ingenious excerpts

CollabNet Subversion Edge cont'd

2011-12-29T15:04:00.000+01:00

I already explained Collabnet Subversion Edge and my experience installing it. Now I want to focus on installing Trac (with some hacks).
I really thought this should be easy, but it turns out that there are a lot of pitfalls. So for any other poor souls who are not fluent in python (and for my own reference) here it goes.

Installing Trac

As you know, trac has some requirements. Namely setuptools and genshii. There are a few packages to download for Windows here. I didn't know which version of python came with subversion edge, so I checked. There is a folder named csvn/python25. So it seems to be python 2.5. But wait - there is a python27.dll in there. and some other files indicating python 2.7. So which is it?

D:\csvn\Python25>python.exe --version
Python 2.7.1

Alright, that settles it. But why did Collabnet not rename the folder..?
So I downloaded the setuptools package for python 2.7 and win32. The installer failed to run, it sais it couldn't find any python 2.7 installation.

Apparently a regular python installer will create some registry entries so that the system recognizes the python installation. Collabnet subversion edge doesn't do this anymore due some complaints.
So I had to go in there and manually create the relevant entries. They were already present from the old python 2.5 installation, which I wanted to get rid of anyway. So I changed the version to 2.7 and updated the paths to point to D:\csvn\python25. This let me install setuptools, genshii and finally trac too.

Configuring Trac

That part was straight-forward. Like with subversion, I just copied the relevant parts of my VisualSVN server's apache config and pasted it to the main httpd.conf file. Here is the relevant snippet:

<Location /trac>
SetHandler mod_python
PythonInterpreter main_interpreter
PythonHandler trac.web.modpython_frontend
PythonOption TracEnvParentDir D:\Trac
PythonOption TracUriRoot /trac

AuthName "Trac"
AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain jerich
SSPIOfferBasic On
SSPIOmitDomain On
require group DOMAIN\Trac-Users
</Location>

All relevant modules are already loaded, so that's it.

Collabnet Subversion Edge

2011-12-29T14:30:00.000+01:00

I have been quite fond of VisualSVN Server on Windows, since it was an easy way to setup subversion with a nice means to administer repositories and users.

As of lately, I grew tired because of the way they mangled apache, subversion, python and trac together. While searching for an alternative I found out that Collabnet offers exactly what I need: Apache bundled with Subversion, Python and other stuff. Very nice! This bundle is called Subversion Edge.

I decided to take the plunge and update the production VisualSVN server. After all: How hard can it be?

The installation went fine, and the collabnet subversion edge web-interface greeted me.
I had tweaked the configuration of VisualSVN server to allow single-sign-on with SSPI, so I naturally wanted to copy the relevant parts of the config. Once one tinkers with the config files, the web-interface can no longer be used to make changes to those parts. That's fine by me.

After this was taken care of I fired up Collabnet's Apache service and started to dump my subversion repositories one by one. Instead of manually loading them with svnadmin, the web interface of subversion edge provides takes care of that. Simply point it to the dump file and go ahead. That was easy!

Setting up the server, finetuning apache and migrating my three repositories took less than one hour! ;-)

rancid updates

2011-09-19T11:44:00.000+02:00

I'm still happy about rancid, that I blogged about previously. I used one more change by Stefan Kublik that is also present in rancid-git:
Remove memory addresses from "show controllers" to avoid unnecessary change notifications

This is done by changing a line in bin/rancid from

ProcessHistory("INT","","","!Interface: $INT$1\n") && next;

ProcessHistory("INT","","","!Interface: $INT\n") && next;

In other words, just remove the $1 and you will change these lines:

!Interface: FastEthernet0/0, GT96K FE ADDR: 63F52098, FASTSEND: 62084C3C, MCI_INDEX: 0

into these:

!Interface: FastEthernet0/0,

In other news, it turned out to be tricky to have rancid automatically updating a trac repository with post-commit hooks. Trac is very picky when it comes to permissions, and you need write access to the trac environment and to the trac logfile to do that. Try out the "trac-admin changeset" command works before debugging svn-hooks, ok?

discover Rancid

2011-09-14T14:04:00.000+02:00

For those of you who don't know Rancid:

RANCID monitors a router's (or more generally a device's) configuration, including software and hardware (cards, serial numbers, etc) and uses CVS (Concurrent Version System) or Subversion to maintain history of changes.

Essentially, this allows to have full coverage over routers, firewalls, network devices configuration and changes. Every network administrator's dream, right? Well, it certainly seems too good to be true..! Let's find out.

