching for new firmware versions does not help here either:

AppImage, Flatpak und Snap in comparison

Wed, 01 Dec 2021 00:00:00 +0000

For installating software, Linux has always offered various possibilities. For example, there is always the possibility of manual compilation using the well-known rule of three (configure, make, make install) - including all the advantages and disadvantages. However, the most convenient solution is using the distribution's package manager. This saves the user the annoying translation of source code - but there are also numerous representatives. Besides the usual Red Hat- (yum, dnf) and Debian-like (apt, apt-get) package managers, there are numerous other tools - and this is exactly where the problem lies.

30 years Linux - my personal retrospect

Wed, 25 Aug 2021 00:00:00 +0000

30 years ago today, a Finnish student presented a project in the then still very prominent Usenet. It was Linus Torvalds and the talk was about a small UNIX-like operating system which ran mainly on cheap 386/486 AT clones. Linus was interested in UNIX, but like most students and hobbyists at the time, could not afford hardware that could run UNIX. In developing his still-unnamed operating system (the name Linux came later), Linus was inspired by the free educational operating system Minix. His announcement was met with widespread interest and the rest is history. 🙂

Keychron K8 - cheap hotswap keyboard

Tue, 11 May 2021 00:00:00 +0000

After more than one year of collective home office I was looking for a keyboard that as silent as possible but still allows unresting typing. As a mechanical keyboard enthusiast, conventional rubberdome keyboards were not an option. Luckily, there are plenty of options available.

The range of mechanical keyboards is very broad - I started collecting them and have a always a matching one depending on the use case. A new trend is not to solder switches and let the user decide which one to choose. Hotswappable keyboards have pre-mounted switches but they can be removed and replaced very easily.

Oracle Linux Manager 2.10: First impressions

Wed, 05 May 2021 00:00:00 +0000

Nach der Einstellung des Spacewalk-Projekts durch Red Hat im Mai 2020 entschied sich neben SUSE auch Oracle für einen Fork der quelloffenen System Management-Software.

Oracle currently offers two tools for managing Oracle Linux:

Oracle Linux Management for Oracle Enterprise Manager
Oracle Linux Manager

Oracle Enterprise Manager is mainly a tool for managing Oracle databases and components relevant to it. For some time this tool also support managing Oracle Linux installations.

Short tip: Java applications and HiDPI

Sun, 02 May 2021 00:00:00 +0000

Legacy software is often used longer than planned. Running older Java software on high-resolution displays with more than 1080p is quite hard by default.

To fix this, manually setting scaling via command-line pararameters is sufficient:

1$ java -Dsun.java2d.uiScale=3.5 -jar app.jar

In this case, 3.5x or 350% scaling is set. Alternatively you can also set the environment variable GDK_SCALE:

1$ GDK_SCALE=3.5 java -jar app.jar

This should make applications human readable again:

Volla Phone: Android privacy phone without Google

Thu, 18 Mar 2021 00:00:00 +0000

With more than 60% market share Android devices are dominating the smartphone market for a long time. But the most devices have one in common: a nosy operating system that likes to experience as much as possible about the user.

Hallo Welt Systeme UG - a german startup from Remscheid - aims to change this. With the Volla Phone they pushed a completely Google-free Android smartphone to the market in late 2020. Sounds good, but is it worth it?

New year, new PC - based on AMD Ryzen

Sun, 21 Feb 2021 00:00:00 +0000

After roughly 8 years it was time to upgrade my desktop computer. Even though I already upgraded the graphic card two times in the mean time, processor and memory resources reached their limits. Especially computing intensive tasks and newer video games were slowd down. Fortunately, things have changed a lot in the last 8 years so an upgrade looked promising.

I really appreciated AMDs big comeback with the Zen architecture introduction. Especially since Intel missing innovations and production problems I wanted to have an AMD system again for the next computer.

Open Source Automation Days 2020 - Virtual Diversity

Tue, 01 Dec 2020 00:00:00 +0000

2020 is not only the product of a fivefold 404 but also the big year of online conferences. While conferences were previously held in particularly conspicuous or unusual locations and invited people to join the physical network, this year online platforms in particular serve as a necessary compromise.

One of the conferences I was especially looking forward to are the Open Source Automation Days of the Munich company ATIX AG.

The event took place from 19.10 to 21.10 - the first day was reserved for workshops, the last two days consisted of lectures.

Short tip: Convert SLES4SAP 12 to SLES 12

Wed, 11 Nov 2020 00:00:00 +0000

While there are scripts for migrating SLES to SLES4SAP, there are no tools the other way around. If you deployed the wrong template by mistake you can change the product without reinstallation with some manual steps. A comparable procedure has also been documented by the vendor for installing SUSE Manager.

First of all, identify the installed release:

1# rpm -qa | grep -i release
2SLES_SAP-release
3SLES_SAP-release-DVD

In this case, two packages and a symbolic link to the product need to be removed:

Raspberry Pi 4: Boot Ubuntu 20.04 via USB

Wed, 28 Oct 2020 00:00:00 +0000

For some time, the Raspberry Pi 4 also supports booting via USB to circumvent buggy SD card system media. Back in May, this feature was supplied as beta, since September it is considered as stable functionality.

Booting Raspberry Pi OS (former Raspbian) via USB works out of the box, but additional steps are required for the current Ubuntu LTS version 20.04.

Before booting Ubuntu via USB you will need to update the single-board computer's EEPROM using a Raspberry Pi OS installation. First, ensure having all available updates installed and reboot the device before altering the configuration file /etc/default/rpi-eeprom-update:

Canonical Landscape: Test and first impressions

Mon, 28 Sep 2020 00:00:00 +0000

Back in 2007, Canonical Landscape - a tool for managing Ubuntu systems - was introduced. So beside already popular tools such as Uyuni and Foreman there is yet another software with comparable features. How useful is it?

Expectations

I've never used Landscape. The reason for this is that I usually work with Red Hat-based distributions, mainly RHEL and SLES. I'm running some Debian-based systems in my Homelab: my Raspberry Pis are running on Raspbian and Ubuntu.

Short tip: VMware vSphere 6.7 Guest Customization and openSUSE Leap 15.2

Thu, 24 Sep 2020 00:00:00 +0000

When automatically customizing openSUSE 15.2 guests under VMware vSphere 6.7 recently, I stumbled upon the famous "Guest Customization failed" issue (once again).

After eliminating the most common error (not having Perl installed which is necessary) I had a look at the VMware Compatibility Guide. Looks like openSUSE 15 is officially not supported under vSphere but only under the desktop hypervisors:

SUSE Linux Enterprise Server 15, which is technically comparable is supported on the other hand:

Package web applications using nativefier

Sun, 20 Sep 2020 00:00:00 +0000

The struggle is real: for day-to-day work, leveraing several web applications such as messenger or customized booking systems is necessary. After a short time you will mostly have a flood of browser tabs and lose track.

Using nativefier it is possible to package websites into desktop applications.

Some websites and messengers offer appropriate clients (like Signal Desktop). These clients usually contain the website and an Electron environment. That's not very efficient and fast but that would be another issue. 🙂

Pinebook Pro: ARMazing or one-ARMed bandit?

Tue, 15 Sep 2020 00:00:00 +0000

With the Pinebook Pro PINE64 offers a very interesting notebook based on an ARM SoC. Because of its price below 200 USD the notebook is a good Chromebook alternative that offers more freedom because of its Open Source designs. All components and even the operating system can be switched easily - that sounds amazing!

But, how well performs the device as daily driver?

Why?

Why choose an alternative architecture at all when there are market-proven processors by Intel and AMD?

Short tip: WSL + Ansible = 'Failed to create temporary directory'

Mon, 24 Aug 2020 00:00:00 +0000

When using Ansible under WSL (Windows Subsystem for Linux) recently, I stumbled upon the following error:

1Failed to create temporary directory.
2In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rootet in "/tmp", for more error information use -vvv.

In this case, Ubuntu 20.04 was used but the issue can also occur on other Linux distributions or versions.

Vagrant + libvirt + openSUSE Leap = /dev/sda not found

Thu, 30 Jul 2020 00:00:00 +0000

Recently, I stumbled upon the following issue when creating new openSUSE Leap 15.1 Vagrantboxes from the generic and roboxes projects:

1[ TIME ] Timed out waiting for device dev-sda2.device.
2[DEPEND] Dependency failed for Resume from hibernation using device /dev/sda2.
3[  OK  ] Reached target Local File System (Pre).
4[  137.377508] dracut-initqueue[242] Warning: dracut-initqueue timeout - starting timeout scripts
5...

Beside openSUSE, also some versions of Fedora, RHEL and CentOS were affected.

The background is that the Symbios Logic SCSI driver (sym53c8xx) used by the Vagrantfile repositories was removed from the kernel for the affected distributions.

Uyuni: Cannot read/write '/var/lib/salt/.ssh/known_hosts'. Please check permissions.

Thu, 25 Jun 2020 00:00:00 +0000

Recently I stumbled upon the following error when registering a new openSUSE system in Uyuni:

The appropriate file simply did not exist - but the folder was created:

1# file /var/lib/salt/.ssh/known_hosts
2known_hosts: cannot open 'known_hosts' (No such file or directory)
3
4# ls -lad /var/lib/salt/
5drwxr-xr-x 1 salt salt 8 Jun 24 14:49 /var/lib/salt/
6
7# ls -lad /var/lib/salt/.ssh
8drwx------ 1 salt salt 22 Jun 25 08:37 /var/lib/salt/.ssh

The solution was really trivial - the file was created and permissions were assigned:

1# touch /var/lib/salt/.ssh/known_hosts
2# chmod 0600 /var/lib/salt/.ssh/known_hosts
3# chown salt: /var/lib/salt/.ssh/known_hosts

Afterwards registering the host was working again.

DIY voice assistant part 4: Internet radio and other (bad) jokes

Tue, 16 Jun 2020 00:00:00 +0000

In the last part of this series, we enabled the voice assistant to read temperature sensors and checking the weather over the internet. In this article, we will ensure entainment by implementing a DIY internet radio and an API for bad jokes.

Radio streams under Linux

A commonly used function of commercial voice assistants is playing music and internet radio - of course this feature is a must for the DIY variant (at least to increase the WAF). Rhasspy does not offer a feature like this, but that's not a problem - as we're using Node-RED we have a lot of expansion possibilities. For example, we can control additional containers in a comfortable manner.

Spacewalk and already installed outstanding patches

Mon, 08 Jun 2020 00:00:00 +0000

Sometimes Spacewalk still suggests updates and errata for a system even though they have already been installed. Especially for bigger system landscapes this is confusing as planning maintenance using the web interface is hard in this way.

1# zypper update scout
2Refreshing service 'spacewalk'.
3Loading repository data...
4Reading installed packages...
5No update candidate for 'scout-0.1.1+20180103.0595254-6.1.noarch'. The highest available version is already installed.
6Resolving package dependencies...
7
8Nothing to do.

Often, the solution for this problem is kinda easy. Within Spacewalk, there is a service called taskomatic being reponsible for executing internal tasks; the appropriate tasks are defined by time in bunches. Usually, Spacewalk systems are configured in a way that the download new software content (updates, errata) every night - sometimes the task for updating repository metadata (channel-repodata-default bunch) simply freezes. In this case, restarting the task scheduler and checking the log might do the trick:

Short tip: FreeIPA - CA did not start in 300.0s

Fri, 05 Jun 2020 00:00:00 +0000

During a recent installation of Red Hat Identity Management or FreeIPA I stumbled upon the following error message:

1DEBUG The ipa-server-install command failed, exception: RuntimeError: CA did not start in 300.0s
2ERROR CA did not start in 300.0s
3ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

CentOS was installed in version 7.6 (so slighty outdated) and FreeIPA was used in version 4.6.5-11:

1$ rpm -qa ipa-server nss
2nss-3.36.0-7.1.el7_6.x86_64
3ipa-server-4.6.5-11.el7.centos.4.x86_64
4
5$ cat /etc/redhat-release
6CentOS Linux release 7.6.1810 (Core)

During analysis the used NSS libraries (Name Service Switch) looked conspicuous to me. I found some bug reports in the internet but unfortunately they were not public.

There's life in the old dog yet: OpenVMS to run on x86

Tue, 26 May 2020 00:00:00 +0000

Beside UNIX, OpenVMS is one of the oldest but still actively developed operating systems. Since its introduction back in 1977 for the VAX architecture (Virtual Address Extension) it already survided two major platform switches: DEC Alpha (1992 - 1994) and Intel Itanium (2001).

Recently, VMS Software, Inc. (VSI) presented first results of a long-awaited milestone: OpenVMS is now able to run on the x86 platform. For me as hobbyist, this could make a little dream come true: using OpenVMS without power-wasting, loud and obsolete Itanium hardware. 🙂

Cooling your Raspberry Pi - reasonable or a waste?

Sun, 24 May 2020 00:00:00 +0000

There are plenty of radiators and fans for the small single-board computer - but how big is the impact of using cooling? Don't get me wrong - having a cooling system is always better than having no cooling at all. But I was curious about the exact difference with the current top model (RPi 4B, 4 GB).

First of all it is good to know in which temperature ranges the computer can be used at all. The Raspberry Pi Foundation names the following values in their FAQs:

DIY voice assistant part 3: Temperature sensors and weather information

Tue, 19 May 2020 00:00:00 +0000

In the last part of this series we linked Rhasspy and Node-RED to teach the assistant its first function: reading the current date and time. In this part we will focus on measuring temperature via the internet and DIY temperature guards based on ESP32 and MQTT.

DIY temperature guard

Temperature sensors are cheap and even microcontrollers (e.g. Arduino or ESP32) can often be bought for under 10 Euro. Using the Arduino IDE those components can easily be programmed - for example to read the room temperature and share values using WLAN. There are plenty of sensors available online making it hard to keep track - here's a listing of some common sensors and their prices:

Short tip: Forgot WSL root password

Mon, 04 May 2020 00:00:00 +0000

If you forget the root password (or a user password) of your WSL installation (Windows Subsystem for Linux), using the registry might help you. Because WSL is rather a lightweight kernel expansion than a full-featured VM, the typical live-CD trick (mounting the filesystem and running chroot) won't help.

Below the path KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss you will find additional keys per WSL installation. Here you will also find additional keys - using DefaultUid the start user can be changed. Usually, WSL starts with a unprivileged user (UID 1000) - and this user can't change the root password or its own password if the old one is not known. Double-click on the item and set the value to 0 temporarily - WSL must not be started during this.

DIY voice assistant part 2: Linked components and first function

Wed, 29 Apr 2020 00:00:00 +0000

In the last part of this series we checked-out and installed software for building our own voice assistant without leverage cloud resources. In this article we will focus on linking both Rhasspy and Node-RED. At the end, the assistant will learn it's first function.

Desired state

As we already know from the last article, Rhasspy is not able to execute intents on it's own - for this it needs an external tool such as Node-RED.

Short tip: Migrate Git repository with history

Sun, 26 Apr 2020 00:00:00 +0000

Recently, I had to migrate a bigger amount of git repositories from one software to another provider. One requirement was to copy the whole project including commit history and tags. Fortunately, it was easy to automate this process.

First of all the former repository needs to be cloned - if not done, yet:

1$ git clone <URL>

Created tags are read like this:

1$ git fetch --tags

If you leverage multiple branches, check-out all branches that need to be copied once:

DIY voice assistant part 1: Software options and installation

Fri, 24 Apr 2020 00:00:00 +0000

Voice assistants are omnipresent gadgets loved by technophile geeks. They support ad-hoc tasks (set tee timer, announce outdoor temperature) and integrate flawlessly into home automation and other third-party systems. Unfortunately, data privacy is often subordinated with these kind of gadgetry. Using various open-source tools you can build your own simple voice assistant without cloud constraints - which might do the job in the most cases.

Requirements

Offline voice assistants are available in various characteristics - but basically you need to keep in mind that local selfmade-siris can't compete with cloud-based pendants when talking about functionality. The reason for this is simple - commercial products have access to nearly inexhaustible compute power and uncountable user data. Siri, Alexa and other learn from billions of users every day - private assistants need to be content with the family as user basis. Also the compute capacity of a single-board computer is heavily limited in comparison. Recognizing full sentences ("Hey, turn on the radio", "Please turn on the radio") is a complex task - a better way is to leverage simple commands ("Turn on radio").

Create multi-arch Docker images for Docker

Thu, 09 Apr 2020 00:00:00 +0000

Docker has been supporting multiple processor architecture for a long time - including x86_64 and ARMv6/7 being the most well-known ones. In addition to them, aarch64/arm64 (ARMv8+), s390x (IBM z Systems) and ppc64le (IBM POWER) are also possible.

Images can be created for multiple architectures in a parallel manner and uploaded to Docker Hub - if you keep some intermediate steps in mind.

Dockerfile

One way to create images is the Dockerfile - a simple text file that creates a new image on the basis of an existing one. Basically, this is the common procedure - creating a "naked" image that contains both the operating system and the application from scratch is way more time-consuming.

Compile Pico TTS on Raspbian

Tue, 31 Mar 2020 00:00:00 +0000

To translate text into voice, a TTS software (Text-to-Speech) is required. Under Linux there are basically two free tools: CMU Flite and eSpeak.

CMU Flite (festival-lite) exists since 2001 and is therefore considered a veteran in speech synthesis under Linux, eSpeak was first released in 2006. From a sound perspective, both tools deliver usable results when using english language, the german voices could be improved heavily.

Of course, there are also cloud-based TTS solutions (for example Amazon Polly oder Google Cloud TTS) - but you should decide on your own whether you would like to go for such a solution.

The agony of choice: a new notebook

Mon, 18 Nov 2019 00:00:00 +0000

If you‘re also working in IT, you will know the problem: new software always brings new requirements and at some point even powerful hardware is not adequate anymore. Even for private use-cases it might be a good idea to replace hardware after 5 years - even if you won‘t get any tax benefits. 🙂 Recently, I had to replace my notebook - but finding an successor was not easy at all.

SLE 15 Unified Installer - is less actually more?

Tue, 08 Oct 2019 00:00:00 +0000

SUSE Linux Enterprise Server 15 (SLES) not only introduced new software packages - another big update was making those packages more modular. In comparison to predecessor releases, SLES has a generic installation media for the first time. Earlier versions had dedicated images for products such as SLES for SAP or SUSE Manager based on the main distribution.

As a result, this change cut down installation media to about 600 MB, and installs only a basic system without YaST. Additional required packages can be retrieved during the installation via SUSE Customer Center (SCC), SUSE Subscription Manager (SMT), SUSE Repository Mirroring Tool (RMT) or ISO images. Beside the installation DVD (SLE-15-SP1-Installer-DVD-x86_64-GM-DVD1.iso, 660 MB) also a package ISO (SLE-15-SP1-Packages-x86_64-GM-DVD1.iso, 8 GB) is available. Images with the -DVD2.iso postfix only contain source code packages and might be uninteresting for the most installations.

Short tip: Clone Git repository via SSH and SOCKS proxy

Tue, 13 Aug 2019 00:00:00 +0000

When using tools such as GitLab can cloned via HTTP and SSH. Especially the second choice can be handy if there is no VPN available - but keep in mind, also sending DNS via the jumphost.

The first step is establishing a SSH connection leveraging port forwarding:

1$ ssh -A -D 1337 USER@IP -i pinkepank.key

Afterwards, http://localhost:1337 can be used as SOCKS proxy verwenden - web servers in the remote networks should be accessable including DNS.

Short tip: Utilize Ansible role via Vagrant

Tue, 16 Jul 2019 00:00:00 +0000

When implementing larger tasks in Ansible, you might thinking about writing your own Ansible role sooner or later. For this, the ansible-galaxy command can help you:

1$ ansible-galaxy init my-role
2- my-role was created successfully

Beside handlers, variables and meta data, also a test task is created. Using this task, the role can easily be assigned to a host:

1$ cat my-role/tests/test.yml
2---
3- hosts: localhost
4  remote_user: root
5  roles:
6    - my-role

This task can be linked within Vagrant to configure a freshly deployed system:

Short tip: Ansible - "failed to create temporary content file: 'The read operation timed out'"

Mon, 17 Jun 2019 00:00:00 +0000

While using the Ansible modules get_url and unarchive I recently stumbled upon the following errors:

1failed to create temporary content file: 'The read operation timed out'
2failed to create temporary content file: (-1, 'Unexpected EOF')

After some research it figured out that the urllib3 library (which is used by Ansible for HTTP downloads) was heavily outdated.

1$ rpm -qa|grep -i urllib3
2python-urllib3-1.10.2-5.el7.noarch

Version 1.25.3 was available on PyPi. Updating the library fixed the issue:

Test-driven development with Chef and Vagrant

Fri, 19 Oct 2018 00:00:00 +0000

When it is planned to automate deploying and configuring complex insfrastructure setups, Chef is a mighty tool. Focussing the Infrastructure as Code (IaC) manifesto, it offers more than conventional Configuration Management and can be used to replace manual tasks with faster, repeatable and measurable automatisms. When developing these automatisms, Vagrant is often used to deploy temporary VM instances hypervisor independently in an automated fashion.

