MuchTall.com

Best Shout-out Ever

Deleting Specific Entries from Conntrack in Linux

First, use conntrack to correctly identify your entries:

    conntrack -L -s 172.16.1.45 -d 123.123.123.123

This should display any connections that came from the internal IP of 172.16.1.45 destined to 123.123.123.123

Once you have confirmed the connections shown are the ones you with to delete/reset, paste the following after the command from above:

    conntrack -L -s 172.16.1.45 -d 123.123.123.123 | sed 's/=/ /g' | awk '{print("conntrack -D -s "$6" -d "$8" -p "$1" --sport="$10" --dport="$12)}'

This will print a list of the commands that would run to delete the connections. Replace "print" with "system" to execute the deletions:

    conntrack -L -s 172.16.1.45 -d 123.123.123.123 | sed 's/=/ /g' | awk '{system("conntrack -D -s "$6" -d "$8" -p "$1" --sport="$10" --dport="$12)}'

Finally, re-run the list command to see that all the entries have been removed:

    conntrack -L -s 172.16.1.45 -d 123.123.123.123

And you're done!

HOWTO: Forwarding a USB device to a Guest VM in Xen on Fedora

This procedure works with fully virtualized VMs. I would assume it works with paravirtualized VMs as well...

Shut down and power off your VM

Unplug and re-plug your USB device to see what it appears as in dmesg, then run
    dmesg | grep ^usb

See these lines?:
    usb 3-2: USB disconnect, address 7
    usb 3-2: new low speed USB device using uhci_hcd and address 8
    usb 3-2: configuration #1 chosen from 1 choice

This indicates that it is connected to Bus 003 as Device 008. Now run this:
    lsusb

Now look a device at Bus 003 Device 008:
    Bus 003 Device 008: ID 04b9:0300 Rainbow Technologies, Inc.

Note the ID...
    04b9:0300

Open the config.sxp file for the domain, usually located at:
    "/var/lib/xend/domains//config.sxp"

Look for a section similar to this:

    (platform
        ((usb 1)
            (device_model /usr/lib64/xen/bin/qemu-dm)
            (boot c)
            (rtc_timeoffset -18008)
            (pae 1)
            (apic 1)
            (localtime 1)
            (acpi 1)
        )
    )

Add your USB device:

    (platform
        ((usb 1)
            (device_model /usr/lib64/xen/bin/qemu-dm)
            (boot c)
            (rtc_timeoffset -18008)
            (pae 1)
            (apic 1)
            (localtime 1)
            (acpi 1)
            (usbdevice host:04b9:0300)
        )
    )

Restart xend:
    /etc/init.d/xend restart

Start your VM

Why "root" isn't a Domain Admin on Fedora w/smbldap-tools

For about 2 years now at work, our "root" (aka, Administrator) account hasn't been showing up as being part of the "Domain Admins" group within Windows, or when running "id root" or "net rpc user info root". It used to, but for whatever unknown reason, stopped working.

The root account in our LDAP directory was, admittedly, messed up. However, it worked on our local server, who were talking with our PDC directly. It just didn't work on our remote BDC-connected systems.

Back around this time, I'm pretty sure we made a change to our enterprise-wise /etc/ldap.conf config: We added "root" to the nss_initgroups_ignoreusers list. The effect is that the local auth mechanisms only use the local files (passwd and group) for users in this list, skipping LDAP checks. Therefore root will never get the "Domain Admins" group membership in this configuration.

Now, the question is, is this normal, or am I missing something? I really don't care at this point. The workaround for me is to simply create an admin user that gets treated as THE admin account. The alternative is to remove root for the ignore list. However, I would suggest against this as it could create startup and login delays if the LDAP database doesn't start for any reason.

Hope this helped somebody. I struggled with it and searched for a solution long enough that I figure it merits a quick post.

