Adventures in Linux, UNIX, Bash, and beyond

The long term effect of short term returns

2011-05-26T21:43:00.000-07:00

Another day another rant about Oracle.

bullying - the act of intimidating a weaker person to make them do something.

Business decisions might not make sense to everyone but they typically serve a specific purpose. A company might tell employees that they must bring a coffee mug instead of using the disposable cups if they wish to drink the coffee in the break room. To some employees this decision is terrible because they now have to get a mug and bring it to work just to enjoy the coffee that they drink every day. On top of that they have to clean the mug instead of just throwing the cup away. The employee might see this as an inconvenience but to the business they are now able to save a little money that they were previously spending on disposable cups.

As time goes on more and more of these decisions are made by business leaders. The true impact of these choices might not be fully realized until a much later time. The short term results of a decision could prove to be desirable because the long term impact has not manifested.

After taking over Sun Microsystems the Oracle corporation has been tasked with making all kinds of decisions. Oracle CEO Larry Ellison is considered by many to be a very savvy business man. Others however might instead regard him as a bully who will do anything to squeeze every last possible cent out of his customer base. Doing whatever it takes regardless of what happens to anyone else just as long as the profit returns continue increasing. This type of activity has been going on in mass ever since the SUN acquisition was completed.

One of the first decisions was not widely published but had a large impact. Solaris 10 will now require service agreements if you wish to continue using the operating system. This decision was definitely aimed at increasing revenue. To use Solaris 10 you must now pay for a support contract which will entitle you to receive the operating system patches which were previously free under SUN. There were a few problems with this choice. First, the way which the message was communicated was atrocious. The support agreement fine print was modified to reflect these changes. Second, now if you are running Solaris 10 you are paying Oracle or you are out of compliance and owe them money. Also, this new policy made it where Solaris 10 could no longer compete directly against Linux in the "free" server install base. This effectively reduced the Solaris 10 installation numbers that SUN worked so hard to create by giving the product away for free.

SUN was very community oriented as a company. They worked closely with various groups of developers in a structured manner where information sharing thrived. Oracle takes the exact opposite approach to development and marketing. They do not want any pesky users trying to tell them what they should or should not do and everyone needs to pay Oracle. This philosophy change at the top of the corporate structure resulted in the systematic elimination of groups like the Open Solaris Governing Board. The OpenOffice project was forked into LibreOffice by the developers who hoped to avoid being controlled by Oracle. A dispute over the name OpenOffice began between Oracle and the new LibreOffice team. Oracle refused to give up the OpenOffice name rights to the new group which is why they renamed the project to LibreOffice.

The business decision by Oracle was to starve out all of these user communities until they ceased to exist. This tactic proved to be quite effective and allowed them to remove any outside influence that might try to oppose the future direction that Oracle was proposing. The Java Community Process was abused and manipulated in such a way that long term members such as the Apache software foundation quit being participants. They were bullied into quitting the JCP through manipulative behavior and request refusals by the Oracle corporation. These decisions were very strategic and put Oracle in the drivers seat of projects that were previously driven by community input along with corporate cooperation.

Prior to the SUN purchase Oracle had been partners with Hewlett Packard. The two companies teamed up to create a world class database setup known as exadata. The exadata system was being touted as the best in the world and contained HP servers running Oracle software. When the SUN deal was announced Oracle took the stance that it's business as usual and even though SUN sells hardware, they would still be just as invested in HP. After the SUN deal was completed however, Oracle proceeded to poach an HP executive along with announcing that exadata would no longer be an HP product. They have continued the bully tactics by announcing the discontinuation of Oracle database products on the HP Itanium platform. This decision forces people running HP hardware with Oracle software to change platforms. Oracle is most likely looking to pick up those margins in the server market by forcing people off a competitors platform. Every business decision made by the Oracle corporation is designed to gain money or increase their control.

The SUN deal took a long time to finally get approved. During this time of uncertainty a lot of customers were jumping off SUN hardware and switching over to IBM or HP based on the deeply discounted offerings when trading in SUN hardware. The response from Oracle has now turned in to "Applications to Disk" and focusing on engineering complete solutions. They have changed their focus to go after very large customers where profit margins will be the highest. They trimmed back the low end server offerings and started chasing the big bucks. Another business decision that maximizes profits while minimizing effort. It's easier to support one large customer site opposed to 20 small customer locations considering the money would be the same for both scenarios.

The situations described above sound like great business right? Well, some people might say yes those choices were very business savvy and put the company in a position to dominate for years to come. Others such as myself would like to bring reality back.

The bundling of hardware, operating system, and database software allow customers to deal with a single source for all their support needs. However, you are now locked in for a long ride. People who are running the database software on platforms besides Oracle will most likely be picked off a few at a time. The first was HP Itanium users which is most likely one of the largest Oracle database installation platforms. Going forward watch for Oracle to make similar decisions that directly impact competitors negatively in an effort to gain a few customers here or there. Although it is possible, don't expect to see any financial incentives for using Oracle hardware instead of other competitors. Once you switch to their complete solution you are then locked in and will have to pay whatever they decide you need to pay.