I've set it up on a CentOS 5.4 box to tinker with it. Installation is pretty straightforward. Configuration is a bit tricky, but the sample files are well documented. There are a few pitfallse, however.

"Show VLAN" output has different line-wrapping behaviour on different IOS versions; as diff is line oriented, this leads to unneccesary changes and notifications
"call-forward all" directives are shown for cisco callmanagers or unified communication managers; if a user forwards his phone, this causes the configuration to change, and notifications to be sent out.
The notification emails show diff output in plaintext; no colors, no highlighting
Notificaions are only sent to a single email address; no distribution lists are possible

As rancid is comprised of a set of perl and bash scripts, the above issues shouldn't be too difficult to address, right? Well, there is fork called rancid-git that provides support for git as well as various other improvements. Most notably is perhaps support for html-mail. So after tinkering a bit with vanilla rancid, I decided to give rancid-git a go. After all it can be used as a drop-in replacement.

Unfortunately it turned out that most of the advertised patches/enhancments are more trouble than they are worth. First of all rancid-git is based on an outdated version of rancid, which means that certain bugfixes and fixes are missing. I didn't see any ill effects with the devices that I monitored (mostly Cisco and proCurve) but ymmv.

So I fired up rancid-git and immedately got a notification with some profound config changes. It was an HTML mail, but there weren't any colors to be seen. I use subversion as repository, so the diff command doesn't show colors. Lucliky there is an easy workaround.

The problem now is, that rancid always sends out notifications, even when there are no changes. So this patch isn't ready for prime-time just yet.

I did like the detailed commit messages of rancid-git, however. So I decided to blend together my own patchset, based on vanilla rancid. Here's what I did:

Comment out "show vlan", "show vlan-switch" in bin/rancid to get rid of the ever-changing vlan port memberships
Added "/^ *(call-forward all)/ && next;" to the dog gone cool matches in bin/rancid to filter out unwanted phone forwardings in the notification mails
Added "/.*coredumpinfo.*/ && next;" to ShowFlash in bin/rancid to get rid of the coredump bug on Cisco ASAs
Added "svn propset "svn:mime-type" text/x-ios $router" to bin/control_rancid so cisco config files can be properly syntax highlighted in trac
Added proper commit messages, blatantly copied from rancid-git
To get syntax highlighting working in trac, install Pygments and this ios lexer; simply put it in the lexers subdirectory and run _mapping.py. If you get an error for a missing attribute, add a line like this "__all__ = ['IOSLexer']" between the imports and the class.
For trac to recognize the mime-type and the IOS lexer, simply add "text/x-ios:ios" to the mime_map in trac.ini. I've tried to add the mime-type to the IOS lexer itself, but this didn't work.

This way, you can use the trac interface to view diffs and the configs. Instead of notification emails, simply rely on the RSS-feed of trac. Profit!

Apache on Linux and Single-Sign-On with Active Directory

2011-08-12T09:56:00.000+02:00

There are many howtos and blog posts that describe how to get Apache on Linux to work against Active Directory with single-sign-on. I found none of them to be current and complete. After tinkering with this topic for a while and getting it to work on my Centos 5.4 box, I wanted to post what I did here.
In my case, I wanted single-sign-on to work for agents in OTRS.

Use samba to join the AD
No need to create a special user account and tinker with ktpass and the likes on windows. Everything that needs to be done in AD can be done from Linux through samba, and it works fine.
I've tried to go down the route with the user-service account in AD and it was troublesome, to say the least. There is no resource kit for Windows 7 anymore, so there is no way to get ktpass.exe. The version from the Windows Server 2003 resource kit doesn't work in Windows 7 x64. In the end I had to run ktpass in the domain controller directly, which I'm sure isn't possible in all environments.
Compile mod_auth_kerb from source, as described by Ben Chapman here. Unfortunately the link he cites is no longer available. While authentication works with the mod_auth_kerb in the centos repositories, authorization seems to be troublesome.
Configure Kerberos and Apache accordingly.
My config files are attached. krb5.conf is complete, the rest are just the relevant parts. Case matters to krb5! I tried to define aliases so it would be less picky about that, but to no avail. Test kerberos functionality with klist and kinit.
kinit username@DOMAIN.LOCAL
Should prompt for password, and exit silently if all worked. If not, go through your config again. I've set Apaches loglevel to debug, otherwise there is no useful output in case of errors with mod_auth_kerb. I had many issues of
gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (, No principal in keytab matches desired name)
In my Apache error_log. It took me a while to figure them out. Somehow mod_auth_kerb wasn't using the correct name for the kerberos service principal, despite me using canonical names. I had to override it, and this finally worked.
Configure OTRS
I first decided to set up authorization in OTRS via Active Directory through LDAP. The OTRS Wiki provides an excellent article that outlines the necessary changes in Kernel/Config.pm. This will not only authenticate existing users through AD, but also create new OTRS users and sync them from AD. For this to work no special Apache configuration is required. If this works, move on to enable Single-Sign-On in Apache for the otrs directory.
Because I want to enable SSO for agents only, I had to use .htaccess files to specify security. So the only change in the Apache config for OTRS from the default is this:

