A.B. IT Ramblings

Git Repo in Google Drive

noreply@blogger.com (Anthony Boccia) — Sun, 09 Apr 2017 04:18:00 +0000

I manage a handful of config files for various parts of my home infrastructure. Some, like my DNS zone-files require changes every now and then and I like to have my changes tracked somewhere. Naturally I turned to git to track the changes. I didn't want to pay for a private repo and I don't want some of these configs hosted publicly but I did want them in the cloud for retention. I thought it would be neat to have the git repo for my tracked files hosted in google drive and accessed via a google drive mount on my machine.

It was surprisingly easy, I installed google-drive-ocaml-fuse, in my case from the AUR. I mounted my google-drive to a folder and created some empty git repos within and added my files to each for tracking. Kind of pointless, maybe lame, I know; but a simple way to track changes to files and have them automatically backed up in cloud storage. It was also a bit slow but worked!

My custom RPMS

noreply@blogger.com (Anthony Boccia) — Sat, 11 Mar 2017 03:30:00 +0000

From time to time the need for a custom built RPM arises. I figured I may as well start tracking them somewhere. To start, I have built the latest stable version of Synergy(1.8.8) for Fedora 25. You can find the spec files for that and eventually others @ misc-rpms

pypi-mirror

noreply@blogger.com (Anthony Boccia) — Fri, 14 Oct 2016 19:04:00 +0000

This week I implemented a custom solution for creating a pypi mirror for only packages necessary for whatever projects we deploy to production. Openstack has a great solution for this in github, however it was a bit dated and had some deprecated options used in the code which caused some issues. I've since forked their repo and made changes so that it all works as it should. You can see my changes here and pull the code for your own use. I am currently in the process of having it approved and merged into OpenStack's master pypi-mirror repo.

3 Steps to fixing "ldconfig empty, not checked" due to corrupted pkgs.

noreply@blogger.com (Anthony Boccia) — Sun, 17 Apr 2016 22:41:00 +0000

Worked this out today, figured I'd toss it on the blog for fun and hopefully to help others.

1) Get the initial list of empty libs from pacman

cat /var/log/pacman.log | grep --text empty | awk '{print $6}' | sort -u >> /tmp/liblist

2) Determine which packages they belong to so you know which need to be re-installed

for X in $(cat /tmp/liblist); do pkgfile -s $X;done | sort -u >> /tmp/pkglist

3) Force reinstall the packages

sudo pacman -Syyy && for X in $(cat /tmp/pkglist); do sudo pacman -S --noconfirm --force $X; done

Be sure to understand these commands and what they are doing, don't just blindly run commands you find on the web. In my case these all worked out perfectly for me, they should in most cases. If something bad should come of you running these commands, I am not liable. :-P

Koji Autobuild from git

noreply@blogger.com (Anthony Boccia) — Thu, 12 Mar 2015 01:48:00 +0000

This week I took some time to write a solution to automatically trigger koji builds upon committing to a privately hosted git repo. The code is in a pub repo on github, bear in mind that this is the first working code release with many improvements to come. It's also my first attempt at netcode so any tips or constructive criticisms are welcome.

Repo @
https://github.com/aeboccia/koji-buildfromgit

An rpm package of koji-bfg will be coming soon, for now the repo has instructions for setting up the listener and git hook.

Note:
Currently I have only written service support for Systemd, I am sure there are SysV boxes with Koji instances running, I plan to create initscripts for the service eventually.

Koji Copy Signed

noreply@blogger.com (Anthony Boccia) — Wed, 04 Feb 2015 02:50:00 +0000

Recently I implemented a Koji RPM Build Server at my place of work. When it came time to signing packages before mashing repo's I was faced with a small dilemma. Sigul signing server is a great solution for signing hundreds of packages and moving them to the correct destination on disk for mash to pick them up from and mash together a repo. However for my use we would not need something so robust as we only would require a hundred or so packages in total, thus I set out in search of a simpiler solution. Fortunately I found one. A koji plugin by the name of sign.py written by Paul B Schroeder <paulbsch "at" vbridges "dot" com>. It is a neat little plugin which signs packages at build time. The issue I ran into was that the packages would be signed at build then left in /mnt/koji/packages/pkgname/#/#/arch/package.rpm Mash when using strict_keys for packages looks under /mnt/koji/packages/pkgname/#/#/data/signed/keyid/arch/package.rpm for the signed packages to mash into a repo. I plan on eventually implementing this change directly into the plugin but since I was in a hurry I whipped up a quick script to run in between mash crons which copies the signed rpms to the correct location for mash to pickup.

