Me in IT - Articles

Using "recording" in VI instead of being annoyed

Robert de Bock — Tue, 02 Feb 2010 09:25:43 +0000

Here is a trick you can use in VI if you need to repeat an action multiple times. Imagine you have this file:

hello
Workd
hello
Workd
hello
Workd

You want to change it to read "Hello world!" Here is what you can do in VI:

Go to the first occurrence of what you would like to have changed.
Enter "q" to initiate a recording.
Enter a letter or digit to save the recording under, like "a" or "1".
Do the actions you would like to repeat.
Enter "q" again to stop and save the recording.
Go to the line where you would like to start running the saved recording/macro.
Enter "@" followed by the letter of digit you have saved the recording under, like "a" or "1".

So, now you have learned what this (annoying) "recording" option can be used for!

Debugging an SSL connection

Fred Clausen — Thu, 28 Jan 2010 10:42:43 +0000

Imagine you would like to debug an SSL connection to a box, for example HTTPS. Using telnet or netcat, you are not able to do so, but openssl makes this possible, here is how:

First; connect to a machine:

$ openssl s_client -connect mail.google.com:443

You will be given the certificate details:

CONNECTED(00000003)
depth=2 /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
verify return:1
depth=1 /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
verify return:1
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=mail.google.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mail.google.com
  i:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
 1 s:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
  i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDIjCCAougAwIBAgIQHxn23jXdY6FCkYrVLMCrEjANBgkqhkiG9w0BAQUFADBM
MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg
THRkLjEWMBQGA1UEAxMNVGhhd3RlIFNHQyBDQTAeFw0wOTEyMTgwMDAwMDBaFw0x
MTEyMTgyMzU5NTlaMGkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHFA1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKFApHb29nbGUgSW5jMRgw
FgYDVQQDFA9tYWlsLmdvb2dsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
AoGBANknyBHye+RFyUa2Y3WDsXd+F0GJgDjxRSegPNnoqABL2QfQut7t9CymrNwn
E+wMwaaZF0LmjSfSgRSwS4L6ssXQuyBZYiijlrVh9nbBbUbS/brGDz3RyXeaWDP2
BnYyrVFfKV9u+BKLrebFCDmzQ0OpW5Ed1+PPUd91WY6NgKtTAgMBAAGjgecwgeQw
DAYDVR0TAQH/BAIwADA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnRoYXd0
ZS5jb20vVGhhd3RlU0dDQ0EuY3JsMCgGA1UdJQQhMB8GCCsGAQUFBwMBBggrBgEF
BQcDAgYJYIZIAYb4QgQBMHIGCCsGAQUFBwEBBGYwZDAiBggrBgEFBQcwAYYWaHR0
cDovL29jc3AudGhhd3RlLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3d3dy50aGF3
dGUuY29tL3JlcG9zaXRvcnkvVGhhd3RlX1NHQ19DQS5jcnQwDQYJKoZIhvcNAQEF
BQADgYEAicju7fexy+yRP2drx57Tcqo+BElR1CiHNZ1nhPmS9QSZaudDA8jy25IP
VWvjEgaq13Hro0Hg32ZNVK53qcXwjWtnCAReojvNwj6/x1Ciq5B6D7E6eiYDSfXJ
8/a2vR5IbgY89nq+wuHaA6vspH6vNR848xO3z1PQ7BrIjnYQ1A0=
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=mail.google.com
issuer=/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
---
No client certificate CA names sent
---
SSL handshake has read 1778 bytes and written 343 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
   Protocol  : TLSv1
   Cipher    : AES256-SHA
   Session-ID: 53530BBF94619E255B7956A18D9B9F26241B2A1BF16F30C18C73C88A60200E5F
   Session-ID-ctx:
   Master-Key:
B40F4E1D533F88AF9248E6576CA4E4CFC2C4BD092816DB7EF9D4FE650EA62B4CAC1F23C36892866B40E3502E67D52CF1
   Key-Arg   : None
   Krb5 Principal: None
   Start Time: 1264674178
   Timeout   : 300 (sec)
   Verify return code: 0 (ok)
---

Now you can enter commands in plain text, just as you would using telnet or netcat:

HEAD / HTTP/1.0

Here is what you get:

HTTP/1.0 302 Found
Cache-Control: private
Location: http://www.google.com
Content-Type: text/html; charset=UTF-8
Content-Length: 218
Date: Thu, 28 Jan 2010 10:23:05 GMT
Server: GFE/2.0
X-XSS-Protection: 0

read:errno=0

An easy trick that can also be used to connect to SSL-ed STMP connections, IMAPS, POP3S, etc.

Making an RPM for a shell script.

Robert de Bock — Tue, 12 Jan 2010 10:21:28 +0000

So, you have written an enterprise quality shell script and would like to deploy it on serveral Red Hat based machines? Creating an RPM will make this easy to do. Here are the steps required.

1. Install rpmbuild so you may start to build your own RPMs.
2. Package your shell script into a tar.gz file and move that to /usr/src/redhat/SOURCES/

# tar -cvzf shell-script-0.1.tar.gz shell-script-0.1
# mv shell-script-0.1.tar.gz /usr/src/redhat/SOURCES/

3. Create a .spec file that describes where everything is.

# cat /usr/src/redhat/SPECS/shell-script.spec
Summary: The do it all script. (Enterprise quality)
Name: shell-script
Version: 0.1
Release: 1
URL:     http://meinit.nl
License: GPL
Group: Applications/Internet
BuildRoot: %{_tmppath}/%{name}-root
Requires: bash
Source0: shell-script-%{version}.tar.gz
BuildArch: noarch

%description
A shell script.

%prep
%setup

%build

%install
rm -rf ${RPM_BUILD_ROOT}
mkdir -p ${RPM_BUILD_ROOT}/usr/bin
install -m 755 shell-script.sh ${RPM_BUILD_ROOT}%{_bindir}

%clean
rm -rf ${RPM_BUILD_ROOT}

%files
%defattr(-,root,root)
%attr(755,root,root) %{_bindir}/shell-script.sh

%changelog
* Tue Jan 12 2010 Robert de Bock <robert@meinit.nl>
- Uberscript!

3. Build it!

# rpmbuild --bb /usr/src/redhat/SPECS/shell-script.spec

4. Install it!

# rpm -Uvh /usr/src/redhat/RPMS/noarch/shell-script-0.1.1.noarch.rpm

Ranges in shell scripts

Robert de Bock — Tue, 15 Dec 2009 07:23:33 +0000

I have been admiring the people who know how to use ranges in shell scripts. These people are faster and more fluent on the Linux command line than anybody without knowledge of ranges could be.

Here are some ranges or patters that you could use.

A sequence of characters, in this case 1 to 10, printed on one line.

$ echo "file{1..9}"
file1 file2 file3 file4 file5 file6 file7 file8 file9
$ echo file{s..z}
files filet fileu filev filew filex filey filez

The order of the range can be found in the man-page for "ascii".

A pattern that describes either a range, or a separated pattern.

$ echo file{1,2,4}
file1 file2 file4

Additional information can be found in the man page of bash, under "Brace Expansion".

Restore hidden files with Apple Mac OS X Time Machine

Robert de Bock — Thu, 03 Dec 2009 09:40:34 +0000

Apple's Time Machine works great, but restoring hidden files (files that start with a dot, like .ssh, .bashrc or .Trash) is difficult, but possible!

Time machine uses the settings as used by the Finder. So first step is to change Finders behaviour, to show hidden files. Execute this command (as a regular user) from within the Terminal.

$ defaults write com.apple.finder AppleShowAllFiles TRUE
$ killall Finder

Now you should be able to see extra files in the finder, like this:

Now start Time Machine and scroll back to the date you were sure a file existed.

Restore it and to hide all thise (annoying) hidden files, revert to original Finder settings:

$ defaults write com.apple.finder AppleShowAllFiles FALSE
$ killall Finder

Nagios time check using SNMP

Robert de Bock — Wed, 25 Nov 2009 08:26:21 +0000

When you would like to retrieve the remotely configured time using SNMP and compare it to see how accurate the time is, here is a script to help you out.

This setup does not specifically require NTP to be running on the hosts that are checked, it just requires that the time is correct. Virtual machines for example are advised to have the appropriate "tools" installed to synchronize time. NTP is not desirable for virtual machines.

(Parts of the script are borrowed from http://spielwiese.la-evento.com/xelasblog/archives/27-SNMP-hrSystemDate....)

