CollabNet Subversion Edge 5.1.0, Trac and mod_wsgi on Windows

As I've blogged before, I think CollabNet Subversion Edge to be quite handy. Now there's a new version (5.1.0) out that addresses several issues. I found that compiling mod_wsgi isn't necessary anymore. But they still ship a version of mod_wsgi that doesn't work.....

TortoiseSVN 1.8.0 and NTLM Authentication on Windows

Subversion 1.8.0 was released recently, and my favorite svn client was updated, too. I had hoped this update to go down smooth, just like going from 1.6 to 1.7 in the past.
This time around there are some authentication issues it seems. TortoiseSVN has dropped neon and relies now solely on serf to handle HTTP(S) authentication.

The release notes mention some server-side configuration changes for optimal performance, but they fail to mention that serf doesn't play nice with NTLM authentication. It does work well with Kerberos though.

So, if you've set up Apache like I described here or here, just add this line to make Kerberos the default and have  TSVN 1.8.0 play nice with single-sign-on.

SSPIPackage Negotiate

This will change the default authentication schema (NTLM) to Kerberos. This will cause TortoiseSVN < 1.8 to prompt for username and password, because the underlying neon library cannot handle Kerberos. TortoiseSVN 1.8 and later will be fine though.
You can force older clients to use serf for specific servers though. I've previously written about it here.

There is a big discussion going on in the subversion-dev mailing list about how to best fix this behavior. It is expected that TortoiseSVN 1.8.1 will include a fix for this issue.

This issue and the fact that most SVN tools still haven't been built on top of subversion 1.8 means that you should stay on TortoiseSVN 1.7.x for now.

TortoiseSVN with kerberos authentication

I'm a big fan of TortoiseSVN (TSVN, short) on Windows. Working with multiple SVN servers and different authentication methods has its pitfalls, however.
I just found out how to make the current TSVN (1.7.11 as of this writing) work with Kerberos authentication on a Linux server that uses krb5 as I previously described here.

CollabNet Subversion Edge cont'd

I already explained Collabnet Subversion Edge and my experience installing it. Now I want to focus on installing Trac (with some hacks).
I really thought this should be easy, but it turns out that there are a lot of pitfalls. So for any other poor souls who are not fluent in python (and for my own reference) here it goes.

Installing Trac

As you know, trac has some requirements. Namely setuptools and genshii. There are a few packages to download for Windows here. I didn't know which version of python came with subversion edge, so I checked. There is a folder named csvn/python25. So it seems to be python 2.5. But wait - there is a python27.dll in there. and some other files indicating python 2.7. So which is it?

D:\csvn\Python25>python.exe --version
Python 2.7.1

 Alright, that settles it. But why did Collabnet not rename the folder..?
So I downloaded the setuptools package for python 2.7 and win32. The installer failed to run, it sais it couldn't find any python 2.7 installation.

Apparently a regular python installer will create some registry entries so that the system recognizes the python installation. Collabnet subversion edge doesn't do this anymore due some complaints.
So I had to go in there and manually create the relevant entries. They were already present from the old python 2.5 installation, which I wanted to get rid of anyway. So I changed the version to 2.7 and updated the paths to point to D:\csvn\python25. This let me install setuptools, genshii and finally trac too.

Configuring Trac

That part was straight-forward. Like with subversion, I just copied the relevant parts of my VisualSVN server's apache config and pasted it to the main httpd.conf file. Here is the relevant snippet:

<Location /trac>
 SetHandler mod_python
 PythonInterpreter main_interpreter
 PythonHandler trac.web.modpython_frontend
 PythonOption TracEnvParentDir D:\Trac
 PythonOption TracUriRoot /trac

 AuthName "Trac"
 AuthType SSPI
 SSPIAuth On
 SSPIAuthoritative On
 SSPIDomain jerich
 SSPIOfferBasic On
 SSPIOmitDomain On
 require group DOMAIN\Trac-Users
</Location>

All relevant modules are already loaded, so that's it.

Collabnet Subversion Edge

I have been quite fond of VisualSVN Server on Windows, since it was an easy way to setup subversion with a nice means to administer repositories and users.

As of lately, I grew tired because of the way they mangled apache, subversion, python and trac together. While searching for an alternative I found out that Collabnet offers exactly what I need: Apache bundled with Subversion, Python and other stuff. Very nice! This bundle is called Subversion Edge.

I decided to take the plunge and update the production VisualSVN server. After all: How hard can it be?

The installation went fine, and the collabnet subversion edge web-interface greeted me.
I had tweaked the configuration of VisualSVN server to allow single-sign-on with SSPI, so I naturally wanted to copy the relevant parts of the config. Once one tinkers with the config files, the web-interface can no longer be used to make changes to those parts. That's fine by me.