I will admit this is a bit redundant since the packages are already signed at build time and can be mashed into a repo just fine provided I don't set strict_keys with mash. I prefer this method as it ensures packages mashed into repos's have the key I specify. In terms of disk space I rationalize this concern with the idea that if i were to implement sigul the rpms would be copied to the same signed dir as my solution here so really either way I'd be eating up space in two places for the same RPM.

The script can be found on github @ copy_signed.py

Killing some time with python

noreply@blogger.com (Anthony Boccia) — Sun, 16 Nov 2014 05:32:00 +0000

I was bored again tonight, so I wrote a quick, very simple, Average Calculator in python.
----------------------------------------------------------------------------------------------------------------------------------------
#!/usr/bin/python

#Modules to import
import sys

#Little Welcome message
print ("Welcome to avgcalc!\n")

#Get input from the user
user_input = input("Enter a list of numbers separated by a <space>: ")

#Separate those entered numbers by space
numbersent = map(int, user_input.split())

#Generate a list of the numbers
final_list = list(numbersent)

#Count how many numbers entered
num_of_nums = 0
for i in final_list:
num_of_nums += 1

#Add up all the numbers
total_of_nums = 0
for y in final_list:
total_of_nums = y + total_of_nums

#Divide the total sum of the numbers by the number of numbers entered to find the average
avg = total_of_nums / num_of_nums

#Print the final result
print ("The average of", final_list, "is", avg)
----------------------------------------------------------------------------------------------------------------------------------------

Quick Benchmarks of Raspi NFS + External Raid Enclosure

noreply@blogger.com (Anthony Boccia) — Sat, 08 Nov 2014 04:23:00 +0000

Here are some results of some quick and dirty benchmarks, I feel they give enough of an idea of the performance you can expect from a Raspi B -> USB 2.0 HDD Raid1.

1.1GB File

268MB File

As you can see the transfer rates are rather consistent at an average of about 7.6 MB/S.

Raspi NFS Server + External Raid1 2 Bay HDD Enclosure

noreply@blogger.com (Anthony Boccia) — Sat, 08 Nov 2014 02:00:00 +0000

I decided I wanted to replace my x86 server with something a little more "arm" powered. Below is just a small post with the steps taken to setup my raspi nfs server. I used the raspi for now as a POC since it kind of lacks due to only having fast eth and no esata/usb 3.0.

Shopping List:

2 X Western Digital Caviar Black 1.0TB HDD's

1 X RaspberryPi Model B with ArchArm

Startech External 2Bay Raid Enclosure

Since I am using the PI I utilized the USB 3.0's backwards compatibility and plugged it into the Pi via USB.

The Pi should see the raid as 1 device

I didn't bother to partition, you can if you like. I formatted the entire drive(s) using xfs.

Next I setup fstab for my new mount point

Next setup NFS export

Finally start the services

Once all of the above was complete I was able to mount the share on my desktop. I will post some transfer speed stats soon. Since this POC has worked I decided to grab a slightly beefier ARM machine to serve NFS. CuBox-i4Pro will replace my second Pi, it has gigE and E-SATA support which should boost performance drastically over the Pi.

Home Infra Overhaul (Switch to ARM)

noreply@blogger.com (Anthony Boccia) — Sat, 08 Nov 2014 01:40:00 +0000

As usual it has been a while since my last post, but i finally have something worth writing about.

Recently I overhauled my small home infrastructure replacing my i3 beefy power sucking tower with 2 Model B Raspberry Pi's and an external 2bay hard disk enclosure with hardware raid 1.

What's on the shelves?

Top Shelf: Buffalo DDWRT Router

Second Shelf: TP-LINK Unmanaged Gigabit Switch, Raspi #1, Cable Modem

Third Shelf: StarTech 2Bay Raid Enclosure, Raspi #2

Fourth Shelf: APC UPS

Specs:

Raspi #1- Arch Arm - Model B - (DNS,DHCP)

Raspi #2 - Arch Arm - Model B - (NFS)

This should save me a bit on electricity rather than running a beefy tower with 3 Disks in a software raid + a bunch of fans which also adds noise.

