local suid in linux ;)

There’s a ugly local suid root in linux that is only patched since, well, very recently. What’s worse there’s also a number of exploits already because this has apparently interested many people.

Further reading:

http://blog.zx2c4.com/749

Otherwise… Well. If you can, search (find -local -perm 4000 / ) and disable all your suid binaries (i.e. start X as root via login manager, then you don’t need suid startx) It’ll be over at some point lol.

The FreeBSD user in me has a strong urge to let out some laughter…

kldunload -f linux.ko :)

Troubleshooting for lm-sensors (early morning edition)

Suppose you want to add the lm_sensors plugin from the check_mk exchange on your desktop PC. And it just won’t work.

Problem determination guide:

Is lm-sensors installed including the support libraries?

If yes:

Has sensors-detect been run?

If yes:

Does it detect your PhenomX6?

If no:

Does acpi -t correctly print temperature?

If no:

Can you see the CPU thermal stuff in proc??

If no:

Did you book a new VPS at edis.at yesterday?

If yes:

Compare these pictures to identify the system you’re working on:

The new vps —>>           

The overclocked PC  —>>

 VPS != PC

Followup on “on-demand provisioning is stupid”

I learned about the technique Mise en place via my girlfriend who thought she needs to professionalize her weekly baking endeavours.

Read http://en.wikipedia.org/wiki/Mise_en_place and mentally apply this to system provisioning in a large (automated) IT.

This is good followup to my old article http://deranfangvomende.wordpress.com/2011/03/31/are-you-really-done-virtualizing-or-did-you-stop-at-the-start/ where I tried to explain why it is a big waste of time to install each server when required, cut each new SAN lun for the server, assign zoning, provision each VLAN when it’s needed instead of having it ready on time.

OVM 3.0 installation xen.gz hang fix

My Supermicro boxes all hung up when the installer booted. Recently there was a post about a fix for this issue on the Oracle OTN forums. To be honest, it’s almost a spam post, anyway. Follow the link in there.

https://forums.oracle.com/forums/thread.jspa?threadID=2308826

Short version: You must disable IPMI serial forwarding if you have this issue. Some BIOSses apparently remap the serial port on the fly and this is whats causing the problem.

A BSD Hypervisor named Beehive

NetAPP apparently had a christmas present for the BSD community named BHyVe (Beehive)

http://wiki.freebsd.org/201105DevSummit?action=AttachFile&do=get&target=BHyVe.pdf (btw… what the f*** is it with wordpress and randomly broken formatting… links… stuff?

It runs using HVM on Intel, the  key difference to running a Xen PV FreeBSD domU is that it’s actually working :)  A port to AMD Pacifica is on it’s way.

Looks like a very lean and simply solution & nice to have.

(Note: FreeBSD HVM is of course no problem anymore)

 

$90 TP-Link switch – wow

Today I got this tiny little switch from chinese TP-Link – and I’ll write a review here, since I’m having a hard time believing what this low-cost thinggy can do.

last time I bought something from that vendor was 5-6 years ago, some wireless cards with the FreeBSD-friendly Atheros chipset. Until recently their switches definitely didn’t look like anything you’d want to buy.

How I ended up with this one?

I always wanted to run fibre through the small hole I drilled into the living room wall so I could have a nice LACP+Vlan trunked interface to “teh server”, since that allows much more networking fun. The “normal” powerful switches like Cisco, Extreme, H3C I would have around are not suited for home use due to the amounts of power they are consuming to generate the noise the make :)

A review of this tiny TP-Link switch in c’t had caught my attention since it listed having SNMPv3 support, plus two SFP ports.

Got the switch, took a moment to realize I would need to look at the manual to find the CLI port speed (38400 bps) and off we were!

Configuration is on the CLI mostly Cisco-link although at some points I didn’t manage to do it right on the CLI. For example I didn’t find out how to save the config :)

From the web UI things are easier to configure, except maybe IP ACLs where you really want some copy-paste facility. It’s not 100% intuitive at all times, but it’s very fast to make up for it.