In the next sections you will see what test-driven development (TDD) means in this context and how you can leverage the mentioned tools. 🙂

Short tip: Python TypeError: init() takes exactly 2 arguments (4 given)

Sat, 06 Oct 2018 00:00:00 +0000

Recently, I stumbled upon the following issue while installing a Python utility on an older CentOS system:

 1# python setup.py install
 2Traceback (most recent call last):
 3  File "setup.py", line 102, in
 4    'katprep_snapshot=katprep.snapshot:cli',
 5  File "/usr/lib64/python2.7/distutils/core.py", line 152, in setup
 6    dist.run_commands()
 7  File "/usr/lib64/python2.7/distutils/dist.py", line 953, in run_commands
 8    self.run_command(cmd)
 9  File "/usr/lib64/python2.7/distutils/dist.py", line 972, in run_command
10    cmd_obj.run()
11  File "/usr/lib/python2.7/site-packages/setuptools/command/develop.py", line 27, in run
12    self.install_for_development()
13  File "/usr/lib/python2.7/site-packages/setuptools/command/develop.py", line 129, in install_for_development
14    self.process_distribution(None, self.dist, not self.no_deps)
15  File "/usr/lib/python2.7/site-packages/setuptools/command/easy_install.py", line 701, in process_distribution
16    distreq.project_name, distreq.specs, requirement.extras
17TypeError: __init__() takes exactly 2 arguments (4 given)

The tool I wanted to install leverages the Python module setuptools for simplifying installation (easy_install). I ensured that the installation program syntax was correct - also, other tools were unable to install. Finally, I found out that the Python module was corrupted during numerous installations and uninstallations - re-installing it fixed the issue:

Short tip: Puppet - 'Unable to fetch my node definition, but the agent run will continue'

Tue, 25 Sep 2018 00:00:00 +0000

Doing a recent Puppet agent upgrade from version 3.x to 4.x I stumbled upon the following errors:

1Puppet (warning): Unable to fetch my node definition, but the agent run will continue:
2Puppet (warning): Could not find terminus rest for indirection node
3/File[/var/lib/puppet/lib] (err): Failed to generate additional resources using 'eval_generate': Could not find terminus file for indirection file_metadata
4/File[/var/lib/puppet/lib] (err): Could not evaluate file metadata for puppet://myserver.localdomain.loc/plugins: Could ont find terminus rest for indirection file_metadata
5Puppet (err): Failed to generate additional resources using 'eval_generate': Could not find terminus file for indirection file_metadata

After some research it turned out that the agent configuration file was erroneous. It contained some obsolete parameters and also configured the appropriate Puppet server in the [agent] section (instead of [main] section):

1[main]
2    logdir = /var/log/puppet
3    localconfig = $vardir/localconfig
4    classfile = $vardir/classes.txt
5
6[agent]
7    environment = production
8    server = myserver.localdomain.loc
9    ca_server = myserver.localdomain.loc

After cleaning-up the configuration, the file looked like this:

Short tip: VirtualBox 5.2 installation under macOS 10.13

Thu, 06 Sep 2018 00:00:00 +0000

VirtualBox enjoys great popularity where it is required to virtualize common operating systems for conventional use-cases at no cost. In comparison with other hypervisors such as VMware Workstation, VirtualBox only offers basic graphics acceleration - which is sufficient for classic desktop applications.

During a recent installation under macOS 10.13 I had problems installing the software. Der appropriate assistant always crashed with the following error message:

The installation failed. The installed encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.

Short tip: Install missing SNMP MIBs under Debian Linux

Tue, 28 Aug 2018 00:00:00 +0000

Leveraging SNMP is often a pain when appropriate MIB files (Management Information Base) are missing - e.g. because the manufacturer did not document them or only offer them at fee. When utilizing a Perl program recently, I stumbled upon the following issue:

Cannot find module (SNMPv2-SMI):

After ensuring that missing Perl SNMP packages are not the reason for this error, I discovered the "snmp-mibs-downloader" package. This utility downloads missing SNMP MIBs and places them in the appropriate folders. The package is part of the non-free repository that might be needed to enabled first:

Short tip: Find out HP Managepent Processor IP address

Thu, 28 Jun 2018 00:00:00 +0000

Recently I needed access to a HP Management Processor (MP) without knowing the appropriate IP address.

A possibility is to utilize a serial connection to the MP - but this is kinda complicated if you don't have any physical system access.

A smarter approach is to find out the IP address using the running operating system (HP-UX). For this, you will need to have the additional software product SFM-CORE (HPUX System Fault Management) installed. The following command checks whether the product is installed:

Puppet agents force dozens of errors: "Could not set 'file' on ensure: incorrect header check"

Sat, 23 Jun 2018 00:00:00 +0000

Recently I had the problem that my homelab's Linux machines managed by Puppet were generating dozens of error messages when updating the catalog:

1# puppet agent --test
2Error: /File[/var/lib/puppet/lib/puppet/parser/functions/load_module_metadata.rb]/ensure: change from absent to file failed: Could not set 'file' on ensure: incorrect header check
3Error: Could not set 'file' on ensure: incorrect header check
4Error: Could not set 'file' on ensure: incorrect header check
5Wrapped exception:
6incorrect header check
7...

This issue first occurred when upgrading Katello to version 3.5. Back then, I also upgraded Puppet from version 3 to 4:

1katello# puppet --version
24.10.12

In accordance with the documentation Puppet 3 clients are still supported. After numerous agent re-installations and further analysis, I had no other ideas.

Short tip: Manage cloned systems with SUSE Manager

Tue, 22 May 2018 00:00:00 +0000

It is a common procedure to use templates ("golden images") when deploying virtual machines. Recently I had an issue when deploying SLES machines - newly registered systems within SUSE Manager replaced older one. The management agent was installed within the template.

For classic systems (registered via RHNSD and OSAD) it is sufficient to remove the following files:

1# rm /etc/sysconfig/rhn/{osad-auth.conf,systemid}

On Salt systems, the following file needs to be removed:

Apache Guacamole, Part 1: Basics and installation under CentOS 7

Fri, 30 Mar 2018 00:00:00 +0000

Readers of my blog know that I have been maintaining a homelab for a couple of years. I really like leveraging products I'm focussing on in my working hours also at home. In other words: I like gaining hands-on experience and learning things from scratch. To access my lab remotely, I have been using a VPN solution in the last couple of years. Unfortunately, you're sometimes travelling in network were outgoing ports are strictly regulated (e.g. only HTTP/HTTPS allowed). Instead of using my VPN solution's default port, I have decided to go for a high port to avoid typical brute force attacks.

FirewallD in a nutshell 101

Mon, 26 Mar 2018 00:00:00 +0000

With FirewallD, some Linux distributions introduce a new default firewall differing heavily from previous interfaces. This post focusses the basic concept and some practical examples.

A major difference is that the firewall now supports changes in realtime without dropping active connections. FirewallD integrates seamlessly into D-Bus which makes it easier for applications and services to retrieve and control firewall configurations. In additional to that, there are plenty of pre-configured zones and services which enable faster configurations.

Short tip: Apache and Pacemaker: invalid parameter

Thu, 22 Mar 2018 00:00:00 +0000

Recently I had some issues with a Linux cluster running Corosync, Pacemaker and Apache. I was unable to run the redskin as ressource - starting always failed with "invalid parameter":

 1# crm resource start apache
 2# crm status
 3...
 42 nodes configured
 55 resources configured
 6
 7Online: [ deb9-node2 deb9-node1 ]
 8
 9Full list of resources:
10
11 Master/Slave Set: ms_drbd_drbd1 [drbd_drbd1]
12     Masters: [ deb9-node2 ]
13     Slaves: [ deb9-node1 ]
14 Resource Group: grp_fs-ip-apache
15     fs_www     (ocf::heartbeat:Filesystem):    Started deb9-node2
16     Service_IP (ocf::heartbeat:IPaddr2):       Started deb9-node2
17     apache     (ocf::heartbeat:apache):        Stopped
18
19Failed Actions:
20* apache_start_0 on deb9-node2 'invalid parameter' (2): call=155, status=complete, exitreason='none',
21    last-rc-change='Thu Mar 22 14:41:20 2018', queued=0ms, exec=2811ms

I was pretty sure that the configuration was correct as I have been using it on plenty of systems:

SUSE Linux Expert Days 2018 Frankfurt

Sun, 04 Mar 2018 00:00:00 +0000

Last Tuesday, one of the SUSE Linux Expert Days 2018 events was taking place in Frankfurt. Every year, SUSE arranges plenty of those events in order to update customers with talks and demonstrations about new products and updates. Instead of less events with bigger audience, 80 regional events are arranged to keep attendance manageable and promote individual discussions. To answer questions, experts were available anytime. This year, the event's topic was "Open. Redefined. Open is more than just code.".

Authenticate Spacewalk users with FreeIPA

Fri, 26 Jan 2018 00:00:00 +0000

A fresh Spacewalk installation usually defines user accounts in a local manner - including permissions. Especially for bigger system landscapes with requirements such as Single Sign-on, this is not a practical solution.

Fortunately, Spacewalk and Red Hat Satellite 5 support authentication using FreeIPA and Red Hat Identity Management. Beginning with Spacewalk 2.3 and Red Hat Satellite 5.7 there is an utility called spacewalk-setup-ipa-authentication which fully automates configuration all participating components (SSSD, Apache, Tomcat, SELinux). Prior to those versions, changes need to be made manually.

CentOS 7.4, Spacewalk 2.7 and Reposync: Internal Server Error

Wed, 24 Jan 2018 00:00:00 +0000

After my last Spacewalk 2.7 installation I had the problem that synchronising repositories using the web interface failed with the following error:

The system protocol (/var/log/messages) included the following finding:

1Jan 24 21:02:13 st-spacewalk03 server: Caused by: java.lang.RuntimeException: File not found: /var/log/rhn/reposync/icinga2.log
2Jan 24 21:02:13 st-spacewalk03 server: at com.redhat.rhn.common.util.FileUtils.readStringFromFile(FileUtils.java:101)
3Jan 24 21:02:13 st-spacewalk03 server: at com.redhat.rhn.frontend.action.channel.manage.SyncRepositoriesAction.getLastSyncLog(SyncRepositoriesAction.java:215)
4Jan 24 21:02:13 st-spacewalk03 server: at com.redhat.rhn.frontend.action.channel.manage.SyncRepositoriesAction.parseSyncLog(SyncRepositoriesAction.java:227)
5Jan 24 21:02:13 st-spacewalk03 server: at com.redhat.rhn.frontend.action.channel.manage.SyncRepositoriesAction.execute(SyncRepositoriesAction.java:84)
6Jan 24 21:02:13 st-spacewalk03 server: at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:425)
7Jan 24 21:02:13 st-spacewalk03 server: ... 45 more

Strangely, the file existed:

1# cd /var/log/rhn
2# ll -d reposync
3drwxr-xr-x. 2 root apache 4096 18. Jan 23:21 reposync
4# ll reposync
5total 3244
6-rw-rw----. 1 apache apache   94706 24. Jan 20:57 icinga2.log
7-rw-rw----. 1 apache apache 3203348 24. Jan 20:57 opensuse-42.3.log
8-rw-rw----. 1 apache apache    7915 24. Jan 20:50 spacewalk-27-client.log

Also, the log file's SELinux type was noticeable:

Short tip: CentOS 7.4, PostgreSQL 9.2.23 and Spacewalk 2.7: Could not install database

Thu, 18 Jan 2018 00:00:00 +0000

When installing Spacewalk 2.7 under CentOS 7.4 along with PostgreSQL 9.2.23, I recently stumbled upon the following error:

1# spacewalk-setup
2* Setting up SELinux..
3** Database: Setting up database connection for PostgreSQL backend.
4** Database: Installing the database:
5** Database: This is a long process that is logged in:
6** Database:   /var/log/rhn/install_db.log
7*** Progress: ####
8Could not install database.

The mentioned log file contained the following errors:

 1# less /var/log/rhn/install_db.log
 2...
 3Created symlink from /etc/systemd/system/multi-user.target.wants/postgresql.service to /usr/lib/systemd/system/postgresql.service.
 4Hint: the preferred way to do this is now "postgresql-setup initdb"
 5Initializing database ... OK
 6
 7/usr/bin/spacewalk-setup-postgresql: Line 165: [: 018446744073692774399: integer expression expected.
 8Redirecting to /bin/systemctl start postgresql.service
 9createdb: database creation failed: ERROR:  new encoding (UTF8) is incompatible with the encoding of the template database (SQL_ASCII)
10HINT:  Use the same encoding as in the template database, or use template0 as template.

The hint regarding the postgresql-setup command is particularly noticeable. Luckily, I've created a snapshot of the system enabling me to "rewind" in order to check the hint.

Short tip: Move running processes into another terminal

Fri, 29 Dec 2017 00:00:00 +0000

Every Linux user knows the following scenario: a running process should be moved to another terminal. An example: an application update takes longer than expected and the status should be monitored on the go in GNU Screen. It's just nasty, if you forgot to prepare this prior to that.

Happily, there are plenty tools for this scenario. A couple of years ago, I found the tool retty - unfortunately it was not very stable and therefore migrated applications often crashed. I was more successful with the utility reptyr, which is available for the most Linux distributions (under Enterprise Linux you get the tool via the EPEL repository).

Short tip: ESXi 6.5, Supermicro X10SDV-TP8F and 10G NICs

Wed, 20 Dec 2017 00:00:00 +0000

When reinstalling one of my homelab vSphere cluster nodes I noticed again, that the Intel driver ixgbe is not part of the ESXi base image. This driver is needed for my Supermicro mainboard X10SDV-TP8F in order to enable 10G networking.

On the VMware download section there is an appropriate download for ESXi 6.0. Anyhow, this driver also works along with ESXi 6.5 - and in accordance with the compatibility list - it is also supported for the newer release.

System management with Foreman/Katello - Part 2: Products, Repositories and Content Views

Tue, 19 Dec 2017 00:00:00 +0000

The last post of this series introduced the software projects Foreman and Katello. If you followed the instructions, you were able to login to a fresh Foreman installation.

In this part, the new installation is filled with live: first software contents are added to deploy and manage systems later.

If you already had a chance to work with Spacewalk (which was the upstream project for the previous Red Hat Satellite major version) might be puzzled by the new terms that are used within Katello:

Migrate WordPress from qTranslate-X to WPML

Fri, 15 Dec 2017 00:00:00 +0000

I have been blogging in multiple languages for couple of years: in my mother tongue german and - because of international visitors - also in english. In the beginning I decided to go for the qTranslate plugin. Unfortunately, development stalled at some time and I had to find an alternative. Luckily there were some forks - qTranslate-X was a good successor.

Sadly, development has stalled again. There have been no updates since 2016 and with newer WordPress versions coming into picture, annoying bugs increase. Since WordPress 4.9, the plugin is not able to translate categories and other taxonomies, such as tags, anymore (that was one reason why I have not posted any new posts in the last time). Because receiving updates in the near future looked unrealistic to me, I had to find another alternative.

Short tip: Get WWN port names under Linux

Fri, 24 Nov 2017 00:00:00 +0000

To find out the WWN port name of a HBA under Linux, reading the port_name file is sufficient - e.g. for all HBAs:

1$ cat /sys/class/scsi_host/host*/device/fc_host/host*/port_name
20x2002f6dc44b8e2b6
30x2001f6dc44b8e2b6

Forcefully stop hanging Foreman tasks

Sat, 19 Aug 2017 00:00:00 +0000

After a system crash I recently had the problem that Foreman had several orphaned tasks that could not be stopped from the web interface:

Because I planned a Foreman upgrade this was pretty bad as it prevented the pre-upgrade check:

1# foreman-rake katello:upgrade_check
2...
3Checking upgradeability...
4Checking for running tasks...
5[ERROR] - There are 8 active tasks.

To fix this it is necessary to kill the orphaned tasks with fire. To do so, you will need to retrieve the task ID from the PostgreSQL database:

Short tip: my Foreman/Katello blog post series

Sat, 19 Aug 2017 00:00:00 +0000

I'm currently working on a blog post series about Foreman, Katello and Red Hat Satellite 6.

Here's the link collection for beginners:

"Introduction and installation" (also published on Pro-Linux [button size="xsmall" color="red"]german[/button])
"Products, Repositories and Content Views" (also published on Pro-Linux [button size="xsmall" color="red"]german[/button])

(this list will be updated regularly)

Here is a recording of my presentation about the topics from above at the FrOSCon 12 conference (German):

English slides of my presentation can be downloaded here.

Short tip: Deploy OVA/OVF templates using OVF Tool

Sun, 30 Jul 2017 00:00:00 +0000

Recently I had massive problems with deploying some VMware appliances under vSphere 6.5. Independently of the frontend (Host Client, HTML 5 Client, Web Client, C# Client) I was unable to deploy templates in a clean way at all - mostly aborts and "generic system failures" occured.

Mark Brookfield gave me the tip to use OVF Tool instead of a graphical interface. The console utility focusses at importing/exporting OVA/OVF templates between multiple VMware products and is available for Microsoft Windows, Linux und App macOS erhältlich. The tool can be downloaded for free.

Simple REST application with Python and Flask

Sat, 22 Jul 2017 00:00:00 +0000

Currently I'm spending a lot of time on automating complex application scenarios; during training I also starting learning about creating customized REST applications. The result was a tutorial which covers all stages of developing a small "RESTful" application:

Concept/Definition
Development
Tests and documentation

But, let's start with the basics first...

Crash course: REST in Peace

REST was designed for communicating between application services as lightweight alternative to existing solutions such as SOAP (Simple Object Access Protocol) or WSDL (Web Services Description Language).

vRealize Orchestrator Configuration Elements in a nutshell

Wed, 12 Jul 2017 00:00:00 +0000

When using an older vRO workflows (vRealize Orchestrator) I stumbled upon the problem that too many information needed to be entered manually. In this case it is easy to enter information incorrectly so I was looking for a possibility to avoid unnecessary inputs. During my researches I stumbled upon Configuration Elements. Reading two blog posts (here and here) I focussed on this and implemented appropriate functions in my home lab. This blog post describes the whole procedure a little bit more detailed than the sources mentioned above.

New vSAN 6.6 home lab

Sat, 01 Jul 2017 00:00:00 +0000

More than a year ago, I upgraded my home lab to get started with vSAN. Back then I decided to go for a small hardware upgrade and already feared that the new resources will lack again very soon. And of course that happened after a short time, when I installed the vSAN cluster.

Back then I already heard about the Xeon D product family, but didn't want to invest on it as prices were really high. Things have changed now, prices decreased and so I purchased two systems to have more resources this time. In comparison with my previous setup, both servers can address up to 128 GB of memory instead of 32 GB. So in summary, the 2-node cluster can be expanded to up to 256 GB of memory.

Short tip: vCenter Server 6.5 UI installer: Failed to connect to SSO

Sun, 28 May 2017 00:00:00 +0000

When deploying vCenter Server 6.5 recently, I stumbled upon an issue that I was able to reproduce for the versions 6.5c and 6.5d. When deploying the appliance using the vCSA UI installer, the second stage always crashed with an error like this:

1Unable to connect to vCenter Single Sign-On: Failed to connect to SSO; uri:https://st-vcsa03.stankowic.loc/sso-adminserver/sdk/vsphere.local

When analyzing the erroneous appliance I saw the following lines in the system protocol:

1vmware-stsd[1762]: has address 127.0.0.1. Request for http://localhost:7080/afd failed after 10 seconds. Status: /usr/bin/curl status. Response: 000. Host: localhost has address 127.0.0.1. Request for http://localhost:7080/afd failed after 10 seconds. Status: /usr/bin/curl status. Response: 000. ...

It seems like the VMware Identity Management service, which is essential for SSO, could not be started - as a result, the installation crashes. I was able to reproduce this effect on multiple ESXi hosts and virtualized environments - so it was not an issue in my local environment. In the VMware board I stumbled upon an interesting post that matched this effect. It also named an workaround that fixed the problem for me.

System management with Foreman/Katello - Part 1: Introduction and installation

Sun, 14 May 2017 00:00:00 +0000

The last couple of years I spent a lot of time in managing Linux systems with Spacewalk and Red Hat Satellite 5. Because the application was superseded by the vendor, I investigated on migrations to the successor.

Back in 2008, Spacewalk was published as upstream project to Red Hat Network Satellite. Since then, a lot of development happened thanks to the numerous developers - e.g. within the community and other companies (such as SUSE). Since 2014, development stagnated - at least for Red Hat because of the general availability of Red Hat Satellite 6, the successor of Red Hat Satellite 5.

Report VMware vSphere RHEL guests to RHSM using Red Hat Satellite 6.2

Thu, 11 May 2017 00:00:00 +0000

If you're utilizing Red Hat Satellite 6 for managing virtual Red Hat Enterprise Linux instances, you will need to leverage Red Hat Subscription Management (RHSM) for maintaining licenses. In comparison with the former Red Hat Network Classic licensing, signed manifest certificates are used. For bigger system landscapes it is easier to list required and needed licenses as RHSM can integrate seamlessly into hypervisors. Using a software that is executed on the Red Hat Satellite server, running RHEL instances and used hypervisors are detected and reported to RHSM to ensure correct licensing. There is no need to install custom software on the hypervisor - it is only required to read information from the hypervisor API. It is advisable to create a read-only service account for reading information.

Short tip: Removing orphaned SAN multipath devices under Enterprise Linux

Thu, 04 May 2017 00:00:00 +0000

Recently, I had to remove a SAN LUN on a physical Enterprise Linux system. The first step was to alter the multipath service configuration file (/etc/multipath.conf) and make the daemon reload its configuration:

1# vi /etc/multipath.conf
2...
3ESC ZZ
4
5# service multipathd reload

Afterwards, the device was removed from the multipath topology:

1# multipath -l

After removing the LUN in the SAN backend, a unnamed LUN was added to the multipath topology. Removing this device was not possible as it seemed to be in use:

Monitoring Foreman, Katello and Red Hat Satellite 6

Sun, 30 Apr 2017 00:00:00 +0000

Foreman, Katello and Red Hat Satellite 6 users have multiple possibilities to monitor infrastructure health. Beside the Foreman host, also managed systems and defined software content are worth monitoring.

Foreman dashboard

Foreman/Katello and Red Hat Satellite offer a dashboard with some widgets that can be used for monitoring hosts and products. The widgets can be ordered and removed. The following metrics are available:

Host configuration status overview
Last events
Tasks and last warnings and errors
Content view synchronization and versions
Last errata
Expiring subscriptions

To lookup current product synchronization tasks and errors, it is advisable to additionally check the overview underneath Content > Sync Status.

Authenticate GitLab against FreeIPA using LDAP

Thu, 27 Apr 2017 00:00:00 +0000

GitLab can utilize LDAP to authenticate against a variety of directory services such as Microsoft Active Directory Domain Services or FreeIPA and Red Hat Identity Management. This post describes configuring and integrating into FreeIPA.

By clicking Identity > User Groups > Add within the FreeIPA interface, an assistant for creating new groups is started. Create two groups named gitlab-users and gitlab-admins.

Afterwards, appropriate users can be added to those groups. Before changing the GitLab configuration file, it is advisable to create a backup:

Short tip: Changed Block Tracking PowerCLI Cmdlet

Wed, 26 Apr 2017 00:00:00 +0000

Changed Block Tracking (CBT) enables creating incremental backups of virtual machines. In comparison with conventional VM backups, guest hard drives are synchronized. Using CBT, the hypervisor detects changed blocks and the backup software will only store these blocks. Unfortunately these are some vSphere and backup software verions that have problems with CBT and it might be necessary from time to time to reset CBT. This mostly means manual effort as CBT settings need to be reset by virtual disk. Unitrends published some PowerCLI Cmdlets simplifying CBT management on GitHub.

