Guru dell'Eccelso Picco

The KVM Forum 2010 just ended and the speakers slide decks are now available online. They are full of extremely interesting details about the KVM project and its roadmap.

((enjoy))

I’m subscribed to Linux Journal from the very first day and yesterday, digging between my paper archives, I found these little pieces of history: the first 3 Linux Journal issues published in 1994.
This journal for me has been a really useful source in all these years of Linux fun, so a big big Thank You to all the people that contributed to it in the last 17 years!

Linux Journal Issue 1 2 3

((enjoy))

A really nice full rainbow photo taken early morning on 29 august 2010.
I do have to install a panoramic photo maker on my N900
((enjoy))

Last week I got some fun configuring an IPSec VPN Lan-to-Lan between a Juniper Netscreen firewall and a Cisco ASA of a customer; in my past experience I’ve configured almost any kind of VPN, but this combination was still missing .

The process has been quite straightforward on the (our) Juniper side, the device is a SSG-320M with ScreenOS 6.2. Unlike other devices (Nortel, Cisco) the ScreenOS supports 2 kinds of VPN: Policy based and route based.

I was able to use the Policy based mode and the device on the other side is a Cisco ASA5540 managed by a smart network guy.

The steps have been basically the following:

• An accurate plan of the network addresses involved by the two encryption domains; as an additional difficulty in my setup the encryption domains have overlapping address space so I configured a virtual Linux “Nat Box” to manage the NAT on my side with the excellent Shorewall package
• The definition of the Address Lists on the ScreenOS, binded to the right zones (Trust/Untrust/other)
• The definition of the Gateway with a static IP and the pre-shared key. Be careful in the definition the Phase1 parameters, they have to match precisely on both sides
• The definition of a VPN AutoKey IKE: again, be careful in the definition of the Phase2 parameters and enable the Reply Protection.
• The definition of the Policies between the Network objects involved in the VPN; it was mandatory to flag the “Position at top” and “Modify matching bidirectional VPN policy”

The most important thing in these situations is to have some handful commands to efficiently debug the VPN during the phase 1 and 2. Here I’ll summarize some of them, at the CLI level on the ScreenOS:

fw> debug ike detail                   #enable debug ike
fw> get dbuf stream                    #show the debug messages in the buffer
fw> undebug all                        #disable all debug
fw> clear dbuf                         #clear the buffer
fw> get config | include ike           #show the ike relevant config statements
fw> set ike accept-all-proposal        #try this to check the other side proposals
fw> clear ike-cookie all               #clear IKE cookie for all VPN
fw> get sa active                      #show the active SAs
fw> get sa id <ID>                     #show the SA details with network details
fw> get sa stat                        #show traffic with pkt IN/OUT counters

Some useful links for this kind of tasks:
Configuring or Troubleshooting a Juniper Firewall VPN (Juniper KB)
Building IPSEC VPN with Juniper Netscreen ScreenOS
Setting up an IPSEC VPN Tunnel betweek a Juniper Netscreen and a Cisco VPN device

((enjoy))

GoogleCL brings Google services to the command line.

http://code.google.com/p/googlecl/

((enjoy))

Under Ubuntu, if are you using the latest version of Thunderbird from the PPA (rebranded as Shredder), you may encounter some problems with the Lightning plugin, especially if you are using the 64 bit version.

For example, with Shredder 3.0.6 you have to use the Lightning plug-in version 1.0b1 and not the latest 1.0b2.

For the X86_64 version you may find the archive of the various builds here:

http://releases.mozilla.org/pub/mozilla.org/calendar/lightning/releases/1.0b1/contrib/linux-x86_64/

((enjoy))

If you have a Vodafone Internet Key and you don’t want to get crazy configuring it, use this really fine package: Vodafone Mobile Connect from Betavine Forge, a Vodafone Group R&D Lab.

It has nice features like:

• statistics about transferred bytes (rx/tx)
• sending SMS
• choosing your preferred network settings (gprs, umts, preferred)
• nice Python GUI
• automatic detection of your Internet Key
• it will not use Network Manager

It will works fine also with recent Internet Keys which need usb_modeswitch.