In the mean time, companies who have developed systems which rely upon SUN hardware and Oracle software are feeling the pain. The increased support costs for compliance when running Solaris are being passed along to their customers through rate increases. The third party companies have to charge customers more just to cover the additional revenue that Oracle has to be paid. The rate increases will force customers to look for alternatives because times are hard everywhere and each dollar counts. This pattern continues until the 3rd party company is forced to change platforms, sell themselves to another larger company, or simply go out of business. The decisions made by Oracle will trickle down to the 3rd party companies who will feel the financial impact. End users will receive the inflated costs until they terminate the services of the 3rd party company. This results in a revenue loss for not only the 3rd party company but also Oracle in the long run.

The cost of Oracle database licenses is almost laughable. The extremely high cost has gotten to the point of forcing customers to choose an alternative database engine because they simply cannot afford to keep paying the rising premiums. While the continuous raising in price might result in annual revenue increases to the bottom line, long term they will start to shed customers. As a result the remaining customers will have to make up the difference until they too decide to choose an alternative platform. The single company large installations will be the main customers of the Oracle corporation. They provide the highest margins with the smallest amount of effort. Some customers will have no choice but to accept the terms Oracle dictates to them.

The people who might have considered using Solaris 10 instead of Linux seem to be long gone. The customers who enjoyed the freedom of choosing their hardware platform to run Oracle software should be extremely concerned because their days are numbered most likely. Open source projects that have fallen under the control of Oracle will be forked or boycotted. Oracle has earned a reputation of being cut throat and should not be trusted. This reputation will create resentment which will in turn make people more actively seek out alternatives. The resentment will only continue to grow as Oracle systematically blasts everyone with sales calls and emails attempting to upsell you products for needs which you don't currently have.

Although Oracle will most likely not disappear from the market any time soon, they might disappear at your company. Do not be surprised when they begin to be phased out. Oracle's outrageous pricing and reputation will cause them to start losing customers as they move forward. Eventually they might be forced to stop focusing on the complete stack solution and go back to chasing database customers everywhere. Otherwise Oracle will find themselves like the 5 star hotel that nobody wants to stay at. Why pay so much for a place to sleep when I can find another place to sleep for much cheaper, and although it's not as nice as the 5 star hotel, it fits my needs just fine.

Solaris 11 Lunch and Learn Review

2011-05-26T20:17:00.000-07:00

Recently I was able to attend a presentation regarding Solaris 11 and it's new features. It was a lunch and learn event that was designed to get attendees familiar with the changes that are coming down the Solaris product line. Having been well versed in Solaris 9 and Solaris 10 I was interested in seeing what changes were on the way. When I was trying to wrap my mind around the SMF and other modifications from Solaris 10 I was told that SUN was forced to keep some of the changes out of 10 because nobody would even recognize it if they didn't.

The Solaris 9 to Solaris 10 changes were quite vast. Things such as the SMF created dependencies within services and would automatically keep services running. This was great and all but you now have to learn to use svccfg and figure out how to create and xml file that has the ability to handle your daemons. I really did not like this change at first but over time as I migrated the Solaris 9 systems up to Solaris 10 it became second nature. Other changes such as the fault management subsystem along with RBAC, ZFS, and most of all Containers, made Solaris 10 the defacto standard for the Solaris bloodline.

OpenSolaris was a community project that was basically the testing ground for new features that would be integrated into Solaris 11. Things like ZFS boot were just a revision away and the sky was the limit. Oracle proceeded to kill the OpenSolaris community through neglect and deception. That is why I was a little shocked when I heard the mention of Solaris 11 express being referred to as having a community. I guess they meant it used to have a community but I couldn't bring myself to derail the show with my snarky comments.

One of the touted features in Solaris 11 is the IPS (Image Packaging System). This is designed to make patching your systems much easier because now instead of downloading and installing a patch, you will download and install a patched version of the package. Not only that but any dependencies that need to be resolved will get resolved automatically and the extra packages needed to meet prerequisites will be pulled down and installed also. That sounds great right? The command to perform these actions is pkg. You can do things like pkg install apache or pkg uninstall apache or pkg update (which will fetch your updates and install them for you). This does sound quite an appealing feature for Solaris because now instead of using blastwave to fetch and install applications, the operating system now has this functionality natively.

Although they call it the Image Packaging System, in reality, this is nothing more than apt-get. The apt suite has been available in debian for years and years. Well now this feature has finally made it to Solaris in version 11. Not only do you have an apt-get equivalent but you will have the ability to choose boot environments during startup. If you install a kernel level package that requires a restart, then this package is tagged with a special boot flag which instructs zfs to automatically snapshot the system and create a menu entry for both the old and new revisions of the kernel. Then during boot you will be presented a menu to choose from. How cool is that! It's also nothing more than grub/lilo ported to Solaris for version 11. Don't get me wrong, I never used the live update features because they were just way too cumbersome and had the potential for more harm then good. At least those lu commands are no longer needed. I guess these "features" are good for Solaris but linux has been doing that for years.