Features

The LACP implementation is working fine, it’s doing real dynamic LACP, you just enable it on ports and they’re bound as cables are plugged in. That also means it will not cause issues when doing kickstart installs, much different from some Linksys switches.

SNMP: You can define views, you can assign them to users / groups all no problem. V2C bulkwalks just fly (ok, the MIB is small, too). No per-VLAN counters as far as I can tell, also no sFlow, but both is hardly even found on $500 models, so that is quite fair.

Fun issue when using it with Check_MK: The interface desc’s I set from the web UI are… well… there is some encoding oopsy somewhere. The vendor supplied descriptions to the left, are all fine, but mine to the right ended up in chinese:

NTP / Syslog: All as you’d expect it. show logging buffer gives the log output locally, what else do I ask. This is one of the pieces I had to setup from the gui.

VLANs: It is possible to change the management VLAN off VLAN1 to something that is not the default vlan. Yay! Didn’t use that yet, since at home it is not … well managed :)  Even GVRP is available and configurable per port in learning or other modes.

Spanning tree stuff is nicely done with STP/RSTP/MSTP support to a level where it can surely use it to extend some lab.

See the screenshot here – and they really call it a “L2 Lite Managed Switch“.

tplink SG3210 mstp settings

MSTP settings

And here’s the output from the bonding driver with working LACP:

802.3ad info
LACP rate: fast
Active Aggregator Info:
	Aggregator ID: 1
	Number of ports: 2
	Actor Key: 17
	Partner Key: zz
	Partner Mac Address: b0:48:7a:b3:xx:xx

Joining the 2nd ethernet port of my server into the bond was just a matter of adding the linux config and doing “ifup eth1″ (since normal linux distros can’t do dynamic lacp grouping like a switch… go figure)

What I didn’t yet get to work was the IP ACLs that should block the config interface & snmp for non-management systems. But I guess that was just my own error.

Also nice is a bunch of DDOS protection stuff (Anyone said SYN flood?) and even ARP spoofing filters, also on a per-port level!

Stability-wise: I’ve pulled 121GBytes off a NFS share at 100+MB/s without errors. OK for me. :)

Noise: It has no fan!

So this thing is taking the #1 place for best low-cost switch from the HP 1810G as of today :)

Next Post

running pvscan…:

    Walking through all physical volumes
        /dev/ramdisk: Skipping (regex)
        /dev/loop0: Skipping (sysfs)
        /dev/sda: Skipping (regex)
        Opened /dev/md0 RO
      /dev/md0: size is 5860543488 sectors
        Closed /dev/md0
      /dev/md0: size is 5860543488 sectors
        Opened /dev/md0 RW O_DIRECT
        /dev/md0: block size is 4096 bytes
        Closed /dev/md0
        Using /dev/md0
        Opened /dev/md0 RW O_DIRECT
        /dev/md0: block size is 4096 bytes
      /dev/md0: No label detected
        Closed /dev/md0

The Raid is OK
The VG is on that disk
Already deleted my LVM cache and disabled writing it

Let me say I am SO sick of this…
Perc5 battery is fully loaded, going to move off the LVM/MD setup ASAP.

Just need to find the data first.

Update1:
Found out that the LVM cache file was both the cause and the last straw. It had been available when the system called lvm.static during boot (which read it). Via the cache file the system found the volume groups, and then once the system was up, it didn’t find them any more.
But since I had disabled write_cache_state (albeit after writing one file), it did never delete that old cache.

Getting closer to the read issue now, but I guess it’s time for a short excursion, making a work copy of the whole server :>

The LVM metadata is either incomplete, or “has a little offset” on the disk md0. I can see it using dd, but not yet sure if it’s OK.

The other thing I found out is that the Perc5i will totally overheat in my current server case.