Rainhill Trials

Setting (Long) Expiry Date for IPA User Passwords

2013-01-11T11:18:00.000-08:00

I use Identity, Policy, Audit (IPA) to provide authentication services to my oVirt and Red Hat Enterprise Virtualization environments. By default IPA not only forces passwords for all user accounts to expire at relatively frequent intervals but makes it difficult to turn this behaviour off.

Future versions of IPA are slated to make this functionality configurable on a more granular level but in the meantime here is how I configured all (existing) users in the system to have a password expiry date some time in 2037:

Obtain a Kerberos ticket for the administrative user.

$ kinit admin

Generate an ldif file containing directives to change the krbpasswordexpiration value for each user.
You can use the following script to do this by changing the elements in bold to match your environment.

#!/bin/sh

USERS=`ldapsearch -Y GSSAPI -b "cn=users,cn=accounts,dc=example,dc=com" | grep -o 'uid=[a-z]*' | cut -f 2 -d '='`

touch ./krbpasswordexpiration_all.ldif

for USER in ${USERS}; do

cat >> ./krbpasswordexpiration_all.ldif <<DELIM
dn: uid=${USER},cn=users,cn=accounts,dc=toner-ipa,dc=usersys,dc=redhat,dc=com
changetype: modify
replace: krbpasswordexpiration
krbpasswordexpiration: 20371231011529Z

DELIM

done

Use ldapmodify to log in as the directory manager and run the ldif file to apply the modifications. You will be prompted to enter your directory manager password to complete this step.

$ ldapmodify -x -D "cn=directory manager" -W -vv -f update_krbpasswordexpiration_all.ldif

References:

AQEMU Now Packaged for Fedora

2012-03-13T08:11:00.000-07:00

It has taken some time but my AQEMU package has been accepted by the Fedora Project.

"AQEMU is a GUI to the QEMU and KVM emulators, written in Qt4. The program has a user-friendly interface for setting the majority of QEMU and KVM options."

It is an open source project started by Andrey Rijov and while a little rough around the edges a viable alternative to virt-manager, particularly for KDE Users.

The packages currently exist in the updates-testing repositories for Fedora 15, Fedora 16, and the yet to be formally released Fedora 17. To install the package on your chosen Fedora release run:

# yum install --enablerepo=updates-testing aqemu

If you want to help speed up the process for getting AQEMU into the stable repositories be sure to test the package(s) and login to Bohdi to add karma!

Testing oVirt Engine on Amazon EC2

2011-11-24T10:34:00.001-08:00

Red Hat recently launched an open source virtualization management project called oVirt. This project is based on the source code for their Red Hat Enterprise Virtualization product, including a new web administration interface that will appear in a future release.

Building and deploying the oVirt is, at the moment, quite time consuming. To give people an opportunity to quickly get an instance up and running to have a look at the new user interface I thought I would provide an Amazon Machine Image (AMI) for use on Amazon's EC2 service.

Note that the image is for the oVirt Engine portion of the project only and consists of a very early build of the oVirt code and is not intended for anything other than testing and development use.

The image currently exists in us-east-1a region (Virginia) and identifies as ami-07438b6e and its name is oVirt Engine Appliance. When launching an instance based on the image ensure that you choose an instance type of m1.large or above to ensure enough RAM is available.

You must also use a security profile that allows access to the following ports:

22
8080
8443

As always when using a public image on Amazon EC2 you should also take care to ensure that they are secure. Once the image is running you can view the new web administration by accessing:

http://[MY_AWS_INSTANCE_ADDRESS]:8080/webadmin

The default user is admin with password letmein!. If you intend to leave the instance running then you must change this.

Obviously this image is not a long term solution for creating an oVirt environment with hosts attached on which you can launch virtual machines, but I thought it might assist people with seeing what all the fuss is about!

Installing OwnCloud on Openshift Express PaaS

2011-11-03T15:02:00.000-07:00

Updated Friday May 25th to cover OwnCloud 4!

OpenShift Express is a free Platform as a Service (PaaS) solution provided by Red Hat. It allows developers to quickly and easily deploy their applications on cloud servers while Red Hat handles the management overhead.

Currently OpenShift Express supports applications created in a number of languages including PHP, Java, Ruby and Perl. As well as allowing developers to quickly and easily deploy their own applications OpenShift provides an easily accessible test bed for off the shelf open source web applications.

I am going to demonstrate quickly setting up OwnCloud. OwnCloud is a project aimed at providing users with the same abilities as many commercially backed personal clouds but with the ability to deploy it anywhere you choose.

Today our infrastructure of choice is provided by OpenShift but an OwnCloud installation can just as easily exist or be moved to a virtual private server, or the machine in your basement.