Moving along I found myself feeling disappointed. I found out that Solaris 11 express is basically OpenSolaris and works the same way. One of the huge complaints that I had with OpenSolaris was that when installing a zone you were forced to have a network connection. Sure it's 2011 so all computers and servers have an internet connection. This might not be a hangup for you but to me that is just poor design. There are numerous reasons why I might not be able to access the internet but still need to install a zone pronto. The zone installation forces you to fetch a pkg file from Oracle's website every time you install a zone. In Solaris 10 this was not the case at all, zones were installed based off the global zones package set. There was not an internet requirement. This was a big step backward in both OpenSolaris and now Solaris 11 express. Another shortcoming was the lack of sparse root zones. All zones are now whole root zones.

A cool feature that was touted was the Crossbow network virtualization project. With Crossbow you can use dladm create vnic to create virtual network cards. This allows you to hand a virtual network card into a local zone and let it operate as though it was a physical card. To elaborate, one shortcoming in Solaris 10 was that your network cards inside of the local zones were not able to be fully controlled unless you released it from the global zone and set ip type=exclusive. The exclusive network card would then be handed into the local zone and along with it came an entire ip stack. With this new network virtualization strategy it allows you to create 892 virtual network cards out of 1 physical network card. The virtual network cards will have independent network stacks. This means that your virtual nics can be setup for different ipfilter rule sets, mac addresses, and best of all, independent routing tables.
A major complaint I had with Solaris 10 was that when sharing the network card between the global and a local zone, there was only one routing table, and it resided in the global zone. You could not successfully put a local zone in a different subnet without adding a route for that subnet into the global routing table. The virtual networking scenarios started to get out of hand with splitting up 4 e1000g cards into 4 parts each creating 16 and then bonding one virtual interface from each physical interface for load balancing traffic across all 4 cards. Also there was some talk about QoS on the virtual networking interfaces and possibly even ratio balancing with a mechanism that sounded like the Fair Share Scheduler for networking.

Another feature that made people sit up a little higher in their seats was the mention of native Active Directory integration and CIFS built in to the operating system at the kernel level. This means that you can now take your ZFS filesets and publish them to windows machines using one command share cifs /mount/point . There was also mention of binding file shares such as these directly to AD for permissions. The command was something such as smbadmin bind domain name1, domain name 2. The ease of setup and potential management power via ZFS make this one of the best features in a lackluster list of changes. Imagine being able to wield the power of ZFS file systems presenting them as file stores for the domain. This would give the flexibility of ZFS with the usability for business environments.

Along with native CIFS and AD connectivity ZFS gets 2 new capabilities. The first of which is dedupe. The de-duplication should help speed up transfers and shrink the storage footprint by eliminating duplication of files. That might not seem like a big deal but imagine the storage savings on a server with 20 zones.

The other new ZFS feature is encryption. This feature will make all the security minded people smile from ear to ear. You can now encrypt your ZFS storage pool and nobody can read it without your permission. But wait, theres more... You can also encrypt at the fileset level which extends this capability even further. Now you can setup ZFS filesets and dedicate them to different zones and allow them to be encrypted individually where even the global zone cannot access them without the proper decryption keys. That means you can ensure privacy between zones that share a system keeping everyone honest, even the global zone administrator.

The last feature that I can remember was the new structure for user account roles. The root user is now just a role on the server and not an actual account. However that works right. The root privileges are then assigned to basic user accounts I'm guessing through an interface similar to RBAC and pfexec in Solaris 10. It's like sudo but you don't have to type sudo. I like the thought of restricting the root user role from a security standpoint but I don't know how people will react to this. Although you can now delegate administration between regular users on a case per case basis, someone has to maintain all these profiles which might turn into a nightmare. It would be cool to allow user1 to administer zones 1 and 2 and let user 2 administer zone 3 but that seems like a lot of RBAC work.

In summary, The Solaris 11 express lunch and learn trip was definitely educational. However, I think that Solaris 11 express overall was not very impressive. Some of the features in Solaris 11 seem to be outright copies of linux. The apt-get package management with the grub menus are quite handy to have but rely too heavily upon fetching files directly from Oracle. The virtual networking features do address some of the shortcomings found in Solaris 10 containers. The root account as a role seems like a good idea but might not be very practical. Someone still has to have the power to assign roles for users to perform root level actions, who does that now? It used to be a job for root but who knows how that will work. Finally the ZFS updates paired with native CIFS and Active Directory capabilities seem great. This feature might be a solution without a problem however. Does the functionality of ZFS justify purchasing Solaris for the corporate environment? That has yet to be seen.

I find myself choosing CentOS over Solaris more and more often these days. The fact that you are forced to have support contracts just to run Solaris on your system kind of knocks it out of contention when it comes to picking the best bang for your buck. Solaris 11 express looks a whole lot like linux except the pricetag. This version of Solaris did not make me think I have to have it the minute it comes out. On the contrary, this version of Solaris had me looking for the exit. Solaris 10 is solid and should have been considered ahead of it's time. Solaris 11 is more like the end of the line.