Manage VMware Photon OS containers with Foreman and Red Hat Satellite 6

Thu, 20 Apr 2017 00:00:00 +0000

Photon OS is minimalistic RPM-based Linux distribution which is focussed on running Docker containers. It was optimized for VMware platforms (Workstation, Fusion, vSphere, vCloud Air) - e.g. its Linux kernel offers a caching mechanism optimized for vSphere.

Another characteristic is the customized package manager tdnf (Tiny Dandified YUM) which is similar to YUM but has also supports managing OSTree content (git-like versioned kickstartable filesystem content).

Foreman and Red Hat Satellite 6 offer Docker support enabling the central creation and management of containers. This article focusses on combining both products.

CentOS 7 and the incorrect dist RPM macro

Tue, 18 Apr 2017 00:00:00 +0000

When creating RPM packages recently, I had the effect that package names on CentOS 7 were set incorrectly. For example, a package had the name pinkepank-0.6-1.el7.centos.x86_64.rpm but should have set pinkepank-0.6-1.el7.x86_64.rpm instead. As Enterprise Linux derivates (CentOS, Scientific Linux,...) offer binary compatibility to Red Hat Enterprise Linux, I prefer omitting distribution-specific tags in package names.

In the RPM spec file package name, version and release are set like this:

1Name: interceptty
2Version: 0.6
3Release: 1%{?dist}

The variable dist is replaced by the major release on Enterprise Linux derivates - e.g. el7 for Enterprise Linux 7. So, no centos is set here. After a long time, I discovered that the macro dist is defined in the /etc/rpm/macros.dist file - e.g. under EL6:

Short tip: FreeIPA looses global DNS forwarder

Mon, 13 Feb 2017 00:00:00 +0000

Recently I found out that Red Hat Identity Management (IdM) and FreeIPA tend to forgot their global DNS configuration after some upgrades. In my case, the global DNS forwarder configuration was dropped forcing external lookups to fail:

1$ ipa dnsconfig-show
2---------------------------------
3Global DNS configuration is empty
4---------------------------------
5  IPA DNS servers: giertz.shittyrobots.loc, jason.shittyrobots.loc
6
7$ dig +short packages.gitlab.com

Using the ipa dnsconfig-mod command, it is easy to configure this setting again:

New project: IcingaBusylightAgent

Mon, 05 Dec 2016 00:00:00 +0000

The last couple of days I have been working on a new project I want to introduce: IcingaBusylightAgent.

It all began with a new telephony system in our office. Instead of using physical phones, my colleagues are now using softphones. In addition to this, a gadget called Busylight representing the instant messenger status is mounted to a monitor or wall. If a call is received, the light blinks and a ringtone is played.

Short tip: Add SSH authentication to Wordpress

Tue, 22 Nov 2016 00:00:00 +0000

Wordpress updates, themes and plugins can be installed very comfortable in the backend - unfortunately it is still required to specify FTP or FTPS connection information. Depending on your personal preferences or security policy FTP is often not an option - e.g. when you're maintaining a central directory for SSH users as primary identificatino source.

Fourtunately, SSH and SFTP support can be added to Wordpress by installing the SSH SFTP Updater Support plugin.

Short tip: disable automatic NetworkManager connections after user logins

Fri, 11 Nov 2016 00:00:00 +0000

During a fresh CentOS installation recently I had the problem that a system's network connection was not working reliably. Sometimes pings were possible, sometimes not. After it was possible to elimiate the firewall as commonly root cause, it turned out that the network connectivity was only working if the console is used.

The mysterious cause of this issue was in the network configuration file - e.g. /etc/sysconfig/network-scripts/ifcfg-eth0:

1TYPE=Ethernet
2ONBOOT=no
3...
4USERS=root

For some reason, Anaconda decided to enable NetworkManager and also bound the network connection to the root user. Networking was only possible once this user started a console session. To disable this behavior, the configuration file was altered like t his:

Grafana LDAP authentication with FreeIPA

Mon, 24 Oct 2016 00:00:00 +0000

Grafana offers the possibility to authenticate users against LDAP - make it quite easy to integrate the tool into existing directory services. I'm using FreeIPA as directory and authentication service in my lab and had to adjust some settings to authenticate Grafana access.

The first step is to alter the main configuration file of Grafana (/etc/grafana/grafana.ini) to enable the LDAP module and the appropriate configuration:

1[auth.ldap]
2enabled = true
3config_file = /etc/grafana/ldap.toml

That's a good time to disable registering new users using the web form:

Kerberos Single sign-On over SSH under OS X

Sun, 23 Oct 2016 00:00:00 +0000

An advantage of using Kerberos along with SSH is that it makes entering passwords obsolete when establishing connections. Unfortunately this is not working out of the box under OS X in the first place:

 1$ kinit cstan@STANKOWIC.LOC
 2cstan@STANKOWIC.LOC's password:
 3
 4$ klist
 5Credentials cache: API:xxx
 6 Principal: cstan@STANKOWIC.LOC
 7
 8 Issued Expires Principal
 9Oct 22 11:17:30 2016 Oct 22 21:17:37 2016 krbtgt/STANKOWIC.LOC@STANKOWIC.LOC
10
11$ ssh cstan@giertz.stankowic.loc
12cstan@giertz's password:

In spite of having a valid Kerberos ticket it is still necessary to enter a password. The reason for this behavior is that the SSH client is not using GSSAPI (Generic Security Service Application Program Interface). The following command did the trick for my OS X installation:

Distribute Python modules using RPM

Fri, 30 Sep 2016 00:00:00 +0000

The Python Package Index (PyPI) website offers plenty of Python module source codes. To install these modules, it is needed to download and extract the archive and execute an installation script afterwards. Using the pip (pip installs packages) package manager, this process can be automated - e.g. for the nagiosplugin module:

1# pip install nagiosplugin

If you are maintaing bigger system landscapes, this might not be an adequate option as it is hard to monitor and control installed modules using central software and patch management solutions. It would be great to distribute modules using RPM. Fortunately, the most Python modules come with installation scripts that offer pre-build routines for this.

5 tools you should not be able to run as root

Tue, 30 Aug 2016 00:00:00 +0000

If you plan to restrict utilizing the root user under Linux, it is most likely that you will create sudo rules to allow certain users to execute administrative utilities. There are plenty of tools you really should not be able to run as privileged users - some examples:

`screen`, `tmux`

The famous terminal multiplexers GNU Screen and tmux automatically create a login shell when starting a new session. Therefore, you really should not start them with root privileges:

Short tip: remove Katello completely

Fri, 19 Aug 2016 00:00:00 +0000

If you're testing the nightly builds of Katello, you might come into a situation where it is advisable to re-install the software completely.

As the particular installation steps are automated using Puppet, there is also a dedicated utility which automates uninstalling the software in a clean way: katello-remove.

This utility removes all required packages, stored content and also appropriate repositories:

 1# katello-remove
 2
 3WARNING: This script will erase many packages and config files.
 4Important packages such as the following will be removed:
 5
 6  * httpd (apache)
 7  * mongodb
 8  * tomcat
 9  * puppet
10  * ruby
11  * rubygems
12  * All Katello and Foreman Packages
13
14Once these packages and configuration files are removed there is no going back.
15If you use this system for anything other than Katello and Foreman you probably
16do not want to execute this script.
17
18Read the source for a list of what is removed.  Are you sure(Y/N)? Y
19
20ARE YOU SURE?: This script permanently deletes data and configuration.
21Read the source for a list of what is removed.  Type [remove] to continue? remove

In my environment I only had to remove the Red Hat Software Collections (RHCSL) repositories manually:

Short tip: Updating Pulp database after upgrading Katello

Wed, 17 Aug 2016 00:00:00 +0000

After upgrading Katello recently, I stumbled upon the following error when accessing the administration interface:

The web server protocol told me that a database update might causes this issue:

1# tail /var/log/httpd/foreman-ssl_error_ssl.log
2[Wed Aug 17 09:42:51.536914 2016] [:error] [pid 3178] [remote 10.22.1.16:128] mod_wsgi (pid=3178): Target WSGI script '/usr/share/pulp/wsgi/webservices.wsgi' cannot be loaded as Python module.
3[Wed Aug 17 09:42:51.536946 2016] [:error] [pid 3178] [remote 10.22.1.16:128] mod_wsgi (pid=3178): Exception occurred processing WSGI script '/usr/share/pulp/wsgi/webservices.wsgi'.
4[Wed Aug 17 09:42:51.536960 2016] [:error] [pid 3178] [remote 10.22.1.16:128] Traceback (most recent call last):
5[Wed Aug 17 09:42:51.536971 2016] [:error] [pid 3178] [remote 10.22.1.16:128]   File "/usr/share/pulp/wsgi/webservices.wsgi", line 19, in <module>
6[Wed Aug 17 09:42:51.536993 2016] [:error] [pid 3178] [remote 10.22.1.16:128]     application = wsgi_application()
7[Wed Aug 17 09:42:51.537000 2016] [:error] [pid 3178] [remote 10.22.1.16:128]   File "/usr/lib/python2.7/site-packages/pulp/server/webservices/application.py", line 117, in wsgi_application
8[Wed Aug 17 09:42:51.537010 2016] [:error] [pid 3178] [remote 10.22.1.16:128]     raise e
9[Wed Aug 17 09:42:51.537026 2016] [:error] [pid 3178] [remote 10.22.1.16:128] InitializationException: The database has not been migrated to the current version. Run pulp-manage-db and restart the application.

To update the Pulp database, it is necessary to run the pulp-manage-db utility as Apache user. This also requires changing the login shell temporarily:

 1# chsh -s /bin/bash apache
 2Changing shell for apache.
 3Shell changed.
 4
 5# runuser -l apache -c pulp-manage-db
 6Attempting to connect to localhost:27017
 7Attempting to connect to localhost:27017
 8Write concern for Mongo connection: {}
 9Loading content types.
10Loading type descriptors []
11Parsing type descriptors
12Validating type descriptor syntactic integrity
13Validating type descriptor semantic integrity
14...
15Database migrations complete.
16
17# chsh -s /sbin/nologin apache
18Changing shell for apache.
19Shell changed.

Afterwards, the user interface behaved like before.

Short tip: Middle mouse click under OS X

Sun, 14 Aug 2016 00:00:00 +0000

The middle mouse button offers extended functionality in the most software - e.g. it can be used in web browsers to open or close tabs. When using the integrated trackpad of a MacBook or the Apple Magic Mouse this will not work due to missing mouse buttons.

To enable this functionality under OS X there is a free software named MagicPrefs. Beside gestures it is also possible to configure additional tweaks or functions - for me the most important feature is the middle mouse click.

Simple CMDB import using Icinga Director

Mon, 11 Jul 2016 00:00:00 +0000

In my last article I focussed on Icinga 2 and the new configuration utility Icinga Director. I mentioned that Icinga Director can be used to link Icinga to pre-existing Configuration Management Database (CMDB) systems to simplify data import. In this article we will create a little "dummy CMDB" with MySQL and automatically import and deploy host information.

Using Icinga Director we can automate maintaining the follow object types:

Hosts and host groups
Services and service groups
Users and user groups
Endpoints and zones
Commands

Database preparation

The following example is a simple table with host information. A hostname and an appropriate IP address are essential for monitoring hosts with Icinga. This information can also be gathered from pre-existing CMDB systems - but collecting the data might be way more complex (e.g. reading multiple tables, etc.). Access to the approriate database is needed - a read-only account should be sufficient. Depending on your CMDB product this step might be complex - so prepare yourself for reading the database documentation (if applicable) and testing things for a couple of hours under the influence of coffein. 🙂

Install Icinga2, Icinga Web 2 and Icinga Director under EL7

Wed, 06 Jul 2016 00:00:00 +0000

Icinga2 is a very powerful monitoring system that can be used optionally with the new user interface Icinga Web 2. In comparison with Icinga 1.x, those tools have been developed completely from scratch - they have nothing in common with the legacy software stack.

This year, a configuration utility named Icinga Director has been released. It can be used to configure the whole Icinga2 stack. An intergration into Configuration Management and CMDB systems is also possible.

Integrate source code patches into RPM packages

Thu, 30 Jun 2016 00:00:00 +0000

Rcently I packaged the software scponly for Enterprise Linux using rpmbuild and stumbled upon an error message:

 1$ cd ~/rpmbuild/SPECS
 2$ rpmbuild -ba scponly.spec
 3checking for libgiertz...
 4...
 5/usr/bin/install -c -o 0 -g 0 scponly /home/cstan/rpmbuild/BUILDROOT/scponly-4.8-1.el7.centos.x86_64/usr/bin/scponly
 6/usr/bin/install: cannot change ownership of '/home/cstan/rpmbuild/BUILDROOT/scponly-4.8-1.el7.centos.x86_64/usr/bin/scponly': Operation not permitted
 7make: *** [install] Error 1
 8error: Bad exit status from /var/tmp/rpm-tmp.Zx3wsc (%install)
 9
10RPM build errors:
11    Bad exit status from /var/tmp/rpm-tmp.Zx3wsc (%install)

During the "installation" of compiled files within the RPM package changing the file owner fails - but why? Having a look at the Makefile should help. Runtime data of previous compiling processes can be found inside the BUILD folder:

Short tip: sudo and vi(m)

Tue, 28 Jun 2016 00:00:00 +0000

System administrators know requirements like this - a dedicated server needs to be deployed for a new application. In order to enable owners to maintain their application they need permissions to modify relevant configuration files. In this scenario, sudo rules are often configured in a way to enable file modifications and also utilities to reload the application configuration.

It is often missed that vi is also capable of executing commands or shells. If it is possible to start vi under a different user context it is also possible to take complete control over the account:

D-Link DGS-1510-28X - cheap 10G switch

Mon, 27 Jun 2016 00:00:00 +0000

Some months ago, I built a small VSAN home lab. Gradualy I expanded the setup - e.g. I moved from a hybrid setup (HDDs and SSDs) to all-flash (SSDs only) to utilize deduplication. Because errors might occur during testing, my NAS is still used as shared storage for the cluster.

The HDDs of my NAS were unable to meet those requirements anymore - therefore I replaced them with faster ones. Quickly I found out, that now the network was slowing down the setup. A benchmark of the RAID volume resulted in about 300 MB/s in read mode - the Gigabit network only offers up to 125 MB/s due to physical limitations. Leveraging LACP for spreading load also did not help as single sessions are not spread among multiple interfaces. Every server only has up to 125 MB/s for storage communication - for all VMs that are running on that host. It would be better to have a dedicated 10 Gigabit connection for the storage. I'm already using comparable network cards for VSAN - those NICs are quite affordable now (ca. 60 Euros per NIC).

Spoiled for choice: new HDDs for my NAS

Sun, 26 Jun 2016 00:00:00 +0000

2016 seems to be the year of big hardware renewals for me - after completely overhauling my virtual infrastructure, I also needed new hard drives for my NAS after nearly 4 years.

NAS, DAS, what?

For many years, I have been using D.I.Y. NAS servers for collecting my data and media library on a single host. After I was switching the hardware platform a couple of times, I'm currently using a HP MicroServer Gen8 with four 2 TB HDDs (see details below!). Once in a week, I'm doing a complete backup of all the data on an external HDD array, Onnto DataTale, that is also equipped with four 2 HDD. Both systems are using RAID-5 volumes. Some people might say that this is kinda paranoid - but some accidents in the past proved that it is basically a good idea to have a backup ("Better safe than sorry"). 🙂

Short tip: Enterprise Linux 7 and annoying prompts in GNU Screen titles

Fri, 24 Jun 2016 00:00:00 +0000

If you want to combine multiple terminal sessions on one window, multiplexers such as tmux or GNU Screen are useful tools. I have been using screen for 10 years with the following configuration:

 1$ cat ~/.screenrc
 2# F7+F8 for tab switching
 3bindkey -k k7 prev
 4bindkey -k k8 next
 5
 6# disable welcome
 7startup_message off
 8
 9# screen line with tabs, date and time
10hardstatus alwayslastline
11hardstatus string "%-w%{= BW}%50>%n %t%{-}%+w%< %87=%d.%m.%Y %0c"
12
13# start some screens
14screen -t bash 0
15screen -t bash 1
16
17# various settings
18deflogin off
19silencewait 15
20autodetach on

It's just a simple setup with a tiny bar at the bottom for tabs and the current date. I'm using tabs with customized titles a lot to keep an overview:

Monitoring OMD sites with check_omd

Tue, 07 Jun 2016 00:00:00 +0000

Using OMD it is possible to setup a working monitoring for checking infrastructure setups just within minutes.

But - what monitored OMD-relevant processes? Usually, a OMD site consists of multiple pre-configured services such as:

Icinga or Nagios
Apache web server
Cron service
rrdcached (for RRD graphs)
npcd (performance data)

For checking the functionality of a site, OMD offers a special command:

1# omd status hansel
2Doing 'status' on site hansel:
3rrdcached:      running
4npcd:           running
5nagios:         stopped
6apache:         running
7crontab:        running
8-----------------------
9Overall state:  partially running

In this case, one of the required services - Nagios - has crashed. As a result, the OMD site is only partially running.

Monitor systemd units with Nagios/Icinga

Mon, 06 Jun 2016 00:00:00 +0000

Recently I stumbled upon an interesting blog post about monitoring systemd units with Nagios or Icinga.

But in my opinion the post's screenshot is misleading. I looks like the linked Python scripts automatically discovers and configures systemd units within Nagios/Icinga - which is not the case. The script named pynagsystemd utilizes the systemctl command to check the state of all active systemd units. Enabled but failed entries (e.g. crashed services) are reported:

Create SELinux module for NRPE and check_fail2ban

Sat, 28 May 2016 00:00:00 +0000

If you need to protect a Linux host against unauthorized access, fail2ban is a very handy service. The application scans log files of various services, automatically detects failed logins and blocks attacker's IP addresses. Especially on public hosts, it is essential to implement a protection like this on prominent services like SSH.

For monitoring bans, the project offers a Nagios / Icinga plugin named check_fail2ban: [click me!]

This plugin uses the fail2ban-client utility for checking bans - for this, a sudo rule is required for NRPE, e.g. for EL7:

Short tip: OMD and Python error 'TypeError: 'frozenset' object is not callable'

Fri, 27 May 2016 00:00:00 +0000

When configuring and testing a Python Icinga plugin within an OMD site, I stumbled upon the following error recently:

1TypeError: 'frozenset' object is not callable

After some tests on other systems, I found out, that the Python library hashlib shipped with OMD seems to be faulty. Copying the system-wide library into the OMD site did the trick for me:

1# cp /opt/omd/sites/$site/lib/python/hashlib.py /opt/omd/sites/$site/lib/python/hashlib.py.initial
2# cp /usr/lib64/python2.7/hashlib.py /opt/omd/sites/$site/lib/python/hashlib.py

Note

$site needs to replaced with the name of your OMD site.

vRealize Orchestrator for beginners, part 1: Introduction and installation

Mon, 23 May 2016 00:00:00 +0000

With this article, I'm starting a blog series I'm really excited about. It's all about VMware's vRealize Orchestrator (vRO) - a very might tool than can simplify a VMware administrator's workaday life heavily. 🙂

What is vRealize Orchestrator?

vRO is a utility for automating IT processes around virtual environments. It integrates seamlessly into the vSphere and vRealize/vCloud product family - beginning with the Standard Edition, it is part of vCenter Server (vC). vRO offers plenty of interfaces to third-party systems to also automate complex processes. To name some examples:

PHP 5.6 under Enterprise Linux 7 using Software Collections

Tue, 17 May 2016 00:00:00 +0000

By default, Enterprise Linux 7 is shipped with Apache 2.4.6 and PHP 5.4. For some current web applications this is way too old as development of PHP 5.4 stalled in fall 2015.

During the product life cycle, Red Hat offers 10 to 13 years (Extended Support) maintenance for all packages being part of the distribution - including PHP. From a security perspective, still using an older PHP version is not critical as Red Hat still maintains these versions. The most web projects discontinue to support this old PHP version for technical reasons.

Enterprise Linux 7 and Oracle-related kernel parameters

Fri, 13 May 2016 00:00:00 +0000

When running Oracle databases under Linux, some additional kernel parameters need to be set. Oracle lists these parameters in the appopriate documentation - e.g. for the most recent version 12c: [click me!]

Especially for Enterprise Linux 7 there is a dedicated profile for the tuned service (RPM package tuned-profiles-oracle). This services takes control over various system settings including kernel parameters. The most Oracle-relevant settings are matching with the values from the official documentation. During an installation recently, I had to adjust two kernel parameters:

Red Hat Enterprise Linux 6.8 released

Wed, 11 May 2016 00:00:00 +0000

Yesterday Red Hat released the 8th update of Red Hat Enterprise Linux 6. The changes have been documented in the release and technical notes:

As usual, kernel driver updates were included. The following list also shows some of the further enhancements I'd like to mention:

Running RHEL as Hyper-V Generation 2 VM is now fully supported. This feature was already part of RHEL 6.6 as technical preview. Support for the TRIM command and reporting kernel crashes inside Event Viewer (ID 18590) has been added. For Azure Cloud setups an agent named WALinuxAgent is used for deployments.
SSLv2 support was removed - and cannot be re-enabled manually
SSSD now fully supports Smartcards for authentification. If a host is member of a Microsoft Active Directory Domain Services (AD DS) setup, the host password is updated frequently to avoid that the host is considered as inactive and removed from the directory.
The adcli command is now available
Openswan was replaced by Libreswan
The NTP client chrony is now available and replaces the ancient ntpd service. It is predicted to be more versatile - the package is already part of Red Hat Enterprise Linux 7.
YUM now includes the search-disabled-repos plugin to notify the administrator if a missing dependency is part of a disable repository (default setting). This requires that the system uses subscription managers, conventional repositories are not supported. The plugin is also capable of automatically enabling disabled repositories to ensure that package dependencies are met (setting notify_only=0 in /etc/yum/pluginconf.d/search-disabled-repos.conf)
SELinux now supports GlusterFS
XFS supports up to bis zu 300 TB big file systems, previously it was limited to 100 TB
The echo intervals used by CIFS (which are sent every 60 seconds by default) can now be confiugred using the mount option echo_interval=n. It is recommended to use the following formula for setting the value: (2 * echo interval) + 17 seconds
dmstats is included as analytics utility for storage device leveraging the Device Mapper driver
Kickstart profiles can now be gathered via HTTPS
The tuned service now offers a profile for Oracle database servers (RPM package tuned-profiles-oracle). This profile is based on the enterprise-storage profile and includes essential kernel parameters required for Oracle
The IBM Java runtime environment has been updated to version 1.8
The remote client Vinagre now also supports RDP
3D support using the vmwgfx driver using VMware Workstation 10
Relax and Recover (ReaR) has been added to the distribution - previously the package needed to be installed from the EPEL repository (Extra Packages for Linunx)

Red Hat Enterprise Linux 6.8 is now available to all Red Hat customers with a valid subscription. On this year's 1.April Red Hat started offering free Red Hat Enterprise Linux subscriptions for developers.