This is the graph that is created:

The script:

#!/bin/sh

# Nagios plugin to report time difference as received via SNMP compared to the local time.
# Make sure the machine this script runs on (poller/nagios host) is using NTP.

usage() {
 # This function is called when a user enters impossible values.
 echo "Usage: $0 -H HOSTADDRESS [-C COMMUNITY] [-w WARNING] [-c CRITICAL] [-v VERSION]"
 echo
 echo " -H HOSTADDRESS"
 echo "     The host to check, either IP address or a resolvable hostname."
 echo " -C COMMUNITY"
 echo "     The SNMP community to use, defaults to public."
 echo " -v VERSION"
 echo "     The SNMTP version to use, defaults to 2c."
 echo " -w WARNING"
 echo "     The amount of seconds from where warnings start. Defaults to 60."
 echo " -c CRITICAL"
 echo "     The amount of seconds from where criticals start. Defaults to 120."
 exit 3
}

readargs() {
 # This function reads what options and arguments were given on the
 # command line.
 while [ "$#" -gt 0 ] ; do
  case "$1" in
   -H)
    if [ "$2" ] ; then
     host="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -C)
    if [ "$2" ] ; then
     community="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -w)
    if [ "$2" ] ; then
     warning="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -c)
    if [ "$2" ] ; then
     critical="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -v)
    if [ "$2" ] ; then
     version="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   *)
    echo "Unknown option $1."
    echo
    shift
    usage
   ;;
  esac
done
}

checkvariables() {
 # This function checks if all collected input is correct.
 if [ ! "$host" ] ; then
  echo "Please specify a hostname or IP address."
  echo
  usage
 fi
 if [ ! "$community" ] ; then
  # The public community is used when a user did not enter a community.
  community="public"
 fi
 if [ ! "$version" ] ; then
  # Version 2c is used when a user did not enter a version.
  version="2c"
 fi
 if [ ! "$critical" ] ; then
  critical="120"
 fi
 if [ ! "$warning" ] ; then
  warning="60"
 fi
}

getandprintresults() {
 # This converts the date retreived from snmp to a unix time stamp.
 rdatestring=$( snmpget -v $version -c $community $host HOST-RESOURCES-MIB::hrSystemDate.0 | gawk '{print $NF}' )

 if [ ! "$rdatestring" ] ; then
  echo "Time difference could not be calculated; no time received."
  exit 3
 fi

 rdate=$( echo $rdatestring | gawk -F',' '{print $1}' )
 rtime=$( echo $rdatestring | gawk -F',' '{print $2}' | gawk -F'.' '{print $1}' )
 cldate=$( echo $rdate | gawk -F'-' '{printf("%4i",$1)}; {printf("%02i",$2)}; {printf("%02i",$3)};' )
 cltime=$( echo $rtime | gawk -F':' '{printf("%02i",$1)}; {printf("%02i",$2)}; {printf(" %02i",$3)};' )
 rdate_s=$( date -d "$cldate $cltime sec" +%s )
 ldate_s=$(date +'%s')
 
 # If the calculated difference is negative, make it positive again for comparison.
 difference=$(($rdate_s - $ldate_s))
 if [ "$difference" -lt 0 ] ; then
  positivedifference=$(($difference*-1))
 else
  positivedifference=$difference
 fi
 
 if [ "$positivedifference" -gt "$critical" ] ; then
  echo "Time difference is more than $critical seconds: $difference|diff=$difference"
  exit 2
 fi
 
 if [ "$positivedifference" -gt "$warning" ] ; then
  echo "Time difference is more than $warning seconds: $difference|diff=$difference"
  exit 1
 fi
 
 echo "Time difference is less than $warning seconds: $difference|diff=$difference"
 exit 0
 }

# The calls to the different functions.
readargs "$@"
checkvariables
getandprintresults

To implement it in Nagios, add these sniplets to nagios.cfg. (or any other applicable nagios file.)

The service for a group.

define service{
        hostgroup_name                  Servertype_Linux
        service_description             time
        _SERVICE_ID                     1856
        use                             SNMP-time
}

The service template.

define service{
        name                            SNMP-time
        service_description             time
        use                             generic-service
        check_command                   check_snmp_time!$_HOSTSNMPCOMMUNITY$!120!60
        max_check_attempts                      30
        normal_check_interval           5
        retry_check_interval            1
        notification_interval           0
        register                                0
}

The command.

define command{
        command_name                    check_snmp_time
        command_line                    $USER1$/check_snmp_time -H $HOSTADDRESS$ -C $ARG1$ -c $ARG2$ -w $ARG3$
}

Optimize only fragmented tables in MySQL

Robert de Bock — Tue, 17 Nov 2009 15:38:36 +0000

When you are using MySQL, you will (likely) have tables that can be fragmented. In MySQL terms this is called "OPTIMIZE".

You could simply OPTIMIZE every table in every database, but during an OPTIMIZE, the tables are locked, so writing is not possible.

To minimize the time that MySQL will be locked (and results cannot be written), here is a script that checks fragmentation of every table of every database. Only if a table is fragmented, the table is OPTIMIZED.

#!/bin/sh

echo -n "MySQL username: " ; read username
echo -n "MySQL password: " ; stty -echo ; read password ; stty echo ; echo

mysql -u $username -p"$password" -NBe "SHOW DATABASES;" | grep -v 'lost+found' | while read database ; do
 mysql -u $username -p"$password" -NBe "SHOW TABLE STATUS;" $database | while read name engine version rowformat rows avgrowlength datalength maxdatalength indexlength datafree autoincrement createtime updatetime checktime collation checksum createoptions comment ; do
  if [ "$datafree" -gt 0 ] ; then
   fragmentation=$(($datafree * 100 / $datalength))
   echo "database.$name is $fragmentation% fragmented."
   mysql -u "$username" -p"$password" -NBe "OPTIMIZE TABLE $name;" "$database"
  fi
 done
done

Result will look something like this:

MySQL username: root
MySQL password:
...
database.cache_filter is 19% fragmented.
meinit.cache_filter	optimize	status	OK
database.cache_page is 35% fragmented.
meinit.cache_page	optimize	status	OK
...

You may comment out that line with OPTIMIZE TABLE in it, if you are just interested in seeing the fragmentation.

Failover on OpenBSD is so easy to setup using carp!

Robert de Bock — Wed, 11 Nov 2009 13:16:42 +0000

I am not the first (and last) to write about carp, the failover/vip/floating-IP solution OpenBSD is using. Many articles describe this topic including a very complete answer to a frequently asked question about carp.

If you are not familiar with IP failover situations; in case of carp/pulse/HSRP/VIP, an IP "floats" between different machines. One machine actually answers request to received packets, so this is an solution that knows of a MASTER of ACTIVE node .

A CARP interface (which is not physical) is bound to a physical interface. The physical interface advertises statuses so other CARP interfaces know about each other.

You can bind almost any service to a CARP interface, some examples are:

DNS
HTTP
NTP
Proxy/Squid

Services that store data/stadia locally are not very suitable for a CARP solution. Examples are: DHCP (because leases are stored localy), MySQL/PostgreSQL (because data is stored on a physical local storage) and SSH (because you can never be sure what machine you are connecting to.

Here is how to set it up. On both boxes add a file /etc/hostname.carp0 with this content:

inet 192.168.1.123 255.255.0 192.168.1.255 vhid 1 pass SeCrEt carpdev em0

Remember to activate the interface like this: (All your network cards will be (re-) configured!)

# sh /etc/netstart

In this case, 192.168.1.123 is the floating IP address and em0 is the physical device that carp0 is running on. Be aware that the other server's carpdev should be connected to the same LAN.

Now that this is done, you may access services on the newly created CARP device's IP address. You may also specifically bind applications to only the CARP device.

You may check the status using ifconfig: (Please not the "carp: MASTER" part, it tells you this machine is the master, all others are "BACKUP".)

# ifconfig carp0
carp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:00:5e:00:01:02
        priority: 0
        carp: MASTER carpdev em0 vhid 1 advbase 1 advskew 0
        groups: carp
        inet6 fe80::200:5eff:fe00:102%carp0 prefixlen 64 scopeid 0x5
        inet 192.168.1.123 netmask 0xffffff00 broadcast 192.168.1.255

One limitation I found; you can not have run dhclient on a carp interface, you will need to assign an IP address to the carp device. Please be aware that this would be a very odd setup; DHCP in a failover interface.

Your Soekris OpenBSD as a OpenVPN appliance

Robert de Bock — Wed, 21 Oct 2009 12:50:28 +0000

I have an existing network at home, but would like to be able to connect to it using a VPN every now and then. This enables me to access the fileserver, printer and so on.

My network contains an Apple Time Capsule as a nat router, an ethernet modem provided by my cable company Ziggo and devices such as laptops, that use the network.

A Soekris box I had lying around meets all requirements perfectly for a VPN-server. Here is how to set it up.

1. Forward UDP port 1194 from your router to your soekris box.

This one is easy enough, on Apple Mac OS X and a Time Capsule (or Airport Express) open AirPort Utility on your Mac, select the Time Capsule, click Manual Setup.
Go to Internet - NAT
Select the box "Enable NAT Port Mapping Protocol" and click on "Configure Port Mappings..."

Click on the "+" to add a portmapping. OpenVPN uses UDP port 1194, so map it from the "Public UDP Port(s)" to the "Private UDP Port(s)" on the "Private IP Address" of your soekris box. Fill in "OpenVPN" in the next "Description" field.

Finish your router configuration by pressing "Update". N.B. The network connection will be gone for a minute or two.

2. Install OpenVPN

I assume OpenBSD is already running on your Soekris box, otherwise check out how to install your soekris box with OpenBSD.
Add the package "openvpn". A dependency "lzo" will be added automatically.

3. Configure OpenVPN

Create a directory /etc/openvpn/keys:

soekris # mkdir -p /etc/openvpn/keys

And create the file /etc/openvpn.conf with this content:

port 1194
proto udp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key                                  
dh /etc/openvpn/keys/dh1024.pem
# This is the network that lives on the tun0 device.
# My regular network uses 10.0.1.0/24, so using
# 10.0.2.0/24 seems pretty logical.
server 10.0.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# When clients connect, tell them that 10.0.1.0/24 can
# be reached through this tunnel. (You may also set this on the,
# client instead of "broadcasting" this...
push "route 10.0.1.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user _openvpn
group _openvpn
persist-key
persist-tun
status openvpn-status.log
verb 3

4. Create OpenSSL certificates

This is quite an abstract step. It boils down to this: on the server you will create a certificate authority (ca) key and certificate, also you will create a key and certificate for each client connecting and sign them using your newly create certificate authority. The certificate from the certificate authority (ca.crt) and client (client1.crt) and the key for the client (client1.key) will be distributed to all clients. That's a mouth full, but here is how to do it in steps:

soekris # cp -Rip /usr/local/share/example/openvpn/easy-rsa /etc/openvpn
soekris # cd /etc/openvpn/easy-rsa/2.0
soekris # cat vars
export EASY_RSA="`pwd`"
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"
export KEY_CONFIG="/etc/openvpn/easy-rsa/2.0/openssl.cnf"
export KEY_DIR="/etc/openvpn/keys"
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"
export KEY_SIZE=1024
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY="NL"
export KEY_PROVINCE="UT"
export KEY_CITY="Utrecht"
export KEY_ORG="Me in It Consultancy"
export KEY_EMAIL="robert@meinit.nl"

N.b. Please change the KEY_ values to match your personal settings.