Extending (Resizing) LVM/XFS Xen images

Documentation on this procedure out on the interwebs seems rather sparse, so I thought I'd post the procedure I use to expand Xen images that use LVM and XFS. The same procedure should work fine if you use EXT3, you probably will just have to substitute the proper e2/3fs command for xfs_growfs.

## FROM THE VM HOST:
### Shutdown VM
xm shutdown VMName

## Backup the image
## (Optional, though highly suggested until you get this procedure tested in your deployment
cp -rp /var/lib/xen/images/VMName.img /var/lib/xen/images/VMName.img.bak

## Add 5GB to the image (takes approximately 4 seconds per Gig)
dd if=/dev/zero bs=1M count=5000 >> /var/lib/xen/images/VMName.img

## Loop the image
kpartx -av /var/lib/xen/images/VMName.img

## Run "fdisk /dev/loop2"
## Enter these commands
## (double check to make sure the partition numbers apply in your case)
#p-rint
#d-elete
#2-(partition 2)
#n-ew
#p-rimary
#2-(partition 2)
#<enter>-(Defaults to first available cylinder)
#<enter>-(Defaults to last available cylinder)
#t-ype
#2-(partition 2)
#8e-(Linux LVM)
#p-print
#w-rite

# Delete the loop and re-add it (to reload partiton table)
kpartx -dv /var/lib/xen/images/VMName.img
kpartx -av /var/lib/xen/images/VMName.img

# Check the Physical Volume size
pvdisplay

# --- Physical volume ---
# PV Name               /dev/dm-3
# VG Name               VolGroup00
# PV Size               3.71 GB / not usable 20.42 MB
# Allocatable           yes
# PE Size (KByte)       32768
# Total PE              118
# Free PE               1
# Allocated PE          117
# PV UUID               OjLnup-7iYu-ErtB-WMvN-gY0v-FbLw-gW6cEB

## Resize the Physical Volume
pvresize /dev/mapper/loop2p2

# Check the PV size again
# Take note of the Free PE (physical extents), 158 in this case
pvdisplay

# --- Physical volume ---
# PV Name               /dev/dm-3
# VG Name               VolGroup00
# PV Size               8.59 GB / not usable 1.05 MB
# Allocatable           yes
# PE Size (KByte)       32768
# Total PE              275
# Free PE               158
# Allocated PE          117
# PV UUID               OjLnup-7iYu-ErtB-WMvN-gY0v-FbLw-gW6cEB

## Delete the loop
kpartx -dv /var/lib/xen/images/VMName.img

## Boot the VM
xm start VMName

### FROM WITHIN THE VM
## Check the LV size of LogVol00
lvdisplay

## Resize the logical volume using the free extents from above (158).
lvresize -l +158 /dev/VolGroup00/LogVol00

## Check the LV size again to confirm the increased space
lvdisplay

## Resize the filesystem (in this case, XFS)
xfs_growfs /dev/mapper/VolGroup00-LogVol00

# Check for the increased space
df -h

## Finally, delete the backup FROM THE VM HOST:
/var/lib/xen/images/VMName.img.bak

### You're Done!

I always enjoy knowing that documentation like this helped someone. Post a comment and let me know if this helped you.

Good luck!

Rant: Linux vs Windows Expertise Availablility

Recently at work, we've been being "audited" by a firm to help us determine the cost of operations in our department, and how we measure up to other organizations of similar structure and size. One of the comments that came back to us is that we could potentially be saving on cost of ownership if we were running a Windows shop on the server side. The argument put forth is that Windows Server expertise is more prevalent, and therefore less expensive, whereas Linux is exotic, and therefore less expertise is available, and therefore the cost of Linux expertise is higher. The argument assumes of course that the cost of ownership would drop with Windows to the point of making it more affordable as a whole over time.