Register and Obtain Client Tools

Register With OpenShift Express, the registration page is available from https://openshift.redhat.com/app/login. As part of the sign-up process you will also be prompted to create a key and install the client tools for OpenShift Express.

Create a Domain

If you did not do so during registration then you need to create an OpenShift domain. At the time of writing each user is permitted one domain name and five applications. The URLs for your applications will take the form:

http://<application_name>-<domain_name>.rhcloud.com/

The rhc-create-domain tool is used to create a domain, providing a name for the domain and your OpenShift login credentials:

$ rhc-create-domain -n <domain_name> -l <login>

The tool prompts you for your password and, assuming it isn't already taken, creates the domain.

Create the Application
Before you can deploy OwnCloud you must create a stub application in the format that OpenShift understands. OpenShift adds application support for programming languages, frameworks, and even databases based on 'cartridges'.

Because OwnCloud is written in PHP we will be using the php-5.3 cartridge to create the application. Then to provide MySQL support we will also add the mysql-5.1 cartridge.

Use the rhc-create-app tool to create the application, providing a name for the application and your OpenShift login credentials. You will also need to provide the password associated with your key, created during registration, to complete application creation.

Note that by default the local copy of the application is created in your current working directory. This is where you will update and deploy your application from.

$ rhc-create-app -a <application_name> -l <login> -t php-5.3

Now use the rhc-ctl-app to add MySQL support.

$ rhc-ctl-app -a <application_name> -l <login> -e add-mysql-5.1

Be sure to take note of the Root User, Root Password, Database Name, and Connection URL of the database.

Install OwnCloud

Change into the directory that was created when you ran rhc-create-app. This directory contains a number of files and directories:

.openshift/
deplist.txt
libs/
misc/
php/
README

Check the README file for a full explanation of what each of these is for. For now we will be concentrating on deploying OwnCloud into the php/ subdirectory.

Change into the php/ subdirectory, download and extract the OwnCloud2 source tarball.

$ wget http://owncloud.org/owncloud-download-4-0-0 -O owncloud-4.0.0.tar.bz2

$ tar -xf owncloud-4.0.0.tar.bz2 --strip-components=1

$ rm owncloud-4.0.0.tar.bz2

Now our local copy is ready to deploy to the OpenShift Express servers. OpenShift Express uses git to facilitate version control and deployment. To deploy we must:

Add the new files to our commit, ensuring the .htaccess file is also added:

$ git add * .htaccess

Commit the new files, entering a commit message when prompted:

$ git commit

Push the commit to the remote server:

$ git push

Now, access your application in a web browser at the address of the form:

http://<application_name>-<domain_name>.rhcloud.com/

The OwnCloud setup wizard will appear.

Enter a Username and Password for your OwnCloud administration account. Remember that this application is running on the public internet and therefore must have a secure password.

Click Advanced and select MySQL as the storage engine. This enables a number of additional options.

These options should be set as follows:

The Data folder should be set to '../../data'. This folder is the location of the persistent data storage for an OpenShift Express application.
The Database user must be set to the database username as returned when adding the MySQL cartridge.
The Database password must be set to the database password as returned when adding the MySQL cartridge.
The Database name must be set to the database name as returned when adding the MySQL cartridge.
The localhost value must be replaced with the appropriate host as returned when adding the MySQL cartridge. This will be in the form of an IP address, the protocol and port information can safely be discarded.

Once you are satisfied with the values entered, click Finish Setup.

Finished!
Assuming all has gone well you will be logged into your newly created OwnCloud installation running on OpenShift Express!

For some hints on what you can actually do with it, see:

http://owncloudtest.blogspot.com/2011/06/what-you-can-do-with-owncoud-today.html

Changing the Primary Display in GNOME 3

2011-09-08T14:56:00.000-07:00

I recently ran into a problem with GNOME 3 and my external monitor. GNOME 3 defaulted to displaying notifications and the activities overlay on what I consider to be my secondary monitor.

Investigating the graphical display configuration tools I was unable to find an option to change this. Luckily xrandr supports the setting of the primary display and GNOME 3 appears to take heed of it. To change primary display:

Run xrandr to list available displays.
Run xrandr --output <display> --primary to set the primary display.

In Fedora 15 the xrandr command is provided by the xorg-x11-server-utils package.

Update: Another viable solution has been posted in the comments. Unlike the one I have posted above it does not need to be done every time you log in. I am not sure how it performs in the event that you disconnect/reconnect the monitor or dock/undock the laptop frequently.

Fedora 15 makes /media a tmpfs

2011-06-14T15:02:00.000-07:00

The /media directory is defined in the Filesystem Hierarchy Standard as containing subdirectories "which are used as mount points for removeable media such as floppy disks, cdroms and zip disks".