<Directory "/opt/otrs/bin/cgi-bin/">
    AllowOverride All
    Options +ExecCGI -Includes
    Order allow,deny
    Allow from all
</Directory>

This enables us to comfortable change security settings in a .htaccess file placed in /opt/otrs/bin/cgi-bin. Here it is:

<files index.pl>
AuthType Kerberos
AuthName "OTRS Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbAuthRealms DOMAIN.LOCAL
KrbServiceName HTTP/webserver.domain.local
Krb5KeyTab /etc/krb5.keytab
KrbSaveCredentials Off
KrbAuthoritative off
KrbVerifyKDC off
# KerbLocalUserMapping on
PerlAddVar ntdomain "DOMAIN.LOCAL pdc bdc"
PerlSetVar defaultdomain DOMAIN.LOCAL
PerlSetVar splitdomainprefix 1
require valid-user
</files>

With these settings in place, we only need to adapt OTRS to use Apaches authentication. Add these lines to OTRS's Config/Kernel.pm:
$Self->{'AuthModule'} = 'Kernel::System::Auth::HTTPBasicAuth';
$Self->{'AuthModule::HTTPBasicAuth::ReplaceRegExp'} ='@DOMAIN.LOCAL';
Despite the manually compiled mod_auth_kerb I still found that Apache passed through the users with the domain name. The easy fix in OTRS is to replace that part via regex, and all is peachy. As of now I'm happy it's working and don't want to spend more time finding out why this fix is required. ;-)
Client settings
This may be obvious to some, but here it is anyway. In Internet Explorer you have to add the webserver.domain.local to the Local Intranet. Also, you have to enable Integrated Windows Authentication in the Advanced Settings. In Firefox you need to make sure to add "domain.local" to the config value network.negotiate-auth.trusted-uris. This will cause firefox to authenticate using SSPI. I use Firefox 5 and this worked like a charm. Specifying webserver.domain.local under network.automatic-ntlm-auth.trusted-uris alone will not work, as this uses NTLM, which is not Kerberos! Also, by using canonical names in Apache, it doesn't matter whether the clients access the serber by hostname alone, or by FQDN. I've had too many users who don't seem to care, so this is a good thing. Of course, when you add SSL to the equation, things look differently. YMMV.

/etc/samba/smb.conf

[global]
   workgroup = DOMAIN
   password server = pdc_fqdn bdc_fqdn
   realm = DOMAIN.LOCAL
   security = ads
   template shell = /sbin/nologin
   winbind use default domain = false
   winbind offline logon = false
   use kerberos keytab = true
   winbind enum users = yes
   winbind enum groups = yes
   winbind use default domain = yes

/etc/krb5.conf

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = DOMAIN.LOCAL
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
MYSERVER.DOMAIN.LOCAL = DOMAIN
DOMAIN.LOCAL = DOMAIN
.DOMAIN.LOCAL = DOMAIN
domain.local = DOMAIN
.domain.local = DOMAIN
DOMAIN = DOMAIN
.DOMAIN = DOMAIN
domain = DOMAIN
.domain = DOMAIN

[realms]
DOMAIN= {
kdc = pdc_fqdn
admin_server = pdc_fqdn
}

DOMAIN.LOCAL = {
kdc = pdc_fqdn
kdc = pdc_fqdn
}

[appdefaults]
pam = {
     debug = true
     ticket_lifetime = 36000
     renew_lifetime = 36000
     forwardable = true
#     krb4_convert = true
     krb5_get_tickets = false
}
[login]
    krb4_convert = true
    krb4_get_tickets = false

Where pdc_fqdn would be somthing like DomainController.domain.local.

/etc/httpd/conf/httpd.conf

These are only the relevant parts, the rest is the default config.

