EZ-VPN on a ASA-5508-X

I've recently had to migrate a dated ASA-5505 to a ASA-5508-X. In theory the config should be compatible. In reality a lot of unused stuff has accumulated over the years. And it was deemed a spring-cleaning was in order. So the config was re-created on the new box.
Having both boxes running side-by-side and being able to match the config makes this relatively easy. There was only one thing that had me stumped. Disclaimer: IANACCSE (I Am Not A Cisco Certified Something Enginner)

Rancid and Cisco WLC

As I've blogged before, I'm using RANCID to backup and version configuration files of various network equipment. Unfortunatley it does not support Cisco's Wireless LAN Controller platform out of the box. But luckily it's rather easy to add support to RANCID....

CollabNet Subversion Edge 5.1.0, Trac and mod_wsgi on Windows

As I've blogged before, I think CollabNet Subversion Edge to be quite handy. Now there's a new version (5.1.0) out that addresses several issues. I found that compiling mod_wsgi isn't necessary anymore. But they still ship a version of mod_wsgi that doesn't work.....

XenServer 6.5 SP1, Dell OpenManage and SNMP.

I've written before about XenServer 6.2, Dell OpenManager and SNMP and XenServer 6.1, Dell OpenManage and SNMP. I'm happy to report that the steps also work on XenServer 6.5 SP1 with very few modifications.

Logitech Media Server and Ubuntu Server 14.04.1 LTS

Logitech Media Server (LMS) was formerly known as SqueezeboxServer, SqueezeCenter and SlimServer. It's been running fine on my Ubuntu Server 13.10 box. I've recently decided to take the plunge and update to 14.04.1 LTS. There were some minor issues, but nothing critical, except for Logitech Media Server which refused to start.

XenServer 6.2, Dell OpenManage and SNMP

I've written before about XenServer 6.1, Dell OpenManage and SNMP. I'm happy to report that the exact same steps also work on XenServer 6.2 SP1.

Guest network with authentication on a Cisco ASA 5505

In case you need to set up an isolated network gut guest access on an ASA, here is a quick guide how to do that. The goal is to have HTTP authentication on the ASA itself before any network traffic is allowed and to isolate the guest-network from any other networks.

rancid and relays using usercmd patch

As I've blogged before, rancid is a really awesome new cisco config differ.

I monitor about 100 devices, and all was well so far.
Now I've come across a device that I can't reach directly from my rancid host. It's not possible to create a direct network connection, or to use ssh tunnels or netcat to forward those ports using a relay host.
Instead I found a much simpler and more elegant solution. Albeit this involves patching rancid.

TortoiseSVN 1.8.0 and NTLM Authentication on Windows

Subversion 1.8.0 was released recently, and my favorite svn client was updated, too. I had hoped this update to go down smooth, just like going from 1.6 to 1.7 in the past.
This time around there are some authentication issues it seems. TortoiseSVN has dropped neon and relies now solely on serf to handle HTTP(S) authentication.

The release notes mention some server-side configuration changes for optimal performance, but they fail to mention that serf doesn't play nice with NTLM authentication. It does work well with Kerberos though.

So, if you've set up Apache like I described here or here, just add this line to make Kerberos the default and have  TSVN 1.8.0 play nice with single-sign-on.

SSPIPackage Negotiate

This will change the default authentication schema (NTLM) to Kerberos. This will cause TortoiseSVN < 1.8 to prompt for username and password, because the underlying neon library cannot handle Kerberos. TortoiseSVN 1.8 and later will be fine though.
You can force older clients to use serf for specific servers though. I've previously written about it here.

There is a big discussion going on in the subversion-dev mailing list about how to best fix this behavior. It is expected that TortoiseSVN 1.8.1 will include a fix for this issue.

This issue and the fact that most SVN tools still haven't been built on top of subversion 1.8 means that you should stay on TortoiseSVN 1.7.x for now.

CollabNet Subversion Edge 4.0 with SSPI WSGI and trac

CollabNet released Subversion Edge 4.0 recently, as they've written here. As you know I've been using this to host our Subversion and trac server. I've made a few tweaks and additions but I've never had any issues with updating Subversion Edge. Until now, that is.

XenServer 6.1, Dell OpenManage and SNMP

I finally updated our productive environment to XenServer 6.1. The upgrade went without a hitch, but there are still many issues with Windows VMs and the XenTools. In the end completely removing the XenTools and reinstalling them did the trick.

Anyway, this post is about Dell OpenManage and SNMP. I've found a spot-on post in the Citrix forums here - thanks Josh Phillips. Read on for the details.

OpenMediaVault & XBMC

I recently stumbled upon OpenMediaVault (OMV), a Linux distribution specific for NASes based on debian squeeze. It's inspired by FreeNas as I gathered.