After this was taken care of I fired up Collabnet's Apache service and started to dump my subversion repositories one by one. Instead of manually loading them with svnadmin, the web interface of subversion edge provides takes care of that. Simply point it to the dump file and go ahead. That was easy!

Setting up the server, finetuning apache and migrating my three repositories took less than one hour! ;-)

rancid updates

I'm still happy about rancid, that I blogged about previously. I used one more change by Stefan Kublik that is also present in rancid-git:
Remove memory addresses from "show controllers" to avoid unnecessary change notifications


This is done by changing a line in bin/rancid from 

ProcessHistory("INT","","","!Interface: $INT$1\n") && next;

to

ProcessHistory("INT","","","!Interface: $INT\n") && next;

In other words, just remove the $1 and you will change these lines:

!Interface: FastEthernet0/0, GT96K FE ADDR: 63F52098, FASTSEND: 62084C3C, MCI_INDEX: 0

into these:

!Interface: FastEthernet0/0,

In other news, it turned out to be tricky to have rancid automatically updating a trac repository with post-commit hooks. Trac is very picky when it comes to permissions, and you need write access to the trac environment and to the trac logfile to do that. Try out the "trac-admin changeset" command works before debugging svn-hooks, ok?

discover Rancid

For those of you who don't know Rancid:

RANCID monitors a router's (or more generally a device's) configuration, including software and hardware (cards, serial numbers, etc) and uses CVS (Concurrent Version System) or Subversion to maintain history of changes.

Essentially, this allows to have full coverage over routers, firewalls, network devices configuration and changes. Every network administrator's dream, right? Well, it certainly seems too good to be true..! Let's find out.

I've set it up on a CentOS 5.4 box to tinker with it. Installation is pretty straightforward. Configuration is a bit tricky, but the sample files are well documented. There are a few pitfallse, however.

• "Show VLAN" output has different line-wrapping behaviour on different IOS versions; as diff is line oriented, this leads to unneccesary changes and notifications
• "call-forward all" directives are shown for cisco callmanagers or unified communication managers; if a user forwards his phone, this causes the configuration to change, and notifications to be sent out.
• The notification emails show diff output in plaintext; no colors, no highlighting
• Notificaions are only sent to a single email address; no distribution lists are possible

As rancid is comprised of a set of perl and bash scripts, the above issues shouldn't be too difficult to address, right? Well, there is  fork called rancid-git that provides support for git as well as various other improvements. Most notably is perhaps support for html-mail. So after tinkering a bit with vanilla rancid, I decided to give rancid-git a go. After all it can be used as a drop-in replacement.

Unfortunately it turned out that most of the advertised patches/enhancments are more trouble than they are worth. First of all rancid-git is based on an outdated version of rancid, which means that certain bugfixes and fixes are missing. I didn't see any ill effects with the devices that I monitored (mostly Cisco and proCurve) but ymmv.

So I fired up rancid-git and immedately got a notification with some profound config changes. It was an HTML mail, but there weren't any colors to be seen. I use subversion as repository, so the diff command doesn't show colors. Lucliky there is an easy workaround.

The problem now is, that rancid always sends out notifications, even when there are no changes. So this patch isn't ready for prime-time just yet.

I did like the detailed commit messages of rancid-git, however. So I decided to blend together my own patchset, based on vanilla rancid. Here's what I did:

• Comment out "show vlan", "show vlan-switch" in bin/rancid to get rid of the ever-changing vlan port memberships
• Added "/^ *(call-forward all)/ && next;" to the dog gone cool matches in bin/rancid to filter out unwanted phone forwardings in the notification mails
• Added "/.*coredumpinfo.*/ && next;" to ShowFlash in bin/rancid to get rid of the coredump bug on Cisco ASAs
• Added "svn propset "svn:mime-type" text/x-ios $router" to bin/control_rancid so cisco config files can be properly syntax highlighted in trac
• Added proper commit messages, blatantly copied from rancid-git
• To get syntax highlighting working in trac, install Pygments and this ios lexer; simply put it in the lexers subdirectory and run _mapping.py. If you get an error for a missing attribute, add a line like this "__all__ = ['IOSLexer']" between the imports and the class.
• For trac to recognize the mime-type and the IOS lexer, simply add "text/x-ios:ios" to the mime_map in trac.ini. I've tried to add the mime-type to the IOS lexer itself, but this didn't work.

This way, you can use the trac interface to view diffs and the configs. Instead of notification emails, simply rely on the RSS-feed of trac. Profit!