planet lisas

luges Stammtisch - 2010-09-01

2010-09-01T00:00:00+00:00

This month's come together will be held on 2010-09-01, 8pm at our regular pub (Trödler).

luges Stammtisch - 2010-08-11 [verlegt]

2010-08-11T00:00:00+00:00

This month's come together will be held on 2010-08-11, 8pm at our regular pub (Trödler).

A New Order

2010-07-19T09:09:25+00:00

A few weeks ago I upgraded the hard disk in my notebook from 160GB to 250GB. I copied the whole hard disk using dd from the old drive to the new drive. I still had to change the partition layout to use the new space. So I downloaded the gparted live CD, booted it and discovered that I was not able to move an extended partition using gparted. I have the following partitions:

/dev/sda1          7  HPFS/NTFS
/dev/sda2          7  HPFS/NTFS
/dev/sda3   *     83  Linux
/dev/sda4          5  Extended
/dev/sda5         83  Linux

My plan was to increase the Windows partitions as well as the Linux partitions. To increase the size of /dev/sda2 I had to move /dev/sda3 and /dev/sda4. I was not able, however, using gparted, to move /dev/sda4. So I decided that I had to make a backup of /dev/sda5, then delete it (and /dev/sda4), move /dev/sda3 and increase the size of /dev/sda2.

Therefore I booted a Fedora installation DVD in the rescue mode and made a backup of /dev/sda5:

dd if=/dev/sda5 bs=65536 | ssh adrian@backup-server "dd of=sda5.img bs=65536"

Then I booted the gparted live CD and deleted /dev/sda5 and /dev/sda4, moved /dev/sda3 and increased the size of /dev/sda2. After that I created a new extended partition (/dev/sda4) and created /dev/sda5 using the remaining space. After gparted finished I booted the Fedora installation DVD again in the rescue mode and restored the backup:

ssh adrian@backup-server "dd if=sda5.img bs=65536" | dd of=/dev/sda5 bs=65536

At the end of the operation I booted my system and was happy that it still worked. Now I still had to resize the encrypted partition. This was pretty easy:

cryptsetup resize luks-<uuid>
pvresize /dev/mapper/luks-<uuid>

Before doing the lvresize I checked the available extends with vgdisplay and used that number in the following lvresize command:

lvresize -l +16449 /dev/mapper/vg_dcbz-lv_root
resize2fs /dev/mapper/vg_dcbz-lv_root

And that was already it. It took some time (maybe 4 hours), but everything finished without any problems. To make sure everything finished without any problems I forced a fsck (touch /forcefsck; reboot).

Before:

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_dcbz-lv_root
                       74G   69G  1.4G  99% /

After:

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_dcbz-lv_root
                      137G   69G   62G  53% /

luges Stammtisch - 2010-07-14 [verlegt]

2010-07-14T00:00:00+00:00

This month's come together will be held on 2010-07-14, 8pm at our regular pub (Trödler).

Deploy own Root CA Certificates in Firefox

2010-07-12T16:06:08+00:00

Companies sometimes do not want to sign their intranet-webserver X509 certificates through a Certificate Authority like VeriSign or Thawte to save costs.
Firefox comes with some CAs included, but it looks like there is no easy way to distribute your own CA to your users.

Today I made some tests with certutil and got a promising solution by distributing an own cert8.db file in /etc/firefox

cd /tmp
# retrieve all CA you wish to make available to your users
wget http://pki.example.com/Root-CA-base64.crt
wget http://pki.example.com/…-base64.crt
….

# install certutil
apt-get install libnss3-tools
# Create new certificate and key databases.
# only cert8.db is important for your users
mkdir tmp
certutil -N -d tmp/
# Insert CAs into cert8.db
for i in *crt ; do certutil -A -n “$i” -t “CT,c,c” -d tmp/ -i “$i” ; done
chmod a+r tmp/cert8.db
cp tmp/cert8.db /etc/firefox-3.5/profile/cert8.db

Unfortunately this solution only works for users not having already a firefox profile in their home. A workaround could be to iterate over all user homes and modify directly the profile folders with certutil.
If you know better ways to distribute a custom root CA certificate, please let me know!

Archaeology

2010-07-11T10:54:12+00:00

If I remember it correctly my server at home (file-server, print-server, router, …) has been installed a long time ago using Red Hat Linux 8.0. Since the initial installation I have done live upgrades using rpm, apt-get or yum to its current version (Fedora 11). Now I just started doing a live upgrade using yum to Fedora 13 and I got an interesting dependency problem:

--> Finished Dependency Resolution
lilo-21.4.4-26.i386 from installed has depsolving problems
 --> Missing Dependency: mkinitrd >= 3.4.7 is needed by package lilo-21.4.4-26.i386 (installed)

It seems I still have an unused version of lilo installed on my system and now that mkinitrd has been replaced yum starts complaining. The lilo package is from 2004 and has also been installed in 2004 (according to the RPM database). It is the oldest package on my system but now it has to go.