The external raid enclosure uses around 12V DC at 3 Amps @ Max and the raspi's use 5V @ 1.2A @ Max. Given I will be running them 24/7, even at max power they will only consume about 420.48Kwh Per annum, which given my flex rate of billing by my hydro company should work out to about $50.45 per annum in power consumption, give or take a couple bucks.

I am aware I did not include the price of the rest of my components as it is obvious they are not major power hogs. In this case I was more concerned with replacing my old tower which definitely ate more given what it was powering.

Mucking around with python and time

noreply@blogger.com (Anthony Boccia) — Tue, 14 Oct 2014 15:53:00 +0000

Was a little bored today, so I wrote a random python countdown to muck around with time in python.

Using Python 3.4.2

#!/usr/bin/python
import time

YVal=5

print ("Hello World!")
print ("Get Ready for the count!\n\n")
for X in reversed(range(1,4)):
print ("In", X)
time.sleep( 1)

print ("\nChecking if Y is equal to", YVal)
for Y in range(YVal+1):
if Y != YVal:
print ("It's not yet equal to", YVal)
else:
print ("\n\nNow Y is equal to!", Y, "\nExiting...")
break
print ("\nY is equal to", Y)
time.sleep( 1 )

A little Intro to Python

noreply@blogger.com (Anthony Boccia) — Fri, 02 Mar 2012 17:29:00 +0000

Today I had some spare time, So I decided to begin teaching myself python, below is a pointless little program I wrote to get some practice with IF's, Whiles, Prints, and functions. I am enjoying the python language so far, it is quite interesting, and fun!.

##################################################################################

#!/usr/bin/env python

#Simple Yes or No
#By Anthony Boccia
#Learning Some Python

#This is the yes or no question function
def question():
print ('Is this Right? Yes or No ( Exit - to Quit program)? ')
answer=raw_input()

while answer != 'Yes' and answer !='No' and answer !='Exit': #Check for user errors
print('\nERROR: Enter Yes or No ( Exit - to Quit program) ""Case Sensitive""\n')
print ('Is this Right? Yes or No? ')
answer=raw_input()

return answer #Return the user input to the main program

#This is the main program
answermain = 0
while answermain != 'Exit':

answermain = question()

if answermain == 'Yes' or answermain =='No':

#Check the returned value and output the proper message based on the value of answermain
if answermain == 'No':
print ('\nYou said ' + answermain + ' Very Well then, it is ' + answermain + 't right\n') #noticed how i used the variable again and added a t for not? Clever or lame? you Decide

elif answermain == 'Yes':
print ('\nYou said ' + answermain + ' Very Well then, it is right\n')
else:
print ('Good' + 'bye!') #Message Printed upon Exit by user which kills loop in backend

##################################################################################

Thats all for now, Cheers!

FSOSS/Linux Fest 2011 - My Teams Presentation

noreply@blogger.com (Anthony Boccia) — Wed, 11 Jan 2012 07:06:00 +0000

Yes, it has been a while since I last threw a post up here, I am still alive. I recently graduated :-) and am seeking a job in RedHat Based system administration...But enough of my begging for work. Below you'll find the FedoraARM development team presentation on running a build farm with Fedora on ARM. We Presented at FSOSS 2011 (Free Software and Open Source Symposium) in October. Just now the video was posted. It is a slideshow with voice over so don't expect to many explosions...or any. I hope it will serve well to educated and offer insight to the advancements and the effort towards the on going development of the Fedora Distribution of Linux in the ARM world.

ARMHFP Builders Via Chroot

noreply@blogger.com (Anthony Boccia) — Mon, 28 Nov 2011 15:26:00 +0000

Recently our Buildfarm http://arm.koji.fedoraproject.org has been upgraded to include ARMV7HL builder support. This was achieved by creating a Fedora 15 Arm chroot on our Pandaboards.

Here are the steps taken:

Prep - Download the completed rootfs, and chrootfs:
RootFS: http://iraq.proximity.on.ca/v7chroot/PANDABOARD/rootfs.tar.gz
Boot: http://iraq.proximity.on.ca/PANDA/boot.tar.gz
ChrootFS: http://iraq.proximity.on.ca/v7chroot/PANDABOARD/v7chroot-final-certless.tgz
MakePandaScript: http://iraq.proximity.on.ca/PANDA/makepanda

Steps for PandaMainroot
1) run the makepanda script on your SDcard, this will create the necessary partition scheme. This should be complete, at this point.

