Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

  • Fedora21 – Quick and Dirty with Firewalld

    firewall

    Hey, are you new to Firewalld like most of us?

    Unless you have been using Firewalld in the last few releases of Fedora, as some out there have, then you probably could probably use a few pointers to get you started on your way to configuring your Linux firewalls the “new-fangled fancy way”. This is especially the case if you plan on moving to RHEL7 anytime soon — as Firewalld is the default there. So put on your big boy (or girl) pants and say goodbye to your old friend IPTABLES.

    According to this page. Firewalld is…

    “The dynamic firewall daemon firewalld provides a dynamically managed firewall with support for network “zones” to assign a level of trust to a network and its associated connections and interfaces. It has support for IPv4 and IPv6 firewall settings. It supports Ethernet bridges and has a separation of runtime and permanent configuration options. It also has an interface for services or applications to add firewall rules directly”

    Wow, how fancy. So how do we use it? Well let’s take a stab at enabling HTTP access to our Fedora21 workstation.

    First thing first, lets figure out what our default done is on our workstation.

    $ sudo firewall-cmd –get-default-zone
    FedoraWorkstation

    Ok, thats a bit strange, in RHEL you should expect PUBLIC to be your default zone.  Now that we know what zone we need to mess with let’s make sure that its applied to the proper interfaces.

    $ sudo firewall-cmd –get-active-zone
    FedoraWorkstation
    interfaces: enp4s0 enp5s4 macvtap0 tun0 virbr0

    The first two interfaces above are our physical interfaces, so we are good here. Now lets apply the rule, and make sure its permanent.

    $ sudo firewall-cmd –permanent –zone=FedoraWorkstation –add-service http
    success

    Now lets check our rules. Note HTTP is missing.

    $ sudo firewall-cmd –list-services
    dhcpv6-client mdns samba-client ssh

    Since we have only applied this new rule to our permanent config and not to our running config, we need to restart firewalld to see the updated rule.

     $ sudo firewall-cmd –reload

    Now your can view the updated rules…

    $ sudo firewall-cmd –list-services
    dhcpv6-client http mdns samba-client ssh

  • Installing Red Hat Enterprise Linux OpenStack with Foreman

    openstack
    If you are looking to know a bit more about Red Hat’s offering in the OpenStack space, this is a good video to start with. The video also takes you through the “Evolution Of OpenStack Deployment Tools” which is helpful for those of us who are just getting our feet wet with OpenStack.

    For additional information on RHEL OpenStack 6 (Juno), this link below has plenty of helpful information.

  • Bropages – Like Manpages but More Friendly

    41KUBzxwK4L._SX300_I stumbled into this fun little tool the other day when I was introduced to it by a friend.  Bropages is a bit like man pages, but without all the hemming and hawing and information that you might not need when you are just trying to remember the proper syntax of a command.  Bropages just shows you an annotated example of how to run a command.

    Before you can get started with Bropages, you need to install it. Note that I am running these commands on my Fedora21 Workstation. Your mileage may vary depending on your distro.

    First you will need to install rubygems if its not already installed.

    #yum -y install rubygems

    Then install bropages — its a ruby gem.

    #gem install bropages

    Now lets take bropages out for a spin by running bro against the which command

    # bro which
    2 entries for which — submit your own example with “bro add which”

    # locates executable
    which bro

    bro thanks to upvote (2)
    bro …no to downvote (0)

    ………………………………………………………………………………………………………………………………

    # Shows all install locations of an executable (in this case ruby)
    which -a ruby

    bro thanks 2 to upvote (2)
    bro …no 2 to downvote (0)

    Neat. As you can see above we have two examples of how to run the which command. Now lets try it against the chage command.

    [root@fedora21 ~] $ bro chage
    The chage command isn’t in our database.

    * Typing bro add will let you add chage to our database!

    * There’s nothing to lose by typing bro add, it will just launch an editor with instructions.

    * Need help? Visit http://bropages.org/help

    So bro don’t know chage, as its not in the bro database… let’s add it.