Now execute these steps, as stolen from The OpenVPN homepage.

soekris # . vars
soekris # ./clean-all
soekris # ./build-ca
soekris # ./build-key-server server
soekris # ./build-key client1
soekris # ./build-key client2
soekris # ./build-key client3
soekris # ./build-dh

Once again; send the newly created file /etc/openvpn/keys/ca.crt, /etc/openvpn/keys/client1.crt and /etc/openvpn/keys/client1.key to the machine using the vpn connection.

5. Configure the OpenBSD Packet Filter

This step enables client to reach your local network using network address translation. At the bare minimum, add this rule to your pf configuration in /etc/pf.conf

nat pass on sis0 from !(sis0) to any -> (sis0)

sis0 is a physical interface that connects the Soekris box to my local area network.

Also, make sure the packet filter is enabled and is using your pf.cofn

soekris # pfctl -e
soekris # pfclt -f /etc/pf.conf

And finally make sure it works after a reboot:

soekris # echo "ps=yes" >> /etc/rc.conf.local

6. Start OpenVPN on the server

Wow, almost there, let's start the software:

soekris # /usr/local/sbin/openvpn --config /etc/openvpn/server.conf --key /etc/openvpn/keys/server.key

Some debugging information will scroll down your screen.

7. Make sure OpenVPN starts at boot time

Add these lines to your /etc/rc.local.

# Add your local startup actions here.

echo " openvpn"
/usr/local/sbin/openvpn --config /etc/openvpn/server.conf --key /etc/openvpn/keys/server.key >> /var/log/openvpn.output &

echo '.'

8. Configure the client(s)

I use Mac OS X to connect to OpenVPN. You will have to install some extra software, your choices are:

Tunnelblick - (Free) Tunnelblick is a ready-to-use graphical OpenVPN client for Mac OS X
Viscosity - is an OpenVPN client for Mac, providing a rich Cocoa graphical user interface for creating, editing, and controlling VPN connections.

For now I am using the trail version of Viscosity because it looks great. Check out the screenshots below.

Managing a Linux Virtual Server

Robert de Bock — Mon, 31 Aug 2009 12:03:09 +0000

When you have setup an LVS you will need to administer it. Here are the tools you can use.

Discover what machine is the master.

# ipvsadm

A list of active services and it's IP-addresses will be printed on the active master.

Or, check /var/log/messages for a line like this:

pulse[$pid]: STARTING PULSE AS BACKUP

This clearly shows you the machine is a backup.

Failover from one machine to another.

You could simple reboot the active machine. Otherwise, stop the service pulse for a moment on the active server. The backup will discover this and configure the floating IP.
On the active machine, issue:

# /etc/init.d/pulse stop
# sleep 60
# /etc/init.d/pulse start

Add/delete a Virtual Service or Real Server.

Use the piranha web interface, located on port 3636 of either one of the load balancers. Remember to copy /etc/sysconfig/ha/lvs.cf to the backup machine as well.
After you have altered the configuration, restart pulse on the active machine. (Be aware; this makes services unavailable for a couple of seconds.

# ipvsadm
[services are printed]
# /etc/init.d/pulse restart
# ipvsadm
[services should be printed in a couple of seconds.]

Making a loadbalancer with CentOS using Linux Virtual Server

Robert de Bock — Mon, 24 Aug 2009 10:06:54 +0000

When you are new to all terminology Red Hat is using, it can be challenging to understand what actions to take to create a simple load-balancer with Linux. Here is some information to get you started.

Read more on the CentOS Virtual Server Administration pages.

Terminology:

piranha This is a package that provides a configuration interface for setting up lvS.
ipvs The name of the module that allows a load-balancing on Linux.
ipvsadm A package (and a command) that makes administrating ipvs possible. Be aware, you either user piranha-gui or /etc/sysconfig/ipvsadm to configur ipvs.
LVS Linux Virtual Server - the project name of all tools used in this document.
pulse A service (/etc/init.d/pulse) that runs on both active and backup machine and opens a port to make checking possible. piranha-gui configures everything, pulse actually activates all configurations.
nanny A process started by pulse to monitor the realservers.
nat Network Address Translation. A common combination with LVS. In case NAT is uses, the loadbalancer/director/LVS accepts traffic on one the VIP and sends traffic to the realservers. Be aware, the current implementation of ipvsadm does not properly use Source NAT, it currently does not rewrite the source address.
direct routing A method of routing available in LVS. Traffic is received on the VIP, sent through to the realservers. The realservers receive the traffic as if it was sent to the VIP, so the VIP must be configured on the realservers. To avoid arp-caches to register the wrong MAC-address-IP-address combination, a few "tricks" must be done.
wlc Weighted Least Connections, an algorithm to balance load to realservers.
VIP Virtual IP. The IP-address the service is configured on.
RIP Real server IP. The IP-address of a real-server.
realserver The server providing the acual service. This can be Linux, Windows, whatever.

Here is an overview of a possible setup:

Steps to finish before eternal succes:

Install piranha-gui

# yum install piranha-gui

(modify 172.16.0.0/24 to whatever network you are using on the realserver network.)

Configure services

# chkconfig httpd on
# chkconfig piranha-gui on
# chkconfig pulse on
# sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/' /etc/sysctl.conf
# echo "*nat
:PREROUTING ACCEPT [46:3346]
:POSTROUTING ACCEPT [431:32444]
:OUTPUT ACCEPT [431:32534]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [4186:1094786]
:FORWARD ACCEPT [729:111992]
:OUTPUT ACCEPT [4266:388099]
-A FORWARD -i eth1 -j ACCEPT
COMMIT" > /etc/sysconfig/iptables
# chkconfig iptables on
# sed -i 's/SELINUX=enabled/SELINUX=disabled/' /etc/sysconfig/selinux

Configure via webinterface

Execute these steps to be able to use the piranha-gui web interface:

# service httpd start
# piranha-passwd
# service piranha-gui start 

Open a browser and open your servers IP-address, port 3636. URL looks something like this: http://192.168.202.50:3636

Synchronize /etc/sysconfig/ha/lvs.cf

You will need to have the piranha configuration the same on both machines. Here are some hints. Do this on both machines, just switch the IP-address.

# ssh-keygen
# scp .ssh/id_rsa* 192.168.202.110:./.ssh/
# cp .ssh/id_rsa.pub .ssh/authorized_keys

Now you should be able to connect to both machines without using a password.

# cat update-lvs.cf 
#!/bin/sh

copiedserialno=$(grep serial_no /tmp/lvs.cf | awk '{ print $NF }')
runningserialno=$(grep serial_no /etc/sysconfig/ha/lvs.cf | awk '{ print $NF }')

if [ "$copiedserialno" -gt "$runningserialno" ] ; then
 mv /tmp/lvs.cf /etc/sysconfig/ha/lvs.cf
fi
# crontab -l
* * * * * /usr/bin/scp /etc/sysconfig/ha/lvs.cf 192.168.1.46:/tmp > /dev/null
* * * * * /root/update-lvs.cf

Reboot the server.

To activate all changes, simply reboot the load-balancer.

Really minimal HOWTO for loadbalancing on CentOS 5.3 using ipvsadm

Robert de Bock — Thu, 20 Aug 2009 11:04:50 +0000

There are quite a few howto's for LVS, but all of them are quite extensive. To be honest; you'll need to read them at some point, but for now let's try to make a very minimal howto for setting up LVS.

Step 1: Install and configure a few settings.

Configure the director/loadbalancer to have two NIC's. One side on a routable network, the other side connected to the machine running the services, called realservers.

# chkconfig ipvsadm on
# sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/' /etc/sysctl.conf
# sysctl -p

If you want your realservers to be able to use the internet, execute these lines on the director. Replace YOURREALSERVERLAN for the network address of the network where the real servers are located, for example. 192.168.1.0

# iptables -A POSTROURING -s YOURREALSERVERSLAN/24 -j MASQUERADE
# service iptables save

Step 2: Tell IPVS how to configure itself for HTTP.

Fill in the blanks for PUBLICIP and REALSERVERIP. If you would like to add more servers to this virtual server, just repeast the last line a few times, changing the REALSERVERIP every time.

# echo "-A -t PUBLICIP:80" > /etc/sysconfig/ipvsadm
# echo "-a -t PUBLICIP:80 -r REALSERVERIP -m" >> /etc/sysconfig/ipvsadm
# service ipvsadm start

Step 3: Test it.

From a machine other then the redirector and/or the realserver, visit the ipaddress of your virtual ip.

N.B. I have spent quite some time trying to access the loadbalancer from the loadbalancer; this does not work.

Zabbix on OpenBSD

Robert de Bock — Fri, 14 Aug 2009 05:55:36 +0000

Installing and using the monitoring tool Zabbix on OpenBSD is quite simple. Take just these steps to get started.

Step 1: Install a few packages.