Short tip: Changed Owncloud CardDAV/CalDAV URLs

Tue, 26 Apr 2016 00:00:00 +0000

Recently I had issues with configuring CardDAV-Sync and CalDAV-Sync along with Owncloud after a fresh Android installation. Specifying the well-known URLs just produced several error messages inside the app:

https://my-server.tld/owncloud/remote.php/caldav/principals/USER/ https://my-server.tld/owncloud/remote.php/carddav/principals/USER/

In the logs I saw a lot of messages about missing sub folders. After searching on the internet, I had a deeper look at the Owncloud web interface and spotted that the URLs have changed.

The following URL schemas worked for me:

ASUS P9D-M, ASMB7-IKVM and false vCenter alarms

Wed, 20 Apr 2016 00:00:00 +0000

I was puzzled when I saw that the ESXi hosts of my new lab are generating critical CPU fan errors. Strange, I'm sure I mounted the fan correctly - otherwise the system would have been shutdown automatically to prevent serious damage. 🙂

I had a look at the IPMI web interface and saw that a fan is detected - but why is it called "FRNT_FAN1"?

Compile Python applications automatically for Windows using GitLab CI

Wed, 20 Apr 2016 00:00:00 +0000

Some time ago I wrote about GitLab Continuous Integration and explained how code changes can be catched up to create or update software packages on remote systems. In order to communicate with the development systems, GitLab utilizes agents that are availble for plenty of platforms - including Microsoft Windows, we will focus on in this article.

In the following example, Python applications (.py) are converted automatically into executables (.exe) after code changes. But - why? I'm using this concept for generic Icinga monitoring plugins. Of course, Python scripts can also be executed on Windows after installing the runtime environment. Think about deploying this on a big amount of systems - it's a huge administration effort. A single executable can be distributed easier and also offers less security risks than a complete runtime environment that consists of multiple sub-programs.

New VSAN 6.2 home lab

Wed, 20 Apr 2016 00:00:00 +0000

In 2008 I started working as VMware administrator and thus also began using vSphere at home. You might know this - as an IT person you want to have a lab at home that can be compared with the infrastructure at work. 🙂

The hardware half-life is quite short and especially when virtualizing workloads you can reach memory and storage limits very quickly. Until now I had to replace my hardware every two years:

vSphere HTML5 Web Client Fling

Wed, 30 Mar 2016 00:00:00 +0000

A couple of days ago, VMware developers announced a new fling called vSphere HTML5 Web Client. Basically, this is a virtual appliance based on SUSE Linux Enterprise Server 12 serving a completely rewritten Web Client. In comparison with the well known Web Client, this client only uses HTML5 and JavaScript - beelzebub Flash isn't required anymore. This introduced development, customers have been waiting for - it is well-known that Flash is a security critical and stagnating technology.

IPFire hardware upgrade

Sun, 20 Mar 2016 00:00:00 +0000

2016 seems to be the year of hardware upgrades for me. After replacing my ESXi host with a VSAN cluster recently, I also had to replace the D.I.Y. router after upgrading my internet connection. At maximum data throughput, CPU load and temperatur are increasing so heavily that other network traffic is slowing down unacceptably. Last year I migrated from IPCop 2.x to IPFire 2.x and feared that a hardware might be necessary in the foreseeable future.

Short tip: Reset VSAN cluster

Sun, 20 Mar 2016 00:00:00 +0000

Especially when playing around with multiple vCenter and VSAN versions in a lab, it might be necessary to rebuild a VSAN cluster. In this scenario, it is sometimes also necessary to also reset the SSD and HDD drives used by VSAN. In my lab I'm often resetting the whole VSAN cluster to have a clear starting point - without any VSAN storage upgrades or the like.

For this, shell access to the particular ESXi nodes is activated for a short time. The following commands are executed to list and remove VSAN storage:

Restore the MBR of a Linux installation

Thu, 17 Mar 2016 00:00:00 +0000

As preparation for a restore test, I removed the master boot record (MBR) of a Linux system recently:

1# dd if=/dev/zero of=/dev/sda bs=512 count=1

This command fills the first 512 bytes (containing the partition table and bootloader) of the first hard drive (/dev/sda) with zeroes (/dev/zero).

The problem is when you discover that the restore did not work and you need to fix the system manually. 🙂

Procedure

To restore the MBR, a utility named testdisk can be used. The program scans hard drives for known file system footprints and thus detects partition boundaries. The most Linux, Unix and Windows file systems can be detected.

Configure LACP under CentOS along with Cisco

Wed, 16 Mar 2016 00:00:00 +0000

If a host has multiple physical network adapters, it is a common procedure to combine the particular links. Mostly, this configuration is chosen to enhance the maximal throughput. Another reason for this is to make network connections more reliable by defining alternative network paths. LACP (Link Aggregation Control Protocol, 802.3ad standard) combines those two approaches by grouping physical adapters logically. As long as enough physical uplinks are available, they are used to spread network traffic frame-wise (continous sessions are excluded from this behavior to ensure correct package orders). If a network path fails, the channel is automatically reconfigured - this is also called dynamic trunking. LACP needs to be supported by the switch as well as by the connected host because of automatic configuration streams.

Forgot vCenter Server Appliance root and SSO administrator password

Thu, 18 Feb 2016 00:00:00 +0000

Loosing the SSO administrator password of vCenter Server Appliance (vCSA) is really bad. Anyhow, this password can be reset, as far as you still have access to the appliance console - this requires the root password. If you also forgot this one, this is really, really, really bad - but also this happens sometimes in labs.

In this case you will need a Linux live CD (like Clonezilla or Knoppix) and a short downtime to fix the issue.

Short tip: Reset Linux password unattended

Tue, 16 Feb 2016 00:00:00 +0000

Sometimes it happens that you lock out yourself from your Linux system. In the worst case, additional security concepts or conditions might hamper access to the system, for example:

No root access
System cannot be rebooted to reset the password in a chroot session
No colleague with system access available

Recently I had an issue like this - but happily the system was still controllable by a central configuration management. I was able to run the following commands to reset the password:

Analyze and clean-up installed RPM packages with package-cleanup

Fri, 12 Feb 2016 00:00:00 +0000

During the installation of kernel updates I stumbled upon a cramped /boot partition recently. Solving this issue is quite easy - e.g. it is possible to manually dig through the RPM database, exclude the running kernel and remove all other packages. Anyhow, this is neither comfortable nor elegant:

1# yum remove `rpm -qa|grep kernel|grep -v $(uname -r)|tr "n" " "`

On RPM-based distributions that are using YUM or DNF, there is a might tool named package-cleanup for analyzing and cleaning the RPM database. The following command can be used to remove all kernels except the current one in a very comfortable way:

vSphere High Performance Essentials

Mon, 01 Feb 2016 00:00:00 +0000

New year, new book - some of you might have noticed it: in the last couple of weeks, there were not much updates on my blog. The reason is that I have been working on a second book project. This time I had the pleasure to work as main author on a book about VMware vSphere. Last year, I have already been working as co-author on VMware vSphere Essentials.

While the first book was an introduction to VMware vSphere, the new book focuses on high-performance virtualization - which also complements the first book. The title is vSphere High Performance Essentials and can be purchased on multiple platforms - including:

IPFire and the AX206 display

Sun, 24 Jan 2016 00:00:00 +0000

Thanks to the lcd4linux project, Linux also offers the possibility to control LC display - e.g. to display status information. Some years ago, a very cheap digital picture frame was sold on mail-order houses like Pearl. Using an alternative firmware, this device is also capable of being controlled by lcd4linux. Since then, there have been a lot of similiar devices with this chipset called ax206. When you're looking for this chipset or "dpf lcd4linux", you should find comparable picture frames. A couple of years ago, I bought some of them and during the spring-cleaning I thought, I could use them again...

Migrating from IPCop to IPFire

Tue, 19 Jan 2016 00:00:00 +0000

Since 2008 I have been using the free Linux distribution IPCop to implement a customized firewall/a router. Of course, DSL providers also equip their customers with routers, but back then I was missing a couple of functions. To name some of them:

IPSec / OpenVPN
NTP time server
DMZ segmentation
WLAN access point with device filter

8 years later, things have changed. The most functions are now parts of modern routers such as Fritz. B.x - but not of mine. Therefore, the IPCop is still a very important part of my network. Since 6 years my IPCop is running very smoothly on a single-board computer by PC Engines: a ALIX.2D13. With 500 Mhz CPU and 256 MB memory, this computer is kinda outdated. In combination with IPCop, the computer did his job quite good while having a low power consumption of less than 10 watts.

GitLab Continuous Integration

Fri, 11 Dec 2015 00:00:00 +0000

With the new major version 8, GitLab was extended to include a continuous integration (CI) component that was developed as dedicated project until now. While it was necessary to utilize external solutions, such as Jenkins, previously, it it now possible to automatically compile and test managed projects easily.

But, what is CI used for? CI is mainly used for professional development purposes for automating sub-steps for compiling and enhancing source code quality. To name some real-world examples:

Microsoft Active Directory Domain Services authentification under VMware vCenter Server Appliance 6

Thu, 12 Nov 2015 00:00:00 +0000

For integration in Microsoft environments, VMware offers several Microsoft Active Directory Domain Services (AD DS) connectors in vCenter Server:

native integration: vCenter Server is managed as computer object in Active Directory
LDAP broker for authentification in Single-Sign-On (SSO)

When installing the last vCenter Server 5.x update (5.5U3) I saw that this integration seems to be unreliable. I often had the issue that authentification was not working anymore - even without changing the environment. The log files did not help at all; re-joining the vCenter Server into Active Directory helped a several times with fixing the issue.

Short tip: Configure HP Smart Array Controller using EFI Shell

Tue, 10 Nov 2015 00:00:00 +0000

New HP Smart Array controllers built into a HP Integrity machine are basically unconfigured. When running the EFI Shell, you will probably see the following message:

1HP Smart Array P800 Controller     (version 7.22)  0 Logical Drives
21785-Drive Array Not Configured
3     Run Smart Array Configuration Utility
4...
5Press <F8> to run the Option ROM Configuration For Array Utility

It's bloody simple - no arrays have been configured, yet. Normally, pressing F8 starts the controller's BIOS. This will not work if you're using the Management Processor (MP) rather than the console. It seems like the shortcut is dropped.

VMworld Europe 2015

Tue, 20 Oct 2015 00:00:00 +0000

Last week the european VMworld event was taking place in Gran Via, Barcelona. Like every year VMware hosts their own event, that is focussed on VMware and partner developments. This year's event was themed "Ready for ANY", giving VMwares focus on more flexible Cloud and Mobility a voice.

On four days visitors were able to choose from a comprehensive program including:

More than 250 breakout sessions by partners and VMware staff
Exhibition area with about 130 partners
Certifications at special prices
VMware store, sale of merchandise and technical literature
Meet and greet with vExperts

Spacewalk 2.4 released

Sat, 10 Oct 2015 00:00:00 +0000

This week Spacewalk was released in version 2.4 after 6 months of development. In summary, about 60 bugs were fixed and some new features were implemented.

The web-interface is now available to other projects as part of the Patternfly framework. The project driven mainly by Red Hat aims at combining beatiful designs with Twitter Bootstrap to generate enterprise-ready administration interfaces easily. Of course, this interface can also be accessed on mobile devices, such as smartphones or tablets in a comfortable way.

Short tip: kinit: Cannot read password while getting initial credentials

Thu, 01 Oct 2015 00:00:00 +0000

While registering a client system with a FreeIPA server I recently stumbled upon the following error message:

1# ipa-client-install
2...
3User authorized to enroll computers: admin
4...
5Kerberos authentication failed
6kinit: Cannot read password while getting initial credentials

After wasting quite a lot of time with analyzing configuration files and also SELinux I remembered that the cause for this issue can be quite simple. Try to generate a Kerberos ticket using kinit when receiving error messages like this - it is possible that the password simply expired:

Use IOmeter under Linux

Thu, 01 Oct 2015 00:00:00 +0000

IOmeter is a collection of tools for running detailed IO benchmarks. It is often used as the tool is able to reproduce the characteristics of current applications and services. IOmeter consists of a management software that manages and evaluates the particular tests and Dynamo - an executable that run these tests in multiple threads on the local or a remote computer.

Beside Windows, the last version of IOmeter also supports Linux on 32- and 64-bit machines. The graphical management software for controlling the tests is only available on Windows, for Linux systems only the worker engine dynamo can be downloaded. This engine can be downloaded on the project website. Older versions are also available for NetWare, Solaris and Linux for the dowdy architectures XScale and PowerPC.

Battle of the ultra-wide angle lenses

Thu, 17 Sep 2015 00:00:00 +0000

Especially during sight-seeing it is often desirable to capture a big scene. In this case, it is great to have a wideangle or even ultra-wide angle (UWA) lens in your pocket. After I was able to take pictures with a Canon EF 8-15mm f/4L Fisheye USM lens, I wanted to have a comparable lens (with an extreme image angle).

It is important to know that the lenses I will introduce are UWA lenses and no fisheye lenses. The difference looks quite small on the spec sheet but has an enormous effect on the picture detail. Fisheye lenses offer a diagonal image angle of up to 180° while UWA lenses normally "only" offer up to at about 120°. Especially, this inures to the benefit of clear lines. While fisheye lenses represent these lines round, pictures on UWA lenses still look natural to the human eye.

Short tip: Full vCenter Server Appliance 5.5 database prohibits logins

Tue, 18 Aug 2015 00:00:00 +0000

Recently one of my vCenter Server Appliance (vCSA) 5.5 installations was unable to proceed logins anymore. After having a look at the storage consumption I saw that two partitions were filled up:

1# df -h /storage/{core,db}
2Filesystem      Size  Used Avail Use% Mounted on
3/dev/sdb1        20G   20G     0 100% /storage/core
4/dev/sdb3        60G   56G   90M 100% /storage/db

In the VMware knowledge base there is an article regarding this symptom. This is a known issue in vCenter Server 5.5U2. The vPostgres database creates plenty of log entries like that:

VMware ESXi Embedded Host Client Fling

Sun, 16 Aug 2015 00:00:00 +0000

One of the rumors regarding VMware vSphere 6 was that a kind of slim vSphere Web Client will be part of ESXi to replace the outdated vSphere Client (legacy client). ESX offered a web-based administration utility, that has been completely removed in ESXi. Since then, the web interface of ESXi is only capable of browsing datastores and downloading the vSphere client for managing the system.

A couple of days ago, VMware released a Fling, that fits this gap. Flings are tools and applications developed by VMware engineers for testing purposes. Normally they are useful but not supported by the VMware support; so using them in production is not recommended. This fling is called ESXi Embedded Host Client and extends an ESXi host with an administration web-interface that looks like vSphere Web Client. Using this, it is sufficient to have an conventional browser to manage an ESXi host. I really love that this tool is really fast as it does not make use of Adobe Flex. Testers of the vSphere 6 beta will see some similarities to a former development engineering.

Errorenous Oracle Instantclient RPM provides under Enterprise Linux

Wed, 22 Jul 2015 00:00:00 +0000

If you are using drivers and libraries that need access to Oracle databases (e.g. perl-DBD-Oracle), you will need the Oracle Instantclient. Oracle offers this software for free after registration. Unfortunately creating correct provides tags was missed when creating the RPM packages. Even though Instantclient is installed, software like perl-DBD-Oracle cannot be installed - because of missing files:

1# yum install perl-DBD-Oracle
2...
3--> Finished Dependency Resolution
4Error: Package: perl-DBD-Oracle-1.74-1.el6.x86_64
5           Requires: libocci.so.11.1()(64bit)
6Error: Package: perl-DBD-Oracle-1.74-1.el6.x86_64
7           Requires: libclntsh.so.11.1()(64bit)
8 You could try using --skip-broken to work around the problem

However, the files exist on the file system:

Distribute GitLab Community Edition with Spacewalk

Sat, 13 Jun 2015 00:00:00 +0000

GitLab is a very popular alternative to GitHub that is available as free Community Edition for interested hobbyists and smaller companies. For installing the software, there is a script for downloading and installing the particular software packages. If you have a look at the source code of this script, you will see that this script uses conventional YUM repositories. So basically, GitLab can also be distributed comfortably using a pre-existing Spacewalk, Red Hat Satellite or SUSE Manager system verteilen.

VMware vSphere Essentials

Fri, 29 May 2015 00:00:00 +0000

Some of you might have recognized that it has been surprisingly quiet on my blog in the last couple of weeks. The reason for this was not that I have not been keen for blogging - rather I was working on something bigger that I'd love to present you today. 🙂

It is nothing less than a book about VMware vSphere named VMware vSphere Essentials that has been released recently on PacktPub.

Short tip: clean-up Windows installation

Tue, 19 May 2015 00:00:00 +0000

After a couple of months or years plenty of storage is wasted on Windows systems and sometime it is not possible anymore to free space by using the well-known procedures. Recently I had this issue on a 5 year old system - the following steps did not help anymore:

Executuing the Disk Cleanup utility
Manual cleaning temporary folders
Moving the page file
Disabling hibernate

Another possibility is to clean-up the %WINDIR%\winsxs directory. For this procedure the dism utility has been created - manually removing files should be avoided. This folder containns older DLL files and other components. The following command removes unnecessary files and Service Pack backup files:

Short tip: DRBD + EL7: /var/lib/drbd/drbd-minor-0.lkbd: No such file or directory

Wed, 13 May 2015 00:00:00 +0000

Recently I stumbled upon the following error message while creating a DRBD volume on CentOS 7:

1# drbdadm create-md r0
2initializing activity log
3NOT initializing bitmap
4Writing meta data...
5lk_bdev_save(/var/lib/drbd/drbd-minor-0.lkbd) failed: No such file or directory
6New drbd meta data block successfully created.
7lk_bdev_save(/var/lib/drbd/drbd-minor-0.lkbd) failed: No such file or directory

Oops! After executing the command the DRBD volume was unavailable as expected.

The reason for this issue was quite simple: the folder /var/lib/drbd didn't exist. As a result drbdadm was unable to create files. After creating the folder (and setting the SELinux flags) I was able to create the volume:

Short tip: Please reserve memory by passing 'crashkernel=X@Y' parameter to the kernel

Wed, 29 Apr 2015 00:00:00 +0000

While configuring kdump on a system I recently stumbled upon the following error:

1Please reserve memory by passing "crashkernel=X@Y" parameter to the kernel

However, the parameter crashkernel was mentioned in the GRUB configuration file and kernel commandline:

1$ grep crashkernel /proc/cmdline
2ro root=/dev/mapper/vg_system-lv_root ... crashkernel=auto ... rhgb quiet

I saw that this setting works for other systems.

The reason for this issue was that the affected system had less than 2 GB of memory. In accordance with the Red Hat Enterprise Linux documentation the parameter value auto is ineffective in this scenario. To fix this, it is necessary to manually set a value. In my case I set the default value 128 MB:

Store kernel dumps using kdump on remote machines

Tue, 28 Apr 2015 00:00:00 +0000

If the Linux kernel crashes it is possible to create a memory image (also called vmcore) using a mechanism called kdump. Especially, this is useful if you plan to engage support to fix the reason for the issue. By default, the vmcore is stored under /var/crash. But if the kernel is not able to access the storage anymore (e.g. because of faulty storage or HBA drivers) the memory image can't be stored. In this case it would be a benefit to store the dump on another host in the network. Fortunately kdump is able to copy these information using SSH and SCP on other systems.

Spacewalk 2.3 released

Thu, 16 Apr 2015 00:00:00 +0000

After Red Hat Satellite 5.7 was released 3 months ago Spacewalk version 2.3 was published on 14th of april 2015 after 9 months of development. Like the commercial spin-off the recent management suite also offers a more modern web-interface. With version 2.2 this interface's user experience was overhauled by HTML5, jQuery and Bootstrap. Die updated web-interface is well-arranged and more functional.

Enterprise Linux 7 systems can now be used as Spacewalk server - due to missing packages and broken package dependencies this was not possible in the previous release and it was necessary to use a EL6 host. EL7 clients were already supported - now it is also supported to manage Fedora 21 clients.

VM Tools for MS-DOS and Windows 3.x

Wed, 01 Apr 2015 00:00:00 +0000

VMware offers software packages including additional applications and drivers for the most support guest operating systems - these packages are also called VMware Tools. Beside recent operating systems also older releases are supported - e.g. there are also Tools for Windows NT.

Unfortunately MS-DOS and Windows 3.x are not supported, yet - even if there are still some special use-cases. During a recent customer project I stumbled upon a ERP landscape which consisted of a metro cluster with 150 Windows 3.x VMs. For implementing this several tweaks and hacks were necessary - especially regarding drivers a plenty of customizations were necessary. To automate this process I decided to develop custom VM tools. This was the only way to complete the project in a reasonable time/usage releationship.

Short tip: VMware vSphere "Module DiskEarly power on failed to lock file"

Thu, 26 Mar 2015 00:00:00 +0000

While booting a virtualized cluster node I stumped upon a suspicious error message recently:

Module DiskEarly power on failed to lock file

In the VMware forums I found a hint that locking mechanisms might account for this issue. However the thread focussed on desktop products and not on vSphere. I found no lock files (*.lck) on the appropriate datastore so I had a deeper look at the VM configuration file (*.vmx) and discovered the following lines:

Short tip: Monitor Koukaam NETIO PDUs with Nagios / Icinga

Sun, 08 Mar 2015 00:00:00 +0000

Koukaam NETIO power outlets offer a network interface that can be used for controlling the particular ports comfortably. It would be even nicer to monitor them with Nagios or Icinga. 2012 I created a provisional bash script for monitoring the ports and time synchronization over NTP.