2) Mount the boot partition and explode the boot tarball to it.

mkdir tmpmnt
mount /dev/carddev1 tmpmnt/

tar xfv boot.tar.gz -C tmpmnt/

sync

umount tmpmnt/

3) Follow the same process for the rootfs

mount /dev/carddev2 tmpmnt/

tar xfv rootfs.tar.gz -C tmpmnt/

sync

umount tmpmnt/

4) Place the card in the panda and power it on, if you make it to the login prompt your good to go, login with password fedoraarm.

Note: That you will have to manually setup your networking, as this is currently done via a script in the rootfs, and will not work outside of our farm, some custom tweaking will be necessary . The chroot will still function just fine for building V7HL with mock, provided you have the correct mock config in place. ping fossjon in #fedora-arm for more info.

Steps for Chroot Creation
1) Install the rootfs onto your pandaboard

2) Explode chroot archive into rootfs like so

tar xfvj v7chroot-final-certless.tgz -C /

3) Copy Main root resolv.conf to chroot

Note: This is done to ensure the chroot has DNS info, the ip will be shared via main rootfs

cp /etc/resolv.conf /path/too/chroot/etc/resolv.conf

4) Test connectivity with: ping yahoo.ca

5) Add the following(6,7) to the main rootfs /etc/rc.d/init.d/koji-config

Note: The koji-config is a script executed at boot time to prep and enable the pandaboard in our build environment, it is native to our set up, yours may differ.

6) Setup bind Mounts from Local root to Chroot

mount -t proc chroot_proc /home/v7chroot/root/proc

mount -t sysfs chroot_sysfs /home/v7chroot/root/sys

mount -t devpts -o gid=5,mode=0620,ptmxmode=0666,newinstance chroot_devpts /home/v7chroot/root/dev/pts

mount -t tmpfs chroot_shmfs /home/v7chroot/root/dev/shm

mount --bind /var/cache/mock/fedora-15-arm/ccache/ /home/v7chroot/root/tmp/ccache

mount --bind /mnt/koji /home/v7chroot/root/mnt/koji

mount --bind /fs0 /home/v7chroot/root/fs0

mount -o bind /dev/ /home/v7chroot/root/dev

7) Change Kojid config in chroot to the correct hostname for user= and create the correct sym link to the kojid cert for the builder
Note: This step is only necessary for a fedora-arm koji setup, it can be ignored if builder will not be included in koji.

sed -i "s/^user *=.*$/user = $(hostname)-v7hl/" /home/v7chroot/root/etc/kojid/kojid.conf

ln -s /etc/kojid/certs/$(hostname)-v7hl.pem /etc/kojid/localhost.pem

8) Start the Chroot

chroot /home/v7chroot/root

9) You can setup in a startup script a command to start the chroot, and kojid within like so: chroot /home/v7chroot/root/ /sbin/service/ kojid start &

10) Finally, if you wish to have your panda as part of the build effort, ping aeboccia,fossjon,frojoe,ctyler in #fedora-arm on Freenode IRC

Efika Smarttop MX51 - 3.0.4 Kernel

noreply@blogger.com (Anthony Boccia) — Fri, 21 Oct 2011 17:58:00 +0000

It is with great excitement that i finally announce a completed 3.0.4 kernel for Efika MX Smarttop ARM Systems. Currently we have nine efika's active in our build farm, they are building packages under mock for our F15Arm release; and are currently running the most up to date stable kernel.

Some Minor tweaks, specific to the Fedora-ARM team setup which have been built into the kernel include, IPV6 support and ACL's on ext2,3,4 filesystems. Another large tweak, was scaling back the version number to 2.6.40. This was necessary as some packages look for kernel version 2.6* when building.

Below are links to the built uImage, module tarball, and the config used to build the kernel.

3.0.4-Config-mx51
Modules-2.6.40
Completed uImage

That's all for now. Stay tuned,

SHARPY

Sigul Signing Server

noreply@blogger.com (Anthony Boccia) — Thu, 16 Jun 2011 18:19:00 +0000

Welcome to another OpenSource post,

This week I was finally able to get a sigul signing server up and running, for CDOT's fedora arm project. Currently we are signing 25835 RPM's for our F13 -Arm release. There is not a whole lot to post here, as the major part of this task was documentation. If you click here you can view my step by step documentation created to allow anyone to setup their own sigul instance.