    #bro add chage

    We are prompted to add our short entry with a brief description

    #~ Bro entry for command ‘chage’
    #~ Provide a useful example for how to use ‘chage’
    #~ Comments starting with #~ are removed
    #~
    #~ Example for command ‘man’:
    #~ # Opens up the manual page for the command ‘ls’
    #~ man ls
    # Configure a user’s password not to expire
    chage -m 0 -M 99999 -I -1 -E -1 username

    There, now we have created and submitted our entry.

  • Insync: The Powerful Google Drive Client For Linux

    Insync

    Insync is a very powerful and full featured Google Drive client for Windows, Mac, and Linux. I ran across Insync when I was looking for a Google Drive client for Linux after I kicked Dropbox to the curb and switching over to Google Drive for all my cloud storage needs.

    In all honesty, if it wasn’t for the Insync client I do not think that I would have made the switch at all, as Google does not even offer a basic GUI client for Linux. Really Google?

    PSA: The integration that Google Drive provides into Google Photos, Google Music, Google Docs, and Gmail is well worth the switch from Dropbox in my opinion, and 1TB for only 9 bucks a month is hard to beat (100GB is only $1.99 a month). Just having a Gmail account gives you access to 15GB of free space… so there is no reason not to give it a try.

    Ok now back to the topic at hand.

    Note that a personal license of the Insync Google Drive client is not free, rather it costs $15. However you can download and try it risk free and without entering any credit card info. This one time fee for a personal license allows you to run and install Insync on multiple machines. Currently I have it installed on 4 separate Linux workstations/laptops. Its well worth cash.

    Installing Insync is very easy and well documented so I am not going to go into that topic here. Rather lets talk about using Insync on Linux.

    (more…)

  • How to Fix the Buffalo Linkstation NAS – Partition Not Found Error

    Buffalo-LinkStation-220-1024x576-e90e950d78fb74df

    Recently I picked up a Buffalo Linkstation 220 to play around with at home as I felt that I could use a bit of additional storage to play around with. Note that this previous statement is pretty much a lie. I have tons of storage, and was really just looking for an new toy to play around with. Basically I just had a few disks laying around that I wanted to put to use.

    However, much to my dismay the I was unable to configure the device once I shoved in the disks, powered it up, and connected to it with the Buffalo Smart Phone Navigator. I figured that this was not a big deal however, so I tried the installable Windows App from my Windows 7 Vm. The Buffalo NAS Navigator was also able to connect to the device, however the device showed that it was currently booted in what was called “Emergency Mode”.

    Not sensing a real emergency, I did not panic.

    See borrowed image below.

    buffalo_unbrick_001

    Fortunately the site that I borrowed the above image from (here) and this site (here) give advice on how to fix the issue. First step is to download the Buffalo Linkstation Firmware Updater that you can get here. Both pages advise you to modify the LSUpdater.ini file. However their instructions did not work for me. The exact changes, and the LSUpdater.ini in its entirety are below.

    [Application]
Title = BUFFALO LinkStation Series Updater Ver.1.62
WaitReboot = 1200
WaitFormat = 600
WaitFileSend = 600
WaitDiscover = 120

[Target]
ProductID = 0x80000000
ProductID2 = 0x0000001D
ProductID3 = 0x0000300D
ProductID4 = 0x0000300E
ProductID5 = 0x00003011

Name = LinkStation

[Flags]
VersionCheck = 0
NoFormatting = 0

[SpecialFlags]
Debug = 1

    At this point you launch the updater again, and select “Update“. This fully partitions the drives and then updates the firmware. This process takes a while, so be patient. Now you can launch the NAS Navigator and configure the device.

  • How to Remove Deactivated or Invalid Nodes from Puppet Enterprise via the CLI

    puppet-logo

    Apparently just deleting a Puppet node from the Puppet Enterprise Console does not actually delete the node from the Puppet database, and free up a licenses… or at least in my case it did not. I ran into this issue tonight after removing a few of my test boxes in preparation of building a new node that I wanted to ensure was properly managed via Puppet.

    As many of you know when running the free version of Puppet Enterprise you are limited to 10 managed nodes. In my Lab I am actually running only 7 nodes, however over the past few months, I have build several test VMs as part of testing my Centos 6 kickstart and Puppet bootstrap scripts. However even after deleting these nodes manually from the WebUI I noticed that I was not freeing up any licenses.

    Below is the process that I had to run to manually remove nodes from my PuppetDB. First lets list all managed VMs and look for nodes that we know do not exist any more.