KeepAlive On
ServerName webserver.domain.local
UseCanonicalName On
LogLevel debug

/etc/httpd/conf.d/auth_kerb.conf

LoadModule auth_kerb_module modules/mod_auth_kerb.so
Alias /private/ /path/to/my/folder

<location private="">
Options Indexes
# SSLRequireSSL
AuthType Kerberos
AuthName "webserver Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbAuthRealms DOMAIN.LOCAL DOMAIN
KrbServiceName HTTP/webserver.domain.local
Krb5KeyTab /etc/krb5.keytab
KrbSaveCredentials On
KrbAuthoritative off
KrbVerifyKDC off
# KerbLocalUserMapping on
require valid-user

</location>

XenServer iSCSI multipathing

2011-05-26T09:28:00.000+02:00

Like many others, I use XenServer with a iSCSI SAN. To leverage a single point of failure, I enabled multipathing. When the IP or path of a host adapter changes, it can be challenging to get XenServer to recognize the new path.

The kb articles that Citrix provides about such issues are good pointers, but some commands are just plain wrong.

So this should serve as my little cheat sheet, and it might help others out there as well.

Check existing iSCSI sessions:

iscsiadm -m session

More verbosive information can be gathered with:

iscsiadm --mode node --loginall=all

If an IP has indeed changed, the old path needs to be forgotten. This can be done with:

iscsiadm –m node –T iqn.2008-01.com.openfiler:store01.lun01 –-portal=ip-address-of-the-storage -u

To reactivate a SR with multipathing one needs to get the SCSI ID from XenCenter, and then issue this:

mpathutil.py add

This step didn't work for me, however. Here's what did work in my case. Discover the targets manually:

iscsiadm -m discovery -t sendtargets --portal=ip-address-of-the-storage

Then, with the iSCSI IQN manually log on to the target:

iscsiadm -m node -T iqn.2008-01.com.openfiler:store01.lun01 --portal=ip-address-of-the-storage -l

This should yield in something like this:

Logging in to [iface: default, target: iqn.2008-01.com.openfiler:store01.lun01, portal: ip-address-of-the-storage,3260]
Login to [iface: default, target: iqn.2008-01.com.openfiler:store01.lun01, portal: ip-address-of-the-storage,3260]: successful

The added path should immediately be shown in iscsiadm -m session. If there are still issues, restart the multipath daemon:

service multipathd restart

It's noteworthy that this doesn't disrupt any services. So it should be safe in a production environment.

If XenCenter still reports wrong number of active/inactive paths, a refresh can be forced by running:

/opt/xensource/sm/mpathcount.py

XenServer 5.6 and Dell OpenManage 6.5

2011-05-23T14:02:00.002+02:00

Citrix recently released XenServer 5.6 Service Pack 2. While you probably have found out already, that upgrading from XenServer 5.6 FP1 only works through XenCenter and not by booting from the ISOs, those of you running XenServer on Dell boxes might appreciate some pointers in getting OMSA up and running again.

Dell actually recognizes XenServer as an operating system for their servers, so there is an ISO that can be used as supplemental pack when XenServer is installed. Yay! The same ISO can be used to install it on an existing system. Instructions can be found here, at Dell's Enterprise Technology Center. This site also has directions where the latest OMSA download can be found, so check it out!

I had OpenManagae 6.4 installed on all of my XenServers prior to upgrading them to 5.6 SP2. The installer failed because some conflicting packages were already installed. So I basically had to remove OMSA 6.4 before I could install 6.5. To save you the hassle of identifying the individual packages, here's how to get rid of it quickly:

yum remove srvadmin-smweb srvadmin-smcommon srvadmin-omilcore srvadmin-sm srvadmin-iws libsmbios sblim-sfcc

After running the install.sh script on the downloaded ISO, it is necessary to bounce the srvadmin services by issuing:

/opt/dell/srvadmin/sbin/srvadmin-services stop
/opt/dell/srvadmin/sbin/srvadmin-services start

Thanks to jh for pointing out the mistake.

iperf woes

2010-12-22T11:23:00.000+01:00

Yesterday I blogged about iperf, CentOS and monit. Well, it turns out it was a bit early to report success. Even with monit, iperf is inherently unstable on CentOS. Monit's log shows this:

[CET Dec 21 11:26:14] error    : 'iperf' process with pid 20557 is a zombie
[CET Dec 21 11:26:14] error    : 'iperf' failed, cannot open a connection to INET[127.0.0.1:5001] via TCP
[CET Dec 21 11:26:14] info     : 'iperf' trying to restart
[CET Dec 21 11:26:14] info     : 'iperf' stop: /etc/init.d/iperfd
[CET Dec 21 11:26:44] error    : 'iperf' failed to stop
[CET Dec 21 11:27:44] error    : 'iperf' process with pid 20557 is a zombie
[CET Dec 21 11:27:44] error    : 'iperf' failed, cannot open a connection to INET[127.0.0.1:5001] via TCP
[CET Dec 21 11:27:44] info     : 'iperf' trying to restart
[CET Dec 21 11:27:44] info     : 'iperf' stop: /etc/init.d/iperfd
[CET Dec 21 11:28:14] error    : 'iperf' failed to stop
[CET Dec 21 11:29:14] error    : 'iperf' process with pid 20557 is a zombie