Stay tuned,

ATI - Catalyst Drivers with Akmod + Watermark Removal

noreply@blogger.com (Anthony Boccia) — Thu, 19 May 2011 01:38:00 +0000

As many know ATI support is not the greatest on Linux, well at least not as far along as Nvidia support, so it can sometimes be tricky getting your ATI drivers to function especially if they are of the HD Mobile chipset variety.
I have an Asus K52JT model laptop, it's an affordable and well performing I7 but it did come with one price, it has a HD6370M gfx card. It's not a bad card but for a Fedora user it presents a challenge. The following is the walkthrough of the steps to install akmod and remove the pesky Unsupported Hardware watermark that may appear.

Open a terminal and SU to root next issue: yum install akmod-catalyst

*After install the drivers reboot the system

Upon booting up, you may notice a Small Watermark to the bottom right of the screen which reads:

AMD
Unsupported Hardware

This watermark tends to show up when the graphics drivers installed do not want to play nice with your hardware, essentially thinking it's not installed though it is. This is not a problem, to test and make sure that the drivers are indeed working perform the following:

Open a terminal SU to root and issue: glxgears

*Note you should see some FPS rates being generated, this means your gfx drivers are installed and functioning

After ensuring the graphics drivers are functioning it's time to remove the watermark. I found a script to do so posted here, and after some minor modification for my system it ran successfully and removed the watermark.
Create the following script

#!/bin/sh
DRIVER=/usr/lib64/xorg/modules/drivers/fglrx_drv.so
for x in $(objdump -d $DRIVER|awk '/call/&&/EnableLogo/{print "\\x"$2"\\x"$3"\\x"$4"\\x"$5"\\x"$6}'); do
sed -i "s/$x/\x90\x90\x90\x90\x90/g" $DRIVER
done

The original source can be found here. I had to modify the top line to lib64 from lib, the best way to check if you need to would be to search for that fglrx_drv.so find its directory and change the top line as per your situation.

Execute the script, and reboot. Upon boot you should no longer have the watermark problem :-)

Thanks for reading, Stay tuned.

PandaBoard - XSession with Firefox On F13beta3

noreply@blogger.com (Anthony Boccia) — Tue, 17 May 2011 19:57:00 +0000

Welcome,

The following is a walk through on how to install graphics drivers, xorg and firefox, on a panda board running Fedora-Arm 13 beta3 release, and configure it to open an X session with Firefox to display a desired page on boot. For CDOT purposes it displays a Status Dashboard web page on an external monitor.

1. Boot up your pandaboard and login

2. Issue command yum install xorg*

This installs all available, fonts, and other things needed for X to function, without a desktop environment, essentially just XSERVER.

* The specific driver in use is omapfb, and is available in the cdot fedora-arm repo's. If you wish to specify solely the xorg base system and single driver you can.

Optional: If you want you can install a Window manager, I did for testing purposes as it was annoying not being able to close more move windows. I used icewm, installed with yum install icewm. But you can use any window manager it's your choice.

3. vi /etc/X11/xorg.conf and add the following:

Section "ServerFlags"
   Option "IgnoreABI" "True"
EndSection

Section "Device"
    Identifier "Card"
    Driver "omapfb"
EndSection

Section "Screen"
Identifier "Screen0"
Device "Card0"
Monitor "Monitor0"
Subsection "Display"
Depth   24
Modes "1024x768"
EndSubsection
Subsection "Display"
Depth   32
Modes "1024x768"
EndSubsection
EndSection

* You can edit the Modes as you wish depending on the monitor size you have and what you prefer.

4. Reboot the system

5. Next install firefox the latest for arm being 3.6: yum install firefox

6. Next for a quick test of X and firefox issue the following:

export DISPLAY=:0

xinit /usr/bin/firefox http://www.google.ca & <--This should open display :0 with a terminal and a firefox window.

7. Getting the window to display on boot will require two things, the first being a javascript html file, which I found easiest for my purposes and should be just fine for any other instance. The scripts to do this were written for me by Jon Chiappetta, they are displayed here.

Once you have created the popup.html file you can begin to write a service for your Dashboard to start on boot.