New Toy

2010-06-25T13:50:48+00:00

Since my boss told me to reduce my overtime I’ve ordered a new toy to compensate the lack of work.

Currently I’m installing the system based on this description. Main idea is to get rid of the loud, big and of course power consuming solution I currently use as internet gateway and print server.

S60 – new line in Stuttgart

2010-06-14T18:04:21+00:00

Today the new S60 line started and I tested it. It is as fast as with the bus, but I am now not longer dependent on the bus (the last bus to my work drives 8:45am)

luges Stammtisch - 2010-06-02

2010-06-02T00:00:00+00:00

This month's come together will be held on 2010-06-02, 8pm at our regular pub (Trödler).

Floppies Revisted

2010-05-22T13:29:09+00:00

Last weekend I upgraded most of my home systems to run Lucid Lynx. From the software point of view everything went pretty smoothly and I am really happy so far. I like the new look which is not surprising as I’ve been using the Dust theme prior to 10.04 and they are not very far apart. The new Ubuntu One integration is an interesting way of trying to make Ubuntu sustainable, I do hope however that it will stay out of my way if I don’t want to use it.

I was close to downloading an album through Ubuntu One until they requested me to register my computer. This is something I do not want to do just to buy an album, so I stopped right there and resorted to the wonderful clamz.

Anyway, during the setup I had to realize that CD-Rs have become the floppies of 2010 – not only capacity-wise but also regarding the reliability. I’ve been having this problem with Ubuntu as well as Fedora setups: When you burn the CD-R just before running the setup on another machine with a different optical drive you will often get read errors at some point in time – typically after being halfway through the setup process. This brings me to my request to the authors of Linux distribution setup procedures: If you cannot read a package from the CD please try downloading it from the Internet after asking the user whether it is OK to do so. I fixed one of the setups with a manual chroot onto the new root fs after modifying the sources.list, on another machine I simply used the mini iso which downloads eveything via the network.

Window Buttons (Minimize, Maximize, Close) issue in Ubuntu 10.04 LTS

2010-05-12T20:01:08+00:00

Many users complained about the arrangement of the windows button (minimize,maximze,close) in Ubuntu 10.04 LTS. To get the old behavior back a user would have to use
gconftool-2 --set /apps/metacity/general/button_layout --type string "menu:minimize,maximize,close"

As I have to roll out Ubuntu 10.04 on several desktops I wanted to fix this “bug” globally on the whole system without modifying any user profiles. These two lines do the trick:
echo '/apps/metacity/general/button_layout "menu:minimize,maximize,close"' > /usr/share/gconf/defaults/99_fix-menu /usr/bin/update-gconf-defaults

luges Stammtisch - 2010-05-05

2010-05-05T00:00:00+00:00

This month's come together will be held on 2010-05-05, 8pm at our regular pub (Trödler).

How do I get the last field of a line with cut?

2010-04-19T22:16:22+00:00

Just reverse the order and return the first field!
echo a/b/c | rev | cut -d/ -f1 # results in "c"
You could also use awk -F/ '{ print $NF}'

luges Stammtisch - 2010-04-07

2010-04-07T00:00:00+00:00

This month's come together will be held on 2010-04-07, 8pm at our regular pub (Trödler).

Kellerdieb

2010-04-05T16:21:00+00:00

Sorry for the German title, but the translated one I did not like. Someone has stolen my partition in the basement. Not just some things from it. My complete partition is taken over by someone else. When I recently went down to put my suitcase I could not find my partition any more. The place did not look like before any more. After some searching it turned out that someone has broken my lock, filled my partition with his things, put paper on the inside of the metal grid (that’s why it looked completely different) and put a new lock. So now I have a partition with someone else’s things any my flat full of things.

Cluster Installation Finished

2010-04-02T08:57:25+00:00

The hardware of our cluster is finally installed and ready. All 180 compute nodes (almost) are ready, Infiniband is working and the lustre is mounted.

First Infiniband benchmarks gave us results of about 23 GBit/s which is the expected bandwidth with our QDR network.

As a mirror admin I am bit frustrated that i cannot use the big filesystem which is mounted on every compute node for my mirror server:

172.31.100.222@o2ib,172.30.100.222@tcp:172.31.100.221@o2ib,172.30.100.221@tcp:/lprod
                       29T  819M   28T   1% /lustre/ws1

Now I still need to install the frontend servers. One is used for the users to log in and submit jobs and the other will contain the grid software as this cluster wil be part of the bwGRiD.

Suspend to disk with Ubuntu 9.10

2010-03-18T09:52:07+00:00

I had problems using suspend to disk. It worked after adding GRUB_CMDLINE_LINUX="resume=/dev/sda6" #the name of my swap partition to /etc/default/grub and running update-grub2

28th Open Grid Forum

2010-03-14T18:29:18+00:00

Starting tomorrow (2010-03-15), I will be at the 28th Open Grid Forum (OGF28) in Munich for four days.

luges Stammtisch - 2010-03-03

2010-03-03T00:00:00+00:00

This month's come together will be held on 2010-03-03, 8pm at our regular pub (Trödler).