I’ve tested with a 28.8 Mbps USB Internet Key Model Number K4505 under Ubuntu 9.10 64 bit.

((enjoy))

After reading this interesting post on Phoronix about the great increase of performance between ubuntu 9.04 and 9.10, I finally convinced myself to make the upgrade.
My first concern was about the ATI driver, which gave me some trouble with 9.04.
Anyway after a good backup, I started the upgrade, and in almost 2 hours I was up and running with 9.10, with a lot of improvements!
The upgrade installed automagically the fglrx driver version 2:8.660, my previous version (built from source) was 2:8.620, however, after the first reboot I started in recovery mode to issue the magic command “aticonfig –acpi-services=off” because I feel that this is still crucial to make the driver work.
After this safety measure, I rebooted and really appreciated the boot speed! Upstart is making a great job really!
So far, I’m very impressed by this release, my major benefits are the following:

• Ultra fast boot and shutdown
• Great performance of the ATI driver. The black areas that sometimes were appearing for example scrolling a Firefox full screen window have disappeared
• Upgrading Skype to 2.1.0.81 solved the problem about the editing of my profile and avatar display
• Performance are really increased, for example opening PDF with Evince
• Not yet tested printing feature
• Suspend to ram works fine
• VMware Workstation works fine

((enjoy))

If you are in the need of expanding the LUN where your Linux is installed without rebooting the server, then may be that here you can find the right answer. Your Linux must be sufficiently recent to support features like LVM version 2, ext3 on-line resizing and so on.

My setup in tihs test is the following:

A Linux RedHat 5.3 64 bit Virtual Machine with a single 300 GB LUN /dev/sda in Raw Device Mapping mode (Physical Compatibility mode) under VMware 3.5 and a Compellent SAN. Inside the single disk there is one Volume Group (vg0) with serveral Logical Volumes.

The SAN guys expanded on-line the LUN from 300 to 500 GB (a 30″ operation ).

To force the rescan of partition to get the kernel aware of the new size (supposing your LUN is /dev/sda):

# echo 1 > /sys/block/sda/device/rescan

and then in dmesg you’ll see:

SCSI device sda: 1048576000 512-byte hdwr sectors (536871 MB)
sda: Write Protect is off
sda: Mode Sense: 8f 00 00 08
SCSI device sda: drive cache: write through
sda: detected capacity change from 322122547200 to 536870912000

Now you have two choices at this point: expand the partition containing the current volume group or create a new partition and extend the current volume group. I sincerely prefer the latter, since resizing the partition with fdisk is a risky operation IMVHO.

Use fdisk to create a new partition of type LVM (0×8e) in the free space. But at this point you may have trouble in the kernel re-reading the partition table:

# sfdisk -R /dev/sda
BLKRRPART: Device or resource busy

So to inform the OS of the partition table changes use partprobe(8) command which comes with the parted packages.

Verify in /proc/partitions that the kernel has updated the partition table.

Now use pvcreate /dev/sda3, then vgextend vg0 /dev/sda3 and you are done! Verify with vgdisplay that the Free PE are consistent.

To make some more stress test I made the following:

While running this command on a newly created LVM partition /dev/vg0/TRASHME mounted on /TRASH:

# dd if=/dev/zero of=TTTT bs=1024k count=30000
..... dd is running....

I tried an online resizing of the Logical Volume and the ext3 partition inside it:

# lvextend -L+10G /dev/vg0/TRASHME
Extending logical volume TRASHME to 40.00 GB
Logical volume TRASHME successfully resized
# resize2fs /dev/vg0/TRASHME
resize2fs 1.39 (29-May-2006)
Filesystem at /dev/vg0/TRASHME is mounted on /TRASH; on-line resizing required
Performing an on-line resize of /dev/vg0/TRASHME to 10485760 (4k) blocks.
The filesystem on /dev/vg0/TRASHME is now 10485760 blocks long.
in the mean time dd finished his work:
30000+0 records in
30000+0 records out
31457280000 bytes (31 GB) copied, 175.612 seconds, 179 MB/s

Great! Remember to always backup your data before doing operations like this! YMMV.

((enjoy))