Use pkg_add to add these packages: (Versions could change over time.)

curl-7.19.3
gettext-0.17p0
jpeg-6bp3
libiconv-1.12
libidn-1.11
libxml-2.6.32p2
net-snmp-5.4.2.1p1
php5-core-5.2.8p0
php5-gd-5.2.8-no_x11
php5-pgsql-5.2.8
png-1.2.33
postgresql-client-8.3.6
postgresql-server-8.3.6
t1lib-5.1.0p1

Follow all hints the package manager tells you.

Step 2: Configure some items.

Make sure the apache daemons is started at boot time. (/etc/rc.conf.local)

Modify PHP to allow longer execution times and set the timezone:

$ grep max_execution_time /var/www/conf/php.ini
max_execution_time = 300
$ grep date.timezone /var/www/conf/php.ini
date.timezone = Europe/Amsterdam
$ sudo pkill httpd
$ sudo /usr/sbin/httpd

Step 3: Compile and install Zabbix.

Get the latest release of Zabbix, untar it and use these options to configure it:

./configure --enable-server --with-pgsql --with-net-snmp --with-libcurl --enable-agent

Use "make install" to install all items. The binaries will be placed in /usr/local.

Import database schemes as described in the Zabbix documentation, chapter 2.4.3: "Zabbix Server"

Create /etc/zabbix/zabbix_agentd.conf and /etc/zabbix/zabbix_server.conf by copying them from the untarred zabbix release:

# mkdir /etc/zabbix
# cp zabbix-1.6.5/misc/conf/zabbix_agentd.conf /etc/zabbix
# cp zabbix-1.6.5/misc/conf/zabbix_server.conf /etc/zabbix

Set DBName DBUser and DBPassword in /etc/zabbix/zabbix_server.conf.

Step 4: Automatically start Zabbix items.

$ cat /etc/rc.local
#       $OpenBSD: rc.local,v 1.39 2006/07/28 20:19:46 sturm Exp $

# Site-specific startup actions, daemons, and other things which
# can be done AFTER your system goes into securemode.  For actions
# which should be done BEFORE your system has gone into securemode
# please see /etc/rc.securelevel.

echo -n 'starting local daemons:'

# Add your local startup actions here.

if [ -x /usr/local/sbin/zabbix_agentd ] ; then
 echo -n ' zabbix_agentd'
 /usr/local/sbin/zabbix_agentd
fi

if [ -x /usr/local/sbin/zabbix_server ] ; then
 echo -n ' zabbix_server'
 /usr/local/sbin/zabbix_server
fi

echo '.'

Step 5: Install the webfrontend.

You are practically done, now copy the php files and visit your zabbix installation:

# cp -Rip zabbix-1.6.5/frontends/php/* /var/www/htdocs/zabbix/

That's it, not extremely difficult!

Bash completion for Mac OS X

Robert de Bock — Fri, 10 Jul 2009 07:20:20 +0000

If your are using the Terminal application of your Apple computer running Mac OS X, try bash programmable completion. It allow you to use the TAB key more often, for example in scp: (If you are using ssh-keys.)

$ scp shell01:/etc/pa
/etc/pam.d/         /etc/pam_smb.conf   /etc/passwd 
/etc/pam_pkcs11/    /etc/pango/         /etc/passwd- 
$ scp shell01:/etc/pa

The steps to start using this great utility are these:

Download the bash programmable completion .tar.gz file.
In a Terminal on your Apple, untar it. (tar -xvf bash-completion-20060301.tar
Copy the bash_completion shell-script to /etc (sudo cp bash_completion/bash_completion /etc)
Add the bash complation to your login script. (echo ". /etc/bash_completion" >> ~/.profile)
Start a new terminal and see the result!

Using DynDNS for iPhone OS 3.0 without crontab but with launchd

Robert de Bock — Fri, 03 Jul 2009 11:10:08 +0000

Apple iPhone OS 3.0 does not have crontab anymore. You are supposed to use launchd's facilities to execute something at a scheduled interval. Here is an example of a simple script to update the IP-address at DynDNS.org.

The script /var/mobile/update-dyndns.org contains:

#!/bin/sh

host="your-host-name.dyndns.org"
user="your-username"
pass="your-password"

oldip=$(cat /tmp/ip)
wget -o /dev/null -O - http://ip.serverchief.com/ > /tmp/ip
ip=$(cat /tmp/ip)

if [ "$oldip" != "$ip" ] ; then
 echo -n "$(date) "
 echo $(/usr/local/bin/wget -O - "http://$user:$pass@members.dyndns.org/nic/update?hostname=$host&wildcard=NOCHG&bacakmx=NOCHG"  2> /dev/null)
fi

The file /var/LaunchDaemons/org.dyndns.update.plist contains:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>  
	<key>Label</key>
	<string>org.dyndns.update</string>
	<key>ProgramArguments</key>
	<array> 
		<string>~/mobile/dyndns-update.sh</string>
	</array>
	<key>StartCalendarInterval</key>
	<dict>  
		<key>Minute</key>
		<integer>3</integer>
	</dict>
</dict>
</plist>

And execute:

# launchctl load org.dyndns.update.plist

Now your IP will be update every 3-rd minute. Have fun!

A shell script to measure network throughput on Linux machines.

Robert de Bock — Tue, 30 Jun 2009 11:58:53 +0000

Here is a shell script to see how many (kilo-, mega-, giga-, terra-) bytes pass a network interface. The output looks like this:

$ ./network-traffic.sh --help
Usage: ./network-traffic.sh [-i INTERFACE] [-s INTERVAL] [-c COUNT]

-i INTERFACE
    The interface to monitor, default is eth0.
-s INTERVAL
    The time to wait in seconds between measurements, default is 3 seconds.
-c COUNT
    The number of times to measure, default is 10 times.
$ ./network-traffic.sh         
Monitoring eth0 every 3 seconds. (RXbyte total = 706 Mb TXbytes total = 1 Gb)
RXbytes = 104 b	TXbytes = 194 b
RXbytes = 80 b	TXbytes = 188 b
RXbytes = 52 b	TXbytes = 146 b
RXbytes = 689 b	TXbytes = 8 Kb
RXbytes = 52 b	TXbytes = 146 b
RXbytes = 52 b	TXbytes = 146 b
RXbytes = 52 b	TXbytes = 146 b
RXbytes = 52 b	TXbytes = 146 b
RXbytes = 4 Kb	TXbytes = 4 Kb
RXbytes = 716 b	TXbytes = 5 Kb

Here is the script:

#!/bin/sh

usage(){
 echo "Usage: $0 [-i INTERFACE] [-s INTERVAL] [-c COUNT]"
 echo
 echo "-i INTERFACE"
 echo "    The interface to monitor, default is eth0."
 echo "-s INTERVAL"
 echo "    The time to wait in seconds between measurements, default is 3 seconds."
 echo "-c COUNT"
 echo "    The number of times to measure, default is 10 times."
 exit 3
}

readargs(){
 while [ "$#" -gt 0 ] ; do
  case "$1" in
   -i)
    if [ "$2" ] ; then
     interface="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -s)
    if [ "$2" ] ; then
     sleep="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -c)
    if [ "$2" ] ; then
     counter="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   *)
    echo "Unknown option $1."
    echo
    shift
    usage
   ;;
  esac
 done
}

checkargs(){
 if [ ! "$interface" ] ; then
  interface="eth0"
 fi
 if [ ! "$sleep" ] ; then
  sleep="3"
 fi
 if [ ! "$counter" ] ; then
  counter="10"
 fi
}

printrxbytes(){
 /sbin/ifconfig "$interface" | grep "RX bytes" | cut -d: -f2 | awk '{ print $1 }'
}

printtxbytes(){
 /sbin/ifconfig "$interface" | grep "RX bytes" | cut -d: -f3 | awk '{ print $1 }'
}

bytestohumanreadable(){
 multiplier="0"
 number="$1"
 while [ "$number" -ge 1024 ] ; do
  multiplier=$(($multiplier+1))
  number=$(($number/1024))
 done
 case "$multiplier" in
  1)
   echo "$number Kb"
  ;;
  2)
   echo "$number Mb"
  ;;
  3)
   echo "$number Gb"
  ;;
  4)
   echo "$number Tb"
  ;;
  *)
   echo "$1 b"
  ;;
 esac
}
  
printresults(){
 while [ "$counter" -ge 0 ] ; do
  counter=$(($counter - 1))
  if [ "$rxbytes" ] ; then
   oldrxbytes="$rxbytes"
   oldtxbytes="$txbytes"
  fi
  rxbytes=$(printrxbytes)
  txbytes=$(printtxbytes)
  if [ "$oldrxbytes" -a "$rxbytes" -a "$oldtxbytes" -a "$txbytes" ] ; then
   echo "RXbytes = $(bytestohumanreadable $(($rxbytes - $oldrxbytes)))	TXbytes = $(bytestohumanreadable $(($txbytes - $oldtxbytes)))"
  else
   echo "Monitoring $interface every $sleep seconds. (RXbyte total = $(bytestohumanreadable $rxbytes) TXbytes total = $(bytestohumanreadable $txbytes))"
  fi 
  sleep "$sleep"
 done
}

readargs "$@"
checkargs
printresults

iPhone OS 3.0 Bluetooth tethering with Mac Book Pro

Robert de Bock — Mon, 22 Jun 2009 16:06:13 +0000

Here is a step by step guide to help you get online with your iPhone using OS 3.0.

Go to this page: http://www.iphone-notes.de/mobileconfig/ It will send you an email. Download that email on you iPhone. It contains a profile to enable Tethering.
Now go to your iPhone preferences, under Network you can enable tethering, activate it
On your Mac Book Pro, go to the bluetooth preferences. Add your iPhone. I had to press "continue" on my Mac Book pro after accepting the pairing request on the iPhone. Waiting here resulted in an error.
On you Mac Book Pro, connect to your iPhone using bluetooth
Now on your Mac Book Pro, under Network Preferences, add a connection: "Bluetooth PAN".