Personally, I don't buy it. I think this theory is based upon this idea that everyone runs Windows desktops (I admit that I do as well, for desktop support reasons), and Windows Server is just like Windows, therefore it's easier to administer a Windows Server over a Linux server because (and I know I'm exaggerating here) any old Joe can work Windows. Usually, when this assumption is made, it's false. I've seen guys mess around with Windows Server because they "just want to set up a server". Next thing they know, they've got broken pile of crap for a network. Setting up a server properly, whether it's Windows or Linux, requires expertise. Not that I discourage experimenting with either, I'm just saying that a person needs experience with the Server environment and paradigms in order to understand how to properly set up a server, and knowing Windows does not better qualify a person for that.

I would argue that Linux actually offers a lower cost of ownership in addition to the obvious up front cost (free) for one simple reason (though there are many): Scriptability. Take for example the need to create a new VPN tunnel from 100 different servers back to a secondary site (something I'm working on this very moment actually). On Windows Server with the builtin PPTP VPN clients, you would have to either connect to each system individually, create the connection, and set up the proper routing, if applicable, by hand. At best you could create a macro with something like AutoHotKey to help you do this, or even purchase some uber expensive tool for doing these sorts of replications. But even in those cases, I would challenge anyone to do it as quickly as I could with a handful of free command line tools in Linux. With one system that's been granted passwordless SSH to all of our branch servers, I can script pretty much any change to happen with a minimal of fuss, and more importantly, I can proceed to other tasks while this executes. Writing a change on 5 servers takes literally as long as writing a change for 50, or 500, all without a single mouse click.

Now that's scalability. I'd like to see that happen on Windows Server.

I've administered an organization with multiple Windows Servers. I know what a pain it is. It's a mess. Word to the wise: GUI's are for the desktop, not for the server. We're currently looking at switching from CommuniGate to Exchange at work, and I cringe at the thought. Administration will be a headache. I know this because I've admined Exchange. Everything is a kludge, and you can blame Microsoft for that. God forbid they follow an established industry standard once in a while.

</RANT>

Overcoming ODBC "Invalid character value" Error in UPS WorldShip

If you ever run into this error when trying to export data from UPS WorldShip:

ODBC ERROR: State = 22005 Error = [Microsoft][ODBC SQL Server Driver]Invalid character value for cast specification

...here's the solution. The "defout.mdb" file that exists on your source installation is corrupt. I'm assuming this, as what proceeds seems to solve the issue. In order to get a clean copy of this file, you need to create a address book on a new installation of UPS WorldShip (possibly on the machine you will be importing to) and export that address book on there. Then take the defout.mdb file from the new system, copy it to the old system, and retry the export on the old system. This time it should complete without failure.

Good luck!

Disabling the Shutdown Event Tracker (via Regedit)

Just quick post to help those of you out there who seem to be having problems finding the Shutdown Event Tracker setting in gpedit (as I did). To disable the shutdown event tracker, you need to add/edit these two keys:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability]
"ShutdownReasonUI"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability]
"ShutdownReasonOn"=dword:00000000

Or, if you prefer, here's a ready-to-use regedit file.

Squid: The request or reply is too large.

Today at work we had a complaint that one of our remote offices couldn't make a new job posting to Monster.com. Many of our offices have transparent squid implemented, and this is one of them.

Then error that the user would see was:

The following error was encountered: The request or reply is too large.

According to a few places, the problem potentially lied with the reply_body_max_size setting. However, in most recent versions of Squid, this is set to unlimited by default. After some poking around in the Squid docs, I noticed that upping the reply_header_max_size setting from the default of 20 KB to 40 KB seems to resolve the issue. The applicable setting is:

reply_header_max_size 40 KB

If this setting does not work for you, try upping the request_header_max_size as well, which would cause failure for similar reasons. Good luck!

And my vote goes to...

I've been thinking about what I'm going to do this coming election. The presidential election is lost for conservatives. Now the question is: What is our best course of action when dealing with two poor choices for President? The way I see it, McCain is just as bad if not worse for this nation in the long run as Obama is. Why is that? One word: Carter.