SQL Server Update Woes

There are various issues that can happen when trying to update SQL Server. For almost all there are workarounds, and they usually work well.

Today I had a trickier experience, and thought I'd share my findings. I wanted to install KB2494113 - "Security Update for SQL Server 2005 Service Pack 3". I got error 57A through Windows Updates. So I had to resort to downloading and installing the update manually.

XenServer 6.1

As I've previously written about here, I'm using the Citrix XenServer. I've been using the free version in a production environment for a few years now. Sure, there were minor issues or hiccups, but no deal breakers.

I'm still running XenServer 5.6, although XenServer 6 and even 6.1 were already released.
Why didn't I upgrade yet?

TortoiseSVN with kerberos authentication

I'm a big fan of TortoiseSVN (TSVN, short) on Windows. Working with multiple SVN servers and different authentication methods has its pitfalls, however.
I just found out how to make the current TSVN (1.7.11 as of this writing) work with Kerberos authentication on a Linux server that uses krb5 as I previously described here.

Introducing django and mysql

I wanted to do some rapid prototyping with web applications, and decided to give python and django a go. There are various tutorials out there, but none of them seem to focus on using existing database structures and views.

So this is primarily to document my own findings. If someone else finds it useful: be my guest. ;-)

Oracle OMS Agent migration

I've recently migrated a few Oracle databases to Enterprise Manager 12c. While this is worth a few posts on it's own, here's just a quick hint of how to update the IP/hostname of an agent after it's been registered at OEM.

First, verify that the agent is responding to requests, by navigating to the new IP/host with your browser:

https://my.new_server.lan:3872/emd/main/

Then log on to the OEM repository DB as sysman. The table MGMT_TARGETS holds all the juicy agent details. Just update the column EMD_URL with the new value, and everything is fine.
For instance

update mgmt_targets set emd_url=replace(emd_url,'my.server.lan','my.new_server.lan')  where target_name like '%my.server.lan%';

Verify your changes in the view MGMT$TARGET.
Finally the agent should be available in Setup - Agents at once. I then resync'd the agent from EMS, and secured the agent. All targets were up and running without issues then.

trac-0.12.3 and HTML notifications and commit_updater

As I've written before, trac-0.12.3 still doesn't HTML notifications. Maurice found out how to work around a limitation with the commit_updater plugin here.

XenServer and "The VDI is not available"

I've been happily running XenServer for a few years now. Last week I encountered a weird issue with seemingly corrupted VDIs, which turned out to be fine after a server reboot.
In the aftermath I had a corrupted storage repository, that manifested like this:

• Unable to scan the SR:

Error code: SR_BACKEND_FAILURE_46
Error parameters: , The VDI is not available [opterr=Error scanning VDI <uuid> ]

• Unable to copy VDIs from or to the SR
  This was nasty, because this meant it wasn't possible to backup virtual disks.

After reading comments on the XenServer forums for many hours I found a working solution. First of all check the file /var/log/SMlog on the pool master server and then trigger a rescan of the bad SR. In my case I had a VDI with an invalid footer.
The log looks like this:

***** VHD scan error: vhd=VHD-<uuid> scan-error=-22 error-message='invalid footer'
*** vhd-scan error: <uuid>
Raising exception [46, The VDI is not available [opterr=Error scanning VDI <uuid>]]

I verified this by running

/usr/sbin/vhd-util scan -f -m "VHD-*" -l VG_XenStorage-<storage-reporitory-uuid> -p

Which, amongst others, gave me this line:

vhd=VHD-<uuid> scan-error=-22 error-message='invalid footer'

 Now many people recommended running vdi-forget to get rid of this VDI. I tried that, but that didn't fix anything. Others recommended running vdi-destroy. After I ran vdi-forget I wasn't able to run vdi-destroy anymore. So I had to work it out using lvremove like this:

lvremove /dev/VG_XenStorage-<storage-repository-uuid>/VHD-<uuid>

This gave me a few warnings like "open failed: Read-only file system" but in the end it did the trick. I re-scanned the storage repository and it finally worked. A few orphaned VDIs showed up which I promptly removed. Subsequent rescans of my SR coalesced VDIs without problems.

I found these links to be helpful: CTX122001 and Thread: Issue with reclaiming disk space in xenserver 6.0.

For the record, I'm running XenServer 5.6 SP2.

check_email_delivery and SMTP SSL

For all of you who want/need/have to monitor an email server's performance or delay, there is a nice plugin for nagios out there written by Jonathan Buhacoff. It's not only a single plugin either, but a suite of scripts to check various smtp- and imap-related things.