Finally, I must say that the woman who gave the presentation did an excellent job. She fielded questions from the audience and you could definitely tell she wasn't just another Oracle sales zombie. She knew her stuff and was quite impressive. The presentation was nice but the fact that she was actually running Solaris 11 on the laptop being used to present put her over the top. Although my frustrations with Oracle have to do with a difference in philosophies it was not through any fault of the presenter. She was much like me, a "doer", someone who gets the job done. It was not her fault that Oracle is a terrible company to do business with.

Thanks for reading my rambles.

Technology Certifications

2010-12-30T21:29:00.000-08:00

The current state of the Information Technology field is more competitive than ever. The number of job seekers far outweighs the number of jobs available. Currently IT employment is harder and harder to obtain. New job seekers continue to enter the market but the overall number of opportunities are shrinking. This is definitely a sellers market so to speak. In order to compete against other job seekers you really have to make yourself stand out in a crowd.

Over saturation of prospective employees has allowed businesses to set qualifications at an all time high. The possibility of getting employed without experience is not looking good. Recent graduates hoping to land a job might have a hard time achieving their goal. Companies are looking to consolidate job duties into positions that can perform multiple functions. Sure there are still jobs out there that allow you to specialize in a specific area but more often than not you will need to possess a wide range of skills. Programmers are expected to know more than one language or maybe even some back end administration. The competitiveness of job seekers has propagated this new trend and it doesn't look like it will go away any time soon.

So how might you differentiate yourself during these cut throat days of working in the IT field? One way to make yourself stand out in the crowd is through certifications. A 4 year college degree is a great thing and a wonderful starting point. After graduation the next step is real world employment. The problem is most companies want someone who has experience and you can't obtain experience without being employed. Just getting a company to call you back once they look at your resume has become difficult.

Certifications in the technology field can give you the edge needed to get your foot in the door and start your career. A industry recognized certification can help validate your level of comprehension in the eyes of an employer. A certification can be the difference between getting a call and getting a thanks but no thanks letter in the mail. There are a large number of certifications provided by a vast amount of vendors and organizations. Being certified in a specific technology gives potential employers a "security blanket" in a way. Your certification validates your skill set and automatically lets people know that at least you know what your doing to some extent.

Obtaining certifications can be a daunting task. Some certs will require a long list of exams which measure various levels of your comprehension. You will need to study the material and most likely work with the specific technology enough to understand various intricacies. The nice thing about becoming certified is that you only need time and the money to take the exams. There are some certifications that strictly require hands on experience, however, most of them you can obtain as long as you have enough money to sit for the exam.

All certifications are not created equal. Since there are multiple vendors offering various certs some are more marketable than others. If you hope to work on computers then perhaps the A+ certification would be of interest for you. However if you want to work with computer networks then perhaps the Network+ cert is more appropriate. Although an employer looking to hire someone to work on their network would probably prefer a CCNA instead.

A system administrator might hold the MCTS certification which would make them a strong candidate for an available job. Then they are informed they did not get the job because someone who holds the MCITP has applied for the position. If you were wanting to be a Linux administrator you might obtain a variety of certifications such as Linux+, LPIC, or RHCE.

The number of certifications can be overwhelming. Whatever you choose to do in the IT field a certification certainly cannot hurt. There are some in the industry who view certifications as merely a piece of paper but there are also those who view them as a required level of understanding. To help yourself stand out in the crowd becoming certified is an excellent challenge.

If you have the opportunity to continue your education and obtain various certifications then take full advantage. I personally am quite satisfied with my current employer but that does not stop me from pursuing more certifications. Currently I hold the SCSA for Solaris 9 & 10, Security+, and C|EH certifications. I hope to one day obtain the CISSP but it will not be easy by any means.

I encourage you to work towards obtaining certifications for yourself. The fact that employers prefer and a large amount of job seekers have obtained certs should be a wake up call. These pieces of paper are becoming more important than ever before. Work on them for yourself and your future because they can open a lot of doors that might otherwise be closed in this tuff economy. This information might not be anything new to you but you should realize that if you are not trying to get ahead you are falling behind.

Linux Process Prioritization

2010-01-29T21:27:00.000-08:00

It can become annoying while waiting on your Linux system to complete a long process. Whatever the process might be you can help speed things along and give more cpu shares to your task. The top command lets you see the current processes running on your Linux machine. One of the columns you will see is the PR which stands for priority.

The lower the PR number the more cpu shares your process will get. The way to manipulate process priorities is with the nice and renice commands. For example, I have VirtualBox running an installation on my system. The top command is reporting alot of free cpu % because VirtualBox is getting it's resources capped due to the current priority.

sudo renice -20 pid

The pid will need to be the id of the process you are wanting to manipulate. In this case we are running renice and setting a priority of -20 (the lower the better) on our process id. Once complete our PR value changes from 20 to 0 and our NI value changes to -20. This dedicates more cpu power to our task and will hopefully cut down on the time it takes for our process to complete.

The same thing can be done to lower the importance of a process.

sudo renice 20 pid

The command above will raise the priority of the process matching our pid. The effect of raising the PR value will cause the process to get less system resources. This can be handy if your running a large task and want to use the system for other things at the same time.