2010-02-26T00:00:00+00:00

This server will not be reachable tomorrow (Saturday 2010-02-27) due to campus wide network changes for at least 8 hours.

80 Nodes Up And Running

2010-02-23T13:14:18+00:00

80 compute nodes from our cluster are up and running. We are now waiting for more switches and the filesystem servers to finally get the complete cluster (with all compute nodes) operational. To get the remaining nodes operational all I have to do is to add their MAC address to a file and with the magic of some scripts everything else is configured automatically. Unfortunately it all depends on the missing ethernet switches which should arrive any day now.

802.1x & EAP-TLS: Alert (Level: Fatal, Description: Unexpected Message)

2010-02-22T23:33:34+00:00

Today we achieved to connect to our corporate WLAN (802.1x / EAP-TLS). Normally certificates are only issued to our Windows Users but with help of our IT Department we got certificates for our linux machines. My colleagues tried it several times but it didn’t work with networkmanager neither with wpasupplicant. The last days I had the “chance” to try myself. I started wpasupplicant together with wireshark. After sending Client Hello to our accesspoint (connected to a radius server) , it returned an error message:

Alert (Level: Fatal, Description: Unexpected Message)

The fatal alert Unexpected Message “should never be observed in communication between proper implementations”. The server did not want to see my my certificates and stopped talking to me immediately. After comparing Client Hello bit-by-bit with RFC 2246, I hit on the SessionTicket TLS Extension (defined in RFC 4507) sent by my client:

Ethernet II
802.1X Authentication
Extensible Authentication Protocol
Secure Socket Layer
SSL Record Layer: Handshake Protocol: Client Hello
Handshake Protocol: Client Hello
….
Compression Methods Length: 2
Compression Methods (2 methods)
Extensions Length: 4
Extension: SessionTicket TLS
Type: SessionTicket TLS (0×0023)
Length: 0
Data (0 bytes)

I was asking myself what would happen if I would remove this Extension from the Client Hello so it would look like a old-fashioned RFC2246 datagram? To accomplish this I downloaded the openssl sourcecode with apt-get source openssl, removed enable-tlsext from rules/debian and rebuilt the code with make -f debian/rules (I didn’t want to install it).
I started wpasupplicant with

LD_LIBRARY_PATH=~/openssl-0.9.8g/ wpa_supplicant -d -i wlan0 -Dwext -c WLAN.conf

and it worked! The TLS Extension is not sent by my client and in wireshark the response from the accesspoint looks now like a well formed Server Hello

TLSv1
Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Mess

Conclusion: I am now sure that the server handles the Client Hello wrong. RFC2246 describes in its “Forward compatibility” note:

In the interests of forward compatibility, it is permitted for a client hello message to include extra data after the compression methods. This data must be included in the handshake hashes, but must otherwise be ignored.

Installing [K|U]buntu with one line?

2010-02-15T15:41:44+00:00

Just use aptitude --with-recommends install [k]ubuntu-desktop !

RAID 1 Shrinking

2010-02-11T16:29:02+00:00

I was not happy with the partitioning of one of the cluster infrastructure servers. It had a software RAID for /boot, one for swap and the rest was a big software RAID for /. I should have used LVM for / for easy resizing, but I forgot and so I had to do it the hard way. I wanted to resize /dev/md2 which was used for / and then use LVM for the rest.

First I had to resize the filesystem. Online shrinking is not supported for resize2fs (at least I was not able to do it) and so I had to boot the CentOS 5.4 rescue system.

After dropping to the shell of the rescue system (without mounting the filesystems) I copied a mdadm.conf from a similar system to /etc so that I would be able to start the RAIDs:

mdadm -A /dev/md0
mdadm -A /dev/md1
mdadm -A /dev/md2

Only starting /dev/md2 would have be enough, but I wanted to make sure that everything is working as it is supposed to. Then, before running resize2fs, I had to do a filesystem check:

e2fsck -f /dev/md2 -C 0

Next step was to actually shrink the filesystem and make it smaller than the desired final size:

resize2fs /dev/md2 30G

Then I shrunk the RAID to about 40GB:

mdadm --grow /dev/md2 -z 40000000

and after that I had to resize the filesystem again to use the 40GB:

resize2fs /dev/md2

At this point I mounted the filesystem to see if it actually worked and it looked good (and smaller). Now came the hard part; to use the remaining space I had to re-partition the disk. I started fdisk and deleted the corresponding partitions and created at the same start point smaller partitions (42GB). This was the part were I was really worried about losing all my data which was fortunately backed up (of course). After I created the smaller partitions I tried to start /dev/md2 and it failed, saying that it could not find any RAID partitions.
I then tried to create the RAID again, hoping all data would be still available. I first created the RAID with only one device:

mdadm --create /dev/md2 -n 2 -l 1 /dev/sdb3 missing

This seemed to work and after mounting the new RAID I saw that all my files were still there. So the next step was to add the second device to the RAID with:

mdadm --manage -a /dev/md2 /dev/sda3

At this point the RAID started to re-sync and 20 minutes later I was able to grow the RAID to the new partition size:

mdadm --grow /dev/md2 -z max

Again I had to wait and before doing the final filesystem resize another filesystem check was necessary:

e2fsck -f /dev/md2 -C 0
resize2fs /dev/md2

And after only two hours I finally had what I wanted. I rebooted the system and it came up with the smaller / partition. I used the remaining space to create a new RAID (/dev/md3) which will probably be used with LVM if I ever need more space on this server in the future.

Without having a backup I would have not done all the steps because I was not always sure it would actually work.

Flashing Maemo

2010-02-10T08:35:26+00:00

Yesterday, I finally found the time to flash my N900 with the latest Maemo version PR1.1. I ran the flasher software on a Fedora host and the process performed quickly without problems. After recovering my backup everything was back to normal. Unfortunately I had no wifi available at the time, so when the backup recovery re-established the software setup, it downloaded ~50MB via UMTS which was somewhat unexpected.

Most notably, the browser feels even snappier than before and I am very pleased that connecting to my OpenVPN now also works over the UMTS/GPRS connection – with the previous version I could join the VPN via WLAN only (and even Patrick couldn’t fix it). I also noted quite a few new packages in the repositories, so there are more hours of fun ahead…

Just Like Three Weeks Ago

2010-02-07T16:08:22+00:00

Yesterday (2010-02-06) Benjamin and myself were again in Lech/Zürs snowboarding; just like three weeks ago. Last time (2010-01-17) Pattrick and Torsten were also able to join. This time it was only Benjamin and me.

The weather was similar to our last visit. Mostly cloudy with a few peeks of sunshine. This time, however, we had lots of new deep powder and it was freeriding time. Extremely exhausting but great fun.

Mass unattended Linux installation with FAI

2010-02-07T12:11:16+00:00

Me and my colleague are responsible for linux installations at our customer. In our scenario installations are complicated:

We are not allowed to operate an own DHCP server. The corporate DHCP server does not allow us to modify the TFTP/NFS Server settings
Our users/clients are not at our site which makes installations difficult: We have to go to our users or our users have to bring-in their client. The distance to our customers is high
Users with different hardware (RAM, HD,…) and different configuration (local users,…)

Finally we found a solution which allows us to do installations with FAI. FAI is a tool for mass unattended Linux installation. FAI works well when your hardware and configuration is the same. As we have different clients we had to implement a hook for interactive configuration.
The picture shows our final installation procedure:

We prepared an ISO file to allow our customers to remote boot an rescue system with SSH enabled. This ISO file does not have to be touched anymore as all configuration is stored on our servers. The user would only have to write this ISO (a dd-dump) to an USB stick, connect it with the client to be installed and power it on. The rescue system gets an IP with DHCP and uses a NFS export of our server as nfsroot. The kernel parameter nfsroot= make sure it uses our NFS server. After booting the rescue system, the User gets a message with the actual IP and our telephone number. The user has to call us to start the installation procedure.

We can then connect with ssh and the client IP. As the nfsroot contains our public SSH keys we do not need any passwords. Our corporate DNS allows the use of dynamic DNS. It would also be possible to use a hostname to connect. Unfortunatelly the actual “ipconfig” in the ramdisk has not all DHCP features included and does not send its own hostname in the DHCPREQUEST. There exists already a patch, but it is still not merged.
Before this “rescue linux with nfsroot=” solution we tried gPXE and a patch of me. It did do the DNS update, but gPXE has problems booting some NICs so we abandoned it.

After log-in with ssh we start with preconfiguration of some individual items which would not make sense to configure them in our FAI repository: userid of the owner, install target (sda/sdb/….), encryption yes/no, size of the swappartition,…
The config is written to /tmp/fai/myvars.sh. Hooks and scripts can later access this config to prevent user interaction during installation.
We trigger then the start of the installation procedure (FAI) and watch the installation progress with

tail -f /tmp/fai/fai.log

FAI uses tarballs as base image and installs further packages on it. To speed up the installation we have images with preinstalled KDE/GNOME.

Now we have a standard way to install our clients. FAI also allows to install other distributions like Ubuntu, but it is still not the same : Installations with DVD are different with FAI.
FAI requires a list of packages to be installed. It would be helpful if Ubuntu would provide a meta-package which would also install the same packages as the Ubuntu installer does. FAI could then do the same procedure without using a tarball.