This weekend I migrated the script to Python and also implemented new features.

The script that can be downloaded at no cost on Icinga Exchange is now also capable of monitoring particular ports.

vRetro trip: MS-DOS 6.22 and Windows 3.1 in 2015

Fri, 06 Mar 2015 00:00:00 +0000

Because of a recent comment on this blog I stumbled upon an interesting Abandonware webseite. For me this was a reason for diving into a world of forgotten software (thank you very much for the hint, Frank!). While browsing the software archive I vividly recalled my first steps with the computer. Back then - in 1993/1994 - my parents had their first PC with the following specification:

ESCOM desktop case
AMD 486DX processor with 66 Mhz clock-rate
14" CRT screen with 800x600 pixel (16-bit)
16 MB EDO RAM
500 MB IDE hard drive
installed MS-DOS 5.0 and Microsoft Windows 3.1

A dot-matrix printer Panasonic KX-P1131 completed the setup. I remember the times when I watched my father while working on the PC before I was allowed to use the keyboard for the first time.

Mercedes-Benz E220 CDI (W212) Review

Tue, 17 Feb 2015 00:00:00 +0000

Last week I had the chance to drive a Mercedes-Benz E class. For me it was the first Mercedes-Benz at all that I drove. Of course I took the opportunity to have a deeper look at the car and summarize my impressions.

Technical data

The car's basic data looked like this:

Model name	E 220 BlueTEC BlueEFFICIENCY Edition
Type series	W 212
Year of construction	2014
Displacement / cylinder	2143 cm³ / R4
Horsepower	170 PS (at 3000 - 4200/min)
Torque	400nm (at 1400 - 2800/min)
Gearing	7G-Tronic Plus (7 gears automatic gearbox)
Gear type	rear wheel
Acceleration	0 - 100 in 8,4 seconds
Injection	Common-Rail
Charging	Bi-Turbo
Consumption	4,6l (combined, manufacturer's data)
CO² emissions	126 g/km
Weight	1735 kg

First impression

The car is a real eyecatcher you can't pass without noticing it. You will attract attention with the noble limousine - a reason for this might be the vehicle's size of nearly 4,9 metres. When you're ranking the car for the first time you will realize the vehemence of the car. The E class looks quite decent but noble if you didn't decide to order it in "retiree beige". The new re-designed Bi-xenon headlight are looking nice in comparsion with those from the predecessor series W211. I like the optional LED headlights even more. I appreciate that the Mercedes-Benz emblem was fixed to the front guard instead of the engine hood - that looks more modern is frees the E class from its old-established image.

Short tip: PostgreSQL error "SQLSTATE[08006] [7] FATAL: Ident authentication failed"

Sun, 15 Feb 2015 00:00:00 +0000

While testing a web application that uses PHP PDO to establish a connection to a PostgreSQL database I stumbled upon the following error message:

1Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[08006] [7] FATAL: Ident authentication failed for user "user"' in xxx.php

Surprisingly I was able to create a connection using the console with the user credentials:

1$ psql -d db -U user

By the way: I'm always creating PostgreSQL databases and users like this:

Oracle XE: reset locked users

Fri, 13 Feb 2015 00:00:00 +0000

If you haven't used an Oracle database for some time you might stumble upon the issue I just had: all internal user accounts were locked and I also didn't know the passwords.

By default login information of internal users are invalid after 180 days.

The following accounts are important to me on my Oracle 11gR2 Database Express Edition (XE):

XDB - Oracle XML DB user, required for APEX (Application Express)
SYS or SYSTEM - system user

The status of particular users can be gathered using sqlplus. Because I didn't know the login information of the system user but the database was still alive I had to establish a connection using the oracle user. After switching the user context using su it is sufficient to read the appropriate Oracle profile before using sqlplus. During this the required Oracle variables (ORACLE_SID, ORACLE_HOME) are set automatically.

vSphere 6: "Brave New IT"

Sun, 08 Feb 2015 00:00:00 +0000

This week VMware introduced plenty of new, long-awaited product versions during an online event. I also joined this event to see the further development that was taking place since VMworld 2014.

vSphere 6

The biggest highlight was vSphere 6 - in accordance with VMware this is the "biggest release ever". With this, a new major release is introduced after tight 4 years. 2 years ago the latest minor release 5.5 was released.

Short tip: Piwik timeout/memory issues on managed web servers

Thu, 05 Feb 2015 00:00:00 +0000

Recently I stumbled upon various PHP errors while using the free analytics software Piwik:

1PHP Fatal error: Allowed memory size of 2442473628 bytes exhausted (tried to allocate 64 bytes)
2...
3Fatal error: Maximum execution time of 30 seconds exceeded in .../piwik/core/DataTable.php

The solution is quite simple - the memory limit and timeout settings need to altered. As the most managed web servers don't allow accessing the configuration file php.ini it is sufficient to alter the appropriate configuration values in the .htaccess file in the Piwik root directory:

Apply particular Wordpress post meta settings database-wide

Mon, 02 Feb 2015 00:00:00 +0000

Doing a recent Wordpress theme installation I stumbled upon a problem which could have taken much time to fix it.

The theme I installed offers multiple sidebar configurations (left, right, none). There is no default settings which means that it is necessary to set the sidebar configuration for every particular blog post - otherwise the design is erroneous. This means that it would have been necessary to do the following steps for every blog post:

Short tip: Oppo Find 5 and short system storage

Fri, 30 Jan 2015 00:00:00 +0000

After a recent update to CyanogenMod 12 (Android 5.x) I realized that the storage for apps is quite tight. The reason for this is that the recommended GAPPS (Google Apps) need a lot of space. Beyond some useful applications this package also includes much "crap" that is unnecessary. You might run out of space if you install some big apps like Facebook.

The Find 5 offers 2 GB storage for system applications and other apps which is quite tight (at the release date this was sufficient). This limit also applies to the 32 GB version. The reason for this is that Oppo decided to split the internal flash in two partitions - some vendors are doing other implementations.

SUSE Linux Expert Day 2015 Frankfurt

Sun, 25 Jan 2015 00:00:00 +0000

This week one of the SUSE Linux Expert Day events that are taking place worldwide since september 2014 was hosted at 25hours Hotel Frankfurt by Levi's - a very stylish and fancy location!

Agenda

The event was planned for 5 hours and consisted of many interesting talks:

Keynote - Michael Jores, Regional Director Central Europe SUSE
SUSE Roadmap - Olaf Kirch, Director SUSE Linux Enterprise
SUSE Linux Enterprise Server 12 - Lars Pinne, Senior Systems Engineer SUSE
SUSE Cloud Überblick & Ausblick - Lars Pinne, Senior Systems Engineer SUSE
Kundenreferenz: FIS-ASP GmbH, Matthias Braun, FIS-ASP GmbH
Wrap-up, Q&A - Martin Wolf, Account Executive Team Lead SUSE

SUSE roadmap

Right after the keynote the plans of further development of current SUSE products was presented by Olaf Kirch. Of this planning is not binding but it already shows development trends.

Red Hat Satellite 5.7 released

Fri, 16 Jan 2015 00:00:00 +0000

This week Red Hat Satellite 5.7 was released. With the ninth update of the 5.x tree many improvements from the Spacewalk development were applied.

New web interface

The most eye-catching change is the web interface. While this hasn't changed a lot in the last 10 years the most recents developments from Spacewalk 2.1 to 2.3 were applied. In March last year Spacewalk already included a first approach of a new web interface combining modern technologies like HTML5, Bootstrap and jQuery. The current interface from Spacewalk 2.3 nightly looks even tidier and intuitive - it is has been adapted for Red Hat Satellite 5.7.

Monitor washing machines with Nagios / Icinga: check_gpio_pir

Sat, 27 Dec 2014 00:00:00 +0000

Winter time is crafting time! I spent the last couple of days on the Raspberry Pi and PIR sensors (Passive Infrared). Using this sensors it is possible to recognize motions - in combination with GPIO APIs you can create useful applications.

The first idea that came in my mind was to monitor my washing machine in the basement. Because I'm a very busy person I often forget the machine and so I thought about scanning the blinking LEDs on the front and automatically sending mails in case of status changes. Because I'm using Nagios respectively Icinga for monitoring my network anyway it was a good idea to develop an adequate plugin. 🙂

Cisco SG 300: configure Port Security with MAC filtering

Tue, 23 Dec 2014 00:00:00 +0000

If you own a Cisco SG-200/300 switch you are lucky to configure Port Security and MAC filtering. The advantage of this is that you are able to define which MAC addresses may establish connections on particular ports. Other devices will not be able to access the network - which is a good idea especially for public network sockets.

Configuring this mechanism is quite easy - if you know the particular steps. In this example one device is configures to access a particular network port - but it is also possible to enable more than one device for accessing ports. It is a good idea to connect all devices that need to be able to establish connections to the switch while configuration.

Minimal CRUX-ARM installation

Sun, 23 Nov 2014 00:00:00 +0000

CRUX-ARM is a Linux distro for ARM devices like the Raspberry Pi that follows the KISS philosophy. If you're looking for a minimalistic system you might want to have a look at the construction kit.

I'm using CRUX-ARM on one of my Raspberry Pi's. The installation fits on a 1 GB memory card. On the project's wiki there is a manual for installing the system: [click me!]

The basic installation consists of some unneeded packages that can be removed:

Short tip: Install Microsoft fonts under Enterprise Linux

Fri, 14 Nov 2014 00:00:00 +0000

Some applications still require Microsoft fonts under Linux. Some Linux distros dropped those fonts because of license difficulties. Microsoft offers those fonts for free but redistributing them is prohibited by the used license. Debian-based distros offer a package msttcorefonts-installer which downloads and extracts the fonts during the installation.

This requires an internet connection which isn't always possible - especially in data centers. A possible solution is to manually create a RPM package that includes all fonts. On Sourceforge there is a spec file for this - using this file it is possible to create a software package on a system with internet connection:

Sending and receiving mails under Linux usind msmtp and mutt over Microsoft Exchange EWS

Tue, 11 Nov 2014 00:00:00 +0000

Especially in Microsoft-embossed environments it might be needed to send and receiver mails over Exchange. Some graphical mail clients like Evolution are offering support for this - of course this is not a good solution for servers without graphical user interfaces.

DavMail is a Java-based platform-independent software that is able to act as Exchange gateway for the following protocols:

POP
IMAP
SMTP
CalDAV
CardDAV

The software listens on appropriate network ports and forwards requests over EWS (Exchange Web Services) to the Exchange server.

Short tip: Online update hard drive sizes under Linux

Mon, 10 Nov 2014 00:00:00 +0000

When hard drive sizes are altered the Linux kernel isn't informed about these changes automatically. Rebooting the system is a possible solution - but often no option.

Beneath the directory /sys/class/scsi_disk you will find additional files controlling some of the device's function depending on the SCSI id. Using the file device/rescan it is possible to schedule re-reading the device information. In this case the kernel will be informed about the new hard drive size. In combination with LVM it is quite easy to serve additional storage:

Short tip: VMware ESXi doesn't recognize SSD as SSD

Wed, 05 Nov 2014 00:00:00 +0000

During a server installation recently a local attached SSD wasn't recognized as SSD and therefore it was impossible to use it as vSphere Flash Read Cache. Not always the reason for this issue is a controller misconfiguration - sometimes ESXi just doesn't recognize the SSD as flash drive. In this case it is possible to flag particular storage devices explicitly as SSD.

For this access to the ESXi console is required. First of all the device name of the affected storage is needed:

GitBucket: GitHub clone for your intranet

Sat, 01 Nov 2014 00:00:00 +0000

GitHub is a very comfortable portal to collaborate source coces. The service manages versions using Git - for documentation purposes bugs and wiki contents can be provided. Especially the open-source scene uses the service a lot but for internal, non-public developments it is only partially suitable.

Premium users are able to create private repositories. For those access rules can be created - the files are still stored on the provider's servers. Another option is GitHub Enterprise - the appliance with costs offers all services known from GitHub in the local intranet.

Short tip: osad: Unable to connect to the host and port specified (EL6.6 + EL7)

Sat, 01 Nov 2014 00:00:00 +0000

Hint from january 2015: the bug has been fixed in the meantime.

I found out that it is currently (11/01/2014) impossible to run osad (Open Source Architecture Daemon) with SELinux enabled on EL6.6 and EL7 systems. The following error message can be seen while starting the service:

 1# service osad restart
 2Shutting down osad:                                        [  OK  ]
 3Starting osad: 2014-11-01 12:23:57 osad._setup_config: Updating configuration
 42014-11-01 12:23:57 osad._setup_config: Time drift 0
 52014-11-01 12:23:57 osad._setup_config: Client name ...
 62014-11-01 12:23:57 osad._setup_config: Shared key ...
 72014-11-01 12:23:57 jabber_lib.setup_connection: Connecting to spacewalk.localdomain.loc
 82014-11-01 12:23:57 jabber_lib._get_jabber_client:
 92014-11-01 12:23:57 jabber_lib._get_jabber_client: Connecting to spacewalk.localdomain.loc
102014-11-01 12:23:57 jabber_lib.__init__:
112014-11-01 12:23:57 jabber_lib.__init__:
122014-11-01 12:23:57 jabber_lib.connect:
13Error connecting to jabber server: Unable to connect to the host and port specified
142014-11-01 12:23:57 jabber_lib.main: Unable to connect to jabber servers, sleeping 60 seconds
152014-11-01 12:23:57 jabber_lib.push_to_background: Pushing process into background

After I spent much time on analyzing the Spacewalk and jabber server I remembered that my colleague Johannes had the same issue the other day. Red Hat Support named the following workaround:

Mac OS X - report after switching 60 days ago

Wed, 29 Oct 2014 00:00:00 +0000

Attentive readers of my blog or Twitter feed might have seen that I'm also spending my time on OS X relevant topics for two months. The reason for this is that I switched the operating system of my notebook from Microsoft Windows to Mac OS X.

Why?

To be honest there was no crucial reason for switching. Since my childhood I was using Microsoft Windows (since version 3.1) - and after a short trip with Linux desktops I returned to Microsoft Windows again. I was interested in a radical change after being frustrated about my last tests with Linux on the desktop. Because I have made first positive experiences with OS X on a Mac Mini I decided to replace my Thinkpad with a MacBook. Changing the hardware would have been necessary anyway as the T420s wasn't sufficient for my needs anymore.

VMworld 2014 Barcelona

Sun, 26 Oct 2014 00:00:00 +0000

Last week the european VMworld event was taking place in Gran Via, Barcelona. The program of the 4-day conference was characterised by virtualization and especially VMware products. VMware hosts two events every year - in the USA and Europe.

I had the honour to join this event as press member which gave me the possibility to gather many impressions. For me it was the first VMworld at all - but the definitely not the last one. 🙂

Install EMC NetWorker agent in VMware vCenter Server Appliance 5.5

Tue, 21 Oct 2014 00:00:00 +0000

When running a virtualized vCenter server it is very important to have a working backup. If the vCenter server crashes the virtual landscape cannot be managed or monitored.

Configuring backup is very easy when running VMware vCenter Server on a conventional Microsoft Windows servers because it is a fully-features operating system. In case you're using the VMware vCenter Server Appliance configuring backup might be more complex. By default this system doesn't come with pre-installed backup agents because it is assumed that a "agentless" backup solution for virtual machines is used.

POODLE - and how to get rid of it

Thu, 16 Oct 2014 00:00:00 +0000

A couple of days ago another security vulnerability that applies to Linux systems called PODDLE was announced. Less serious than Heartbleed especially web servers that are still allowing SSL generations 2 and 3 are affected. Because of a bad security design it is possible to decrypt transfered data. Often those protocol versions are allowed in the default configuration shipped by many Linux distributions - so administrators should really harden their servers. In the meantime CVE 2014-3566 was created to describe POODLE - the security vulnerability was detected by Google. To fix the issue it is sufficient to simply disable the older protocol generations. For Apache this is done by altering the appropriate configuration file:

Red Hat Enterprise Linux 6.6 released

Wed, 15 Oct 2014 00:00:00 +0000

Yesterday Red Hat released another update of its Red Hat Enterprise Linux major release 6: 6.6. Like for the minor updates before many optimizations and some "technical previews" were implemented.

The changes have been documented well in the release and technical notes:

Beside common kernel driver updates some other interesting customizations were made - I'd like to list some of those:

Installation as Hyper-V second generation VM - e.g. under Windows Server 2012 R2 (*), this also includes new Hyper-V Daemons: Hyper-V KVP (Hyper-V Key Value Pair) Hyper-V VSS (Hyper-V Volume Shadow Copy Service)
Improved support of additional SCSI signals for better hardware change handling using udev (e.g. size changes, thin-provisioning status, adding new LUNs,...)
Implemented a Open vSwitch module for additional Red Hat products, support is only offered in combination with other Red Hat products
For device mapper a caching modul (dm-cache) was introduced (*). This module can use faster drives (e.g. SSDs) as cache for slower storage media - details can be found in the lvmcache manpage
The software packages keepalived and haproxy are now fully covered by the Red Hat support
OpenJDK 8 Java Runtime Environment can be installed optionally (*)
Windows 8-certified touch screens are now supported by hid-multitouch
Red Hat Enterprise Linux 6.6 is now NSS FIPS-140 Level-1 certified
System Security Services Daemon (SSSD) was optimized for better authentification in combination with Microsoft Active Directory
gdisk - new tool for GPT partitioniing, the "look and feel" is alike fdisk
rsyslog7 - new, overhauled rsyslog version witn improved encryption and external database support (MySQL, PostgreSQL,...). It is recommended to migrate to this most recent version

(*) = technical preview

Short tip: uninstall pkg applications under OS X

Sun, 12 Oct 2014 00:00:00 +0000

The Apple App Store is not the only way to installation additional applications under OS X - another way is to install .pkg files (which have been created by the Apple Installer Framework).

Unfortunately not all applications installed using these files are present in the "Programs" category inside Finder. Uninstalling these applications using drag & drop inside the recycle bin is impossible.

But there is a tiny tool called General Package Uninstaller - it can be downloaded on GitHub. The program lists installed applications - and uninstalls them:

Virtualized cluster storage using VMware ESXi

Sun, 12 Oct 2014 00:00:00 +0000

Many software cluster solutions require shared storage between all cluster nodes. A very prominent example for this might be Oracle RAC (Real Application Clusters). In enterprise environments shared cluster storage is often implemented using SAN storage that is connected to multiple systems.

For (private) test scenarios a SAN storage system might exceed the budget. Fortunately there is a possibility to provided virtualized shared storage. If you're using VMware ESXi the keyboard for this is "multi-writer". ESXi uses its own file system called VMFS for local and iSCSI storage - this file system automatically creates locks to make sure that particular files cannot be accessed from multiple virtual machines (unless you're using Fault Tolerance). By disabling this behavior it is possible to access virtual hard drives (.vmdk files) parallely from up to 8 virtual machine_s_.

Short tip: configure hard drive standby with systemd

Sat, 11 Oct 2014 00:00:00 +0000

Hard drives can be forced into hibernate using hdparm. While it was quite easy to implement automatic setting this hibernation values by inserting the appropriate command (hdparm -B intervall device) into /etc/rc.local (which was executed after the boot) on sysvinit-based Linux distributions this changed on newer systemd-based systems. It is a good idea to implement this behavior as a service.

First you need to create a system-wide service and activate and start it afterwards:

Short tip: Gather HP SmartArray cache battery information under HP-UX

Thu, 09 Oct 2014 00:00:00 +0000

When a RAID controllers cache battery fails it is a benefit if you can gather the spare part number without any downtime. If your server is equipped with a HP SmartArray controller you can easily get t hose information using the sautil utility. This requires the HP-UX products RAIDSA and RAIDSA-PROVIDER to be installed. For displaying the information the hardware path of the affected controller is gathered and passed to sautil:

DELL OpenManage Integration Virtual Appliance update problems

Tue, 07 Oct 2014 00:00:00 +0000

DELL offers an Linux appliance based on CentOS 5 for customers using VMware products. This appliance is called "DELL OpenManage Integration for VMware vCenter Appliance" and integrates seamless in VMware vCenter Server (or the appliance). It can be used for monitoring physical servers and also allows controlling the particular servers remotely. Amongst others it is possible to update firmware versions and check warranty information.

Recently I had problems with updating the appliance using the web interface. The update was started and the appliance was restarted but the version number didn't change at all. In an older documentation I found a hint about a log file named /usr/share/tomcat5/rpmupdate.log - the update process is recorded in this file. Because even the administrator account has no shell access to the appliance it would be necessary to use a live CD. Fortunately this effor isn't needed because there is a button for creating troubleshooting bundles in the web interface. You can find the mentioned file rpmupdate.log in the ZIP file offered for download. (if you prefer the live CD solution the file can be found underneath /usr/share/tomcatSpectre/logs in appliance version 2.x)

Pebble Steel

Sat, 30 Aug 2014 00:00:00 +0000

I was very happy when I heard a couple of weeks ago that the coveted Pebble smartwatch can now also be ordered in Germany after a long time. Until now this was a problem due to duty difficulties. It seems like this difficulties have now been solved - ordering the watch in the Netherlands is now possible. After I've been waiting for a long time for this update I really had to order it instantly. The delivery time was quite short in spite of the huge demand. 🙂

Short tip: Mount optical media under Solaris

Sat, 30 Aug 2014 00:00:00 +0000

I'm not administrating Solaris systems very often - it is even more rare that I need to mount optical media on Solaris. This is just a short reminder so that I don't need to use a search engine everytime.

First of all the CD / DVD drive is determined by the iostat command. Afterwards the drive is mounted using the first device slice.

 1# iostat -En
 2c8t0d0           Soft Errors: 0 Hard Errors: 0 Transport Errors: 0
 3Vendor: VMware   Product: Virtual disk     Revision: 1.0  Serial No:
 4Size: 21,47GB <21474836480 bytes>
 5Media Error: 0 Device Not Ready: 0 No Device: 0 Recoverable: 0
 6Illegal Request: 4 Predictive Failure Analysis: 0
 7c7t0d0           Soft Errors: 0 Hard Errors: 5 Transport Errors: 0
 8Vendor: NECVMWar Product: VMware IDE CDR10 Revision: 1.00 Serial No:
 9Size: 0,35GB <349175808 bytes>
10Media Error: 0 Device Not Ready: 5 No Device: 0 Recoverable: 0
11Illegal Request: 1 Predictive Failure Analysis: 0
12
13# mount /dev/c7t0d0s0 /mnt

Depending on the media type is might be necessary to select the file system (e.g. -o hfs).

