I recently installed Linux Mint (ubuntu with some goodies) on a laptop and wanted an encrypted whole disk. In order for this to be truly secure, you need encrypted swap. Well most of the HOWTOs for encrypting swap use a randomized key. This breaks hibernate to disk for laptops because the linux kernel has no way to decrypt a randomized cipher (of course). So I referenced a separate howto and combined the two approaches. I can now hibernate to disk using an encrypted swap partition that is protected with a passphrase in the same as way as root and home partitions.

It should be apparent this howto is non-trivial.  The config file changes I supply in it are in diff -u format so this is deliberately written for a technical audience. My research indicates that there is some interest in getting this into distributions in a more elegant fashion, but that kind of deep integration takes time. I needed something that works for me now.

Anyway, here’s the link in the Linux Mint user forums: ]]> http://www.scottharney.com/2009/09/17/linux-with-encrypted-root-and-swap-with-working-hibernate-to-disk/feed/ 0 http://www.scottharney.com/2008/06/12/vicious-week/ http://www.scottharney.com/2008/06/12/vicious-week/#comments Thu, 12 Jun 2008 15:09:19 +0000 scotth http://www.scottharney.com/2008/06/12/vicious-week/ Oh Man, These past two weeks since getting back from Vegas have been brtual. I’ve had patches blow up in my face (partly because Solaris patching is still so 1995). I had a storage crunch on my NetWorker index store force me to borrow some space and mount it over NFS. Which worked great. Until the server housing the NFS mounts core dumped and spontaneously rebooted in the middle of the backup window, wiping out the indexes of the two largest Oracle database servers in the environment. Yeah, the indexes were back on tape, but it would (and did) take a while to get em back. And of course I had to find some more spare space. That spare space had to come off of local, unprotected disk again (except for tape) since we are out of SAN storage until some new hardware hits the floor. That means a month or so. In the middle of hurricane season, as usual. All of which has meant precious little sleep of late.

Oh, and I’ve had my problems with Legato, er, EMC NetWorker over the past few years, but none of the above was NetWorker bug-related and it handled all that mess far more gracefully than I would’ve expected. It failed and restarted backups automatically, and recoving indexes was a simple process. I’ve done some bootstrap recoveries for DR tests in the past, but this was the real deal. So hoorah for NetWorker for doing something right and not being the cause of sleepless nights (yes. 7.3.3 is very stable in our busy,big, and hopelessly complex environment).

And of course there has been the inevitable management foolishness. Most of the above didn’t affect anything outside of “my world” but as soon as some manager sees a status update, they try and correlate some technical issue they’re having to my event and I have to answer all this foolishness. Politely. With little or no sleep. Not to mention, more foolishness sending me out of town for what looks to me like pure politics and little technical merit, but maybe I’m missing something. Nah, probably not. it’s a dog and pony show. I wonder if I’m a dog, or a pony?

Anyway, if anybody out there has some really super secret vacation ideas they want to share, send em my way. My wife and I really haven’t been on a vacation alone since 2004, our honeymoon. And, apparently, travel is, like, really expensive right now.

Vegas a few weeks ago didn’t do much for me for the vacation side, as mentioned below. But as a technical/educational trip, it was pretty cool. I’m not much of an EMC fanboy. We use both Netapp and Sun/HDS storage here in addition to EMC. There are things about those platforms I like a lot better than the mish-mash of storage options EMC presents.

I attended a ton of technical sessions. There was a large VMWare presence there, which was pretty cool. We are deploying VMWare ESX, though I’m not directly involved in that activity. We handle the storage for ‘em though as well as the backups. To that end, I got really interested in Avamar for doing our VMWare guest backups. We did an eval here and it looks pretty good and it looks like we’re actually going to get it. I went to several sessions with that as well and feel a lot more comfortable with having stuck my neck out for this solution.

I’m sure there will be headaches in the deployment, but it should help. And I’ll be able to remove some complexity from our Networker deployment and free up some index space, by potentially removing 100 or more clients and putting them in Avamar. File servers, vmware guests, and some DMZ-resident hosts are all good candidates for that. Unlike a lot of EMC NetWorker customers, we aren’t initially interested in using NetWorker 7.4 with nominally-integrated Avamar. One of my goals is to reduce my complexity and index space in our huge NetWorker setup. So dividing and conquering actualy simplifies things for me rather than having one global namespace. I had some conversations with some EMC techies (and not sales techies) and they said that was unique in their experience.

But the reality for me is, even if the software can technically scale to 1000+ clients processing 100s of terabytes/week of backups (and DR copies), can it really be managed by humans at that point?  At such a scale, can you even get a window to patch things, do upgrades, etc? And if you do have a problem, the pain you have and the pain that problem can cause can be quite big indeed.  Obviously for me it already is with ~800 clients and about 70TB/week. (see paragraph one)
I’m still digesting material from the convention and looking forward to getting my hands on the presentation material. Like I said, it was pretty interesting stuff. If you’re, ya know, a geek.

Note: Yes. this is the most technical/geeky thing I’ve posted in years.