And ps shows iperf is defunct. This is obviously a bad situation. When I run iperf without -D parameter, it responds one time and then shuts down. But I couldn't get this behaviour to work with iperfd and monit properly. For the record, I used "iperf version 2.0.4 (7 Apr 2008) pthreads".

So in the end I resorted to use iperf on a Windows box and run it as a service. So far there have been no problems.

CentOS, iperf and monit

2010-12-21T10:13:00.004+01:00

I'm quite fond of FAN and so I have several CentOS-based Nagios systems to check various things. I recently needed to check the available bandwith between two servers, so I decided to use check_bandwidth which is based on iperf. So far so good.
Because I need to rely on iperf to be running on both ends, I ended up using monit.

"Monit can start a process if it does not run, restart a process if it does not respond and stop a process if it uses too much resources."

Greg from the brain dive was kind enough to post the steps to set up iperf and monit on CentOS here. These steps almost led me to success, I had to do a few extra steps to make it work:

chmod +x /etc/init.d/iperfd
add "set daemon 60" to /etc/monit.conf

I found monit a bit weird to debug, because it doesn't write anything to it's logfile. So to find out why it's dying, I ran it in foreground with "monit -vI" which gives nice diagnostic output.

XenServer and Dell OMSA

2010-11-22T13:53:00.005+01:00

As I have written before, there is a way to install ans use Dell OpenManage Server Administrator on vanilla Citrix XenServer. I have got it running on three production servers for five months now without issues. One is a R710, the others are PowerEdge 2950.

I've had to update the firmware of one RAID controller in order for it to work with OMSA. This was tricky, as there is no support for doing this in Linux. So I've had to use a Windows live CD, and upgrade the firmware from there. Worked like a charm.

XenServer and Dell OMSA - addendum

2010-07-06T14:26:00.002+02:00

As I've written here it is indeed possible to install Dell OMSA on a XenServer 5.6 host without DDK. I've taken a brand new Dell R710 machine and decided to give it a go.
After I followed the instrcutions I encountered some weird issues though. The OMSA Webinterface was buggy, and only a few sensors were available.

For instance

# omreport chassis temps
Error! No temperature probes found on this system.

certainly didn't seem right. After some googling I thought I found the cuplrit in missing modules, namely dcdbas and dcdipm. I found only dcdbas was present, but not loaded:

# modprobe -l -v|grep dcd
/lib/modules/2.6.27.42-0.1.1.xs5.6.0.44.111158xen/kernel/drivers/firmware/dcdbas.ko

Loading it didn't help though. After more googling I found that openipmi is required, but isn't being installed during the OMSA install. So I installed it, restarted all omsa services and everything works fine:

# omreport chassis temps
Temperature Probes Information

------------------------------------
Main System Chassis Temperatures: Ok
------------------------------------

Index : 0
Status : Ok
Probe Name : System Board Ambient Temp
Reading : 28.0 C
Minimum Warning Threshold : 8.0 C
Maximum Warning Threshold : 42.0 C
Minimum Failure Threshold : 3.0 C
Maximum Failure Threshold : 47.0 C

XenServer and Dell OMSA

2010-06-25T15:25:00.004+02:00

So Citrix has finally seen the light and is no longer supporting OEM'd versions of XenServer. If you have Dell servers however, you might want to monitor them using OpenManage. While Dell supports a host of Linux distributions, XenServer per se (which is a stripped-down CentOS) isn't directly supported. There were a few hackish guides floating around the interpipes, but I didn't want to risk them on a production system.

Now this guy has found out how to install OMSA on XenServer 5.6 and lo and behold, there is no black magic involved. I can't wait to verify his claims. Now I'm off backing up my XenServers though ;)

Xen 4.0 on Debian Squeeze

2010-05-28T10:26:00.003+02:00

After having used Citrix XenServer for a while, I wanted to set up and test vanilla Xen for some time now. Finally an opportunity arose, so here are my findings.

Installing Xen 4.0 is easy
The debian-xen kernel is no good

Turns out that it's missing the netbk module, without which networking and xen virtual machines don't work. And virtual machines without network - let's face it - are about as interesting as washing your feet whilst wearing boots.