Jimmy Carter is probably one of the worst Presidents this country has ever seen. His policies dragged this country closer to economic collapse, and his doom-and-gloom speculation regarding the environment and oil have been roundly disproved. According to Carter, we'd be living in the age of Mad Max right about now, and if we'd actually done what he had prescribed, we'd be experiencing mass poverty in our nation, and probably be either speaking Russian or pushing up daisies. Carter was a horrible president, as history has shown, and he persists in trying to destroy our nation even to this day.

But, there was a bright silver lining on that cloud. His name was Ronnie. Ronald Reagan was the result of that terrible presidency. He renewed the conservative movement in such as way that the positive effects of his policies have lasted to this day. He brought down our nation's greatest enemy without firing a shot. He showed us the real meaning of "Peace though superior firepower". The victory of the cold war should be a lesson to all gun control supporters: Freedom has been for some time, and probably will be for the foreseeable future, won and lost at the end of a gun. The question is: Which end would you rather be on?

But back to the point of this rant: The 2008 Presidency.

There's a parallel here, and admittedly it's an unoriginal one at that. However it's still worth repeating. Obama is the Carter of our time. The candidates we have are the result of the steady decline of conservatism since Reagan left office. There have been some revivals, however the momentum has waned to the point of total dissapointment with our chosen nominee. And Obama, much like Carter, is seeing a rock-star like rise in popularity, without any real qualification or experience. Top that off with a repeat of history (attempts at price controls, calls to conserve our way out of an oil shortage, artificial pushes for alternative enery sources, and straight from the words of Carter himself "windfall profits taxes"), and we're headed for the early 80's all over again. It's as if someone dug up Carter's old speeches and handed them to Barack without even changing a single word.

McCain, on the other hand, may actually do a few things right during his presidency: stay the course in Iraq, continue to pursue Al Queda, open up (some) oil drilling, and push for a resurgence of nuclear power. However, beyond these few things, he's either iffy or downright wrong on the issues. Is he pro-life or isn't he. Will he appoint conservative judges, or will he fold just like he has in the past? Will he stop furthering environmentalist rhetoric or well he continue to capitulate? His record isn't very good. The question then becomes: Can we really risk four more years of slipping standards in the conservative movement in the name of the party?

Back to the silver lining. As you can tell by now I'm hoping McCain loses. I'm not saying I'm voting for Obama, that would also be immoral as a Catholic voter. I'd considered it, but after some careful thought about it, and discussion with my wife, I'd decided that it's best I withhold my vote from both Obama, and McCain. However, I'm still going to vote. You see, I think that the goal of this election needs to be re-focused for conservatives like myself. The message needs to be sent out, loud and clear, that the people of the Republican party should not be seen as servants to the party, as the Democrats see their people. We expect and demand that the liberals in the Republican party move on to their rightful home: the Democrat party. They need to take back thier party from the Socialists that control it. We are not your subjects. We will not follow the party blindly. We, unlike you, have principles. Our motive is not to keep our party in office, in power. Our motive is to bring about the return of Freedom. Freedom from the Federal government. Economic freedom. Religious freedom. True freedom. We will not follow you, because our leader is not the Republican party, it is God himself, the one who gives us true freedom.

Thanks to the hubris of the establishment Republicans, we have no candidate to vote for. To make it clear to the Republican party just who is in control here, we need to send a message that their chosen candidate is not acceptable to us, and that we know who embodies the qualities of a great President, not them. We must vote for the man who was the only true conservative in this race. With enough votes, the message will be clear. I don't expect him to win. I only hope that he will do for this party what Goldwater did for us back in the 60's

If you can't tell by now, "I'm With Fred". Or rather, I'm back with Fred. Fred Thompson has always been the only true conservative in this election. I'll be writing his name in on my ballot. I know he doesn't have a chance, but as I stated, that's not really the point. The point is: I want my party back. I want my country back.