    [root@puppet puppet]# puppet cert list -all

    + “batman.localdomain” (SHA256) 4C:76:04:38:CE:D3:4A:E0:C9:2A:C8:E6:BB:4A:92:0C:6B:39:D9:4B:7C:E4:D1:9D:0F:E2:06:FD:97:CC:72:AF
    + “robin.localdomain” (SHA256) A9:08:E8:09:B6:68:65:81:92:FC:82:93:DB:83:82:D9:A5:A2:EB:6D:DD:6E:C5:F0:45:55:A5:39:47:DB:A1:27

    In the example above, I found two test VMs… Batman and Robin, which I know are no longer valid, so lets remove them and free up a couple of licenses.

    [root@puppet puppet]# puppet node deactivate robin.localdomain
    Submitted ‘deactivate node’ for robin.localdomain with UUID 54267132-1c23-4cf7-96f4-d6f3ff13a684

    [root@puppet puppet]# puppet node deactivate batman.localdomain
    Submitted ‘deactivate node’ for batman.localdomain with UUID 160d9f7c-734c-4830-8faa-23f331218b90

    Once you have set the node to deactivate, lets clean out the certs.. rinse and repeat for each node to delete.

    [root@puppet puppet]# puppet node clean batman.localdomain
    Notice: Revoked certificate with serial 17
    Notice: Removing file Puppet::SSL::Certificate batman.localdomain at ‘/etc/puppetlabs/puppet/ssl/ca/signed/batman.localdomain.pem’
    batman.localdomain

    Now when we return to the WebUI we should have two free licenses and can add new managed nodes without issue. Note that according to puppet themselves “that in some cases, the PE license count in the console will not decrease for up to 24 hours, but you can restart the pe-memcached service to update the license count sooner”

  • HomeLab: How to Resolve Supermicro x8dti Fan Revving Issues

    Supermicro-Hyper-Speed-6027AX-TRF-Front-Straight

    Its Winter here in the Atlanta area, and the temperatures have been dropping down close to freezing. Likewise, the temperatures in my basement Homelab have been dipping below 66 degrees Fahrenheit, and apparently this makes my Supermicro Servers a bit unhappy.

    A bit of background. When I set out to build my lab I decided to transfer my Supermicro X8DTI boards out of their stock rack mount enclosures (like what you see above) and into Standard EATX Towers. Running my boards in these towers allowed me to use large 120mm and 140mm fans for cooling. Sound wise this is a huge improvement over the stock 80mm fans used in the default enclosure as these larger fans can spin much slower than stock and still keep the system cool.

    On several occasions I have been working in my office and have heard the fans in my lab servers revving up and back down again. At first I thought that maybe a fan was failing, and that one of my systems was overheating. Or that one of my systems had sucked in a bit too much basement dirt and dust. However neither were the case.

    Specifically what was happening was this… The systems were running cool, so the fans would spin down to a low rpm and the system would then throw a low rpm threshold alert and spin the fan back up.When this occurs the system switches into some sort of “Critical Cooling Mode” and spins all the fans up to 100% for a few seconds. Rinse and repeat a few dozen times and you hear what almost sounds like an intoxicated neighbor playing with his new weedeater.

    Using the IPMIitool command from my Linux desktop first logged into IPMI controller on my systems and checked to make sure that the fans were actually working properly. SDR is short for Sensor Data Repository

    # ipmitool -H 10.1.0.104 -U admin -P <password> sdr list
    Fan2 | 2176 RPM | ok
    Fan3 | 340 RPM | ok
    Fan4 | no reading | ns
    Fan5 | 544 RPM | ok
    Fan6 | 340 RPM | ok
    …truncated…

    Fan6 above is spinning mighty slow. Slow enough to drop below the Lower Non-Critical Value threshold. Rather than increase the speed of the fan as I have seen others do, I decided to lower the thresholds for this fan with the command below. Since Fan5 is also a bigun’ I decided to preemptively adjust its thresholds as well.

    ipmitool -H 10.1.0.104 -U admin -P <password> sensor thres Fan4 lower 100 200 300
    ipmitool -H 10.1.0.104 -U admin -P <password> sensor thres Fan5 lower 100 200 300