You can now tether using your iPhone!

For tethering, an extra network interface is added, in my case "en5". To see what the IP-address of your connection is, open a Terminal and type:

ifconfig en5

In my case I see that I am using a private class (192.168.20.0/24) IP address. That means that T-Mobile in the Netherlands is NAT-ing my connection. Not a problem, but connecting back to my laptop is not possible from the internet.

Convert a human readable date to epoch with a shell script on OpenBSD and Mac OS X

Robert de Bock — Mon, 25 May 2009 12:25:11 +0000

Dates can be quite challenging. Especially if you systematically want to use dates, for example to compare what date is older.

If you would like to convert this date into epoch, take these steps.

$ # The first step is to print the date.
$ echo "2009/05/25 18:34:30;"
2009/05/25 18:34:30;
$ # This step is to strip the /-es.
$ echo "2009/05/25 18:34:30;" | sed 's%/%%g'
20090525 18:34:30;
$ # This step removes the space
$ echo "2009/05/25 18:34:30;" |  sed 's%/%%g;s% %%g'
2009052518:34:30;
$ # This step removes the trailing :30;.
$ echo "2009/05/25 18:34:30;" | sed 's%/%%g;s% %%g;s%:..;%%'
2009052518:34
$ # This step removes the :.
$ echo "2009/05/25 18:34:30;" | sed 's%/%%g;s% %%g;s%:..;%%;s%:%%g'
200905251834
$ # Finally feed that output to the "date" command.
$ date -j "+%s" $(echo "2009/05/25 18:34:30;" | sed 's%/%%g;s% %%g;s%:..;%%;s%:%%g')
1243269240

On Mac OS X you'd have to use this command:

$ date -j -f date -j -f "%Y/%m/%d %T" "2009/10/15 04:58:06" +"%s"
1255575486

Configure soekris as a OpenBSD wireless NAT router.

Robert de Bock — Fri, 22 May 2009 07:51:40 +0000

I use a Soekris device, bought mine for € 70,- with a wireless network interface. (wi0)
Besides that interface, this "machine" has two other ports; sis0 going to the modem and sis1 is not used, but any computer may be connected.

How difficult would it be to use this machine as a router using OpenBSD? Not difficult at all!

First install your Soekris with OpenBSD.

Now login and configure a few things.

# vi /etc/rc.conf.local
# Start NTP, it syncs time and requires very little maintenance.
ntpd_flags="-s"
# Start a DNS server.
named_flags=
# Clients should receive an IP-address. DHCP will only listen on sis1 and wi0, the network
# interfaces where computers will connect on. Don't start DHCP on your "modem-port".
dhcpd_flags="sis1 wi0"
# Enable Packet Filter.
pf=
# Here are the rules for PF.
pf_rules=/etc/pf.conf

Configure named, the DNS server.

# cat /var/named/etc/named.conf                                                                                       
// $OpenBSD: named-simple.conf,v 1.9 2008/08/29 11:47:49 jakob Exp $
//
// Example file for a simple named configuration, processing both
// recursive and authoritative queries using one cache.


// Update this list to include only the networks for which you want
// to execute recursive queries. The default setting allows all hosts
// on any IPv4 networks for which the system has an interface, and
// the IPv6 localhost address.
//
acl clients {
        localnets;
        ::1;
};

options {
        version "";     // remove this to allow version queries

        listen-on    { any; };
        listen-on-v6 { any; };

        empty-zones-enable yes;

        allow-recursion { clients; };
};

logging {
        category lame-servers { null; };
};

// Standard zones
//
zone "." {
        type hint;
        file "etc/root.hint";
};

zone "localhost" {
        type master;
        file "standard/localhost";
        allow-transfer { localhost; };
};

zone "127.in-addr.arpa" {
        type master;
        file "standard/loopback";
        allow-transfer { localhost; };
};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
        type master;
        file "standard/loopback6.arpa";
        allow-transfer { localhost; };
};

zone "lan.meinit.nl" {
        type master;
        file "master/lan.meinit.nl";
};

zone "wifi.meinit.nl" {
        type master;
        file "master/wifi.meinit.nl";
};

zone "1.168.192.in-addr.arpa" {
        type master;
        file "master/1.168.192.in-addr.arpa";
};

zone "2.168.192.in-addr.arpa" {
        type master;
        file "master/2.168.192.in-addr.arpa";
};

Now add all zones.

# cat lan.meinit.nl                                                                                                             
$ORIGIN lan.meinit.nl.
$TTL 6h

@       IN      SOA     lan.meinit.nl. root.meinit.nl. (
                        1       ; serial
                        1h      ; refresh
                        30m     ; retry
                        7d      ; expiration
                        1h )    ; minimum

                        NS      soekris.lan.meinit.nl.
soekris                 A       192.168.1.1
32                      A       192.168.1.32
33                      A       192.168.1.33
34                      A       192.168.1.34
35                      A       192.168.1.35
36                      A       192.168.1.36
37                      A       192.168.1.37
38                      A       192.168.1.38
39                      A       192.168.1.39
40                      A       192.168.1.40
41                      A       192.168.1.41
42                      A       192.168.1.42
43                      A       192.168.1.43
44                      A       192.168.1.44
45                      A       192.168.1.45
46                      A       192.168.1.46
47                      A       192.168.1.47
48                      A       192.168.1.48
49                      A       192.168.1.49
50                      A       192.168.1.50
51                      A       192.168.1.51
52                      A       192.168.1.52
53                      A       192.168.1.53
54                      A       192.168.1.54
55                      A       192.168.1.55
56                      A       192.168.1.56
57                      A       192.168.1.57
58                      A       192.168.1.58
59                      A       192.168.1.59
60                      A       192.168.1.60
61                      A       192.168.1.61
62                      A       192.168.1.62
63                      A       192.168.1.63
64                      A       192.168.1.64
65                      A       192.168.1.65
66                      A       192.168.1.66
67                      A       192.168.1.67
68                      A       192.168.1.68
69                      A       192.168.1.69
70                      A       192.168.1.70
71                      A       192.168.1.71
72                      A       192.168.1.72
73                      A       192.168.1.73
74                      A       192.168.1.74
75                      A       192.168.1.75
76                      A       192.168.1.76
77                      A       192.168.1.77
78                      A       192.168.1.78
79                      A       192.168.1.79
80                      A       192.168.1.80
81                      A       192.168.1.81
82                      A       192.168.1.82
83                      A       192.168.1.83
84                      A       192.168.1.84
85                      A       192.168.1.85
86                      A       192.168.1.86
87                      A       192.168.1.87
88                      A       192.168.1.88
89                      A       192.168.1.89
90                      A       192.168.1.90
91                      A       192.168.1.91
92                      A       192.168.1.92
93                      A       192.168.1.93
94                      A       192.168.1.94
95                      A       192.168.1.95
96                      A       192.168.1.96
97                      A       192.168.1.97
98                      A       192.168.1.98
99                      A       192.168.1.99
100                     A       192.168.1.100
101                     A       192.168.1.101
102                     A       192.168.1.102
103                     A       192.168.1.103
104                     A       192.168.1.104
105                     A       192.168.1.105
106                     A       192.168.1.106
107                     A       192.168.1.107
108                     A       192.168.1.108
109                     A       192.168.1.109
110                     A       192.168.1.110
111                     A       192.168.1.111
112                     A       192.168.1.112
113                     A       192.168.1.113
114                     A       192.168.1.114
115                     A       192.168.1.115
116                     A       192.168.1.116
117                     A       192.168.1.117
118                     A       192.168.1.118
119                     A       192.168.1.119
120                     A       192.168.1.120
121                     A       192.168.1.121
122                     A       192.168.1.122
123                     A       192.168.1.123
124                     A       192.168.1.124
125                     A       192.168.1.125
126                     A       192.168.1.126
127                     A       192.168.1.127

# cat wifi.meinit.nl                                                                                                            
$ORIGIN wifi.meinit.nl.
$TTL 6h

@       IN      SOA     wifi.meinit.nl. root.meinit.nl. (
                        1       ; serial
                        1h      ; refresh
                        30m     ; retry
                        7d      ; expiration
                        1h )    ; minimum