DNS service location in Windows XP

2010-02-03T09:14:35+00:00

My employer has a big active directory infrastructure with many subsidaries. While configuring Linuxnotebooks to authenticate with kerberos (pam_krb5) against Active Directory. I was asking myself why I have to insert all our local corporate Active Directory server IPs into krb5.conf. Is there no way to just use the DNS-Name of the Domain-Name to locate my nearest Domain Controller? How do Windows XP Clients locate a domain controller? I asked a similar question already 7 years ago, but now I am able to answer this question. The KB Article of MS did not satisfy me so I tried to put here together the most interessting information.

Here is a strong simplification how a XP Client discovers a Domain Controller:

Step 1) Lookup SRV-/A-Records for a given Domainname to locate a random Domain Controller.

$ DOMAIN=mydomain.example.net
$ dig -t srv _ldap._tcp.$DOMAIN +short
Step 2) The Records of some Domain Controller are returned. We could use this results to log-in and stop here, but the client tries to discover an DC near its site.
Step 3) In the order of the results the Domain Controller are contacted with an “LDAP Ping”. This is an connection-less and anonymous LDAPSEARCH over UDP. In the Samba source is a script  which allows sending cldap datagrams to a DC LINK

./cldap.pl –domain $DOMAIN –server
Step 4) Active Directory has a map between “sites” and “subnets”. The Domain Controller compares the client IP with its map and returns the name of the “site” (here: SiteA)
Step 5) The Client will use the “site” in further DNS request to locate Domain Controllers at its site.

$ dig -t srv _ldap._tcp.SiteA._sites._msdcs.$DOMAIN +short
Step 6) The DNS responds with Domain Controllers responsible for SiteA
Step 7+8) The client uses the Domain Controllers in its site in further requests. The client saves the sitename in a registry key DynamicSiteName to prevent step 1)-6). The client could also be forced to use a certain site with setting the registry key SiteName. Beginning with Windows Vista, it is also possible for a client to lookup the nearest DC with the associated costs.

Why do I explain explain this stuff on a LinuxBlog? Because I would be happy to see these features more in linux applications (e.g. ldapsearch).

site-discovery
If there a different locations with site-local servers, the client should alway use its nearest server to prevent WAN traffic.
This technique is also used in CDNs. There are also some approaches with geoip and DNS which could be helpful here. Some years ago I had to modify all site-local DNS servers so that the same DNS entry returns the IP of our site-local OpenVPN server but this was more a hack than a technique.

single DNS entry = all available servers
Instead of configuring different servers in client applications e.g. ldap1,ldap2,ldap3,…. it would be nicer (?) to control the clients just with one DNS entry.
This would also make the applications more robust as new failover servers can easily be published via DNS.
If the first IP returned by DNS is unavailable, the client should also use the other results (just like SMTP does it with MX-records)
Using DNS instead of an IP is also not a drawback her as there are usually more than one working DNS server in an organisation. As DNS is replicated, the same information is available on all other DNS servers, too.

btw: A microsoft consultant told me, that samba is site-aware – Nice!
Update: Also Yum supports site-discovery and fault-tolerance

luges Stammtisch - 2010-02-03

2010-02-03T00:00:00+00:00

This month's come together will be held on 2010-02-03, 8pm at our regular pub (Trödler).

Agenda: http://lisas.de/pipermail/luges/2010-February/005278.html

luges Stammtisch - 2010-01-13 [verlegt]

2010-01-13T00:00:00+00:00

This month's come together will be held on 2010-01-13, 8pm at our regular pub (Trödler).

Cluster Installation: First Nodes Up

2010-01-12T22:38:56+00:00

Since Monday I am at the High Performance Computing Center Stuttgart (HLRS) and I have started the initial installation of our cluster.The people from the HLRS have offered to support us with the initial installation, which we gladly accepted because they know how to do clusters.

On Monday I installed the three infrastructure servers which are used to control the 180 nodes of the cluster. The cluster is running Scientific Linux and my first task was to get it on those three infrastructure servers.

Those servers have two 500GB disks and they were supposed to be running as software RAID. After the seventh failed attempt to configure the partitions as RAID1 with the Scientific Linux installer we used a Debian install DVD to partition the disks and after the successful configuration of the partitions as RAID1 we installed Scientific Linux on all three systems. Not knowing how to use anaconda to configure a RAID1 (like we wanted to) was a bit embarrassing, but with all the Fedora and CentOS installation I have done I have never configured a software RAID1 from the installer; either the system had only one disk, a hardware RAID controller or I configured the RAID manually after the installation. But at the end of the day all three system were installed and configured for their tasks.

Today (Tuesday) we used the installation to boot the first two nodes of the cluster. All the nodes are running disk-less and are booting over TFTP/NFS from a single read-only image.

Update To Fedora 12

2010-01-11T21:03:36+00:00

Last week I have finally updated our mirror server to Fedora 12. It was still running Fedora 10 which has reached its end of life. The server was running Fedora 10 for a long time and it was always running with a CentOS kernel. The Fedora kernels were, at the beginning, not stable enough (crashing after three or four days) so that I quickly switched to a CentOS kernel. I know that I should have reported bugs, but in the case of the mirror server I am more concerned to keep it up and running than getting debug data from it. It also not easy for me to get physically to the machine so that I had a lot of good excuses to switch to a CentOS kernel.