Some people, myself included, have been known to use this location to mount more semi-permanent media such as additional hard drives or even network shares below this location. I fully recognise that this was always folly of me, but hey - for a long time it worked.

As of Fedora 15 the /media directory has become a tmpfs by default. This means that among other things it is wiped on reboot. Any devices still plugged in will of course be detected when the system starts and their mounts will re-appear in the directory.

What this means for those of us who have been abusing this area of the filesystem is that our mounts have 'disappeared' since the first reboot after the upgrade.

Simply issuing umount /media as root is enough to temporarily return your mounts to their previous state so that you can move the data to a less controversial location.

An Introduction to Amazon Web Services, Post-presentation Reflections.

2011-06-08T04:58:00.000-07:00

Today I was lucky enough to attend a presentation given by Simone Brunozzi (@simon) who works for Amazon Web Services (AWS). The slides from the presentation are available on slideshare but I thought I would take the time to quickly reflect on a few key points that I took away from it.

Who needs Venture Capital?

The biggest thing I took away from today was that AWS presents an amazing opportunity for small startups to get off the ground without necessarily needing to acquire large amounts of venture capital. Even when venture capital is being sought the value proposition is much more attractive to potential sources of funding than a traditional proposal. Using AWS the funding required can scale appropriately along with the success (or failure) of the venture itself rather than requiring a large outlay up front.

Indistinguishable Experience for End Users

While the list of large, well known, companies using AWS to support their web presence is quite long how many of their users realize the services they use are backed by it? For the most part, ignoring the recent well publicized outage, the user experience of a correctly defined AWS setup is completely indistinguishable to end users from that of a traditionally hosted site. In some instances it may even be better thanks to the use of services like CloudFront!

Everyone has a Unique or Unsolvable Problem

Based on the under currents of some of the questions posed in today's session it seems that many in IT, at least locally here in Australia, still believe that their organisation is somehow unique. Indeed in many cases this may in some small way be true. The problem is that this line of thinking is the precursor to the argument that an organisation's problems cannot possibly be solved by generically designed platform or framework of the day X.

This isn't an attitude unique to today's attendees by any means, and I don't particularly hold it against them either. There are obvious risks attached to a change in platform mix for any established organisation. That said I couldn't help but wonder, given the previous point regarding how invisible AWS is from an end user experience perspective, how many of these same organisations already have competitors leveraging the efficiencies of the cloud and they aren't even aware of it.

Security of Platform

A common thread of concern in the Question and Answer session was what I will refer to as security of platform. That is to ask the question "what is to stop AWS yanking my site at will". The answer unfortunately appears to be "trust us, we wont - it's not in our interests". The only real test of this that has come to light was with regards to WikiLeaks and in that particular case the site was indeed taken off AWS.

Amazon argue that the reason WikiLeaks was removed from AWS was in fact due to the fact that they were clearly not the owners of the content they were serving and thus violated the Terms of Service. Whether or not this is the case it seems that business users are still very much concerned about the ramifications of building their IT infrastructure on top of a platform that can, at least technically, be pulled out from under them at a moments notice.

Along a similar line there is concern that currently there is no Australian region for almost any services provided by AWS. As a result jurisdiction over data stored by Australian companies using these services ultimately resides with foreign governments. For many organizations this is simply unpalatable and often in fact impossible due to legislative requirements.

Unfortunately given Australia's small population and the small number of regions currently available in AWS it seems unlikely that this will be changing any time soon.

Give your desktop a new look with the elementary icon theme

2011-05-16T15:31:00.000-07:00

This post migrated from http://blogs.fedoraproject.org/wp/sgordon/2011/04/03/give-your-desktop-a-new-look-with-the-elementary-icon-theme/

Looking to give your desktop a new look? Try the elementary icon theme. These icons are available in the default Fedora repository for F14. As such they can be installed by issuing the following yum command:

# yum install elementary-icon-theme

To activate the icon theme Gnome users should:

Access System -> Preferences -> Appearance.
With the current overall theme selected click Customize.
Select the Icons tab on the Customize Theme dialog box.
Select elementary or elementary-monochrome from the list provided.
Click Close on both dialog boxes to apply and save the changes.

The instructions for users of other desktop environments such as KDE, XFCE or LXDE will differ. Consult the documentation for your desktop environment of choice if you are unable to find the appropriate settings.

linux.conf.au wrap-up

2011-05-16T15:29:00.000-07:00

This post has been migrated from http://blogs.fedoraproject.org/wp/sgordon/2011/02/08/linux-conf-au-wrap-up/

As I mentioned in my previous post last week I attended linux.conf.au which was this year held in 2011. I thought I might do a quick wrap-up linking not only the presentation I made at the Cloud Mini-conf but also some other presentations I attended during the week which might be of interest to other Fedora users.