Please note that nice and renice are common Linux/Unix tools however the syntax of the command is not always the same. The example above was from an Ubuntu system. On other distrobutions you might have to add flags such as -n or -p to make this command work. When in doubt check your manpages

man renice

Solaris 10 installation

2010-01-29T21:12:00.000-08:00

After fighting with the shortcomings of OpenSolaris I have decided to install Solaris 10 inside of VirtualBox. Once the installation is complete I will have a running instance of Solaris 10 with a ZFS root file system. This virtual machine will be used to create future articles regarding the magical things you can do with Solaris.

The Solaris 10 installation is straight forward and much like any common Linux distrobution. You are asked a few questions about your system and then presented with an installation type. I chose the entire distrobution option in order to get a graphical desktop on this virtual machine. If this was a production system I would have selected the core installation option which is a much smaller package set. If you do choose the core option for your system you will have to add in additional packages from the installation media if you want to use features such as zones.

The downside to choosing the entire distrobution is the added packages that you most likely won't need or use. These packages then get inherited by zones when you create them. This adds to the package counts for your local zones when they are created. When it is time to perform system patching you will need to account for extra time on systems that have chosen the entire distrobution option. More packages will add to more patches that your system needs to stay up to date and secure. Just some things to think about if you are going to be serious about your Solaris system.

The ZFS root filesystem option must be chosen after booting from the installation media. You will need to specify 3 or 4 for your initial installation choice if you wish to select the ZFS filesystem later on during your system installation. Once completed I will have a virtual machine running Solaris 10 on x86_64 with ZFS. The traditional UFS filesystem will work fine but you will have to setup partitions (slices) for your system. With ZFS the entire disk is allocated to the root pool and can be divided on the fly later on using various system commands to create filesystems under the ZFS root along with other tasks such as applying partition limits.

Oracle now owns the rights to all things SUN. Even the SUN website now redirects to a page containing an oracle header. Oracle has stated they plan to continue investing in Solaris which will most likely "SPARC" growth of this operating system.

China, Microsoft, and why you should be afraid

2010-01-16T14:43:00.000-08:00

Google getting hacked in China has been all over the Internet this last week. There has been speculation that the Chinese government is the party responsible for hacking Google and up to 30 some firms operating in China.

The initial blame went to Adobe but upon further review it was revealed that the hackers gained access to these systems through a 0 day exploit in the Internet Explorer web browser.

First of all......... Google what are you doing using Internet Explorer at work???

Now we have got that out of the way lets take a look at this a little deeper.

The technology sector moves quick and forgets even faster. Had I not been an open source advocate for over 10 years I probably would have forgotten all about the headlines from 2003-2004 when Microsoft GAVE CHINA A COPY OF THE SOURCE CODE! This has been covered before but everyone in today's tech sector must have just forgot. This attack in China against Internet Explorer should not be a surprise by any means. It most likely took them a few years to review the code to find exploits such as the one that was used to compromise and monitor all of these systems.

This attack was noticed and tracked back to the source ( Chinese Government ). The best hacks are the ones which occur without being detected by the victim. How long would this have gone on if it was not discovered?

Other countries are recommending people get rid of Internet Explorer because it has so many security issues. With the code used for the attacks now available online combined with no fix from Microsoft, when will the rest of the world (specifically the United States) learn from these mistakes and leave Microsoft behind?

If this was insightful, click on our ads.

OpenSolaris is a Failure

2009-12-30T14:56:00.000-08:00

Yup... it's official. OpenSolaris is a Failure

Let me start off by saying I am a HUGE fan of Solaris. I am a Sun Certified Systems Administrator for Solaris 9 and Solaris 10. I would choose Solaris/SPARC over Linux/x86 for mission critical enterprise applications all day long. Why, because it is rock solid and it is proven to be reliable. Now as far as OpenSolaris is concerned I consider it to suck and here are a few reasons why.

NO TEXT BASED INSTALLER

Believe it or not you are unable to install OpenSolaris from a text based terminal. You are forced to use the gui-install command to get the system installed. I recently installed VirtualBox on my Ubuntu 9.10 laptop and ran into problems starting the graphical login interface on the OpenSolaris cd that was sent to me directly from Sun. After watching the system hang when trying to render the screen time after time I rebooted and chose the text based terminal option. I figured I could just login through the terminal and run the installation in a ncurses style interface. I was sooo wrong.

After booting off the cd to a text interface I was able to login to the system using the username/ password combination of jack/ jack. Once logged in I was allowed to su - to root using the password opensolaris. However, I was not able to find a method for installing the system onto the hard drive.

I ran the startx command and was greeted with a grey screen with an X for a mouse and was unable to do anything else. Luckily I was able to crash the startx command and search for other options. I attempted to locate some dt commands that were not found on the system. Then I attempted to run xinit and pass the option of gnome-session to the xinit command which did not work. I finally was able to work around this problem because I have many years of Linux under my belt. I started using Linux back before your X settings were autodetected and you were forced to use things such as SuperProbe and XF86Config to setup your graphical environment. The way I was able to finally get OpenSolaris installed was by running the command xorgcfg.