Now the system is running using the Fedora 12 kernel and after a week it is still up without any problems.

Updating My RPM Fusion Builder

2010-01-08T12:01:49+00:00

I am running one of the RPM Fusion builders in a VM using CentOS and after I saw that the newly created VMs on my notebook are using virtio for network and disk access I thought that I will try this also for my builder VM. It was pretty easy and straight forward.

First I had to update from CentOS 5.2 to CentOS 5.4 so that the virtio drivers are available. After that I was just following http://wiki.libvirt.org/page/Virtio.

For the network:

shut down the VM
edit the XML and add <model type='virtio'/> to the network section
start the VM
done

For the disk:

create a new ramdisk with the virtio drivers: mkinitrd --with virtio_pci --with virtio_blk -f /boot/initrd-$(uname -r).img $(uname -r)
or dracut -f --add-drivers "virtio_pci virtio_blk" /boot/initrd-$(uname -r).img $(uname -r) for Fedora 12
change /boot/grub/device.map from “(hd0) /dev/hda” to “(hd0) /dev/vda“
using LVM requires no changes to the root= parameter in /etc/grub.conf
shut down the VM
edit the XML changing <target dev='hda' bus='ide'/> to <target dev='vda' bus='virtio'/>
start the VM
done

During the boot of the VM I can now see that it is loading the virtio disk drivers and detecting vda1 and vda2. Using lspci and lsmod I can also verify that the new virtio devices are available and also used. The VM seems to be faster but I have not actually benchmarked it.

RPM Fusion Mirrorlist Server

2010-01-08T09:55:58+00:00

On the last day of the last year (2009-12-31) both RPM Fusion’s mirrorlist server were most of the time not reachable. The problem started at 00:53 (UTC) and it was at least going on until 16:00 (UTC). Both mirrorlist servers have been on the same network and the router for that network broke down. If it would have been the link to our provider the router had a backup route to stay on-line, but this time it actually hit the single point of failure – and everything was off-line. See: error report of the provider (german).

I was never happy that both mirrorlist server were running in the same network and I especially wanted to get the mirrorlist server off my mirror server. Thanks to Patrick I have now access to another VM at a different provider where I am running a new mirrorlist server instance. It does not require much in terms of resources and bandwidth, but having root access makes everything so much easier.

RPM Fusion’s mirrorlist server are now two dedicated VMs at two different providers and that should protect the functionality from failures like the one on 2009-12-31.

Learning while in holiday: Kerberos

2010-01-05T19:07:04+00:00

I had already user experience with Kerberos, but now I wanted to install it myself. I took the MIT Kerberos implentation. Even I was used to use “single-sign-on” with SSH keys, it was amazing to see how ssh, telnet, smbclient and ldapsearch on an Active Directory Server works without logging in. Kerberos is also capable to encrypt telnet network traffic.
Installation was fast, too. It took only long to understand the architecture of Kerberos. Fortunatelly oreilly has a nice book, too.

Learning while in holiday: OpenLDAP

2010-01-05T19:06:38+00:00

I read a whole book about OpenLDAP to use all features of a directory server. I managed to migrate from flat files to LDAP and set-up replication. Samba is using OpenLDAP as backend, too. Installation was really fast and it was quite uncomplicated.

Learning while in holiday: Rootserver with KVM

2010-01-05T19:06:11+00:00

Together with some colleagues we rented a rootserver at Hetzner. Everyone has now an own KVM guest with 512 MB RAM and 50 GB HD. Usually KVM uses a bridged network setup when using official IPs. As Hetzner routes the IP to the rootserver (instead of switching it), we had to built a small virtualised routed network with internal transfer IPs so supply the guest with network connection.
On demand from Adrian I spent a KVM guest as mirrorlist-server for rpmfusion.

Fixing The Planet

2010-01-05T11:51:01+00:00

Adrian just upgraded lisas.de to Fedora 12 and that brought us an upgraded python. Unfortunately the current planet version uses the md5 module which has now been deprecated, so cron now sends me one deprecation warning per hour, which is rather frustrating. I wrote a little patch to fix the planet and this entry will be the one to test the patched planet with. If it works I’ll add the patch to bug #552462.

Saving the planet

2010-01-03T19:28:09+00:00

I’ve moved my printer to another room. Now it’s connected to my continuously running computer. But it’s constantly connected to power and is not really switching off. So I was searching for a solution to switch it of automatically. Using a µC would be nice, but the idea a the moment is to use a USB->serial converter and us the status pin RTS to switch a solid state relay. Today I’ve successfully tested the setup. First I tried with python, which in general is able to set the status of that pin, but unfortunately python is too “high”. During initialization and termination RTS is touched. And I don’t want to “shock” my printer with short switching pulses. But I’ve found this C-code. This allows to keep the state of the pin after termination of the program. This little piece of code exactly does what I need. I’ve added a diode before connecting RTS to the solid state relay to make sure that the relay does not see a negative voltage. I can not yet post a picture of that because my prototype is highly dangerous and I don’t want to provide any examples of dangerous 230V wiring on the net.