Oracle Forms 6i vs. Oracle 11gR2

2010-04-30T15:02:00.002+02:00

Oracle Forms 6i is a well known application, and despite it no longer being supported, it shares a huge user base. Most applications are so vast that it's simply not feasible to ever upgrade them. Instead some are being gradually replaced while others just drag on.

While Oracle Forms 6i client is of course supported even on Windows 7 and Server 2008, it is unclear whether it will be play nice with future Oracle database releases.

As Oracle datase 11gR2 has been released on Windows platforms too, I considered upgrading our old RDBMS to 11gR2. Of course we use Oracle Forms 6i client/server, which is only certified for Oracle 10gR1.

To my surprise, Oracle Forms 6i is able to connect to 11gR2 using username/password. When using Native Windows Authentication however, the client just freezes for a few seconds, then quits. I tried all patches, and even patched Oracle RSF to 8.0.6.3 - but the problem remained. It seems to be a fundemalten problem as the client is unable to connect to a 11gR2 database as soon as the parameter sqlnet.authentication_services includes NTS.

With 11gR1 however, everything's fine in this regard.

Oracle SQLDeveloper on Windows x64

2009-12-29T14:47:00.005+01:00

There is a new version of Oracle SQLDeveloper available. The release notes are here. This time there is even a build for 64bit Windows platforms available. All that needs to be done after unpacking is to point it to the JDK x64 java.exe. It doesn't work with a 32bit JDK!

There were quite some workarounds floating around to make it work. Having to install a 32bit JDK on a 64bit OS for a 32bit Java application always seemed weird to me. So I'm glad Oracle finally got around the bend and provide a fully functional SQL Developer for Windows x64.

Of course the language / regional fix still applies to this version, as they didn't bother to include a GUI option to specify them. In case you are wondering why your SQL Developer shows up in some weird language other than English, add these lines to your sqldeveloper/bin/sqldeveloper.conf:

AddVMOption -Duser.language=en
AddVMOption -Duser.country=US

improving the LG BD390?

2009-12-27T13:57:00.003+01:00

I recently got a LG BD390, which is of course a bluray player that features UPnP/DLNA support, as you all already know.

Someone has gotten the alleged firmware from LG, but turns out just to be the cross-compile toolchain and ucLinux. Well, anyway we know know that the BD370 and BD390 are based on that.

I don't think that there isn't a way to get console access to this device. A detailed network scan revealed this:

PORT STATE SERVICE VERSION
111/tcp open rpcbind
9736/tcp open unknown
44394/tcp open unknown

Port 44394 TCP returns a "500 internal server error", but probably just due to an incorrect URL. At least this means a webserver is running, so there is hope. ;-)

SS4200 woes

2009-03-31T18:30:00.005+02:00

Well, ever since I had the SS4200 it just froze from time to time. I never had a chance to find out the details, because it mostly froze during the day when I was at work, or at night when I was out drin^H^H^H^H studying.

I always thought it was related to my custom kernel. Now it finally froze in my presence, so I could check it out. I opened the case and found the fans spinning rather slowly, and the CPU and northbridge were very hot. I figured the poor thing overheated.
So in fact I was right, because I enabled thermal management and CPU throtteling in my kernel, and loaded all those modules of course.
Add the fact that the Celeron 420 actually doesn't support SpeedStep, and you've got a few kernel moduels going crazy.
I'll remove the thermal and cpu throtteling modules for the time being and see whether that improves stability.

In the long run I want a NAS that doesn't consume more power than really necessary, so I'll probably switch the CPU to a Celeron E1400 or similiar. Those already got a 2nd core and support SpeedStep. While that's got a higher TDP, I think the power consumption is going to be lower, over all.

Guess we'll have to wait and see.

C# debugging

2009-03-05T09:05:00.002+01:00

If you are a C# developer using Visual Studio 2008 and you need to debug your solution using arguments? Then read on.

There is a nice security feature in VS2008 that prevents arguments from being passed on to your executable. There even is a nice warning message, that tells you something about some bogus debug security settings. I haven't found any of these settings anywhere in the project, solution or even VS2008 settings.

I've still found a workaround, however:

In your C# project settings under Debug activate SQL-Server debugging
Make sure you've entered some arguments in the run options
Debug your solution
Profit!