Once xorgcfg ran it created an X environment with the old style configuration setup. However when inside of the xorgcfg session I was able to click on a blank space on the desktop and launch an Xterm. From inside the Xterm I ran the gui-install command an voila... I am now installing OpenSolaris.

Think I'm lying about that... check this out.

Wow.... all those painful nights attempting to configure X have finally paid off for me :)

WHY OH WHY MUST YOU HAVE INTERNET FOR ZONE INSTALLS????

This part is really frustrating and does NOT behave the same way as Solaris. I have attempted to setup a non global zone using the zonecfg command. I issue the create -b statement as to invoke a full-root zone creation. Next I set the zonepath to a directory that I had previously setup and chmoded to 700 permissions. Now when I invoke the zoneadm install command it fails miserably complaining about unable to download from opensolaris.org. FAIL! Why would you ever need to contact opensolaris.org to do a zone install????? This is one of the biggest FAIL moments I have ran across with OpenSolaris. Currently, I am not online with my ethernet card. This creates problems with VirtualBox because I do not have networking functional. However, installing a zone should only copy packages from the global zone into a local container. Why would it ever need to contact the internet to do this?

Here is the proof

Very poor performance by a operating system that attempts to claim a part of the Solaris name. This is not Solaris and it definitely shows. This project has even claimed to be a Linux variant. I will continue to fiddle with OpenSolaris but at this point I am saying that it sucks as a project. When it doesn't just work out of the box then all the features such as dtrace, zfs, zones, etc do not matter at all.

In closing, I was going to sign up at the OpenSolaris forums and try to explain to them how I received a cd directly from Sun and so far it sucks but I decided that it would not be worth my time. Next month, when Oracle finalizes it's purchase of Sun, OpenSolaris will most likely die anyway. I guess I will have to go back to using Solaris x86.... at least it works out of the box.

Slackware Sound Card Problems

2009-12-25T20:44:00.000-08:00

Recently my 4-5 year old laptop bit the dust due to hardware failure. So I have been forced to knock the dust off the old Slackware box and use it as my primary computer. After performing the steps needed to convert this old linux router into my new desktop I have ran into a problem with the sound card.

root@solarislackware > lspci | grep Multimedia
00:1f.5 Multimedia audio controller: Intel Corporation 82801BA/BAM AC'97 Audio (rev 11)

Great... I at least know what the sound card is even though it's not working correctly with this old Slackware 11 installation.

root@solarislackware > modprobe snd-intel8x0
insmod: insmod snd-intel8x0 failed

well... looks like I don't currently have the driver I need for this sound card.

root@solarislackware > modinfo soundcore
description: "Core sound module"
author: "Alan Cox"
license: "GPL"

Well, at least I have the sound core module loaded into my current kernel. Now I need to install the ALSA packages from my old Slackware install cd #1. I put the cd into the drive and mounted the disk to /mnt/cdrom. Next cd /mnt/cdrom/slackware/ and run the following command

root@solarislackware > for i in $(find ./ -name '*alsa*.tgz' -print) ; do installpkg $i; done

The end result is that alsa-driver, alsa-utils, alsa-oss, and alsa-lib all get installed onto the system. Next I ran the alsaconf to config my card, alsamixer command to set my volume levels followed by alsactl store to save my config.

root@solarislackware > alsaconf

root@solarislackware > alsamixer

root@solarislackware > alsactl store

I checked my work by clicking on kmix and when it loaded it was no longer useless. kmix actually has some pretty controls to use and it had found a sound card on my system.

I now have sound on this old computer. I tried to build ALSA from source but it just was not working for me. Luckily I had the Slackware 11 install cd handy and was able to get what I needed from there.

Simple uses for Sed

2009-12-12T00:43:00.000-08:00

Picking up where we left off on the Awk article

We have the following output from a command.

sed@intro > awk ' { print $2" "$1 } ' test.txt
Phone User
555-555-5553 tom
555-555-5552 larry
555-555-5511 daryl

Problem here is the column titles for Phone and User are not aligned with the output information.

Enter Sed

sed@intro > awk ' { print $2" "$1 } ' test.txt | sed 's/Phone User/Phone........User/g'
Phone.............User
555-555-5553 tom
555-555-5552 larry
555-555-5511 daryl

Sed the stream editor is being used to format the output from awk using a search and replace function globally. sed 's/Pattern to match/ What to replace it with/ g'

Simple Awk Usages

2009-12-12T00:31:00.000-08:00

Say that you are logged into a bash terminal session on a local linux box. You have been asked to extract some information from a text file that is on the system. The text file could be 100,000 records long. For this example it has a header line and 3 data lines. The contents of the file are as follows

awk@intro > cat test.txt
User Phone Zip
tom 555-555-5553 55555
larry 555-555-5552 99999
daryl 555-555-5511

Now, the problem that we have is that we need to take this file and re-arrange the information to best fit our needs. The phone number needs to be the first thing that we see followed by the username. The zip code should be left out of this report. How can we easily accomplish this task?

