asyd’s blog

Une partie du public

Puppet

Alban Peignier

ZFS

Olivier Delhomme

Le clustering

Arnaud Gomes-do-Vale

Splunk

Bruno Bonfils

Gestionnaire des annuaires via GoSa

Benoit Mortier

Fusion Inventory

David Durieux

iTop

Erwan Taloc

Remerciements et conclusion

Quelques minutes de pause entre deux conférences

En premier lieu, je tiens à remercier Olivier Delhomme et l’école des mines pour nous avoir mis à disposition la salle, qui je dois l’avouer était vraiment sympathique. D’autre part, merci à François Bayart pour avoir imprimé et fabriqué les badges, ramener le café et des gâteaux, ça fais tout de suite plus convivial ! Bien entendu un grand merci aux conférenciers, d’une part d’être tous là, et d’autre part d’avoir bien compris l’objectif de la journée. Merci à Fabrice Bacchella pour ses photos.

Au vu de ce que l’on peut nommer un succès, nul doute que cette journée ne sera que la première. La seconde est prévue pour fin janvier, donc si vous avez des idées de sujets, n’hésitez pas à m’en faire part !

Today, I was looking for a small tool to display interface usage on Solaris, I tried first iftop. However, after spent few hours to try to build it (including ncurses, libpcap) I finally got a binary, but it’s not working! After google for few minutes, I found Bandwitdth monitor NG. It’s a very simple software, which uses only few libraries, and works like a charm!

Here a snapshot:

And for information, ldd output :

% ldd /opt/tools/bwm-ng-0.6/bin/bwm-ng
libcurses.so.1 => /lib/libcurses.so.1
libkstat.so.1 => /lib/libkstat.so.1
libc.so.1 => /lib/libc.so.1
libm.so.2 => /lib/libm.so.2


After few weeks trying to persuade my boss to buy Splunk, I start to put it in production. My first goal was to clone the search application’s dashboard using a dedicated index. Indeed, I have few splunks agent reading some tomcat’s logs and forward them to my splunk instance. All these logs are going to a dedicated index, named rtlnet. Our webdeveloppers want to use splunk to see the production’s logs. While it was easy to create the rtlnet index, I wanted to clone the search’s dashboard to give them an overview of logs by application, or by host. However, while it was easy to add index=rtlnet in the metadata search, I was not able to add the index in the search computed when you click on a result (for example the sourcetype).

Here the original code which produce one of the three panel:

      <module name="SearchLinkLister">
        <param name="settingToCreate">list1</param>
        <param name="search">| metadata type=sources</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="label">source</param>
            <param name="value">source</param>
          </list>
          <list>
            <param name="label">totalCount</param>
            <param name="labelFormat">number</param>
          </list>
        </param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">list1</param>
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="source">$target$</param>
            </param>
          </param>
          <module name="ViewRedirector">
            <param name="viewTarget">flashtimeline</param>
            <param name="uriParam.auto_pause">true</param>
          </module>
        </module>
      </module>

As I said, adding index=rtlnet in the metadata search is trivial. However, when a user click on a result (in that case on a source), the computed search was only source=$target so there was no result, since it the index is not specified. After spending few hours trying to understand how to add the index in the existing intention, I finally understood I need to nest it into a new HiddenIntention. Here the new module definition:

      <module name="SearchLinkLister">
        <param name="settingToCreate">list1</param>
        <param name="search">| metadata type=sources index=rtlnet </param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="label">source</param>
            <param name="value">source</param>
          </list>
          <list>
            <param name="label">totalCount</param>
            <param name="labelFormat">number</param>
          </list>
        </param>
        <module name="HiddenIntention">
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="index">rtlnet</param>
            </param>
          </param>
          <module name="ConvertToIntention">
            <param name="settingToConvert">list1</param>
            <param name="intention">
              <param name="name">addterm</param>
              <param name="arg">
                <param name="source">$target$</param>
              </param>
            </param>
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
              <param name="uriParam.auto_pause">true</param>
            </module>
          </module>
        </module>
      </module>

As you can notice, I embedded the existing ConvertToIntention module in a new HiddenIntention. Cheers!

Here a rsyslog snippet to create a file by day, by device. Indeed, the %now variable take a value like 2010-05-24. Note that HOSTNAME will be replace by the hostname send by the syslog client. If you want to use IP, you can use %fromhost-ip%, and if you want the DNS name resoved by the rsyslog server, use %fromhost%.


$template default,"/data/logs/%HOSTNAME%/%$now%.log"

*.* ?default


Alors que la liste sysadmin@asyd.net va bientôt fêter ses 4 ans d’existence (création le 17 septembre 2006), avec un total de 157 abonnés, nous commençons l’organisation du premier séminaire.