Serving data with http and ftp is is not very CPU intensive, but over time the amount of rsync traffic being fed by the kernel.org server continued to increase, and rsync is CPU intensive. “That’s what rsync does” Peter said, “it trades bandwidth for CPU horsepower. We were getting to the point where we had all the bandwidth, but the Dual PIII 1.1′s couldn’t really keep up.” He noted that the load average kept growing, well into triple digits. Referring to 32-bit systems, Peter noted, “we learned that the Linux load average rolls over at 1024. And we actually found this out empirically.”

That’s fairly amazing. Also noteworthy is the bare number of software optimizations they’ve thrown at the problem, which basically consisted of mounting their filesystems with the noatime attribute. Have to double check that one on some of my busier http boxes.

Slashdot has an article in their FAQ, detailing their hardware and software mix as well. It probably hasn’t been updated in a while but the basic config described probably remains as detailed in the FAQ entry.

In fact, any change can be made. Software can be added. And further, those changes can be incorporated with Knoppix’s existing persistent home dir feature. So every time you boot it, it picks up your mods. Knoppix already has so many uses and so much functionality. And it keeps getting better.

First read about it on oreillynet.

Lots of folks think a re-install might not be necessary; just apt-get upgrade to happiness. But, honestly, I’ve got a mess of old packages, configs, etc form having a nearly 4 year old desktop, unstable installation. If this box were a server with a stable-testing, it would be a different story. There are times when a clean install makes sense. And it would give me a chance to get re-aquainted with the “Debian way” and new tools they have built — just recently I discovered the rather handy modules-assistant for rebuilding nvidia-kernel and alsa-src on my 2.4-kernel unstable Debian box.

References

• http://people.debian.org/~jgoerzen/dfs/html/dfs.html
  – DFS documentation
• http://julien.danjou.info/article-apt-build.html
  – apt-build tutorial (translated from French). Gives (overly) fine-grained build customization ala Gentoo.

In any case, it’s a neat concept and something I may have to try soon.

OpenBSD doesn’t have portupgrade like FreeBSD. Many OpenBSD users just take a snapshot of installed ports/packages by first running pkg_info and then deleting their package database as described in OpenBSD’s upgrade documentation. OpenBSD does offer a script though, to check what ports are out of date: /usr/ports/infrastructure/build/out-of-date. The script seems to work well for my needs.

So I found gnump3d and liked what I saw. So I installed it, reconfigured some firewall rules, and liked it even more. This is a web-based way to control and stream an music collection. The web interface is well-designed and skinnable. It seems to give me more control than xmms-shell. I can cue up individual songs or albums. Each song is a playlist so I can easily scramble within my xmms client at work rather than on the server. I can create customer playlists through the web interface.

The coolest feature is the way resampling is handled. The parameters for resampling (called downsampling in gnump3d.conf allow you to specify subnets that do not require downsampling. Thus I can fire up a session on my local desktop and use it to control music and those songs will not be re-encoded to a lower bitrate. The cacheing that happens between each song due to stream is instantaneous on a local connection so album play is minimally interrupted.

gnump3d doesn’t utilize a MySQL or other backend database. It’s very simple to setup and has taken some reasonable security precautions. I like it’s “keep it simple” approach.

It doesn’t work well through the reverse inbound proxy so I run it through an alternate port on the firewall and redirect that to the internal gnump3d server. One way I could deal with this is switch to Apache::MP3. This is a mod_perl solution that runs within Apache. So even SSL-encrypted streaming could work through this. Port 80 name-based virtual hosts work fine Apache::MP3::Skin and Apache::MP3::Resample would provide the additional similar functionality. A user can choose the level of resampling desired so it’s pretty interesting.

Since gnump3d works so well for me I didn’t try the Apache perl module approach but I may mess with it at a layer time. I’ve been experimenting with mod_perl stuff for a while so it may be educational to mess with this.

  VERBOSE=off
  PATH=$HOME:/usr/bin:/bin:/usr/local/bin:.
  MAILDIR=$HOME/Mail      # You'd better make sure it exists
  DEFAULT=/var/mail/scotth
  LOGFILE=$HOME/Mail/from
  LOCKFILE=$HOME/.lockfile
  SENDMAIL=/usr/sbin/sendmail

  :0 Wh: msgid.lock   # get's rid of duplicates
  | formail -D 8192 msgid.cache

  # Autoresponder
  :0i
  * !^Subject:.*Re:
  * !^FROM_DAEMON
  * ^Subject:.*get key
  | (formail -r -A "From: scotth@scottharney.com" ; cat $HOME/.pubkey.asc)\
      | $SENDMAIL -oi -t

  # SpamAssassin
  :0:
  * ^X-Spam-Status: Yes.*
  $MAILDIR/junk

  # mailing list inet-access
  :0:
  * TO.*inet-access
  $MAILDIR/inet-access

If you just need an autoresponder, you’d just use formail in a .forward. Here’s how I do it using a mail server running qmail. Just create
~/alias/.qmail-autorespond containing the following text

| (/usr/local/bin/formail -r -A "From: autorespond@yourdomain.com" ;\
   cat /var/qmail/alias/autoresond.txt) | qmail-inject

Put your autoresponce email body in /var/qmail/alias/autorespond.txt. The ‘qmail-inject’ is qmail’s way of saying ‘/usr/sbin/sendmail -oi -t’.