CentOS Dojo Cologne 2014

Fri, 08 Aug 2014 00:00:00 +0000

This week the first official CentOS Dojo in Cologne was taking place. CentOS Dojos are one-day events where administrators and developers can exchange knowledge. Talks about recent topics are always part of these events.

inovex GmbH kindly features the event by providing their rooms and hearty catering. Beside coffee and cake there were many opportunities for smalltalk and making contacts. 🙂

The talks

Many interesting topics have been discussed in 7 talks:

Short tip: File transfer from Android to OS X using MTP

Mon, 28 Jul 2014 00:00:00 +0000

Files can be easily transfered from an Android device to Windows computer using MTP (Media Transfer Protocol). Unfortunately this protocol is not supported in Finder which means that you need to connect your smartphone as hard drive - if this function is supported.

My Android 4.4.x ROM isn't supporting this function anymore - fortunately there is an application called Android File Transfer that expands MTP to OS X.

The application can be downloaded for free on the Android website. Connected Android devices are automatically connected if the screen is unlocked - and copying files is working like a charm. 🙂

OpenVPN under Mac OS X Mavericks 10.9

Sun, 27 Jul 2014 00:00:00 +0000

OpenVPN connections can be established under Mac OS X using the free software Tunnelblick - I kept in mind.

Using the most recent OS X version Mavericks this is a problem. The stable version of Tunnelblick is not ready yet for Mavericks which means that it is necessary to use beta version. Unfortunately those were not working for me. It was possible to establish tunnels but afterwards any network connection was impossible. When having a look at the log I spotted the following line for a hundred times:

Short tip: Get Raspberry Pi temperature

Sun, 27 Jul 2014 00:00:00 +0000

There is no standard sensor that can be used with lm_sensors to get the temperature of the Raspberry Pi embedded board - what a pity! Fortunately for this function there is a dedicated command called vcgencmd which is already included in the Raspbian image. To make it work you will need to customize the LD library paths:

1# echo "/opt/vc/lib" > /etc/ld.so.conf.d/raspberry-firmware.conf
2# ldconfig
3# /opt/vc/bin/vcgencmd measure_temp
4temp=51.9'C

There is also an appropriate file underneath /sys/class to get the temperature:

Akismet firewall problems (and how to fix them)

Tue, 08 Jul 2014 00:00:00 +0000

Recently I was confused when I spotted several spam comments on my blog. After logging into the Wordpress administration page I saw the reason for this issue:

1Akismet has detected a problem. A server or network problem is preventing Akismet from working correctly.

Oops - where did that come from?

It seems like my hoster All-Inkl has updated its PHP configuration recently. The Akismet plugin needs access to particular external servers to filter Spam comments. I discovered that the following PHP settings need to be set that this access works:

Short tip: YUM error: 'xz compression not available'

Tue, 08 Jul 2014 00:00:00 +0000

While importing the recent EPEL7 YUM repositories I stumbled upon the following error:

1# /usr/bin/spacewalk-repo-sync --channel epel-el7-x86_64 
2> --url http://dl.fedoraproject.org/pub/epel/beta/7/x86_64/ 
3> --type yum -c epel-el7-x86_64
4Repo URL: http://dl.fedoraproject.org/pub/epel/beta/7/x86_64/
5ERROR: xz compression not available

The solution was pretty easy - the following Python library was missing:

1# yum install pyliblzma

The next import was working like a charm. 🙂

Short tip: RHEL7 channels not available to Red Hat Satellite 5.6

Sat, 21 Jun 2014 00:00:00 +0000

It is possible that RHEL7 channels aren't available to Red Hat Satellite even though you're having a valid Red Hat Enterprise Linux subscription.

The appropriate software channel (rhel-x86_64-server-7) is not part of the list of available channels - it also cannot be downloaded manually:

1# satellite-sync --list-channels|grep "server-*7"
2# satellite-sync -c rhel-x86_64-server-7
316:17:48 Red Hat Satellite - live synchronization
4...
516:23:23 ERROR: these channels either do not exist or are not available:
616:23:23        rhel-x86_64-server-7
716:23:23        (to see a list of channel labels: /usr/bin/satellite-sync --list-channels)

Intel 82579LM Gigabit NIC under VMware ESXi

Thu, 19 Jun 2014 00:00:00 +0000

While bringing my self-made ESXi hosts into service I saw that only one of two network cards was detected. The reasons for this issue was that VMware ESXi offers no driver for the second network card Intel 82579LM.

What a pity. Fortunately I stumbled upon a blog which offers an adequate software packages which was created from the Intel source codes: [click me!]

The software packages just needs to be transfered to a datastore the ESXi host has access to before it can be installed. You also need to make sure that installing VIB packages that are not signed by VMware is allowed (community-supported):

A new ESXi home server

Sat, 14 Jun 2014 00:00:00 +0000

At about two years ago I replaced a lot of my hardware with more power-saving alternatives. My self-made NAS and hypervisor wer replaces by two HP ProLiant MicroServer G7 servers (N36L and N40L) - for a long time I was very happy with them.

In the last months the amount of VMs increased and now the CPU and memory ressources are exhausted. A new, more powerful VMware server was needed.

Manage Solaris with Spacewalk and Red Hat Satellite

Fri, 16 May 2014 00:00:00 +0000

Beside Linux systems also Oracle Solaris hosts can be managed using Spacewalk and Red Hat Satellite - a cool feature that is often forgotten. (Update: since Spacewalk 2.2 from 07/16/2014 this function is "deprecated" which means that it might be removed in one of the following releases)

Bigger companies which are reliant on proprietary Unices due to roadmaps or political reasons might be interested in this force migration purposes. Red Hat takes up the cause of facilitate migrations using this interface. It seems like it was planned to also support other proprietary Unices like IBM AIX or HP-UX - I suppose that because the Red Hat Satellite documentation always mentions an generic "Unix" and not a particular one. Maybe the support was dropped due to the lack of interest - but that's only my personal (and arbitrary) assumption.

Monkey web server + PHP5 + SQLite on Raspbian

Thu, 15 May 2014 00:00:00 +0000

Using Raspbian it is possible to convert a Raspberry Pi into a full-featured Webserver with PHP support. Using SQLite the embedded web server is also capable of serving database-driven web applications.

First of all the official Monkey APT repository needs to be included - this can done very easily by addind a line into the configuration file /etc/apt/sources.list:

1# echo "deb http://packages.monkey-project.com/primates_pi primates_pi main" >> /etc/apt/sources.list

The following commands are updating the APT cache and installing Monkey including SSL- and FastCGI support (needed for PHP) and some other plugins:

Spacewalk / Red Hat Satellite / SUSE Manager package action fails: "empty transaction [[6]]"

Mon, 05 May 2014 00:00:00 +0000

It is possible that the following error message is displayed on client systems when software packages are distributed using Spacewalk, Red Hat Satellite or SUSE Manager:

1Error while executing packages action: empty transaction [[6]]

This issue rests on the database of the management suite. After a while (or after a database schemata update) the cached packages information of the particular client systems are invalid. Already installed updates are provided - of course installing them fails.

arsa - archive and remove old Spacewalk/Red Hat Satellite/SUSE Manager actions

Sat, 03 May 2014 00:00:00 +0000

If you're maintaining your system landscape with Spacewalk, Red Hat Satellite or SUSE Manager you might also see many old entries while having a look in the action list after a while:

Every task triggered using the web interface is registered as action - after a while this list is growing rapidly. I'm not very familiar with the database design of the software suites mentioned above but I think it's basically a good idea to clean this up sometimes.

mkelfs - create kickstart trees for Enterprise Linux comfortably

Thu, 10 Apr 2014 00:00:00 +0000

A couple of days ago I spent a lot of time with Kickstart under Spacewalk and Red Hat Satellite and was looking for a possibility for creating Kickstart Trees for CentOS comfortably.

Radomly I stumbled upon a blog article which served a useful script. That inspired me to create a more handy python script for that.

After some hours a little application came up which can be used to create Kickstart Trees for the most Enterprise Linux-like distros (e.g. CentOS, Fedora, Scientific Linux): mkelfs. 🙂

Short tip: List imported RPM GPG keys

Wed, 09 Apr 2014 00:00:00 +0000

Sometimes it is sufficient to know which RPM GPG-Keys have been imported. You can get this information with the following command:

1# rpm -qa --qf '%{VERSION}-%{RELEASE} %{SUMMARY}\n' gpg-pubkey*
2c105b9de-4e0fd3a3 gpg(CentOS-6 Key (CentOS 6 Official Signing Key) <centos-6-key@centos.org>)
30608b895-4bd22942 gpg(EPEL (6) <epel@fedoraproject.org>)
4863a853d-4f55f54d gpg(Spacewalk <spacewalk-devel@redhat.com>)
566fd4949-4803fe57 gpg(VMware, Inc. -- Linux Packaging Key -- <linux-packages@vmware.com>)

The command lists all packages that are starting with the string gpg-pubkey - for each package the version, release and a summary is displayed. In the summary you might find a useful hint about the appropriate YUM repository.

Distribute Oracle JRE using Spacewalk, Red Hat Satellite and SUSE Manager and perform an clean installation

Sat, 05 Apr 2014 00:00:00 +0000

There are several OpenJDK versions for running Java applications under Enterprise Linux. This is adequate for the most applications but in some cases you might need the proprietary version by Oracle (e.g. because of support matrices of commercial third-party software).

On the JRE webseite you can find tarball and RPM package downloads.

If you are distributing the RPM package within a custom software channel using Spacewalk, Red Hat Spacewalk or SUSE Manager you will notice that there is a duplicate entry for the jre package. If you plan to install JRE afterwards the packages provided by the RHEL- / Scientific Linux- or CentOS channels are preferred.

Short tip: Fault Tolerance - Replay is unavailable for the current configuration

Thu, 03 Apr 2014 00:00:00 +0000

A couple of days ago I stumbled upon the following error message while activating Fault Tolerance on a particular virtual machine:

Replay is unavailable for the current configuration.

First I wasted time by verifying the following topics:

checking the VM configuration (vCPUs, OS support, disk provisioning,...)
tested using dvSwitches instead of vSwitches
researching syslogs and the internet

The solution was quite simple: the virtual machine was turned on and therefore Fault Tolerance was not able to work. After shutting down the VM I was able to enable Fault Tolerance and boot the system again.

Short tip: create RPM GPG key for EL5 and 6

Wed, 02 Apr 2014 00:00:00 +0000

If you want to create and sign RPM packages for Enterprise Linux 5 and 6 you will have to consider some things while creating and using the GPG key so that EL5 systems can also use the signed packages.

If you create a GPG key using the standard settings and sign a RPM package under EL6 you will get the following error on EL5 systems:

1# rpm -v --checksig mypackage.rpm
2Header V4 RSA/SHA1 signature: BAD, key ID xxxxxxxx

In a blog article I found a very useful hint that RPM/GPG is not able to deal with OpenPGP V4 signatures. It is required to use the older signature V3 here.

First sight at SUSE Linux Enterprise Server for VMware

Mon, 31 Mar 2014 00:00:00 +0000

A couple of days ago I stumbled upon something I nearly forgot: SUSE Linux Enterprise Server for VMware.

This is a slightly customized version of SUSE Linux Enterprise Server (SLES) created 2010 during a cooperation between VMware and Novell. The most interesting thing about this is that this version is completely without charge for owners of the VMware vSphere editions Standard or higher. Yes, you're right - without any charge. Usually you'll have to buy subscriptions in order to get patches and updates for SLES. This is inapplicable to VMware customers becuase the patch and update entitlements are bound to the vSphere subscription. This means: as long as vSphere is maintained SLES installations will also be maintained.

VMware vSphere Mobile Watchlist

Mon, 24 Mar 2014 00:00:00 +0000

VMware published a very useful tiny helper named vSphere Mobile Watchlist. The smartphone application is designed to be used for monitoring and controlling running virtual machines.

To avoid beeing overwhelmed by a endless list of virtual machines (of course this depends on the size of your virtual environment) the most important virtual machines can be combined in a "watchlist". Using this you always have your favorites in a single view.

The particular VMs can be powered on/off and hibernated remotely. The VM console cannot be accessed directly at the moment but at least the application is able to show a screenshot of the recent state so that you can see whether a VM crashed because of a bluescreen or Kernel panic. So it remains to be seen whether VMware upgrades the application in the future - that's the only feature by now that I miss. 🙂

Migrating vCenter Server Appliance data partitions to LVM volumes

Fri, 21 Mar 2014 00:00:00 +0000

Recently I discovered the following hint in the vCenter service state overview:

Apparently there was a issue with the integrated LDAP service of the vCenter Server Appliance - unfortunately I was not very successful when researching the internet with the appropriate error message:

LDAP data backup subcomponent error: JoinTool operation status: FAILED

A first sight at the system gave a interesting hint regarding the possible fault cause:

Spacewalk: Fatal error in Python code occurred [[6]]

Fri, 21 Mar 2014 00:00:00 +0000

During a recent system update that I started using Spacewalk I stumbled upon the following error message:

1Fatal error in Python code occurred [[6]]

After some troubleshooting I came up that I upgraded my spacewalk server to the most recenet release a couple of days ago. During this update I forgot to update also the Spacewalk client repository.

The solution was quite simple:

Deleting the existing packages in the Spacewalk client repository
Customizing the software channel URL: http://yum.spacewalkproject.org/2.1/RHEL/6/x86_64/
Updating the software channel content

In another blog article I demonstrated how automatically update software channel contents using a cronjob - of course this script also needs to be altered:

First sight at Spacewalk 2.1

Wed, 19 Mar 2014 00:00:00 +0000

A couple of days ago I stumbled upon a blog article by Duncan Mac-Vicar - it was all about a very interesting concept to modernize the web interface of Spacewalk. With great interest I have taken note of that a combination of defacto standards like Twitter Bootstrap, jQuery and HTML5 was used to pretty up the frumpy interface. Later I found out that these changes have already been applied in Spacewalk 2.1 - I totally missed that, what a pity! 🙁

Short tip: Analyze new configuration files deployed by RPM

Wed, 19 Mar 2014 00:00:00 +0000

Often configuration files are also updated during the installation of newer RPM packages. Using the package manager yum you're informed about that like this:

1# yum update
2...
3  Updating   : osad-5.11.33-1.el6.noarch                                  13/32
4warning: /etc/sysconfig/rhn/osad.conf created as /etc/sysconfig/rhn/osad.conf.rpmnew

If you're looking carefully at the output of the yum command you can compare the appropriate configuration files afterwards manually using diff. If you're managing plenty of systems you might have a automated solution like Red Hat Satellite or Spacewalk - maybe there is also no such a log.

Short tip: Find WWN/WWID for Fibre-channel controller under Linux

Wed, 05 Mar 2014 00:00:00 +0000

To find out the World Wide Name / World Wide Identifier of a Fibre channel controller under Linux you actually have multiple possibilities.

A very common way is to read the /sys directory. In this virtual file system there are e.g. special files which contain further information about the hardware. Below the folder fc_host there are additional sub-folders (host1,...) per adapter. In this subfolder there are additional files starting with node - those files contain the pretended WWN / WWID:

Patch Linux kernel source code

Tue, 25 Feb 2014 00:00:00 +0000

Sometimes it is necessary to patch the Linux source code - e.g. after new drivers or security bugfixes have been applied.

As a rule this task is done by your chosen distributor - but maybe you don't want to wait for that (or you like doing this on your own).

I'm currently preparing myself for the LPIC-2 certification - the following task is part of the exam objective "201.3 Patching a kernel".

Short tip: Upgrading GRUB2 on CRUX Linux fails: ./grub-mkfont: No such file or directory

Mon, 24 Feb 2014 00:00:00 +0000

When updating the GRUB2 package on a clean install of CRUX Linux I recently stumbled upon the following error:

1# prt-get update grub2
2...
3Pkgfile: line 28: ./grub-mkfont: No such file or directory"

The solution for this issue was simple - the freetype package was missing. This package is needed for generating GRUB fonts. Installing that package did the trick for me:

 1# prt-get install freetype
 2# prt-get update grub2
 3...
 4=======> Building '/usr/ports/opt/grub2/grub2#2.00-4.pkg.tar.gz' succeeded.
 5prt-get: updating grub2 from 2.00-3 to 2.00-4
 6pkgadd: rejecting etc/grub.d/, keeping existing version
 7pkgadd: rejecting etc/bash_completion.d/, keeping existing version
 8
 9-- Packages updated
10grub2
11
12-- updated packages with README files:
13grub2

Thanks for the support, jaeger (from the CRUX Linux core team)! 🙂

Create errata reports using Spacewalk, Red Hat Satellite or SUSE Manager

Fri, 14 Feb 2014 00:00:00 +0000

Sometimes it is necessary to break down the patch status of the Linux landscape.

Especially if the administrator's work is subjected to security standards a constant documentation of maintenance tasks is often necessary.

Using Spacewalk, Red Hat Satellite or SUSE Manager available patches are described as errata. Those errata are also specified depending on their type (security fix, bugfix, feature enhancement,...).

Instead of determining the available errata manually per system you also use the Spacewalk utility spacewalk-report and automate this process. If this tool is not available on your system you might need to install the software package spacewalk-reports using your distributions package manager.

Pitfalls and tips for ArchLinux installation

Fri, 07 Feb 2014 00:00:00 +0000

Recently I finished my first ArchLinux installation since 2010. Many things have change since I used the distro the last time and I felt a little bit helpless first.

The former ArchLinux installer isn't used anymore - the experienced Linux user has to prepare the hard drives for the installation on his own. The installation and configuration is executed using pacstrap and arch-chroot.

While you could configure your whole system using the /etc/rc.conf configuration file before you will have to customize several configuration files now. The most important configuration files are /etc/hostname, /etc/locale.conf and /etc/vconsole.conf.

Short tip: Copying a VMware VM fails: "failed to log into nfc server"

Thu, 06 Feb 2014 00:00:00 +0000

When a upload/download of a particular virtual machine on a VMware vSphere ESXi host is not working a common issue is that required network ports are not opened (yeah, it's "always" a firewall issue!). It makes no difference whether you start the process directly on the ESXi host or on a VMware vCenter Server.

A common error message is:

1failed to log into nfc server

You might want to have a look at VMware's KB article 1012382 which lists all required network ports per product and version.

Short tip: osa-dispatcher dead but subsys locked

Thu, 30 Jan 2014 00:00:00 +0000

Recently I had a issue when trying to use the OSA dispatcher integrated in Spacewalk, Red Hat Satellite and SUSE Manager. The software was unable to push actions to registered client systems - it seems that there was a problem with the appropriate service:

1# service jabberd status
2router dead but subsys locked
3sm (pid 5294) is running...
4c2s (pid 5301) is running...
5s2s (pid 5308) is running...
6
7# service osa-dispatcher status
8osa-dispatcher dead but subsys locked

After my previous troubleshooting ideas were unsuccessful I had to use Google for researching. I found the solution for the issue in the following mailing list: [click me!]

Short tip: GPG key generation failes - command get_passphrase failed: Operation cancelled

Wed, 29 Jan 2014 00:00:00 +0000

Recently I stumped upon the following error while creating GPG keys for signing self-created RPM packages :

1can't connect to `/home/su-rpmdev/.gnupg/S.gpg-agent': No such file or directory
2gpg-agent[14392]: command get_passphrase failed: Operation cancelled
3gpg: cancelled by user
4gpg: Key generation canceled.

For creating the RPM packages I created a dedicated user su-rpmdev - it was necessary to create GPG keys for this particular user.

I found the solution for this issue on the following website: [click me!]

Short tip: Lightbox overlays aren't opened in Wordpress

Sat, 25 Jan 2014 00:00:00 +0000

If you're creating your own Wordpress theme and want to pimp photo galleries you will probably use a Lightbox plugin like Simple Lightbox, wp-jquery-lightbox or WP Lightbox 2. If you're not very familiar in creating Wordpress themes in addition (like me) you might forget the following lines and wonder why linked photos aren't showed up in the expected overlay.

By using another theme on your website you can easily detect whether you forgot something while coding your theme. If the overlays are working with another theme you might forgot the following lines:

Short tip: VMware vSphere ESXi - Uplink redundancy lost on DVPorts: "xxxx/xx ..."

Wed, 22 Jan 2014 00:00:00 +0000

After a recent upgrade from VMware vCenter Server 4.1 to VMware vCenter Server Appliance 5.5 and from ESXi 4.1 to 5.5 I was molested by the following message:

1Uplink redundancy lost on DVPorts: "xxxx/xx ..." Physical NIC vmnic1 is down

Analysing the switches showed that there was no link flapping. This fault message was erroneous.

You want to have a look at the following ideas/questions:

temporarily disable auto-negotiation on the affected network card
Was a wrong MTU assigned?
Is the most recent release of ESXi used?
Is the latest version of vCSA used?
Are the firmware's of the server (BIOS, BMC, NICs,...) up-to-date and supported by VMware?

In my case temporarily disabling auto-negotiation solved the issue. After re-enabling the automatic speed negotiation the error message and the molesting mails just disappeared. Really strange but this really worked in my case. 🙂

Deploy VMware Tools using Satellie, Red Hat Satellite or SUSE Manager

Tue, 21 Jan 2014 00:00:00 +0000

Virtualized Linux guests running on VMware vSphere can only offer the best performance if the helper software VMware Tools in the most recent version.

If you have ever used VMware products you know that constant updates guarantee the support of new operating systems and hardware. But this has also the disadvantage that this helper software needs to be updated more often.

This might be no problem for private use. But if you have to maintain a bigger amount of Linux VMs you surely know that this can be very time-consuming.

Short tip: VMware vSphere ESXi - "Virtual machine disks consolidation is needed"

Tue, 14 Jan 2014 00:00:00 +0000

I was dazzled when I recently saw the following warning message ahile using the vSphere Client:

1Virtual machine disks consolidation is needed

Okay - let's do this. I started the requrested consolidation by opening the context menu of the affected virtual machine and clicking "Snapshot" and "Consolidate" - unfortunately this process crashed.

The detailed error message gave a hint regarding active locking:

1An error occurred while consolidating disks: msg.fileio.lock.