Au programme :

Pour les confs éclairs, la liste ne fait que commencer, mais on y trouvera :

• JRDS, un cacti like en Java
• PowerDNS

N’hésitez pas à vous manifester pour proposer une conf éclair !

Cet événement prendra place à l’école des mines à Paris, 60 Boulevard Saint Michel. Pour des raisons pratiques d’organisation, les participants sont invités à s’enregistrer.

It’s the first time I’m using pound (a http reverse proxy), and I was a little disappointed about its configuration. My use case is very simple, for a given virtual host (idp.asyd.net in my case) I want to redirect from / to /opensso. Since pound seems not very well documented, here my configuration to achieve that:

ListenHTTP
   Address  0.0.0.0
   Port  80
   Service
      HeadRequire "Host: idp.asyd.net"
      URL "^/$"
      Redirect "http://idp.asyd.net/opensso"
   End
   Service
      HeadRequire "Host: idp.asyd.net"
      Backend
         Address 127.0.0.1
         Port 8080
      End
   End
End

As a new owner of an yubikey, I was looking the best way to integrate it with the web application I already use. While there is already an available OpenID provider which support Yubikey authentication, I prefer to manage my own system, using OpenSSO for sure

First, let me introduce the yubikey. This USB key act as an OTP (One Time Password) device, each time you press the button, the key compute a new password. This pasword must be verify, in the case of Yubikey, this is done by query a Webservices on a yubico (the company) server. Yubikey offers a lot of advantages than others classical OTP devices, including:

• The yubikey is see as an USB keyboard (class HID), no driver required!
• No battery, more longlife than anothers devices
• Very cheap, around 20 euros (ordered by 10, from France), transport and taxes included

So, why choose OpenSSO? For few years know, OpenSSO provides an extension to act as an OpenID provider, and an authentication class is available for the Yubikey.

References:

• Build the OpenSSO extension for OpenID
• Build the Yubikey authentication class

I actually manage a LDAP directory with a lot of entries (almost 1,5 millions entries in the same OU). In order to check the replication state, I was looking for a way to count the number of entries in this OU. Thanks to Ludovic Poitou (once again), this information is available via an hidden attribute in the OU.


% ldapsearch -Wxh ldap1 -D "cn=Directory Manager" -b 'ou=people,ou=ssousers,dc=asyd,dc=net' -s base '(objectClass=*)' 'numsubordinates'
[..]
dn: ou=people,ou=ssousers,dc=asyd,dc=net
numsubordinates: 1386931


Depends on the directory server, it’s also possible to get the number of entries for a given backend (the following code was tested for Sun Directory Server 5.2):


% ldapsearch -Wxh ldap1 -D 'cn=Directory Manager' -b 'cn=monitor' -s base '(objectclass=*)' 'backendmonitordn'
[..]
dn: cn=monitor
backendmonitordn: cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
backendmonitordn: cn=monitor,cn=ssoUsers,cn=ldbm database,cn=plugins,cn=config
backendmonitordn: cn=monitor,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config



% ldapsearch -Wxh lynx -D 'cn=Directory Manager' -b 'cn=monitor,cn=ssoUsers,cn=ldbm database,cn=plugins,cn=config' -s base '(objectclass=*)' 'ldapentrycount'
[..]
dn: cn=monitor, cn=ssoUsers, cn=ldbm database, cn=plugins, cn=config
ldapentrycount: 1408974


Most of system administrators use OpenSSL (which is not a good idea, but it’s an another story) to manage their PKI. While OpenSSL is good to create/convert X509 certificates from PEM/DER to PKCS#12 (and vice versa, for sure) it doesn’t understand the JKS (Java KeyStore) format. JKS are used in Java world, for example Glassfish application server, OpenDS and so more. In this post, I’ll explain how to convert a PKCS#12 to a JKS using portecle. portecle is a small, but very useful application (written in Java) to manipulate keystores.

1. Download portecle, extract it, and lauch it using java -jar portecle.jar (note that Java 6 seems required for version 1.4.x)
2. Open your PKCS#12 file, provide the password
3. Click on Tools/Change KeyStore Type/JKS menu
4. If you don’t want to use the default password (which is password), click on the menu keystore password
5. Save it, that’s all folks!

You can know list the contents of your JKS using keytool:


% keytool -list -v -keystore yourkeystore.jks


Here the following commands I use to create a IPMP (IP Multipathing) groups (master/slave):


#!/bin/sh

# Add logicial interface
ifconfig nge544001 addif 10.16.244.60 netmask 255.255.252.0 up


You can also tweak the multipath daemon by editing /etc/default/mpathd to decrease the value to detect a NIC failure.

• Solaris 10 IPMP Documentation reference