                        NS      soekris.wifi.meinit.nl.
soekris                 A       192.168.2.1
32                      A       192.168.2.32
33                      A       192.168.2.33
34                      A       192.168.2.34
35                      A       192.168.2.35
36                      A       192.168.2.36
37                      A       192.168.2.37
38                      A       192.168.2.38
39                      A       192.168.2.39
40                      A       192.168.2.40
41                      A       192.168.2.41
42                      A       192.168.2.42
43                      A       192.168.2.43
44                      A       192.168.2.44
45                      A       192.168.2.45
46                      A       192.168.2.46
47                      A       192.168.2.47
48                      A       192.168.2.48
49                      A       192.168.2.49
50                      A       192.168.2.50
51                      A       192.168.2.51
52                      A       192.168.2.52
53                      A       192.168.2.53
54                      A       192.168.2.54
55                      A       192.168.2.55
56                      A       192.168.2.56
57                      A       192.168.2.57
58                      A       192.168.2.58
59                      A       192.168.2.59
60                      A       192.168.2.60
61                      A       192.168.2.61
62                      A       192.168.2.62
63                      A       192.168.2.63
64                      A       192.168.2.64
65                      A       192.168.2.65
66                      A       192.168.2.66
67                      A       192.168.2.67
68                      A       192.168.2.68
69                      A       192.168.2.69
70                      A       192.168.2.70
71                      A       192.168.2.71
72                      A       192.168.2.72
73                      A       192.168.2.73
74                      A       192.168.2.74
75                      A       192.168.2.75
76                      A       192.168.2.76
77                      A       192.168.2.77
78                      A       192.168.2.78
79                      A       192.168.2.79
80                      A       192.168.2.80
81                      A       192.168.2.81
82                      A       192.168.2.82
83                      A       192.168.2.83
84                      A       192.168.2.84
85                      A       192.168.2.85
86                      A       192.168.2.86
87                      A       192.168.2.87
88                      A       192.168.2.88
89                      A       192.168.2.89
90                      A       192.168.2.90
91                      A       192.168.2.91
92                      A       192.168.2.92
93                      A       192.168.2.93
94                      A       192.168.2.94
95                      A       192.168.2.95
96                      A       192.168.2.96
97                      A       192.168.2.97
98                      A       192.168.2.98
99                      A       192.168.2.99
100                     A       192.168.2.100
101                     A       192.168.2.101
102                     A       192.168.2.102
103                     A       192.168.2.103
104                     A       192.168.2.104
105                     A       192.168.2.105
106                     A       192.168.2.106
107                     A       192.168.2.107
108                     A       192.168.2.108
109                     A       192.168.2.109
110                     A       192.168.2.110
111                     A       192.168.2.111
112                     A       192.168.2.112
113                     A       192.168.2.113
114                     A       192.168.2.114
115                     A       192.168.2.115
116                     A       192.168.2.116
117                     A       192.168.2.117
118                     A       192.168.2.118
119                     A       192.168.2.119
120                     A       192.168.2.120
121                     A       192.168.2.121
122                     A       192.168.2.122
123                     A       192.168.2.123
124                     A       192.168.2.124
125                     A       192.168.2.125
126                     A       192.168.2.126
127                     A       192.168.2.127

# cat 1.168.192.in-addr.arpa                                                                                                    
$ORIGIN 1.168.192.in-addr.arpa.
$TTL 6h

@       IN      SOA     lan.home.meinit.nl. root.meinit.nl. (
                        1       ; serial
                        1h      ; refresh
                        30m     ; retry
                        7d      ; expiration
                        1h )    ; minimum

                        NS      soekris.lan.meinit.nl.
1                       PTR     soekris.lan.meinit.nl.
$GENERATE       32-127  $       PTR     $.lan.meinit.nl.

# cat 2.168.192.in-addr.arpa                                                                                                    
$ORIGIN 2.168.192.in-addr.arpa.
$TTL 6h

@       IN      SOA     wifi.meinit.nl. root.meinit.nl. (
                        1       ; serial
                        1h      ; refresh
                        30m     ; retry
                        7d      ; expiration
                        1h )    ; minimum

                        NS      soekris.home.meinit.nl.
1                       PTR     soekris.wifi.meinit.nl.
$GENERATE       32-127  $       PTR     $.wifi.meinit.nl.

And setup the DHCP server.

# cat /etc/dhcpd.conf                                                                                                           
subnet 192.168.1.0 netmask 255.255.255.0 {
        option domain-name "lan.meinit.nl";
        option domain-name-servers 192.168.1.1;
        option routers 192.168.1.1;
        range 192.168.1.32 192.168.1.127;
}
subnet 192.168.2.0 netmask 255.255.255.0 {
        option domain-name "wifi.meinit.nl";
        option domain-name-servers 192.168.2.1;
        option routers 192.168.2.1;
        range 192.168.2.32 192.168.2.127;
}

Finally configure your PF in /etc/pf.conf:

# wan is the interface to which the modem is connected.
wan = sis0
# This is an extra interface, not in use right now, but you could connect a cable.
lan = sis1
# This is the (Prism 2) wireless network card. Clients will connect to this interface mostly.
wifi = wi0

scrub in all

nat on $wan from !($wan) to any -> ($wan)

Now beter reboot to activate all changes. (Sure you could start every daemon by hand...)

Using Virtualbox on Mac OS X

Robert de Bock — Wed, 20 May 2009 10:01:53 +0000

Virtualbox is a open source virtualization tool that runs on many operating systems, including Mac OS X It's free, simple and it works, but you'll need to be aware of how to use it. Here are my experiences with different settings.

The default network driver makes an airport interface (en1) on Mac OS X unstable. So; either map the virtual interface to a wired network interface (en0) or use another driver. The Intel PRO/1000 MT Desktop (8254OEM) works fine for me, the PCnet-FAST II (Am78C973) does not work well for me.

For FreeBSD guest operating systems, the default IDE disk causes timeouts. Better use a SATA emulation, IDE emulation causes errors during the install.

Have fun using Virtualbox, after all, its free!

Update Soekris bios firmware from your Apple Mac OS X machine

Robert de Bock — Fri, 15 May 2009 06:50:15 +0000

When you are using a Soekris, a new bios is published every now and then. Because I had to search-copy-try-paste quite some time to get my Apple Mac OS X to upload the most recent Soekris (net4521) bios.

Here is what you need:

Hardware: a USB-to-serial cable. I used a IOGear CUG232A.
Software: a driver for that USB-to-serial cable.
Firmware: A recent firmware for your soekris.
Software: lsr. from the lrzsz project.

I downloaded b4501_133.bin.

The driver for the IOGear USB-to-serial cable creates a device called /dev/tty.PL2303-00002006. The Soekris will most likely run on 19200 bps. If your Soekris spits out unreadable text, try a speed like 9600. If you are able to access the Soekris bios, you can always change the serial speed using "set ConSpeed=19200" for example.

# cu -l /dev/tty.PL2303-00002006 -s 19200
POST: 012345689bcefghipsajklnopqr,,,tvwxy

comBIOS ver. 1.33  20080103  Copyright (C) 2000-2007 Soekris Engineering.

net45xx

0064 Mbyte Memory                        CPU Elan SC520 133 Mhz 

Pri Mas  LEXAR ATA FLASH                 LBA Xlt 999-32-63  1007 Mbyte

Slot   Vend Dev  ClassRev Cmd  Stat CL LT HT  Base1    Base2   Int 
-------------------------------------------------------------------
0:00:0 1022 3000 06000000 0006 2280 00 00 00 00000000 00000000 
0:17:0 104C AC51 06070000 0107 0210 10 3F 82 A0000000 020000A0 10
0:17:1 104C AC51 06070000 0107 0210 10 3F 82 A0001000 020000A0 10
0:18:0 100B 0020 02000000 0107 0290 00 3F 00 0000E101 A0002000 11
0:19:0 100B 0020 02000000 0107 0290 00 3F 00 0000E201 A0003000 05

 1 Seconds to automatic boot.   Press Ctrl-P for entering Monitor.

> download -

Start sending file using XMODEM/CRC protocol.
~+./lsz -X b4501_133.bin
Sending b4501_133.bin, 608 blocks: Give your local XMODEM receive command now.
Bytes Sent:  77824   BPS:1745                            

Transfer complete

File downloaded succesfully, size 608 Blocks.

> flashupdate
Updating BIOS Flash ,,,,,,,,,,,,..,,,,.. Done.

> reboot

Good, you are done!

Install your Soekris (or any other machine) with OpenBSD using OpenBSD

Robert de Bock — Wed, 13 May 2009 14:55:31 +0000

To install OpenBSD on your Soekris machine, (or any other machine) take these steps to create an OpenBSD installation server. This instruction help you setup a DHCP, TFTP and HTTP server required for a network installation of OpenBSD.

This setup creates an autonomous install server, that can be disconnected from the internet. During the setup this machine is connected to the internet to install all required software.

First; install an OpenBSD machine. This may either be virtual or physical. Just install the default set of software and make sure it's connected to the internet. (It does not matter if you are using DHCP or a static IP configuration.)

This instruction is based on OpenBSD 4.5, but will likely work for future releases.

Install a DHCP server.

# export PKG_PATH=http://mirror.roothell.org/pub/OpenBSD/4.5/packages/i386/
# pkg_add isc-dhcp-server
isc-dhcp-server-3.1.1: complete

Configure the DHCP server. This step is very dependent of your network configuration, so don't just copy paste everything, but try to understand (using man pages) what's configured.
My /etc/dhcpd.conf looks like this now:

option  domain-name "home.meinit.nl";
option  domain-name-servers 192.168.1.1;

subnet 192.168.1.0 netmask 255.255.255.0 {
        range 192.168.1.32 192.168.1.127;
        host pxe-client {
                hardware ethernet 02:03:04:05:06:07;
                filename "pxeboot";
                next-server 192.168.1.1;
        }
}

Be aware; the "hardware ethernet" address mentioned above is not correct. It needs to be set to what the MAC address is of the machine you would like to install.

Make sure it start by modifying /etc/rc.conf.local, like this:

# echo "dhcpd_flags=" >> /etc/rc.conf.local

Enable the TFTP server in /etc/inetd.conf: (It's installed by default on an OpenBSD installation!)

tftp            dgram   udp     wait    root    /usr/libexec/tftpd      tftpd -s /tftpboot

Create some directories and restart inetd:

# pkill -HUP inetd

Now get the kernel that is being used when booting over the network and retreive the PXE boot code.

