Guru dell'Eccelso Picco

KVM Forum 2010

liuk — Tue, 31 Aug 2010 21:48:30 +0000

The KVM Forum 2010 just ended and the speakers slide decks are now available online. They are full of extremely interesting details about the KVM project and its roadmap.

((enjoy))

Tribute to Linux Journal

liuk — Mon, 30 Aug 2010 07:20:51 +0000

I’m subscribed to Linux Journal from the very first day and yesterday, digging between my paper archives, I found these little pieces of history: the first 3 Linux Journal issues published in 1994.
This journal for me has been a really useful source in all these years of Linux fun, so a big big Thank You to all the people that contributed to it in the last 17 years!

Linux Journal Issue 1 2 3

((enjoy))

Wonderful full rainbow

liuk — Mon, 30 Aug 2010 07:16:44 +0000

A really nice full rainbow photo taken early morning on 29 august 2010.
I do have to install a panoramic photo maker on my N900
((enjoy))

HOWTO Configure an IPSec VPN between a Juniper Netscreen firewall and a Cisco ASA device

liuk — Fri, 27 Aug 2010 14:10:00 +0000

Last week I got some fun configuring an IPSec VPN Lan-to-Lan between a Juniper Netscreen firewall and a Cisco ASA of a customer; in my past experience I’ve configured almost any kind of VPN, but this combination was still missing .

The process has been quite straightforward on the (our) Juniper side, the device is a SSG-320M with ScreenOS 6.2. Unlike other devices (Nortel, Cisco) the ScreenOS supports 2 kinds of VPN: Policy based and route based.

I was able to use the Policy based mode and the device on the other side is a Cisco ASA5540 managed by a smart network guy.

The steps have been basically the following:

An accurate plan of the network addresses involved by the two encryption domains; as an additional difficulty in my setup the encryption domains have overlapping address space so I configured a virtual Linux “Nat Box” to manage the NAT on my side with the excellent Shorewall package
The definition of the Address Lists on the ScreenOS, binded to the right zones (Trust/Untrust/other)
The definition of the Gateway with a static IP and the pre-shared key. Be careful in the definition the Phase1 parameters, they have to match precisely on both sides
The definition of a VPN AutoKey IKE: again, be careful in the definition of the Phase2 parameters and enable the Reply Protection.
The definition of the Policies between the Network objects involved in the VPN; it was mandatory to flag the “Position at top” and “Modify matching bidirectional VPN policy”

The most important thing in these situations is to have some handful commands to efficiently debug the VPN during the phase 1 and 2. Here I’ll summarize some of them, at the CLI level on the ScreenOS:

fw> debug ike detail                   #enable debug ike
fw> get dbuf stream                    #show the debug messages in the buffer
fw> undebug all                        #disable all debug
fw> clear dbuf                         #clear the buffer
fw> get config | include ike           #show the ike relevant config statements
fw> set ike accept-all-proposal        #try this to check the other side proposals
fw> clear ike-cookie all               #clear IKE cookie for all VPN
fw> get sa active                      #show the active SAs
fw> get sa id                      #show the SA details with network details
fw> get sa stat                        #show traffic with pkt IN/OUT counters

Some useful links for this kind of tasks:
Configuring or Troubleshooting a Juniper Firewall VPN (Juniper KB)
Building IPSEC VPN with Juniper Netscreen ScreenOS
Setting up an IPSEC VPN Tunnel betweek a Juniper Netscreen and a Cisco VPN device

((enjoy))

GoogleCL: Google Apps from the command line

liuk — Tue, 03 Aug 2010 12:49:31 +0000

GoogleCL brings Google services to the command line.

http://code.google.com/p/googlecl/

((enjoy))

Thunderbird or Shredder and Lightning compatibility

liuk — Wed, 07 Jul 2010 12:27:18 +0000

Under Ubuntu, if are you using the latest version of Thunderbird from the PPA (rebranded as Shredder), you may encounter some problems with the Lightning plugin, especially if you are using the 64 bit version.

For example, with Shredder 3.0.6 you have to use the Lightning plug-in version 1.0b1 and not the latest 1.0b2.