8. First create a service script file, to boot the Xdisplay and firefox on boot

vi /etc/init.d/servicename <--pick a name...any name

Add the following to the file

#!/bin/sh
#
# CDOT-Service Status notification daemon #<-- Change this to reflect your service info
#
# Author:       Fedora_Arm team #<-- Change this to reflect your authors name
#
# chkconfig: 2345 98 20
#
# description: This is the status board service \   #<-- edit the description as you desire.
#               For CDOT Dashboard
# processname: zdotstats #<-- Match your service name, so it is easy to identify in the process list
#
RETVAL=0;
start() {
echo "Starting YourService"
export DISPLAY=:0
#We login as root, as it is the only user we have on the machine, and nothing critical is hosted.
export USER=root
export HOME=/root
xinit &
killall firefox
rm -f /root/.mozilla/firefox/i7l6qmmk.default/sessionstore*
/usr/bin/firefox http://yourhost.com/popup.html &
}

stop() {
echo "Stopping your service"
pkill xinit
}

restart() {
pkill xinit
/usr/bin/xinit &
}

case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
*)
echo $"Usage: $0 {start|stop|restart}"
exit 1
esac

exit $RETVAL

9. Issue command: chkconfig --add servicename
           chkconfig servicename on

* This will add your service to the list of services and turn it on for all run levels, if you want you can specify using the --levels option.

10. Test the service with command: service servicename start
If all is well, your x session should start and open your popup page in firefox automatically.

11. Finally reboot your system, and if all is in good order your X session should start and open firefox to your popup page on boot.

0.3 - Nothing new since 0.2 But More to come

noreply@blogger.com (Anthony Boccia) — Wed, 27 Apr 2011 05:10:00 +0000

Hello All,

Yes i am late with my 0.3 report release, since hongkong has had much downtime I have been unable to test full builds on the Italy koji system since the repo it relies on is not functioning at the moment. I plan to soon post timings and results with builds on fully arm supported build system, with hongkong up and running. Stay tuned.

First BUILD on Open-RD Koji - 0.2

noreply@blogger.com (Anthony Boccia) — Mon, 28 Mar 2011 19:53:00 +0000

I have done it...finally, a couple of days ago i posted that i finally had koji up and running on the Open-RD system and needed to grapple with kojira next, to get repo's setup. Finally after a couple of days, I was able to build a src.rpm for filezilla, with a wonderful green complete within a few seconds; this is excited not only because I am finally %99.99 complete on my journey with Koji and ARM, but because the build showed that the setup between the two arm systems Open-RD(HUB/WEB) and GuruPlug(Builder) proves very efficient for builds. That being said, I find the web interface is still a tad to slow for my liking, and i plan to soon begin researching more efficient ways for it to function...not to jump to a conclusion but placing koji-web on a separate dedicated arm machine may be a great option, and i hope i can obtain the resources to begin testing this theory.

One thing to note, is that the koji how-to documentation does not outline how to go about the repo setup, however it does provide a link that does. ServerBootstrap Is the walk through i followed to get base tags setup that are required for build's to function. It was straight forward and believe it or not for once i had no error troubles.

That's all for now,

Stay Tuned

Koji + 1 Builder Running on Open-RD

noreply@blogger.com (Anthony Boccia) — Sat, 26 Mar 2011 16:17:00 +0000

It is with great excitement that I announce the installing of the koji build system running on an ARM based platform. After a few days which followed a few months of grappling with koji and it's howto guide, I was able to get koji web and hub up and running on an Open-RD system, with one attached koji builder Guru Plug.

http://italy.proximity.on.ca/koji
||
Open-RD <--PrivateLan-->GuruServerPlug

Koji-Hub Koji-Builder

Koji-Web

Above is a more visual breakdown on whats running what. So far the builder is able to communicate with the hub and all Lights are green :-). Next step is to create the kojira repo, and in the following week I will begin testing the building of packages to see what the speeds are like, with builds, web interface, and the Open-RD itself. This should allow for further determination on what types of tweaks can be made to ensure an efficient as possible, fully ARM supported build farm.

Stay Tuned!