# cd /tftpboot
# ftp http://mirror.roothell.org/pub/OpenBSD/4.5/i386/bsd.rd
Trying 88.198.153.75...
Requesting http://mirror.roothell.org/pub/OpenBSD/4.5/i386/bsd
100% |*******************************************************************************|  5461 KB    00:06
Successfully retrieved file.
# echo "set tty com0 
stty com0 19200
boot bsd.rd" > etc/boot.conf
# ftp http://mirror.roothell.org/pub/OpenBSD/4.5/i386/pxeboot
Trying 88.198.153.75...
Requesting http://mirror.roothell.org/pub/OpenBSD/4.5/i386/pxeboot
100% |*******************************************************************************| 53276       00:00    
Successfully retrieved file.

Enable a HTTP server.

# echo "httpd_flags=" >> /etc/rc.conf.local

Now get all required software sets you'd like to offer.

# ftp http://mirror.roothell.org/pub/OpenBSD/4.5/i386/index.txt
Trying 88.198.153.75...
Requesting http://mirror.roothell.org/pub/OpenBSD/4.5/i386/index.txt
100% |*******************************************************************************|   266       00:00    
Successfully retrieved file.
# cat index.txt | grep -v '.iso' | tee index.txt | while read file ; do 
>  ftp http://mirror.roothell.org/pub/OpenBSD/4.5/i386/"$file"          
> done
100% |********************************************************************************|   106 KB    00:00    
100% |********************************************************************************| 22356       00:00    
100% |********************************************************************************|  1022       00:00    
100% |********************************************************************************| 46941 KB    00:27    
100% |********************************************************************************|  6539 KB    00:02    
100% |********************************************************************************|  6558 KB    00:03    
100% |********************************************************************************|  5461 KB    00:02    
100% |********************************************************************************| 44724       00:00    
100% |********************************************************************************|  2048       00:00    
100% |********************************************************************************| 87874 KB    00:59    
100% |********************************************************************************|   501 KB    00:00    
100% |********************************************************************************|  1440 KB    00:00    
100% |********************************************************************************|  1440 KB    00:00    
100% |********************************************************************************|  1440 KB    00:00    
100% |********************************************************************************|  2555 KB    00:00    
100% |********************************************************************************|  8032 KB    00:03    
100% |********************************************************************************|  2866 KB    00:02    
100% |********************************************************************************| 53276       00:00    
100% |********************************************************************************|  9761 KB    00:07    
100% |********************************************************************************| 75214       00:01    
100% |********************************************************************************| 34745 KB    00:26    
100% |********************************************************************************| 19478 KB    00:11    
100% |********************************************************************************|  2698 KB    00:06

Now that everything is ready, reconfigure your network to use a static IP which is usable in the network you are planning this installation server.

NOTA BENE: you have enabled a DHCP server, if your network already uses a DHCP server, clients might get an IP address from your DHCP server, which is likely incorrect and/or conflicting with the exiting DHCP server. Normally you'd like to use one DHCP server per network.

# echo "inet 192.168.1.1 255.255.255.0 192.168.1.255" > /etc/hostname.em0
# echo "lookup file" > /etc/resolv.conf
# reboot

Now in the freshly installed client, modify/create /etc/boot.conf with this content:

set tty com0 
stty com0 19200

The Soekris uses these setting to be able to access the serial console.

Okay, after your install server has been rebooted, go and boot an uninstalled client.

For soekris users; connect your console cable, see the machine boot.

You will see that it's first getting the pxeboot code, then the kernel (bsd). When the kernel has booted, select your bootservers IP address to install software from and enter "/" at the server directory question.

Add a permanent static route to Mac OS X

Robert de Bock — Mon, 04 May 2009 08:42:51 +0000

As a reminder for myself, but likely useful for you! If you are in a situation where you'd like to add a static route to you Mac OS X machine, you could issue:

$ sudo route add 10.0.0.0/8 192.168.1.1

This commands tells the TCP/IP stack to sent traffic with the destination 10.*.*.* via 192.168.1.1. But, this command is only active after issuing it and before the next reboot. To "save" this command, make it permanent, you can take these simple steps.

$ sudo mkdir /Library/StartupItems/AddRoute
# cd /Library/StartupItems/AddRoute
$ echo "{
        Description     = \"Add static routing tables\";
        Provides        = (\"AddRoutes\");
        Requires        = (\"Network\");
        OrderPreference = \"None\";
}" > StartupParameters.plist
$ echo "#!/bin/sh

# Set up static routing tables 
# Roark Holz, Thursday, April 6, 2006

. /etc/rc.common

StartService ()
{
        ConsoleMessage "Adding Static Routing Tables"
	sudo route add 10.0.0.0/8 192.168.200.15
}

StopService ()
{
        return 0
}

RestartService ()
{
        return 0
}

RunService "$1"" > AddRoutes
$ sudo chmod 755 AddRoutes

Now you should be prepared. After a reboot, the route will be visible. (netstat -rnf inet)

Nagios check for Centreon to create CPU graphs for Linux

Robert de Bock — Fri, 17 Apr 2009 09:14:06 +0000

Centreon is a great front-end for Nagios, the well known monitoring tool.

Nagios only performs "up" and "down" checks, Centreon adds performance graph capabilities.

Centreon comes with many checks to measure values, like traffic on eth0, a ping response time check, an ntp check and so on. Many checks are based on SNMP, so for Linux machines net-snmp should be installed.

What Centreon is missing, is an SNMP check that reports CPU usage and graphs the information. Here is a shell script to get the values for a specified host and return the CPU-idle percentage, CPU-system percentage and CPU-user percentage.

The script depends on a binary snmpget found in the package net-snmp-utils. Install it on the Nagios pollers that perform this check.

This script implements Performance Data as described by Nagios, which is very short means that besides outputting readable data, it also outputs performance data after the pipe ("|") mark, separated by a comma.
The script has been designed to incorporate all described requirements by Nagios plugins.

#!/bin/sh 

# Nagios plugin to report CPU usage on Linux boxes.

usage() {
 # This function is called when a user enters impossible values.
 echo "Usage: $0 -H HOSTADDRESS [-C COMMUNITY] [-w WARNING] [-c CRITICAL] [-v VERSION]"
 echo
 echo " -H HOSTADDRESS"
 echo "     The host to check, either IP address or a resolvable hostname."
 echo " -w WARNING"
 echo "     The percentage of cpu-idle to start warning, defaults to 15."
 echo " -c CRITICAL"
 echo "     The percentage op cpu-idle to reflect a critical state, defaults to 5."
 echo " -C COMMUNITY"
 echo "     The SNMP community to use, defaults to public."
 echo " -v VERSION"
 echo "     The SNMTP version to use, defaults to 2c."
 exit 3
}

readargs() {
 # This function reads what options and arguments were given on the
 # command line.
 while [ "$#" -gt 0 ] ; do
  case "$1" in
   -H)
    if [ "$2" ] ; then
     host="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -w)
    if [ "$2" ] ; then
     warning="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -c)
    if [ "$2" ] ; then
     critical="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -C)
    if [ "$2" ] ; then
     community="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   -v)
    if [ "$2" ] ; then
     version="$2"
     shift ; shift
    else
     echo "Missing a value for $1."
     echo
     shift
     usage
    fi
   ;;
   *)
    echo "Unknown option $1."
    echo
    shift
    usage
   ;;
  esac
done
}

setvariables() {
 # Here is a function to set some default values.
 cpurawidle="UCD-SNMP-MIB::ssCpuRawIdle.0"
 cpurawuser="UCD-SNMP-MIB::ssCpuRawUser.0"
 cpurawsystem="UCD-SNMP-MIB::ssCpuRawSystem.0"
 if [ ! "$warning" ] ; then warning="15" ; fi
 if [ ! "$critical" ] ; then critical="5" ; fi
 tmpdir="/tmp/nagios"
}

checkvariables() {
 # This function checks if all collected input is correct.
 if [ ! "$host" ] ; then
  echo "Please specify a hostname or IP address."
  echo
  usage
 fi
 if [ "$warning" -lt "$critical" ] ; then
  echo "Critical may not be higher than warning. Please modify your critical an warning values."
  echo
  usage
 fi
 if [ ! "$community" ] ; then
  # The public community is used when a user did not enter a community.
  community="public"
 fi
 if [ ! "$version" ] ; then
  # Version 2c is used when a user did not enter a version.
  version="2c"
 fi
 if [ ! -d "$tmpdir" ] ; then
  mkdir "$tmpdir"
  if [ $? -gt 0 ] ; then
   echo "Unknown cannot create $tmpdir!"
   exit 3
  fi
 fi
}

getandprintresults() {
 # First, get all values in one snmpget session. I think this is lighter for
 # the machine that is queried compared to three separated snmpgets.
 snmpget -c "$community" -v "$version" -t 3 "$host" "$cpurawidle" "$cpurawuser" "$cpurawsystem" | while read mib equals type digit ; do
 case "$mib" in
  # This output is returned for the cpuidle value.
  UCD-SNMP-MIB::ssCpuRawIdle.0)
   cpuidlevalue="$digit"
  ;;
  # This output is returned for the cpuuser value.
  UCD-SNMP-MIB::ssCpuRawUser.0)
   cpuuservalue="$digit"
  ;;
  # This output is returned for the cpusystem value.
  UCD-SNMP-MIB::ssCpuRawSystem.0)
   cpusystemvalue="$digit"

   if [ -f "$tmpdir"/"$host".cpuidle ] ; then
    cpuidlediff=$(($cpuidlevalue - $(cat "$tmpdir"/"$host".cpuidle)))
   fi
   echo "$cpuidlevalue" > "$tmpdir"/"$host".cpuidle

   if [ -f "$tmpdir"/"$host".cpuuser ] ; then
    cpuuserdiff=$(($cpuuservalue - $(cat "$tmpdir"/"$host".cpuuser)))
   fi
   echo "$cpuuservalue" > "$tmpdir"/"$host".cpuuser

   if [ ! -f "$tmpdir"/"$host".cpusystem ] ; then
    echo "$cpusystemvalue" > "$tmpdir"/"$host".cpusystem
    echo "First run, gathering data."
    exit 3
   else
    cpusystemdiff=$(($cpusystemvalue - $(cat "$tmpdir"/"$host".cpusystem)))
    echo "$cpusystemvalue" > "$tmpdir"/"$host".cpusystem
   fi