I discovered that the affected virtual machine also had a snapshot - and then I remembered what created this snapshot: my backup appliance, Quantum vmPRO.

Short tipp: multipath LUN gets no alias under Linux

Tue, 07 Jan 2014 00:00:00 +0000

When a logical storage device unit (LUN) of a SAN storage system shall be connected to a Linux server multiple access paths are often used to increase the availability of the storage - especially in case of failures. To implement this technique the multipath daemon (multipathd) is often used under Linux. This software bundles the appropriate paths to one abstracted device file. This file always uses the best path to the storage unit and is used like a device file of a conventional local hard disk. In case of a failure an alternative path is used to transfer data. The higher the amount of paths (normally between 2 and 8) the higher the availability.

Short tip: Uptime displayed in Spacewalk/Satellite/SUSE Manager in spite of reboot incorrect

Fri, 20 Dec 2013 00:00:00 +0000

Some system updates (e.g. kernel updates) require the affected Linux system to be rebooted. If the system is managed using Spacewalk, Red Hat Satellite or SUSE Manager this reboot can be scheduled after patching the host very comfortably.

However it is possible that after the reboot (watch the output of the uptime command) a hint regarding the needed reboot is still displayed:

To fix this issue you'll need to update the hardware information - an appropriate menu element can be found beneath the tab "Details > Hardware":

VMware backup solution for HP MicroServer N36L, N40L and N54L

Wed, 18 Dec 2013 00:00:00 +0000

Due to their low price and power consumption HPs tiny MicroServer N36L, N40L and N54L are often used as tiny VMware servers in the basement of enthusiastic nerds and geeks.

Especially in combination with faul-tolerant ECC memory and a HP SmartArray P410 SAS controller you can built an adequate solid Enterprise-ready ESXi host.

But - how to backup those VMs best? That's a topic I was working on intensively in the last weeks. This article will give you an overview about the possibilites.

VMware Converter VM and distributed portgroups: failed to poweron vm

Tue, 03 Dec 2013 00:00:00 +0000

When converting a physical Linux server using VMware Converter Standalone the following error message might be displayed if you're using distributed portgroups:

1A general system error occured: failed to poweron vm

I found a hint that indicated that the amount of used vCPUs or cores exceeds the license limit of the ESXi host. But in my case this was not the error cause.

I used another distributed portgroup during the Converter assistant. Afterwards the helper VM wasn't able to convert the source server because it was connected to another network - but the VM booted successfully.

Kill a non-responding VM under ESXi

Sun, 01 Dec 2013 00:00:00 +0000

It is possible that a VM is not responding any more - mostly it's a simple solution to restart the appropriate VM.

Under rare circumstances it is possible that this restart process isn't passing through. An indicator for this issue is that the process (which normally only takes a couple of seconds) needs multiple minutes and the progress bar freezes.

I had this problem recently - I was puzzled when I saw the following error message while starting the VM console:

Short tip: Nagios/Icinga error "DISK CRITICAL - /var/lib/pgsql/data is not accessible: Permission denied"

Mon, 18 Nov 2013 00:00:00 +0000

If you're running a PostgreSQL database on a CentOS/RHEL system and moved the data directory to a dedicated partition the following error might occur if you want to monitor the filling level using the Nagios/Icinga plugin check_disk:

1DISK CRITICAL - /var/lib/pgsql/data is not accessible: Permission denied

The reason for this issue is that the check_disk plugin is not allowed to move to the directory:

1# ls -ld /var/lib/pgsql/data/
2drwx------ 13 postgres postgres 4096 Nov 13 23:49 /var/lib/pgsql/data/

Of course a solution is to grant the rights for other users using the chmod o+x command. But it is more senseful to use ACLs instead - this is the only way to make sure that only the nrpe user (and not all users) is allowed to access the directory.

Clean up Spacewalk/Satellite/SUSE Manager software channels

Fri, 15 Nov 2013 00:00:00 +0000

After some time old packages are accumulated in software channels managed by Spacewalk, Red Hat Satellite or SUSE Manager.

Especially at least when your hard drive are threaten to get tanked up you should clean up and remove unneeded packages. For this there is a utility called spacewalk-data-fsck - but this tool only removes packages from the hard drive that cannot be found in the database.

In the Red Hat Spacewalk mailing list I found a script developed by Nicolas Pradelles that removes old package versions. This script scans all software channels and removes outdated packages from the database and the file system.

Short tip: Red Hat Enterprise Desktop and Flash plugin updates

Fri, 15 Nov 2013 00:00:00 +0000

If you want to always use the most recent Flash version around with Red Hat Enterprise Desktop (RHED) you'll probably use the Adobe YUM repository. If you're also receiving packages from the RHN channel "RHEL x86_64 Workstation Supplementary" further complications are possible because this channel also offers a package with the same name.

If both channels are used it is possible that an update for Flash is installed from the Adobe YUM repository and overwritten the next day by the RHN-Channel.

Short tip: List all installed Perl modules

Mon, 11 Nov 2013 00:00:00 +0000

If you want to list all installed Perl modules - e.g. to make sure all requirements of a Perl application are provided - pmall might help you a lot. On Red Hat Enteprise Linux/CentOS systems the tool is part of the perl-pmtools package and creates an output like below:

1# yum install -y perl-pmtools
2# pmall
3Newt (1.08) - Perl bindings for Red Hat newt library
4Mysql (1.2401) - Perl interfaces to the mSQL and mysql databases
5DBI (1.52) - Database independent interface for Perl
6APR (0.009000) - Perl Interface for Apache Portable Runtime
7Clone (0.27) - recursively copy Perl datatypes
8GD (2.35) - Interface to Gd Graphics Library
9...

All modules (their versions are mentioned in brackets) and their appropriate short descriptions are listed.

Use OMD with ssmtp

Thu, 07 Nov 2013 00:00:00 +0000

If you use Open Monitoring Distribution (OMD) and don't want to setup a full-fledged Postfix or Sendmail service (e.g. because it is a test system) you might want to have a look at the alternative tool ssmtp for relaying mails to an external mail server. The tool is only recommend if you don't need any local mail transfers.

Of course this works with Postfix and Sendmail as well but implementing this task is - depending on the configuration the mail server - more time-comsuming (e.g. because canonical maps, SASL, SSL/TLS have to be configures). I prefer ssmtp for fast setups because I can do all the configuration tasks in one single file and this takes not even 5 minutes.

Assign recent errata automatically to Spacewalk

Mon, 04 Nov 2013 00:00:00 +0000

Recent bugs and security issue are mapped to necessary updates in the form of errata. Users of the commercial Red Hat Satellite or SUSE Manager server get these information directly from their distributor. Using Spacewalk this needs to be done manually - fortunately there a script CEFS by Steve Meier which automates this: [click me!]

Periodically a XML document containing all available errata is published there: [click me!]

This script can be automated in form of a cronjob to make sure that you always have to most recent errata information. First of all you need to have the following Perl modules installed on your Spacewalk system:

OSAD SSLError troubleshooting

Sun, 03 Nov 2013 00:00:00 +0000

If problems occur while starting the Open Source Architecture Daemons the issue can have multiple problem causes. This service is used amongst others in combination with Spacewalk, Red Hat Satellite, or SUSE Manager to push configuration jobs or software packages.

The following problem causes are possible:

The firewall on the Spacewalk / Red Hat Satellite or SUSE Manager Server does not permit any connections on the TCP and UDP ports 5269 and 5222.
The firewall on the client system does not permit any connections on the TCP and UDP port 5222
The Jabber service jabberd on the Spacewalk / Red Hat Satellite or SUSE Manager server isn't starting properly. If the command "service jabberd status" answers with "dead but subsys locked" there can be a problem because of invalid file permissions or SELinux contexts - this happens quickly if you fiddle with the appropriate configuration files and create backups.
The client system wasn't registered using the FQDN with the Spacewalk, Red Hat Satellite or SUSE Manager system

In every case it is useful to have a look in the OSAD protocol on the client system:

5 recommended OwnCloud plugins

Thu, 31 Oct 2013 00:00:00 +0000

There are plenty of "apps" for OwnCloud which are expanding the functional range of the open-source software. Currently at about 110 such addons are available for free download. Some of these addons can be installed directly using the "Apps" menu in the administration interface of OwnCloud - some addons require manual downloading and copying to the apps/ folder on the server using FTP.

My personal selection of useful addons:

EditDoc

Install OwnCloud on a managed web server

Wed, 30 Oct 2013 00:00:00 +0000

When it is necessary to share files between multiple devices and persons OwnCloud is a good alternative for Dropbox.

The open-source software that also supports WebDAV can also be installed on a managed web server - for this purpose the project offers a installation script which is transfered to the server using FTP: [right-click and save as!]

Depending on the configuration of the web server there might be some pitfalls. For example, my web server uses PHP 5.2 by default - OwnCloud forceful needs PHP 5.3 or higher to work. Beyond that a special function called "PHP magic quotes" needs to be disabled to run OwnCloud properly.

Syncing contacts and calendars using Baikal on your own web server

Mon, 28 Oct 2013 00:00:00 +0000

To keep contacts and calendars up-to-date between multiple devices well-known cloud services like Apple iCloud or the Google services are often used.

It's no doubt that this is a very comfortable solution - but in my opinion you shouldn't place trust in public cloud services. I personally avoid cloud services and try to host all services on my own servers.

Using the CardDAV and CalDAV protocols contacts and calendars can be synchronized. There are plenty of open source applications that implement these protocols - including OwnCloud and Baikal. While OwnCloud is an all-inclusive software environment to host your private cloud Baikal offers only CardDAV and CalDAV synchronization - exactly what I was looking for.

VMware ESXi 5.5 and HP MicroServer N40L

Mon, 28 Oct 2013 00:00:00 +0000

VMware released a new version of the famous ESXi Hypervisor one month ago.

This tops VMware's portfolio off after the products Fusion, Player and Workstation already were updated in september.

Some technichal enhancements of the new version:

dropped 32 GB host memory limitation - (a minimum of 4 GB memory is required by now) - the free version is still limited to a maximum of 2 physical CPUs
expanded host support - an ESXi host can now manage up to 320 physical CPUs and 4 TB memory, 40 GBit/s network cards are now supported
CPU C states - Until now the CPU could only be stepped down (P states), additional power-saving options are supported
Virtuelle Hardware Version 10 - VMDKs can store up to 62 TB, added support for virtualized SATA controllers (by now only SCSI/SAS), support for Windows 8.1, Server 2012 R2 and Red Hat Enterprise Linux 7 guest, dropped support for legacy software (Windows 3.11 - 2000, NetWare, MS-DOS, SCO)
Improved vGPU support - better performance in virtual machines and expanded vendor support; by now only NVidia was supported - now also AMD GPUs are supported
vSphere Flash Read Cache - special technology which caches VM data on SSDs, read access is executed accellerated on flash drives
Improved LACP support - 22 new Hashing algorithms, maximum of 64 aggregation groups (LAG) per Host and dvSwitch

If you want to learn more aber technical enhancements of ESXi 5.5 you might want to have a look at the following PDF by VMware: [click me!]

Third sight at Windows 8.1 - and: the trimmed Lenovo drivers

Thu, 24 Oct 2013 00:00:00 +0000

Earlier this year I tried Windows 8 for the second time - and decided to switch back to Windows 7. One of the reasons was the missing support of my Thinkpad X230's webcam and UltaNav - especially the middle mouse button. It was not possible to use the middle mouse button als middle button. By default a scroll function is assigned to the middle mouse button - I prefer to use the button with its formerly function because many programs assign special functions to this button. As an example, Firefox or others tools can open and close tabs using the button. I use the middle mouse button a lot and don't want to miss it. Acceptable working is not possible for me without this feature.

Short tip: Configuration debugging of Active Directory authentification under vCSA 5.5

Wed, 23 Oct 2013 00:00:00 +0000

If you're having issues with configuring Active Directory authentification in VMware vCenter Server Appliance (vCSA) 5.5 you might want to have a look at the following log file: /var/log/vmware/vpx/vpxd_cfg.log

Ideally access this file using tail -f before saving the Active Directory configuration to see error messages in real-time.

I entered the following configuration values in my test environment and couldn't find any errors:

Active Directory enabled
Domain: D2.LOCALDOMAIN.LOC
Administrator user: D1\admin-cstan
Administrator password: ...

The administrative user was part of another domain - that's why I prepended the other domain name. Appropriate authorization rules have already been defined in Active Directory.

Call "HostDatastoreSystem.QueryVmfsDatastoreCreateOptions" for object "ha-datastoresystem" on ESXi "xxx.xxx.xxx.xx" failed.

Fri, 18 Oct 2013 00:00:00 +0000

While creating a VMFS storage I received the following error yesterday:

1Call "HostDatastoreSystem.QueryVmfsDatastoreCreateOptions" for object "ha-datastoresystem" on ESXi "xxx.xxx.xxx.xx" failed.

First I thought the freshly created logical drive on my HP RAID contorller had a failure - but this drive was working properly:

 1=> ctrl slot=1 pd all show status
 2
 3 physicaldrive 2I:0:5 (port 2I:box 0:bay 5, 500 GB): OK
 4 physicaldrive 2I:0:6 (port 2I:box 0:bay 6, 500 GB): OK
 5 physicaldrive 2I:0:7 (port 2I:box 0:bay 7, 250 GB): OK
 6 physicaldrive 2I:0:8 (port 2I:box 0:bay 8, 250 GB): OK
 7
 8=> ctrl slot=1 ld all show status
 9
10 logicaldrive 1 (465.7 GB, 1): OK
11 logicaldrive 2 (232.9 GB, 1): OK

After some research in the internet I discoverd that a invalid GPT label can be the reason for this issue. A solution is to re-create the GPT table using the gParted live medium. I didn't want to reboot my system - especially because ESXi can do this on its on as is also has the parted utility installed. You only need to know the device name of the logical drive with the invalid GPT table. If you don't know this file have a look at the output of the fdisk utility and compare the drive sizes:

Short tip: create screenshots under HP-UX

Sat, 12 Oct 2013 00:00:00 +0000

If you want to create a screenshot of your HP-UX system and don't have GIMP installed, you can easily create a X dump using the xwd commandos. This X dump can be converted into a JPG file (or some other picture format) on another machine using XnView.

After executing the xwd command simply click on the window for the screenshot or mark a window range. After that the X dump is created.

There's life in the old dog yet - HP Integrity RX2600 EFI Unexpected TRAP

Tue, 17 Sep 2013 00:00:00 +0000

A couple of months ago I installed Red Hat Enterprise Linux on a dedicated hard drive of my HP Integrity RX2600 servers. Because the installation programm doesn't support the native Management Processor console I had to connect a screen, keyboard and mouse to the device. The installation worked like a charm and after a hour the host rebooted.

Unfortunately the system didn't want to boot anymore since the installation. A rare and funny accident - evil to him who evil thinks (if [ "$os" <> "HP-UX" ]; then crash; fi;).

Short tip: Disable IPv6 completely under RHEL / CentOS

Fri, 06 Sep 2013 00:00:00 +0000

Use the following commands to completely disable IPv6 under RHEL / CentOS up to version 6:

1# echo "options ipv6 disable=1" > /etc/modprobe.d/ipv6.conf
2# chkconfig ip6tables off
3# shutdown -r now

A module parameter prohibits IPv6 functionality after the next reboot. If this value wasn't set, some services still open IPv6 sockets. The IPv6 firewall isn't required anymore - disable it.

Beginnign with Enterprise Linux 7, this behaviour has changed requiring a kernel variable to be set:

Persistent txqueuelen network parameter using udev

Wed, 21 Aug 2013 00:00:00 +0000

txqueuelen is one of many configurable networking parameters. This paremeter defines the queue size in which the kernel stores data before it is sent over the network. By default this parameter has a value of 1000 - depending on your application you might want to increase this value using ifconfig or ip:

1# ifconfig eth0 txqueuelen 5000
2# ip link set eth0 txqueuelen 5000

This is no smart solution because this command has to be entered again after each reboot or network restart. Of course you could also insert the command into the /etc/rc.local script - but there is a much nicer way to get it working.. 🙂

Software and configuration management made easy using RPM

Sun, 30 Jun 2013 00:00:00 +0000

If you're maintaining multiple Red Hat Enterprise Linux systems (or equivalent offsets like CentOS or Scientific Linux) your administration work with the particular hosts will gain in a routine. Because even the best administrator might forget something it would be advantageously to have a central software and configuration management solution. Chef and Puppet are two very mighty and popular mangement tools for this application. Depending on your system landscape and needs these tools might also be oversized though - RPM can emerge as a functional alternative in this case.

Eject all CD-ROMs in a VMware cluster

Tue, 18 Jun 2013 00:00:00 +0000

Every VMware administration knows the following issue - the cluster needs to patched and so the particular nodes need to be rebooted. Fortunately this doesn't bother the users working on the farm becuase the virtual machines can be moved "online" between the cluster nodes.

There might be a little show stopper when ISO images (which aren't saved on the cluster storage) are mounted - e.g. local CD drives. In this case the virtual machine can't be moved and the cluster node won't enter maintenance mode - it is necessary to fix this manually.

High-availability ad absurdum - instant messenger cluster using DRBD and Finch (Pidgin)

Thu, 09 May 2013 00:00:00 +0000

It is often unjustifiable said that implementing high-availability under Linux is way too complex. Of course you will have to be patient while spending some time in learning the required basics - but all this is feasible for an experienced administrator (or someone who wants to be such an administrator some day). This example shows how easy a simple 2-node cluster can be built.

When it is necessary to keep data synchronous between multiple hosts, implementing a DRBD (Distributed Replicated Block Device) might be the most elegant and easiest solution.

iOS and IPCop/IPFire OpenVPN

Thu, 02 May 2013 00:00:00 +0000

OpenVPN Connect is a good OpenVPN client for iOS devices with version 5.0 or higher.

Using this app VPN tunnels can be managed and used comfortably. Unfortunately the respective OpenVPN configuration files can't be edited directly on the iPhone, iPod or iPad like in the Android application. The first setup might be more complex because you'll have to modify the configuration files on a computer and copy them to the device using iTunes afterwards.

Default gateway ignored under RHEL / CentOS 5.3

Tue, 23 Apr 2013 00:00:00 +0000

On RHEL or CentOS 5.3 it is possible that a noticed default gateway is ignored. In this case the routing table doesn't contain any appropriate entry...

1# netstat -r|grep default

...even if the gateway was noticed both in the main network configuration...

1# cat /etc/sysconfig/network
2...
3GATEWAY=10.24.36.1

...and interface configuration:

1# cat /etc/sysconfig/network-scripts/ifcfg-eth0
2...
3GATEWAY=10.24.36.1

To fix this issue it is necessary to add the following entry to a routing file:

CDE under Debian Squeeze

Mon, 15 Apr 2013 00:00:00 +0000

Many administrators or IT enthusiasts still might know Common Desktop Environment (CDE) from old UNIX days. Introduced in 1993, it was Unix's standard desktop for HP-UX, IBM AIX, Sun Solaris and Tru64 for more than 10 years. Even if Solaris dropped its CDE support 3 years ago, the old desktop is still used in HP-UX, AIX and OpenVMS.

A petition for publishing CDE's source code was started in 2006. After 6 years, the desired source code was published in september 2012. Currently, there's an alpha version which can be compiled under Linux.

Differences between Spacewalk, Red Hat Network Satellite and SUSE Manager

Mon, 15 Apr 2013 00:00:00 +0000

Red Hat Network Satellite and SUSE Manager are two management suites for the Linux enterprise distros Red Hat Enterprise Linux and SUSE Linux Enterprise Server.

At first sight these products look very similar to each other and there are also technical analogies because the products are based on the same core code: Spacewalk. Spacewalk was released as open source by Red Hat in 2008 - it is also the base platform for the commercial Satellite server.

Obsolete tools: nslookup & ifconfig

Sun, 07 Apr 2013 00:00:00 +0000

nslookup and ifconfig are two well-known tools for configuration the network of Unix/Linux hosts and checking whether DNS is working properly.

ifconfig was part of the 4.2BSD distribution in 1983 for the first time and quickly became the standard tool for network configuration - even commerical Unices like Solaris or HP-UX integrated the utility.

Some Linux distributions don't use ifconfig anymore (e.g. ArchLinux) - other distributions (e.g. SuSE/SLES and Fedora) are advising that this tool will be missing someday:

CRUX-ARM 2.8 on Raspberry Pi

Wed, 03 Apr 2013 00:00:00 +0000

. Meanwhile there are plenty of operating systems available for the Raspberry Pi - including an ARM version of the source-based Linux distro CRUX.

So if you like handcrafting or think Raspbian is "too mainstream", you can have a lot of fun with a SD card with at least 1 GB of memory and a pot of coffee. 😉

Partitions and mounting

The following partitions have to be created on the SD card:

New strategy objectives for Ubuntu: custom kernel, exclusive hardware and the cloud?

Mon, 01 Apr 2013 00:00:00 +0000

It's doubtless that Ubuntu is one of the most innovative Linux distributions - it made Linux desktops becoming more user-friendly and - thanks to this - raised the acceptance for end users in the last years.

Currently the gossip factory is working overtime again - some reliable sources announced that some big strategy changes - that are the focus of this article - are pending to the distribution.

New engine: ARM-focused - no GNU/Linux for the first time?

According to insider information there is a middle-term objective to move to a new kernel platform. In the past the maintenance of the Linux kernel exposed as a very time-consuming and complex task. Special Ubuntu modifications have to be made later and new device drivers are often buggy which decreases the customer's satisfaction.

Short tip: postfix - SASL authentication failure: No worthy mechs found

Tue, 19 Mar 2013 00:00:00 +0000

If you install and configure a Postfix mail server for relaying mails using an external smarthost you might be puzzled about the following error message:

1Mar 19 17:00:22 hostname01 postfix/smtp[2003]: warning: SASL authentication failure: No worthy mechs found

The reason for this issue can be really trivial - in my case I did a minimal installation of RHEL which came without SASL and the appropriate plain module.

Installing the needed libraries fixed the problem for me:

RHEL 6.4, tmpfs and OMD: can't find /omd/sites/... in /etc/fstab or /etc/mtab

Mon, 18 Mar 2013 00:00:00 +0000

Hint: The following issue has been fixed by a RHEL / CentOS patch (util-linux-ng) - just update your system!