Kojiadmin CN=fqdn Mixup

noreply@blogger.com (Anthony Boccia) — Wed, 23 Mar 2011 01:23:00 +0000

I was able to solve my server certificate error from before, but the next error proved a little bit tricky and took me a couple of days to figure out the fix to. When attempting to issue admin level commands with the kojiadmin user I was faced with ActionNotAllowed: admin permission required

What could be causing this? I thought. The certs were all in the right spots but for some reason I could still could not issue admin commands, the apache error_log reported the following:

/usr/lib64/python2.6/site-packages/mod_python/importer.py:32: DeprecationWarning: the md5 module is deprecated; use hashlib instead

import md5

2011-03-15 15:41:44,145 [WARNING] m=createUser u=iraq.proximity.on.ca koji.xmlrpc: Traceback (most recent call last):

File "/usr/share/koji-hub/kojixmlrpc.py", line 191, in _marshaled_dispatch

response = self._dispatch(method, params)

File "/usr/share/koji-hub/kojixmlrpc.py", line 253, in _dispatch

ret = func(*params,**opts)

File "/usr/share/koji-hub/kojihub.py", line 7867, in createUser

context.session.assertPerm('admin')

File "/usr/lib/python2.6/site-packages/koji/auth.py", line 527, in assertPerm

raise koji.ActionNotAllowed, "%s permission required" % name

ActionNotAllowed: admin permission required

Solution:

For some reason iraq.proximity.on.ca was auto added to the psql database, when giving it admin permissions kojiadmin could add users----Possible cert issue?

I regenerated certs, and found it was occurring due to the CN being set as iraq.proximity.on.ca with the kojiadmin cert. It was attempting to authenticate the fqdn instead of the OU with was kojiadmin.

By regenerating the certificates for kojiadmin and making the CN=kojiadmin with a blank OU the error no longer occured, and kojiadmin was able to be authenticated to add users or perform other administrative tasks on koji with the kojiadmin user.

Koji Cert FUN!

noreply@blogger.com (Anthony Boccia) — Wed, 23 Mar 2011 00:48:00 +0000

The generation of the certs, though it is tedious, it's not to painful so long as you understand exactly how they function between koji hub, and ssl for user authentication. I learned how they interacted with certs the hard way, the first main issue i ran into was far into the configuration of koji when issuing the add-user koji command i was faced with the following:

Command: koji add-user kojira

Error:

[('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]

Solution:

Apache may be pointing to the incorrect certs for ssl authentication, in my case my apache ssl configuration was looking in /etc/pki/tls/certs/localhost.crt for the server cert and /etc/pki/tls/private/localhost.key for the server private key.

This can be fixed two ways, either by changing apache ssl to point to your koji_ca_cert.crt and koji_ca_cert.key files

ssl.conf (Option 1)

#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/pki/koji/koji_ca_cert.crt

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file. Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/pki/koji/private/koji_ca_cert.key

Or by leaving the SSL configs to defaults and copying koji_ca_cert.crt to /etc/pki/tls/certs/localhost.crt and overwriting it and doing the same for the private key by copying the koji_ca_cert.key to /etc/pki/tls/private/localhost.key

Commands (Option 2):

cp /etc/pki/koji/koji_ca_cert.crt /etc/pki/tls/certs/localhost.crt

cp /etc/pki/koji/private/koji_ca_cert.key /etc/pki/tls/private/localhost.key

Through this problem I was clear on how koji authenticates its user which is sending commands in this case from the CLI with apache SSL, the user kojiadmin does not just have to have a config file with pointers to the correct certs, the server certificates must point to the valid koji_ca generated certificate authority cert since the koji setup creates a standalone cert auithority. The certificates were definitely the most challenging part of this config as they spread across multiple aspects of koji, and must be configured in line with the other parts of Koji in order to flawlessly function.

Adventures in Koji

noreply@blogger.com (Anthony Boccia) — Sun, 13 Mar 2011 22:16:00 +0000

Hello, All

Okay so it has been long overdue that I post something, recently I have been going about the process of installing the Koji Build system on Fedora 13. So far it has been a bit of a headache, fun, and a great learning experience. The next several posts will outline step by step what I have done so far, the errors I encountered and how I went about fixing them. Throughout my adventure in Koji I have been following the fedora wiki walk through, which as many may already know is a great guide, but doesn't really go to in depth on the install process, and the common issues some may face, so for some added help to any others who may be on the same road as me or same road block as I once was with this process, I will be trying to be as detailed as possible as I post each step of my adventure with Koji.

Koji Hub on ARM

noreply@blogger.com (Anthony Boccia) — Thu, 03 Feb 2011 16:12:00 +0000

Hello All,

Been a while i know, recently i created my project page for the work i will be doing on the implementation of Koji or the Open-RD Hub. Here is a link to my wiki for the project, I will also be blogging as often as i can to keep you all posted on the progress. If any of you would like to help or have some ideas please let me know either by comment or emailing me.

Stay Tuned...

Koji Hub on ARM