The next step will be to set up a cups backend that switches on and off the relay.

Putting things together

2009-12-24T13:27:57+00:00

Since I’m on holiday I have more time to play with the µC. I’ve now got a 2X16 character display running and I can read temperature from the small one-wire sensors. So I’ve put that together and created a thermometer.

The sensors are the small barely visible black dots on the upper part of the breadboard. The oscilloscope visible on the left I’ve taken with me from office during Christmas holiday since I can’t afford such a thing.

2009-12-22T00:00:00+00:00

After mirroring ftp.mozilla.org since 2000 we are now finally included in the automatic redirector pool. Chances are, if you are downloading something from mozilla.org, that you will be redirected to our mirror.

It does rock indeed

2009-12-15T21:53:48+00:00

So this is the obligatory blogged-on-the-N900 blog entry, straight from the maemo browser running all that WordPress JavaScript. So far, I am pretty amazed, although it’s only one day and I didn’t have much time to play with it. Software and UI are much more polished than I would have expected, and browsing the web works so much better than with any other mobile browser I’ve used so far.

Storage Trouble

2009-12-14T10:06:50+00:00

In the night from Friday to Saturday a disk (slot 7) from our external RAID, containing most of the mirror server data, failed and was marked as BAD. No really a big problem, yet. The hot spare drive was activated and the rebuild started. About 24 hours later the rebuild finished. On Sunday (around 16:00) another drive (slot 5) failed and we immediately started to sync all the data to another box in case another drive decides to go off-line, which would mean a complete data loss. All the data on that RAID are (only) mirrored, but to re-sync all the 9TB we currently have would probably take a few weeks. Unfortunately the sync to another box will also take a few days until it is finished, so it is still possible that we might lose a lot. We are waiting for the replacement disks which have been promised to be here by Monday (today), but as the rebuild needs over 24 hours there is still the chance of a data loss.

Update (2009-12-14 23:20): The replacement disks have arrived and after more than twelve hours 25% of the array has been rebuilt.

Update (2009-12-15 11:00): After more than 24 hours 58% of the array has been rebuilt. It seems to rebuild faster during the night.

Shipping

2009-12-13T10:10:24+00:00

It’s on its way! I have finally ordered one of these fine mini laptops that can serve as cell phones, too. Now I’m sure that Adrian will taunt me for buying a device that comes with my favorite audio daemon pre-installed, but hey if it works as it should I’m OK with that. What convinced me to get one of these phones is that I will be able to install Debian packages, that it features an XTerm hotkey that will open a shell from anywhere and that it should be useful without relying on my Google account.

Getting packages without beeing at home

2009-12-11T21:03:22+00:00

Today I picked up my first package from a Packstation. A Packstation allows receiving packages 24/7 without beeing at home. It is quite simple: When a package arrives, a Mail/SMS notifies the receiver. The receiver then needs to go to a Packstation, enter a PIN, open a slot and take the package.

Back In School

2009-12-10T14:52:50+00:00

Not really back in school, but it has been now more than one week that I started my new job at my old university in Esslingen at the beginning of December 2009. After only 11 months at my previous workplace (Matrix Vision) I am now working for the faculty of Information Technology.

I will be responsible for the setup and installation of the new cluster of the university. The cluster will be part of the bwGRiD and it will have around 1500 cores and is currently being installed. It is partly water-cooled and a few days ago the racks were delivered and installed. The cluster is from NEC and we are expecting the servers to be delivered in the next few days. The cluster will be running Scientific Linux.

I am now in the same building as my mirror server. This might be a good thing, because now I am much closer to the hardware and can act faster if something unexpected happens… It might also be a bad thing, because now I am much closer and can experiment with things I would not do if I was not in the same building.

Euro Gusto

2009-12-07T22:28:58+00:00

I’ve been to Tours in France. For picking up my sister at the Euro Gusto. This is an exposition comparable to the Slow Food. OK, I’ve to admit it’s not very reasonable to drive 1800 km in 3 days just for having a look at some wine and tasting some smelling cheese. But I like France and it was definitely good to away from work for some days and I had the possibility to correct some of my prejudice about French people. They tried hard to understand my bad French and did not ask for every word I’ve pronounced in a wrong way and they even tried to talk German to me.

The picture shows the things I’ve bought there: cheese, calvados, almonds, fleur de sel and nougat.

Grub2: partition name

2009-12-02T23:12:48+00:00

One interessting change in Grub2: “The first partition of the disk is now accessed with hd0,1 and not longer with hd0,0″
A german article about further changes in Grub2: linux-magazin.de

luges Stammtisch - 2009-12-02

2009-12-02T00:00:00+00:00

This month's come together will be held on 2009-12-02, 8pm at our regular pub (Trödler).