Enter Awk.

awk@intro > awk ' { print $2" "$1 } ' test.txt
Phone User
555-555-5553 tom
555-555-5552 larry
555-555-5511 daryl

That was easy. Awk splits the file into numbered variables for the columns inside of test.txt. Since we want the phone number first we tell awk print $2" "$1 which gives us the second column, a space, and the first column. This job is done, that was easy.

Linux Distrobutions

2009-12-12T00:17:00.000-08:00

Depending on the situation, I use a wide variety of Linux distros to accomplish the task at hand.

For my home laptop I use Ubuntu.

The reason I use Ubuntu is because it just works. It's very easy to maintain and it will interact with almost anything I throw it's way. I have been quite pleased with 9.04 thus far and have been using it exclusively for 3 months or more. It detected all my hardware and has been rock solid. I had to work through a few oddities like the flash player and various media codecs but that is to be expected. I don't have to think twice about this system, it just works.

For my home computer that acts as my router I use Slackware

Slackware is extremely solid. I will do exactly what you tell it to do. The problem is all the time you have to spend setting it up to do what you want it to do. Package management tools like apt-get and yum just don't seem to exist for Slack. You compile alot of things from source and resolve the dependencies yourself. However, once your done you can pretty much walk away from the thing and know that it will keep churning along.

I have a few CentOS boxes I use for various tasks.

CentOS is kind of in the middle between slack and ubuntu. Cent has the friendly tools for package management but you can also build things from source fairly easily. I consider it to be a happy medium between the two.

I have also dabbled with Red Hat before they started charging, mandrake linux, fedora, suse, puppy, knoppix, kubuntu, debian, caldera, and various others from time to time. Each one has it's good and bad points. I would suggest reviewing your options before selecting your distro. Depending on the task at hand, you have alot of tools to choose from

check out distro watch for more options http://distrowatch.com/

Problems I have with CentOS

2009-12-11T23:39:00.000-08:00

Let me start off by saying that I like CentOS. Don't get me wrong. It is basically a free version of RedHat Enterprise Linux. Having said that though, I have encountered a couple of annoyances with the distrobution that I would like to address.

I have not had any first hand experience dealing with RHEL. My complaints about Cent could very likely hold true within RHEL, I do not know for certain. If this happens to be the case please feel free to comment on this article and let me know.

CentOS is your basic rpm based distrobution which is another RedHat spinoff. I have installed Cent on a few different machines and have been maintaining system updates. Yum, which is a very handy tool, is extremely easy to use for system packages. However, one thing I cannot comprehend is the way CentOS package versioning works. This in itself is my main complaint.

For example, you have installed the httpd apache package onto your system. A security update has been released and a new version of apache is available. Yum check-update will inform you that a new version is out and you should update. Using yum update you can easily download the new package and install it on your server. Here is where the problem begins.

The Cent Apache version reports that it is version 2.2.3. However, 2.2.3 is an extremely outdated version of Apache. The latest version acording to the Apache website is 2.2.14. This is definitely a reason for concern. The problem is that the Cent version of Apache 2.2.3 is really equivalent to 2.2.14. The CentOS moderators have applied all the patches needed to step version 2.2.3 up to version 2.2.14. If this is the case why do you still see 2.2.3 you might wonder.

The 2.2.3 package contains all the fixes associated with the new version, they (Cent) merely apply the fixes to the older package and leave the version number. I had a hard time understanding this at first but after working with it for a while I am beginning to comprehend. Even though remotely I detect 2.2.3 it is truly 2.2.14. The problem I have with this has to do with compliance.

For example, say you are an e-commerce site that gets PCI audits. The PCI compliance auditor scans your server and reports that the version of Apache you are running is old, outdated, and contains security problems. We know that this is not true due to the CentOS versioning strategy, however it still pops up on the report and we have to deal with the problem. The same goes for other packages such as kernel files or ssl versions.

Why does Cent feel they should patch and release the old version as opposed to releasing a new updated package which contains the appropriate version number. These type of problems can cause much greif for administrators. Would someone please give me a logical explaination as to why they would update packages in this fashion? It just does not make sense to me at all.

The rpm file might give more detail about the package / version combination that you have installed on your system but that does not really matter. I say it doesn't matter because the security scanners will be coming from external sources and will not have any knowledge of the actual system packages. Only the version reported by the daemon itself will be used for testing.

Another complaint I have regarding Cent has to do with yum. I really like the yum tool for installing packages and system updates. However I have found a few problems using the automated yum installer/updater.

First, I have a system which I had installed apache/php through the yum repositories. A few weeks pass and there are updates for those 2 packages. After applying the updates I find myself looking at 3 php modules that now fail to load. Sure, this is my fault I guess. However, the point of a tool such as yum is to make things as easy as possible. If those packages get updated yum should be intuitive enough to fetch updates for the other packages that are built based on php or Apache. I now receive a size mismatch module load error from php which I have fixed for now by disabling the three modules in question. Why would yum not have knocked this out the box to begin with? The automated tool I am relying on doesn't seem to keep my system packages aligned.