For the X86_64 version you may find the archive of the various builds here:

http://releases.mozilla.org/pub/mozilla.org/calendar/lightning/releases/1.0b1/contrib/linux-x86_64/

((enjoy))

RIAFFERMAZIONE DEI PRINCIPI FONDANTI LA RETE INTERNET

liuk — Sun, 07 Mar 2010 23:16:47 +0000

RIAFFERMAZIONE DEI PRINCIPI FONDANTI LA RETE INTERNET

ISOC Italia, delegazione nazionale di Internet Society, preso atto del dispositivo della sentenza di primo grado,emessa il 24 febbraio scorso dal Tribunale di Milano, che ha condannato tre dirigenti di Google per violazione delle norme sulla privacy, a causa di un video rimasto presente per alcune settimane nel 2006 sul sito di Google Videos, che riprendeva un minore affetto da autismo, insultato e offeso da quattro studenti di un istituto tecnico di Torino,ritiene di dover tornare ad affermare alcuni principi fondantie imprescindibili per conservarela libertà e le potenzialità della rete internet:

[1] la rete deve rimanere aperta; nessun ostacolo deve essere posto alle sue potenzialità ed al suo uso ad esclusivo beneficio della comunità;

[2] i provider, sia quelli impegnati nel garantire l’accesso alla rete, sia quelli che operano nella distribuzione dei contenuti eteroprodotti dagli utenti, non devono essere assoggettati ad alcuna forma di controllo o di censura preventiva sui contenuti;

[3]forme di autoregolamentazione, inevitabilmente sottoposte al vaglio degli utenti stessi della rete, oltre ad essere auspicabili promettono di garantire un buon equilibrio tra gli interessi, i diritti e le esigenze di libertà e di comunicazione della conoscenza dei soggetti coinvolti;

[4] le libere espressioni in rete non devono essere impedite attraverso metodi indiretti come controlli restrittivi sull’hardware, sul software, sulle infrastrutture di comunicazione o sulle altre componenti essenziali di Internet da parte dei governi o di portatori di interessi privati;

[5] l’informazione personale generata in rete non deve essere usata in modo improprio o utilizzata da altri senza il consenso informato di chi la ha prodotta; l’informazione è di chi la genera, non di chi la veicola tecnicamente attraverso gli strumenti della rete.

Questi principi appaiono disattesi negli effetti della sentenza, che vede Google condannata – attraverso i propri dirigenti – quale intermediario meramente tecnologico della comunicazione; sicuramente le motivazioni, non appena note, daranno la possibilità di approfondire lo scenario che ha portato all’esito processuale.

ISOC Italia non può che concordare sulla necessità di applicare le norme esistenti per sanzionare i reati commessi attraverso l’uso di Internet, tuttavia ritiene che nessuna responsabilità oggettiva possa essere attribuita ai fornitori dei servizi Internet per quanto attiene i contenuti posti in rete da terzi. Non è possibile trasferire la responsabilità di ciò che è pubblicato su una piattaforma video o su un social network dal soggetto che effettua la pubblicazione al soggetto che mette a disposizione l’infrastruttura tecnologica. Le conseguenze di sentenze di questo tipo potrebbero rendere impossibile l’uso della rete nelle forme più innovative di collaborazione quali il Web 2.0 e le reti sociali, che si basano sulla condivisione di contenuti creati da milioni di persone e per i quali controlli preventivi risulterebbero discutibili e tecnicamente impossibili.

ISOC Italia sente la necessità di esprimere una forte preoccupazione, come condiviso da varie fonti autorevoli, anche a livello internazionale, che la sentenza in questione metta a rischio i principi di libertà in rete attraverso la creazione di un pericoloso precedente.

STEFANO TRUMPY

Presidente ISOC ITALIA

(Giovedì 4 marzo 2010)

Vodafone Mobile Connect for Linux

liuk — Fri, 05 Mar 2010 00:05:09 +0000

If you have a Vodafone Internet Key and you don’t want to get crazy configuring it, use this really fine package: Vodafone Mobile Connect from Betavine Forge, a Vodafone Group R&D Lab.

It has nice features like:

statistics about transferred bytes (rx/tx)
sending SMS
choosing your preferred network settings (gprs, umts, preferred)
nice Python GUI
automatic detection of your Internet Key
it will not use Network Manager

It will works fine also with recent Internet Keys which need usb_modeswitch.

I’ve tested with a 28.8 Mbps USB Internet Key Model Number K4505 under Ubuntu 9.10 64 bit.