You'll see the familiar messagebox telling you that the security settings permit the arguments from being passed on to the executable. Continue anyway. Then you'll see a second messagebox, yapping on about some debug security settings that were disabled. Well guess what - from now on you can use arguments to debug! Oh and of course you can disable SQL server debugging, it's only needed to trigger that metaphysical process in VS2008. ;)

VisualSVN + Trac = Love

2009-02-27T15:16:00.005+01:00

VisualSVN is pretty well known for providing a decent subversion server on windows-platforms thats also easy to administer. Even for those of us who want to use integrated windows authentication. However, the built-in support is lacking seamless single-sign-on from those applications that support it.

There exists a special version of VisualSVN thats packed with trac. While this install isn't quite as straight-forward as the standard package - whoever has installed python on a production server knows what I'm talking about - once setup it works remarkably well. Except for true single-sign-on.

To address this issue I figured that VisualSVN is just comprised of apache plus some svn modules. So it should be easy to hack in support to auth against an Active Directory. There are quite a few options when it comes to this. I found only one working stable: mod_auth_sspi.

To get the correct modules and dependancies I installed a stand-alone apache (the exact version that ships with VisualSVN + Trac), and went from there. I blatantly copied any missing deps into the visualsvn/bin folder.

Here's my httpd.conf:

#
# This is configuration file for Apache HTTP server which is
# part of VisualSVN Server.
#
# DO NOT EDIT THIS FILE IT WILL BE REGENERATED AUTOMATICALLY BY VISUALSVN SERVER
#
# Contact with VisualSVN Ltd. (support@visualsvn.com) if you have suggestions and
# improvements.
#

ThreadsPerChild 64
MaxMemFree 100
MaxRequestsPerChild 0

ServerRoot "C:/Program Files/VisualSVN Server"
ServerName "hostname.mydomain:443"
ServerSignature Off
ServerTokens Prod
DocumentRoot "htdocs"

PidFile "C:/Repositories//server.pid"

Listen "443"

LoadModule auth_basic_module bin/mod_auth_basic.so
LoadModule auth_digest_module bin/mod_auth_digest.so
LoadModule authn_file_module bin/mod_authn_file.so
LoadModule authn_visualsvn_module bin/mod_authnz_visualsvn.so
LoadModule authz_visualsvn_module bin/mod_authnz_visualsvn.so
LoadModule authz_svn_module bin/mod_authz_svn.so

LoadModule dir_module bin/mod_dir.so
LoadModule deflate_module bin/mod_deflate.so
LoadModule mime_module bin/mod_mime.so
LoadModule setenvif_module bin/mod_setenvif.so

LoadModule dav_module bin/mod_dav.so
LoadModule dav_svn_module bin/mod_dav_svn.so
LoadModule ssl_module bin/mod_ssl.so

LoadModule sspi_auth_module bin/mod_auth_sspi.so

Options FollowSymLinks
AllowOverride None

DAV svn

SVNListParentPath on
SVNParentPath "C:/Repositories/"
SVNIndexXSLT "/svnindex.xsl"
SVNPathAuthz on

AuthName "Subversion Repositories"
AuthType Basic

AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain jerich
SSPIOfferBasic On
SSPIOmitDomain On

require group MYDOMAIN\Subversion

DirectoryIndex index.html

ErrorLog "C:/Repositories//server.log"

LogLevel error

DefaultType text/plain

TypesConfig conf/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl

SSLEngine on

SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLPassPhraseDialog builtin
SSLSessionCache "shm:C:/Repositories//ssl_scache"
SSLSessionCacheTimeout 300
SSLMutex default
SSLCertificateFile conf/hostname.cer
SSLCertificateKeyFile conf/hostname.key.insecure

Include conf/httpd-custom.conf

And the httpd-custom.conf which includes the trac configuration:

LoadModule python_module "trac/python/mod_python_so.pyd"
LoadModule authz_user_module bin/mod_authz_user.so

SetHandler mod_python
PythonInterpreter main_interpreter
PythonHandler trac.web.modpython_frontend
PythonOption TracEnvParentDir C:\Trac
PythonOption TracUriRoot /trac

AuthName "Trac"
AuthType Basic

AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain mydomain
SSPIOfferBasic On
SSPIOmitDomain On

require group MYDOMAIN\Subversion

Everyone in the AD-group "Subversion" is granted access to SVN and trac also. This could be changed of course to allow different groups access. The access levels in trac can be configured from within the admin interface.
I decided to run a https server. To avoid nasty Internet Explorer warnings about certificates and whatnot, you can either disable the checks for certificates, or create a proper certificate if you are lucky and you've got a CA server in your domain. Here's how to create a proper cert using openSSL and a windows CA. Copy them onto your svn server and that's it.