Second, I had to install the rpmforge packages to get anything useful outside the base distro packages. I do not have a problem with that, it is helpful that something such as rpmforge exists. However, I have ran into problems with other packages that I typically use. RKHunter is a very useful tool that I like to install on my linux systems. After installing rpmforge it was very easy to install. yum install rkhunter. boom, just like that after answering y to the prompt I have rkhunter installed. When I attempt to run rkhunter --update it fails miserably based on a null variable error. The rkhunter-update.sh script doesn't seem to locate the version number and throws an exception when it hits an if statement that evaluates version numbers.

This is kind of annoying. It spits out some xml code blurps and dies off. When running the rkhunter -c command it works and runs through the system checklist. It finds a few typical CentOS directories and has a fit about them /dev/.udev as I remember and a few others. If this package has been configured for CentOS then why would you not fix these common problems? It's little things such as these that are a turn off for other people. I have been using Linux for long enough that I can most likely identify and fix the issue, but your average newbie admin would be hitting the wall here and thinking about another solution.

Cent seems to be rock solid, it has some Unix like features such as the sysctl configurations. I think it is a great alternative to paying for RedHat Linux and I will continue to use it. I just have a few problems... that's all.

Nesting commands in a bash shell

2009-12-05T10:59:00.000-08:00

How many levels deep can you run commands under bash?
Using the back tick operator it is possible to execute a command first and pass the result backwards.

bash-magic > more `find /etc/ -depth -name resolv.conf -print`
::::::::::::::
/etc/resolv.conf
::::::::::::::
# Generated by NetworkManager
nameserver 8.8.8.8
nameserver 8.8.4.4

This can come in quite handy when using the command line. The example above execs a find command and passes the output to the input of the more command.

The backticks ` ` can only do one level of depth within the shell. But what happens if you need to string more than 2 commands together? Backticks just will not cut it.

Enter the almighty parentheses ().
bash-magic > ps -ef $(grep $(id))

Here is an example of 3 commands deep within the shell. The ps -ef command calls a subcommand grep which calls a subcommand id. This could have been accomplished using ps -ef | grep `id` but for examples sake we are using parentheses ().

Logging interactive shell sessions to a file

2009-12-05T10:41:00.000-08:00

Recently I wanted to find a way to log everything a user does when they log into my system. For example you have a vendor who might login to one of your systems in order to modify an application. You can see that they have logged in and might be able to find processes they are running using ps -ef… but what if you want a log of the entire session for a specific user.

Here is how we do it.

First I create a subdirectory under /tmp named watch which will be used for storing the log once the user exits the session. We also need to change permissions on the directory so that it is writeable by the account we want to monitor. In the following example I am using remoteuser for the user and remotegroup for the group. Modify these values to fit your needs.

watch-you@my-host > mkdir /tmp/watch
watch-you@my-host > chown remoteuser:remotegroup /tmp/watch/

Now we have the directory setup for the log file we need to put the magic into motion. I fumbled through attempting to set this up using the local users .profile and .bashrc but was running into all kinds of problems when a shell session was invoked. The solution was to put the code into the system wide profile which can be found at /etc/profile

open up /etc/profile with your favorite editor ( if you need to use sudo when opening the file ).

watch-you@my-host > sudo vi /etc/profile
skip to the bottom of the system profile and add the following lines at the very end.

if [ "$USER" == "remoteuser" ]
then
dte=`date +’%Y_%m_%d_%H_%M’`
export dte
/usr/bin/script -q /tmp/watch/$dte-session-$USER.txt && exit
fi

This script checks to see if the current user is “remoteuser” (the one we want to monitor). If it is, then we setup a variable named dte with a timestamp and export it to the shell. Next, we call /usr/bin/script -q /tmp/watch/$dte-session-$USER.txt. This is where the magic happens. The script command is passed the -q (quiet) to supress the end user alert that script has been activated for this session. Next we pass the script command the full path to our log file. The reason for && exit at the end is due to the fact that when the user types exit wanting to leave the shell, the first time they type exit the system only exits the script command. This would alert the remoteuser that something fishy is going on. The && exit forces another exit command to be passed to the shell after the user exits the session. This allows us ( the paranoid system administrator) to avoid detection.

The user logs into the system and script is active. They run a few commands and logout. Once they logout the contents of thier terminal session is written to our file and left for us to review.

ssh remoteuser@my-host
watch-you@my-host > echo “WOW THATS NICE”
WOW THATS NICE
watch-you@my-host > exit

From another session cd into /tmp/watch and see if we have a file.

watch-you@my-host > cd /tmp/watch/
watch-you@my-host > ls
2009_12_05_12_05-session-remoteuser.txt

When we view the file we can see what the user was up to.

watch-you@my-host > more 2009_12_05_12_05-session-remoteuser.txt

watch-you@my-host > echo “WOW THATS NICE”
WOW THATS NICE
watch-you@my-host > exit

There you have it… a dirty way to track user sessions using the script command inside of /etc/profile