If you want to install Open Monitoring Distribution on RHEL or CentOS 6.4, you might have the problem that creating sites isn't working as expected:

1# omd create test
2Adding /omd/sites/test/tmp to /etc/fstab.
3Creating temporary filesystem /omd/sites/test/tmp...mount: can't find /omd/sites/test/tmp in /etc/fstab or /etc/mtab
4ERROR

Starting sites isn't working either:

 1# omd start test
 2Creating temporary filesystem /omd/sites/test/tmp...mount: can't find /omd/sites/test/tmp in /etc/fstab or /etc/mtab
 3ERROR
 4Starting dedicated Apache for site test...OK
 5Starting rrdcached...OK
 6Starting npcd...touch: cannot touch `/omd/sites/test/tmp/pnp4nagios/run/npcd.pid': No such file or directory
 7chown: cannot access `/omd/sites/test/tmp/pnp4nagios/run/npcd.pid': No such file or directory
 8An Error occured while reading your config on line 197
 9Message was: "Could not open pidfile '/omd/sites/test/tmp/pnp4nagios/run/npcd.pid': No such file or directory"
10OK
11/omd/sites/test/etc/rc.d/80-nagios: line 58: /omd/sites/test/tmp/nagios/nagios.cfg: No such file or directory
12Nagios configuration file /omd/sites/test/tmp/nagios/nagios.cfg not found. Terminating...
13Initializing Crontab...OK

While searching for a solution I discovered the following thread in the check_mk mailing list: http://comments.gmane.org/gmane.network.nagios.checkmk.german/1694.

Retro: S.u.S.E. Linux 5.0 (1997)

Wed, 13 Mar 2013 00:00:00 +0000

After 6 months of developing, openSUSE 12.3 was released today.

Time to have a look at the roots. openSUSE is based on the former S.u.S.E. Linux - S.u.S.E stood for the german company name (Gesellschaft für Software- und System-Entwicklung GmbH).

The first official S.u.S.E. version 4.2 was released 1996 and came with Linux 1.2.13.

By sheer good fortune I got S.u.S.E. 5.0 (1997) installation media and tried to install the old operating system inside a virtual machine.

Oracle 11gR2 XE - "Database Configuration failed."

Sun, 10 Mar 2013 00:00:00 +0000

Recently I had problems with installing Oracle 11gR2 Express Edition on CentOS 6.4.

The installation of the RPM package worked but the database configuration crash with the following error:

1# service oracle-xe configure
2...
3"Database Configuration failed.  Look into /u01/app/oracle/product/11.2.0/xe/config/log for details"

The log file wasn't very helpful because it showed no explicit hint - but I found a lot of entries with the following error code:

1ORA-01034: ORACLE not available

This can be originated from amongst others:

IMAP-Push under Android

Wed, 06 Mar 2013 00:00:00 +0000

If you want to receive mails on your smartphone or tablet you have to choose between two completely different technologies:

Polling - The mail server is contacted in a pre-configured timeframe (30 minutes, 1 hour,...) and asked for new messages
Pushing - The mails servers informs the mobile device about about new emails

The most Androids are using the Polling technology - unfortunately the most standard mail clients offer no Pushing functionality. You can find some alternative mail clients with Pushing functionality in the Google Play store - for example K-9 Mail.

4EXT vs. ClockworkMod

Tue, 05 Mar 2013 00:00:00 +0000

4EXT and ClockworkMod are two recovery images for Android devices - they can be used for installing, saving and restoring alternative ROMs.

But what's the difference between those two tools? That's what this article is about.

Depending on the Android ROM it might be required to use on of the two tools. For example, there are plenty of ROMs that aren't fully compatible with ClockworkMod (CWM).

I merged the tool differences I know in the following table:

Stable Android 4.2.2 ROM for the HTC Sensation

Tue, 05 Mar 2013 00:00:00 +0000

After I have been using Sense ROMs for a long time, I decided to "make a journey abroad".

On my Nexus 7 I'm using Android 4.2.2 - and I'm very satisfied with it. I decided to try this Android release also on my HTC sensation.

On xda-developers I spotted a ROM which is based on CyanogenMod 10.1 (Android 4.2.2) and supports all the hardware of the Sensation. This is very important for me - I don't want to try "pre-alpha" ROMs and miss half the features of my smartphone.

Synchronize Outlook contacts with Android

Tue, 05 Mar 2013 00:00:00 +0000

Not everybody wants his contacts and calendar entries synchronized to the Google Cloud - I'm also one of those persons who prefer synchronizing sensitive data locally.

With HTC ROMs you can use HTC Sync for this - for me this have been the only reason why I used this ROMs for a long time.

But what to do if you don't have a HTC smartphone? There are posibilities, too. A possibility is the CompanionLink Android tool, a colleague told me.

Trip abroad: nonsens(e) ROMs

Tue, 05 Mar 2013 00:00:00 +0000

Since I rooted my smartphones I tried a lot of ROMs and finally always ended with Sense ROMs. The main reason for this was the HTC Sync tool which enabled me to synchronize contacts and tasks with my local Outlook.

HTC Sync is only compatible with HTC ROMs - Android stockroms are not supported. I found no other tool like this. This didn't prevent me trying alternative Android ROMs.

I was really suprised when I saw, how big the performance and lifetime differences between Sense and Android ROMs are. The latter were always working faster and offered a much better battery life. I can't get behind the reason of this effect. The file size differences between Sense and plain is another thing I can't understand. The file size of an Android 4.2.2 ROM is about 150 MB - Sense-ROMs normally need 500 MB of space. I suppose that this huge difference is forced by the installation of many additional compability libraries and other legacy runtime overhead from old Windows development times (HTC Sense originally came from Windows Mobile development).

Nokia IP130 - a different kind of IPCop

Mon, 04 Mar 2013 00:00:00 +0000

Currently I'm implementing a IPSec tunnel between my and another flat. After my first plan, using an already existing Raspberry Pi as IPSec gateway, fizzled after plently of failed tries I decided to implement a router-to-router solution.

The center of my network is a ALIX.2D13 which is used as IPCop to offer DNS, NTP and VPN functionality. Using IPSec I'd like to connect my IPCop's network to the other's. In a virtual environment I successfully implemented this scenario after a couple of minutes.

Short tip: Dell OpenManage Server Administrator under RHEL x86_64 - ./invcol: /lib/ld-linux.so.2: bad ELF interpreter

Wed, 27 Feb 2013 00:00:00 +0000

It is possible that the DELL OMSA inventory collector crashes on 64-bit RHEL systems with the following error message:

1# /opt/dell/srvadmin/sbin/invcol
2/opt/dell/srvadmin/sbin/invcol: ./invcol: /lib/ld-linux.so.2: bad ELF interpreter: No such file or directory

What a pity! This issue needs to be fixed if you want to check if there are available firmware patches for the afftected systems using DELL OpenManage Essentials.

The problem is that the mentioned tool needs two additional 32-bit libraries - those dependencies are not noted in the RPM package. You will have to do this on your own:

Short tip: Mount Linux volumes under Windows

Sat, 23 Feb 2013 00:00:00 +0000

Sometimes it might be necessary to mount Linux file systems under Windows.

This can be done very easily using a tool named "DiskInternals Linux Reader". This tool is able to mount the following file system types in read-only mode:

ext2/3/4
reiserFS/reiser4
HFS(+)
UFS2

Be noticed that the tool only mounts these file system types in read-only mode to preserve the integrity of the appropriate file system. If you plan to mount volumes also in read-write mode, you have to use other tools:

Red Hat Enterprise Linux 6.4 released

Thu, 21 Feb 2013 00:00:00 +0000

Today Red Hat released the fourth update of Red Hat Enterprise Linux 6. After 8 months there's also another update that brings a lot of fixes and new features.

The Release Notes für RHEL 6.4 are, as usual, very considerably - I personally think, that the following updates are specially mentionable:

Kickstart

Using th fcoe, vlanid, bondslaves and bondopts options, it is now possible to use Fibre-Channel-over-Ethernet devices, VLANs and network bonds for kickstart installations.

Get controller or LUN WWN / WWID under HP-UX

Wed, 20 Feb 2013 00:00:00 +0000

Reading the World Wide Name (WWN) / World Wide Identifier (WWID) of a controller or a LUN is not always easy unter HP-UX - depending on the release. Especially under the older releases 11.11 and 11.23 additional tools are required to get the requested information - this is much easier under 11.31.

Controller information

Using ioscan a overview about mounted Fibre-channel cards:

1# ioscan -fnkCfc
2Class     I  H/W Path     Driver   S/W State   H/W Type     Description
3========================================================================
4fc        0  0/3/0/0/0/0  fcd      CLAIMED     INTERFACE    HP AD300A 4Gb Dual Port PCIe Fibre Channel Adapter (FC Port 1)
5                         /dev/fcd0
6fc        1  0/3/0/0/0/1  fcd      CLAIMED     INTERFACE    HP AD300A 4Gb Dual Port PCIe Fibre Channel Adapter (FC Port 2)
7                         /dev/fcd1

Depending on the controller type (td/fcd driver) one of the following tools are executed and combined with grep to get the Port WWN/WWID:

Short tip: First steps after HP-UX 11i v1/v2 installation

Wed, 20 Feb 2013 00:00:00 +0000

There are plenty of changes that have to be made after a fresh HP-UX 11i v1/v2 installation because of missing pre-configuration. For example:

Name resolution

By default, the file /etc/nsswitch.conf doesn't exist and has to be created and modified using a template. If this isn't done, neither XF86 nor the sw utility family (swinstall, swremove,...) are working:

 1# ls -1 /etc/nss*
 2/etc/nsswitch.compat
 3/etc/nsswitch.files
 4/etc/nsswitch.hp_defaults
 5/etc/nsswitch.nis
 6/etc/nsswitch.nisplus
 7
 8# cp /etc/nsswitch.files /etc/nsswitch.conf
 9# vi /etc/nssswitch.conf
10...
11hosts:        files dns

In this example the system is configured to resolve services, protocolls, user/groups, et cetera using local files. Hostnames are additionally resolved using DNS.

Google Nexus and the hidden system update

Mon, 18 Feb 2013 00:00:00 +0000

It is possible that a system update for a Google Nexus device can't be found and - according to this - downloaded, even if the update was definitely released.

A reason for this issue might be the "Google Services Framework" - it forces an error while communicating with the Google update servers. A solution might be to stop the process and delete the data of the framework. The next search request shall be acknowledged by a Google update server - if you're lucky, you're able to download the update afterwards.

Red Hat Certified Professional (RHCP) of the Year 2013

Sat, 16 Feb 2013 00:00:00 +0000

Since a few years Red Hat is awarding a free ticket (incl. flight and hotel) for their own "Red Hat Summit" exhibition in Boston/Massachusetts in line with the "Red Hat Certified Professional (RHCP) of the Year" promotion. Every administrator who holds a valid certification can apply - valid certifications include:

Red Hat Certified System Administrator (RHCSA)
Red Hat Certified Engineer (RHCE)
Red Hat Certified Virtualization Administrator (RHCVA)
Red Hat Certified Security Specialist (RHCSS)
Red Hat Certified Datacenter Specialist (RHCDS)
Red Hat Certified Architect (RHCA)
JBoss Certified Application Administrator (JBCAA)
JBoss Certified Developer in Persistence (JBCD)
Red Hat Certificates of Expertise

I'm proud to hold the first two certificates and so I - naturally - also applied for the price:

HP C8000 - System firmware hang. Contact your HP Support Engineer.

Thu, 14 Feb 2013 00:00:00 +0000

A few days ago I wanted to use my HP C8000 workstation after a long time - but a defect changed my plans. Instead of showing the Boot Console Handler (BCH) the C8000 only presented a black screen. Even the serial interface was not working at all - no good sign.

I had a deepter look at the issue and unplugged all hardware which is not required for startup (hard drives, optical drives, soundcard) and removed the CMOS battery for one hour - unfortunately it didn't help.

Short tip: Change backspace control key at run time

Wed, 13 Feb 2013 00:00:00 +0000

Depending on SSH client configuration and HP-UX release it is possible that the backspace control key (which is used for deleting erroneous inputs) is not working as expected.

1# mn^?^?man
2mn^?^?man: command not found

A possibility is to modify the configuraton of PuTTy - but this requires resetting the current session.

Alternatively the stty command can be used with the following parameters to re-define the backspace control key:

Find out Tachyon XL2 part number under HP-UX 11.11 / 11.23

Mon, 04 Feb 2013 00:00:00 +0000

Especially in older PA-RISC and Itanium machines HP Tachyon XL2 hostbus adapters can be found. If you want to know the associated HP part number (e.g. if you need to compare a support matrix) you might have used ioscan - and found nothing:

1# ioscan -funC fc
2Class     I  H/W Path  Driver S/W State   H/W Type     Description
3=================================================================
4fc        0  0/4/2/0   td   CLAIMED     INTERFACE    HP Tachyon XL2 Fibre Channel Mass Storage Adapter
5                      /dev/td0
6fc        1  0/5/2/0   td   CLAIMED     INTERFACE    HP Tachyon XL2 Fibre Channel Mass Storage Adapter
7                      /dev/td1

Unfortunately there is no part number in the description - like in other HBAs:

Kerberos single sign-on with SSH v2 under windows

Thu, 31 Jan 2013 00:00:00 +0000

Using Kerberos it is possible to "kerberize" services and applications to enhance security. Compared to classical username/password authentification Kerberos uses time-limited tickets which are applied per-user for authentificating against services and applications.

In combination with SSH the encrypted remote protocol can be further secured - who worries about security (or seems to be paranoid) can force using Kerberos authentification instead of conventional authentification using the following changes to the SSH server configuration (/etc/ssh/sshd_config):

Clone Mac OS X installation on a new hard drive

Mon, 28 Jan 2013 00:00:00 +0000

By default, OS X installation media isn't shipped with Macintosh computers - there is also no information about purchasing installation media. It seems that Apple wants to prevent that "homebrew macs" are built.

This is a problem if you bought a Mac with a small or slow hard drive (saved money in the wrong place) and want to replace it. That's what happened to me - I bought a Mac Mini with a 500 GB hard drive (5400 rpm) in 2011. Meanwhile, I'm nerved by the boot times and application startup time forced by the slow hard drive. After rebuilding my Thinkpad T420s I got a 160 GB spare SSD that I wanted to use for the Mini. Without the installation media I can't install OS X on it.

Google Nexus 7

Mon, 28 Jan 2013 00:00:00 +0000

On a recent business trip I was annoyed by the heavy weight of my Thinkpad Tablet - this and the badly customized Android distribution by Lenovo forced me to have a look for alternatives. Some days ago I could play a few minutes with the Nexus 7 of a colleague - I was amazed by the device.

In short - I decided to order and test such a device.

Technical data

The specifications of the Nexus 7 are really interessting - the device is cheaper and more powerful than my Thinkpad Tablet:

Short tip: list of modified RPM packages

Thu, 24 Jan 2013 00:00:00 +0000

If you want to have a short overview about which files of installed RPM packages has been altered, you probably don't want to deal with AIDE - a short script should be enough:

 1#!/bin/sh
 2for i in $(rpm -qa|tr "n" " ")
 3do
 4        RESULT="$(rpm -vV $i)"
 5        if [ "$?" != "0" ]; then
 6                echo "$i has been changed:"
 7                echo "$RESULT"
 8                echo ""
 9        fi
10done

Of course you should have a detailed look at the file list - modified files don't have to be the result of an attack:

Short tip: unpack manpages under HP-UX and RHEL

Mon, 21 Jan 2013 00:00:00 +0000

Especially on new installed systems it is possible that the manpage database wasn't initialized, yet. You can identify this if whatis / man -k doesn't "find anything":

1# man -k man
2man: nothing appropriate

Under HP-UX the index is created using the following command:

1# catman -m

Under RHEL there is a tool named makewhatis which completes ideally without any feedback:

1# makewhatis

Tada - searching in the mapages is working by know:

Stable and fast Sense ROM - Android Revolution HD

Sat, 19 Jan 2013 00:00:00 +0000

I had almost every Sense ROM (preferring Sense 4) on my HTC Sensation for testing purposes. I wasn't satisfied will all these ROMs by now - there was always something which annoyed me.

The most ROMs with Sense 4 look nice but have a poor battery life and/or casual stutters while using the home screens. After installing customized performance kernel (e.g. Sultan kernel) this issue was fixed - but afterwards WLAN tethering wasn't working anymore.

Storage management under Fedora made easy: System Storage Manager

Wed, 16 Jan 2013 00:00:00 +0000

One of the innovations of Fedora 18 is the new System Storage Manager as I mentioned yesterday. This tool enables the central administration of storage devices. Are the times of reading manpages finally over for newbies? I had a deeper look at the SSM - and was pleasantly suprised. The System Storage Manager can be installed comfortably using Yum or rather DNF:

1# yum install system-storage-manager
2# dnf install system-storage-manager

The concept of SSM reminds me on diskpart from Windows and the in the HP-UX world good-known vxdisk utility - those tools also allow storage management using simple and self-explanatory commands. But what can SSM do at all?

First glance at Fedora 18

Tue, 15 Jan 2013 00:00:00 +0000

After the original release date and 6 other dates were canceled, Fedora 18 was released today.

Time to have a look at the anticipated operating system. The latest version of the RedHat supported project introductes some new features which might be also included in the upcoming version of Red Hat Enterprise Linux and accordingly Red Hat Enterprise Desktop.

Anaconda facelifting

The most eye-catching update is the Anaconda installer which welcomes user with a completely new look. The hitherto installer design was introduced at the time of Red Hat Linux (no I'm not referring to Red Hat Enterprise Linux!).

Short tip: automatic UTF-8 encoding under SciTE

Fri, 11 Jan 2013 00:00:00 +0000

SciTE is a minimalistic, extendable editor with syntax highlightning for more than 30 programming languages.

Of course SciTE also supports UTF-8 - but doesn't use it by default. If a UTF-8 encoded file is opened, umlauts are displayed erroneous. The used encoding can be selected from a menu - anyway, this trick needs a lot of time while editing multiple files.

This issue can be fixed by adding a entry in the user options file:

Read Windows 8 BIOS-Product Key

Fri, 28 Dec 2012 00:00:00 +0000

It has become common, that new acquired devices with pre-installed Windows 8 don't have a product key label on the back anymore. Only a tiny Windows 8 label shows that the device was shipped with Windows 8.

The product key of Windows 8 is saved in the BIOS, but it is impossible to get the full key using tools of the operating system (only the last 5 letters are shown).

Firmware update for Raspberry Pi 512 MB

Wed, 26 Dec 2012 00:00:00 +0000

It is quite possible that a brand-new Raspberry Pi only comes with 256 MB memory after the first boot:

1$ dmesg | grep -i "MB total"
2[    0.000000] Memory: 256MB = 256MB total

A misdelivery does not necessarily have to be the reason for this effect. It is rather important which of the following codes is noted on the memory chip of the Raspberry Pi:

Caption	Memory size
K4P4G324EB-AGC1	512 MB
K4P2G324ED-AGC1	256 MB

If the chip caption is correct, a outdated firmware version might be the reason for the limited memory amount. The firmware isn't saved on the Pi itself, but on the SD card - because of this, newer distributions (like Raspian Wheezy, etc.) shall not be affected by this problem. If you're using an older distro (e.g. Raspian Squeeze) you can update your firmware using a tool named rpi-update. The tool is available through a git web mirror - but it needs some other tools which need to be installed before:

Debian Wheezy's send_nsca and nsca 2.7.2

Mon, 10 Dec 2012 00:00:00 +0000

For the first time, a dedicated package for the NSCA agent is added under Debian Wheezy (before there was only a package which combined agent and daemon). The package version is 2.9.1 - which leads to syslog error messages in combination with a NSCA server in version 2.7.2:

1# cat /var/log/messages
2...
3nsca[30772]: Handling the connection...
4nsca[30772]: Dropping packet with invalid CRC32 - possibly due to client using wrong password or crypto algorithm?

The reason is that the new send_nsca uses a bigger fixed package size of 4096 bytes (instead of 512) - the server isn't able to handle that request. The simplest solution is compiling an older version of send_nsca. It's a good idea to choose the same version used for NSCA on the Nagios/Icinga server.

Raspbian Linux

Sat, 08 Dec 2012 00:00:00 +0000

Raspian is a special customized version of Debian for the Raspberry Pi. By default, this image includes a graphical user interface and some tools like media players and web browers. For some use cases (e.g. servers) this might be not needed. It's also a security breach if you run a server.

I want to use a Raspberry Pi as Icinga server - therefore I don't need a graphical user interface.

HP OpenVMS Technical Update Days 2012

Sun, 11 Nov 2012 00:00:00 +0000

This week the annual "OpenVMS Technical Update Days 2012" has been taking place at HP. Like every year the event's focus was the technical progress of OpenVMS.

I'm quite new to OpenVMS and recently discovered the operating system. For me it was the first time I've been to the OpenVMS TUDs.

The agenda was extensive and has packed two complete days:

Day 1	Day 2
OpenVMS - keep on working together	Open Source & Unix Portability
Your future with OpenVMS	Your future with Integrity Servers
OpenVMS Update News	Itanium News
Connect	OpenVMS on large Blades - practical experiences
OpenVMS vs Linux/Windows - security costs	The Charon Emulator in real life
OpenVMS Services from HP	Oracle Database on OpenVMS and Oracle Rdb Product Updates
The Secrets of EFI	Storage Update
News from the OpenVMS hobbyists	OpenVMS Success Story
Open Discussion Panel	OpenVMS in a new environment

Source: german OpenVMS portal and HP website

Lenovo Thinkpad X200 display issue

Thu, 18 Oct 2012 00:00:00 +0000

Since I got my T420s my old Thinkpads R500 and X200 are waiting for new owners. A few days ago I discovered a screen issue on my X200. Its display is badly lighted when the brightness is dimmed down - in addition to this the screen is squeaking high-frequently.

Working in dark and silent environments is nearly impossible in this way.

This is how my screen looks like:

Short tip: PuTTY connection to HP-UX host

Thu, 19 Apr 2012 00:00:00 +0000

If you establish a connection to a HP-UX host using PuTTY and SSH you might have the problem that the backspace is not working with the standard settings.

Characters are not deleted, a control key is added - the solution is quite simple:

You need to modify the settings under "Terminal > Keyboard > The Backspace key" - instead of "Control-H" you'll have to select "Control-?" here.