A colleague and I presented a talk called Deltacloud - Abstracting for Freedom providing an introduction to Deltacloud and the Aeolus Project. The video from the talk is available online as are the slides. Some specific talks I feel might be relevant or of interest to Fedora users are linked below:

There are of course plenty of other presentations that took place during the week. The videos for these are being made available at http://linuxconfau.blip.tv.

In search of unicorns

2011-05-16T15:25:00.000-07:00

This post has been migrated from http://blogs.fedoraproject.org/wp/sgordon/2011/01/28/in-search-of-unicorns/

Over the last week I have had the pleasure of attending linux.conf.au which was held in my home city of Brisbane, Australia. Overall it was a great experience and I hope to write up on some of the specific experiences I had which might be more specifically interesting to the Fedora community over the coming weeks.

Right now however I would like to touch on the 'Training Allies' session I attended as part of the Haeksen mini-conference. Effectively the session was an opportunity to review some examples of discrimination which arise from time to time in the FOSS world and indeed the IT industry as a whole.
One of the specific scenarios discussed was the use of pornographic and sexually explicit imagery in conference presentations. As those running the mini-conf detailed some experiences from their own pasts where they had seen this occur and others from the crowd chimed in I distinctly remember rolling my eyes somewhat. In my mind we have long since passed the point where anyone in the industry thought this was acceptable or in any way necessary, right?

Then Friday's keynote speech rolled around. The full text of the speech and the slides can be found here. While not everyone might be offended by the slides I think most readers will be observant enough to work out which ones some might not have considered appropriate for a conference which draws attendees from all walks of life. I have no doubt Mark Pesce also realised that some slides would be controversial and this was the intention of including them but that still does not make it acceptable.
Some will debate the linux.conf.au rules word for word, others will be offended by the idea that conference presentations are being censored in some way (or not, as it turns out, otherwise we wouldn't be having this dialog). I'm not going to try address every argument that either has been made or is likely to be made in defense of this presentation. In fact I'm not even going to directly address any.

The sole purpose of this post is to register that in my personal opinion that such events are not at all helpful in an environment where we are trying to attract individuals, businesses, and governments to open source. They are also completely avoidable and therefore un-necessary.

I will also say I am not sure what the point of having a rule regarding the use of sexually explicit images in presentations is if the enforcement to back it up consists of allowing the presentation to continue unhindered and issue a lame duck apology retrospectively. I do however appreciate the difficult position this scenario put the room organiser in. Ultimately conference organisers shouldn't require such a rule and be able to rely on the professionalism of community members and people recognising the social consequences of their actions as is traditionally done, alas we can dream.

http://blog.futurestreetconsulting.com/?p=484

FOSS drivers for ATI Mobility HD 5xxx (Evergreen series) on Fedora 14

2011-05-16T15:22:00.000-07:00

This post has been migrated from http://blogs.fedoraproject.org/wp/sgordon/2010/12/20/foss-drivers-for-ati-mobility-hd-5xxx-evergreen-series-on-fedora-14/

I have had a laptop with an ATI Mobility HD 5xxx video card for some time now. Getting 3D support for this card on Linux has been painful. Unsupported by the FOSS driver included in Fedora releases the only option has been to install the proprietary Catalyst driver. The Catalyst driver works when available but often releases lag long after the versions of Xorg included in the latest Fedora.

I have recently discovered, via a post on fedoraforum.org, that the updated version of the FOSS driver which is currently in the rawhide repository includes support for cards in this series! To install it you can use the following commands (note that the first is only required if you have previously installed the Catalyst drivers):

#/usr/share/ati/fglrx-uninstall.sh
# yum install fedora-release-rawhide
# yum update --enablerepo=rawhide --nogpgcheck kernel libdrm mesa-* xorg* cairo pixman
# yum remove fedora-release-rawhide

I had some issues with the graphical boot when I rebooted following the installation. By editing my grub settings to ommit the rhgb parameter I was able to successfully boot into my graphical environment which now has 3D acceleration!

Welcome!

2011-05-16T13:59:00.000-07:00

Welcome to the Rainhill Trials blog, named after the Rainhill Trials. These trials were run by the Liverpool and Manchester Railway in 1829 to evaluate steam engines and locomotives for use on the company's newly completed rail line.

This blog is intended to document my own trials and tribulations with emerging technologies. In particular expect content relating to:

Linux, particularly the Fedora Project,
virtualization technologies, and,
cloud computing technologies and management platforms.

Initial content will be migrated from the (limited) archives from my existing blog.