Agenda: http://lisas.de/pipermail/luges/2009-December/005272.html

next steps

2009-11-22T15:47:08+00:00

Now that the prototype is running it’s time to move on to “series” production. The files of the first version are here.
So a PCB has to be designed and the parts have to be selected and tested. Selecting the parts is not that difficult, but designing a PCB is not that easy since I don’t have any experience. In addition it looks like the old days are finally over. It’s becoming more and more difficult to get non-SMD-parts.
Btw: I’ve updated the pictures. The red background was a little bit too much and had to be changed to black.
Question: Does anybody have a good idea how to take picture to show that the dimming is working?

2009-11-10T00:00:00+00:00

We are now part of the rsync.de.gentoo.org and rsync.europe.gentoo.org rotation.

Convergence Revisited

2009-11-07T17:07:39+00:00

While idling in front of my desktop watching the karmic update complete, I decided it was time for a fresh wall paper. So I put some of the good, old convergence onto a photo I took at our local tram museum recently. In case you want to run underneath a historic tramway, too, here a three different resolution edits (1280×1024, 1680×1050 and 2560×1024):

luges Stammtisch - 2009-11-04

2009-11-04T00:00:00+00:00

This month's come together will be held on 2009-11-04, 8pm at our regular pub (Trödler).

First Result

2009-10-16T15:21:21+00:00

Yesterday evening the first real result was visible. Reception of DMX data and output of PWM on 8 channels is working now.

At the moment it’s only a development board.

All external parts are attached via loooong cables to other hardware.

A PCB Design is ongoing, but not all the details are yet clear for series production.

OKOK, that was maybe a little bit to short. First of all:

DMX: a strange protocol, that looks like it was intended to keep amateurs from building their own devices by adding a protocol error as start signal. But with todays µCs is possible, even though it’s a little bit ugly.

In my setup there is a light control desk which is the sender. So I only care about receiving at the moment.

The received 8 byte are saved in the µC and are the input data for the PWM generator.

Th PWM signal is used for PFC.

An external circuitry is used to detect the zero crossing of the 230V AC and based on the received DMX data triacs can be started.

Now that the basic functionality is working I can add service functions and error detection.

2009-10-09T01:00:00+00:00

Reboot for RAID reconfiguration and kernel upgrade.

luges Stammtisch - 2009-10-07

2009-10-07T00:00:00+00:00

This month's come together will be held on 2009-10-07, 8pm at our regular pub (Trödler).

Agenda: http://lisas.de/pipermail/luges/2009-October/005264.html

USBprog

2009-09-25T17:07:22+00:00

USPprog (available here) is a very useful tool. I mainly use it as a AVRISP mk2 clone. This is done by flashing an AVRISP mk2 emulation firmware in the µC of the USBprog. Tools for doing that are available for the command line and also as GUI. I’ve ordered the parts together with some ATMega32 µCs and a prototype board. Since the USBprog consists of very few parts it can be easily soldered even by not so experienced users. The result looks like this:

The difficult part is to flash the boot loader SW on it. It’s a chicken/egg problem. I want to flash a SW on a µC that I want to use for flashing a µC. But with an old PC that has a parallel port it can be done.
After that I had a working USBprog. On the right you can see the USB port and on the left the cable used to connect to the µC.

Justification

2009-09-20T10:45:31+00:00

Having a complete PC is a good thing, but for controlling small things like a light it’s way too big and expensive, so I’ve decided to use smaller processors for that. After some research I ended up with the AVR micro controllers made by Atmel. They are easily available and affordabel and what is even more important: An open source toolchain consisting of avr-gcc and avr-libc exists and even the hardware I’ll be using for programming the µCs is open source: USBprog.

First Text Then HTML

2009-09-18T11:50:48+00:00

I finally have mutt configured in such a way that it first tries to display the plain text part of a mail and only the HTML part if there is no plain text available. For years I had mutt configured to display HTML mails using lynx but it was displaying the HTML part even if there was plain text available.

To display HTML mails I was using auto_view text/html in my .muttrc like it is described everywhere with the following corresponding entry in my .mailcap:

text/html;      lynx -dump %s; copiousoutput; nametemplate=%s.html

The problem with this setup is that it displays the HTML part of a mail even if there is a plain text part available. So I had auto_view text/html disabled for most of the time and edited the configuration file manually to enable it again for the rare cases in which I received a HTML only mail.

But as this is mutt and almost everything can be configured I finally searched and found a solution:

auto_view text/html
alternative_order text/plain text/html

If the message has a plain text part and a HTML part mutt shows me the plain text part, but if there is only a HTML part available I get the HTML converted to plain text. Exactly what I always wanted.

Hello world!

2009-09-18T08:03:20+00:00

With some help of Alex this is now working and I can say “Hello world”

Whatever blogs were originally invented for, I’ll use it mainly as a documentation tool for my struggles with the atmega32.