Windows CE cab madness

2009-02-19T10:35:00.001+01:00

When you're creating applications for Windows CE 5.0 devices, and you want to package them using a cab file, here's two pieces of advice.

Don't compress the cabinet file
Don't use authenticode

kthxbye

Linux 2.4 hacking?

2009-02-05T10:56:00.002+01:00

I need to hack on a Linux 2.4 kernel for an embedded system. I thought of using one of my Linux boxes to do the work. But not only did the trusted "make menuconfig" bail on me, there were countless compile errors, even on the vanilla kernel! I gathered this is due to a version conflict with ncurses.

I had to resort to an old Debian, that's based on 2.4 and still comes with the old gcc and whatnot. Works like a charm!

I'm sure I am not the only 2.4 hacker using a modern Linux distro. Any hints on how to make it work?

NAS galore...again

2008-12-27T09:20:00.003+01:00

Well my replacement SS4200 has arrived surprisingly swift. That left me a lot of time to tinker with the serial console part again, but I couldn't get it to work. I noticed that the BIOS on this unit was a different version than the old one, maybe that's why.

The trouble is that you need to access the BIOS to change the boot order. But as soon as a new disk device is recognized, the boot order is changed. Bummer. The nice workaround that I used was to utilize SATA hot-plugging. Although it's specifically not supported with the EMC firmware and also it's stated to be unsupported in Intel's docs, it works surprisingly well. ;-)
In case anyone needs to know: First plug in the power cable on the drive, then attach the SATA cable.

ss4200 RIP

2008-12-19T20:17:00.001+01:00

Sweet, now just after I thought the new NAS is really coming along nicely, the PSU dies on me.
grrr

Debian on the SS4200

2008-12-16T20:29:00.005+01:00

And debian it is!
I've blatantly plugged the DOM into the IDE socket of a standard PC and fired up the ubuntu server installer. You have to compile a custom kernel however, since the stock ubuntu kernel lacks the IDE drivers for the SS4200.

A custom kernel needs to have IDE_GENERIC, IDE_PIIX and BLK_DEV_IDEDISK for the ide controller to be detected.

The E1000 module has the network driver, and the BLK_DEV_DS is quite nice to have USB storage support.

To compile and install I've stuck to this guide, I've used a vanilla linux kernel (2.6.27.9) though.

The tough part wasn't compiling the kernel though. Its getting the BIOS to always boot from the DOM. The RS232 header didn't work for me as described here. I had to resort to a PCIe x1 graphics adapter and do it the old-fashioned way. I've tried to use a straight through cable without success.

NAS galore

2008-12-11T20:35:00.003+01:00

After using the brave Linksys NSLU2 for more than 3 years, I've finally found a successor. :-) Before I spoil the news I'd like to elaborate on what this amazing little device was used for.

Running unslung the little slug has fought bravely and I've used it to automagically fetch podcasts, record streams, serve audio and video.
It's amazing what can be achieved with a 266Mhz CPU and staggering 32MB of memory. Although there wasn't a day when I didn't make use of any of those services, the slug easily had uptimes >100 days. Due to the lack of moving parts it was inaudible, too.

My device of choice is the Intel SS4200, which looks ridiculously powerful in comparison. It features a 1.6Ghz Celeron CPU (dual core) and sports 512MB of memory. The beauty is that all those components aren't soldered on, but socketed. So changing components is a piece of cake. When dealing with such numbers there are bound to be moving parts, and I've yet to see how to tune those fans for least possible noise. I'm certainly going to run the OS off an SSD so that the HDs can spin down when idle - something that was tricky on the slug to say the least ;-).

I still haven't made up my mind about which OS to use. I have considered freenas, some rpath appliances and of course debian/ubuntu. The huge debian userbase would certainly coem in nice....

Although the SS4200 seems to be a nice device, there seems to be little information on hacking it. The only useful information I've found so far was in this blog. For what it's worth I'll blog about my experiences putting *IX on this thing soon ;-)

Meme

2008-11-13T19:42:00.002+01:00

Grab the nearest book.
Open it to page 56.
Find the fifth sentence.
Post the text of the sentence in your journal along with these instructions.
Don’t dig for your favorite book, the cool book, or the intellectual one: pick the CLOSEST.

That's in German:

Wenn diese beiden Kongruenzen nicht erfüllt sind, ist g eine Primitivwurzel mod p.

and in English:

If those two congruencies are not valid, g is a primitive root mod p.

This is about prime residue groups, in number's theory.
The book is 'Einführung in die Kryptograhpie' by Buchmann.