((enjoy))

Ubuntu Karmic 9.10 on HP EliteBook 8530p – All is fine!

liuk — Tue, 02 Mar 2010 22:40:39 +0000

After reading this interesting post on Phoronix about the great increase of performance between ubuntu 9.04 and 9.10, I finally convinced myself to make the upgrade.
My first concern was about the ATI driver, which gave me some trouble with 9.04.
Anyway after a good backup, I started the upgrade, and in almost 2 hours I was up and running with 9.10, with a lot of improvements!
The upgrade installed automagically the fglrx driver version 2:8.660, my previous version (built from source) was 2:8.620, however, after the first reboot I started in recovery mode to issue the magic command “aticonfig –acpi-services=off” because I feel that this is still crucial to make the driver work.
After this safety measure, I rebooted and really appreciated the boot speed! Upstart is making a great job really!
So far, I’m very impressed by this release, my major benefits are the following:

Ultra fast boot and shutdown
Great performance of the ATI driver. The black areas that sometimes were appearing for example scrolling a Firefox full screen window have disappeared
Upgrading Skype to 2.1.0.81 solved the problem about the editing of my profile and avatar display
Performance are really increased, for example opening PDF with Evince
Not yet tested printing feature
Suspend to ram works fine
VMware Workstation works fine

((enjoy))

Online LUN expansion and partition resizing without reboot under Linux

liuk — Wed, 30 Sep 2009 15:55:43 +0000

If you are in the need of expanding the LUN where your Linux is installed without rebooting the server, then may be that here you can find the right answer. Your Linux must be sufficiently recent to support features like LVM version 2, ext3 on-line resizing and so on.

My setup in tihs test is the following:

A Linux RedHat 5.3 64 bit Virtual Machine with a single 300 GB LUN /dev/sda in Raw Device Mapping mode (Physical Compatibility mode) under VMware 3.5 and a Compellent SAN. Inside the single disk there is one Volume Group (vg0) with serveral Logical Volumes.

The SAN guys expanded on-line the LUN from 300 to 500 GB (a 30″ operation ).

To force the rescan of partition to get the kernel aware of the new size (supposing your LUN is /dev/sda):

# echo 1 > /sys/block/sda/device/rescan

and then in dmesg you’ll see:

SCSI device sda: 1048576000 512-byte hdwr sectors (536871 MB) sda: Write Protect is off sda: Mode Sense: 8f 00 00 08 SCSI device sda: drive cache: write through sda: detected capacity change from 322122547200 to 536870912000

Now you have two choices at this point: expand the partition containing the current volume group or create a new partition and extend the current volume group. I sincerely prefer the latter, since resizing the partition with fdisk is a risky operation IMVHO.

Use fdisk to create a new partition of type LVM (0×8e) in the free space. But at this point you may have trouble in the kernel re-reading the partition table:

# sfdisk -R /dev/sda BLKRRPART: Device or resource busy

So to inform the OS of the partition table changes use partprobe(8) command which comes with the parted packages.

Verify in /proc/partitions that the kernel has updated the partition table.

Now use pvcreate /dev/sda3, then vgextend vg0 /dev/sda3 and you are done! Verify with vgdisplay that the Free PE are consistent.

To make some more stress test I made the following:

While running this command on a newly created LVM partition /dev/vg0/TRASHME mounted on /TRASH:

# dd if=/dev/zero of=TTTT bs=1024k count=30000 ..... dd is running....

I tried an online resizing of the Logical Volume and the ext3 partition inside it:

# lvextend -L+10G /dev/vg0/TRASHME Extending logical volume TRASHME to 40.00 GB Logical volume TRASHME successfully resized # resize2fs /dev/vg0/TRASHME resize2fs 1.39 (29-May-2006) Filesystem at /dev/vg0/TRASHME is mounted on /TRASH; on-line resizing required Performing an on-line resize of /dev/vg0/TRASHME to 10485760 (4k) blocks. The filesystem on /dev/vg0/TRASHME is now 10485760 blocks long.
in the mean time dd finished his work:
30000+0 records in 30000+0 records out 31457280000 bytes (31 GB) copied, 175.612 seconds, 179 MB/s

Great! Remember to always backup your data before doing operations like this! YMMV.

((enjoy))