   # Add all differences, so a calculation of the percentage can be made later.
   allcpu=$(($cpuidlediff + $cpuuserdiff + $cpusystemdiff))

   # Now calculate how many percent each value represents.
   cpuidlevalue=$((($cpuidlediff*100)/$allcpu))
   cpuuservalue=$((($cpuuserdiff*100)/$allcpu))
   cpusystemvalue=$((($cpusystemdiff*100)/$allcpu))

   # Now see if any of these percentages is over a threshold.
   if [ "$cpuidlevalue" -lt "$critical" ] ; then
    # First see if it's in a critical state.
    echo "CPU CRITICAL idle value: $cpuidlevalue%|cpuidle=$cpuidlevalue% cpuuservalue=$cpuuservalue% cpusystemvalue=$cpusystemvalue%"
    exit 2
   elif [ "$cpuidlevalue" -lt "$warning" ] ; then
    # Now see if warning applies.
    echo "CPU WARNING idle value: $cpuidlevalue%|cpuidle=$cpuidlevalue% cpuuservalue=$cpuuservalue% cpusystemvalue=$cpusystemvalue%"
    exit 1
   else
    # If neither critical, nor warning apply, it must be OK!
    echo "CPU OK idle value: $cpuidlevalue%|cpuidle=$cpuidlevalue% cpuuservalue=$cpuuservalue% cpusystemvalue=$cpusystemvalue%"
    exit 0
   fi
  ;;
  esac
 done
}

# The calls to the different functions.
readargs "$@"
setvariables
checkvariables
getandprintresults

Don't forget to chmod (755) the script on the Poller(s).

Now go into the Centreon web front end and add a command at:
Configuration - Commands - Add.
I named the check "check_cpu" where the command line is:

$USER1$/check_snmp_cpu -H $HOSTADDRESS$ -C $ARG1$

Bind this check to a service template and bind a hostgroup to the service template. Remember Centreon does not use $USER2$, but $_HOSTSNMPCOMMUNITY$.

Pasting shell scripts from Microsoft Word into Putty

Robert de Bock — Tue, 31 Mar 2009 09:06:32 +0000

As a Linux/UNIX engineer you will have to cope with the strange behaviour of Microsofts products. Microsoft Word replaces a simple double quote (") for an angled quote. Now when you paste that code into Putty, your (angled) quotes are replaced for dots.

To correct this behaviour open Microsoft Word, click Tools then Autocorrection options and on the unselect Smart Quotes. (You may want to disable other "handy" features as well.

Finally, I am able to paste documented code into Putty!

Simple AWK script to show filesystems that are almost full

Robert de Bock — Fri, 13 Mar 2009 09:46:23 +0000

Here is a simple oneliner to show filesystems that are nearly full:

df -k | awk '$4 > 85 {print $7,$4}'

What it does;

df -k - This displays the filesystems and how full they are.
awk '$4 > 85 {print $7,$4}' - This prints the 7th and 4th column, when the 4th column is greater than 85.

An alternative to top for AIX

Robert de Bock — Mon, 09 Mar 2009 10:47:02 +0000

Almost everybody loves the GNU command top. Top displays information about what's going on at your system. Some systems don't provide top, this script can be used as an alternative for top:

#!/bin/sh

# If the shell script is stopped with CTRL+C, the screen
# might need to be sized correctly.
trap 'eval $(resize); exit 2' 2

# A loop to display activity.
while [ 1 ] ; do
 eval $(resize)
 output=$(ps -eF "pcpu time pid user comm" | grep -v TIME | sort -rn | head -$(("$LINES"-2)))
 echo ' %CPU      TIME    PID     USER    COMMAND'
 echo "$output"
 sleep 3
done

Running an Open Source Phone Part 1

Fred Clausen — Fri, 06 Mar 2009 13:43:55 +0000

Introduction - Why do we need an Free Software phone?

As we all know, when purchasing a new phone, it often has a slew of restrictions. On the telephony side, you are usually only allowed to use an authorised type of SIM card in the phone but there are far greater restrictions as to what you can do with the software on the phone. Almost all phones out there use proprietary software and, in the cases where a Free Software kernel is used, it is always hidden away and you can't modify your phone by installing a free GNU/Linux distribution on it since only authorised, signed operating systems will be booted.

Besides the software in the phone not being Free (as in freedom) software, there are often arbitrary restrictions on how you can use the phone. For example, DRM to restrict how you can play the music you have legally purchased, you cannot install you own applications but only applications approved by the Telco and/or phone vendor - think of the iPhone.

I am writing a series of articles in order to share my experiences and hopefully help people get familiar with Free Software on mobile devices, specifically cellular telephones. This first article will focus on a high level introduction to some of the hardware and software available for open source/free software phones. For those interested - I am using a Neo Freerunner running QTextended as my daily phone.

The Hardware

All this Free Software is no good if there is no phone you can install it on so I will now give a non-exhaustive list of the mobile devices I know about on which you can install free software.

The Neo Freerunner

The Neo Freerunner is designed to be an open phone from the ground up - the manufacturing diagrams are published as CAD files which anyone can use as a basis for another phone. The Neo Freerunner is the most promising, truly open phone that I am aware of and has a highly active community developing software for the Neo Freerunner and future phones from Openmoko.

The software on this phone (covered in Part 2) is not quite ready for end-user use but can be used as a daily phone by enthusiasts. That said, I expect that basic functionality will be stable in half a year.

Google G1

The Google G1 is a Linux based phone brought out by Google, it seems they want to compete with the Apple iPhone. The retail G1 is a locked phone that will only run authorised images so no change there. However, you can gain access to the full functionality of your phone in two ways; rooting the phone or buying the developer G1 called the "Android Dev Phone 1". Once this has been done you can proceed to experiment to your hearts content with the underlying Linux system making up the G1 - with some limitations.

The Trolltech Greenphone

The now discontinued Green phone used a software stack called Qtopia created by Trolltech (now owned by Nokia) - the same people who develop the QT toolkit in use by such projects as KDE and countless other, smaller applications.

The idea behind the Greenphone was to promote Qtopia as a mobile development platform and not as an end-user telephone. Trolltech no longer ships the Greenphone and the Qtopia software stack as been renamed to QTextended. QTextended has just released version 4.4.3, which will be the last release of the QTextended platform as this too is being discontinued but a community maintained version will still be available and may even become better than the Trolltech version.

Nokia Internet Tablet

The Nokia N810 supports the running of Open Source software - the main software stack target at this device is the Maemo plaform but it also supports QTextended and Debian GNU/Linux. By installing Debian on the N810 you can access to the vast software repositories available to Debian systems.

iPhone

Yes, you read correctly, you can now run Linux on your iPhone. This project is still in its very early stages and already seems to be laying the groundwork quite well. Definitely worth keeping an eye on. Also, I suspect you will need a jail-broken phone in order to install Linux on your iPhone and Apple may release updates to their boot loader ROM that will make it difficult to install Linux on the iPhone.
Netbooks

And, let's not forget, the ever popular Netbooks being made by seemingly all major computer manufacturers. While not strictly speaking a phone or a "tablet", they are nevertheless very mobile and so I will cover them here. The recent Netbook trend all started with the Asus Eee PC which made people realise that they just need "good enough" computing rather than a super computer on their lap.

One can easily install any Linux distribution on these devices and, when combined with a mobile broadband device (aka "dongle"), you have a powerful, mobile Internet device. Especially useful for those of us that are on call!

A very good history of the Netbook can be found at Arstechnica.

In the next article I will be taking a deeper look at the various Free Software stacks that are available for running on your mobile device. Stay tuned!

Hopeful: Linux professionals will survive the recession

Robert de Bock — Tue, 03 Mar 2009 08:07:33 +0000

Linux professionals (administrators, engineers, architects) will manage during the financial crisis. That's what sites like Cyberciti predict.

It's hard to tell what the impacts of the recession will be for Linux professionals, but here is why "we" should be perfectly fine:

Linux is free - Sure it is, although the "enterprise programs" all cost money when you require support. Be aware that free (as in money) software does not mean installing and maintaining it is free; you need Linux professionals to help out.
Linux is scalable - You can start now for a limited amount of money, when better times arrive, you will be ready to expand your infrastructure.
Linux is stable - Invest some money now to setup infrastructure, when it's done it won't just stop working!
Linux is the way to go - For the server market Linux is very common. This will only grow in the years to come so you will be ready for the future.

Well Linux professional, hope that helps you to manage during these "interesting" times.

Aesthetics of shell scripting

Robert de Bock — Mon, 02 Mar 2009 12:02:31 +0000

Here is the problem; you need to print a single line filled with dashes. Will you just echo 80 dashes or write a beautiful loop for it?

The ease solution

$ echo "--------------------------------------------------------------------------------"

The aesthetic solution

$ n=0 ; while [ $n -lt 80 ] ; do printf "-" ; n=$(($n+1)) ; done ; echo

Both give the same result, but the easy solution is faster. Result from the machine where I am working on:

Test	Easy way	Aesthetics way
Time to execute:	0.000 seconds	0.039 seconds
Bytes on disk	88	70
Complexity level	1	7
System calls	37	657
lines printed in 1 minute	1471371	18318

The numbers show that simplicity is more efficient.