Pietro Abate - Pietro Abate homepage/working blog

running skype in a schroot

abate — Sun, 27 Apr 2008 12:12:56 +0200

If I don't trust a stranger to wonder inside my house, why should I allow a closed source program to access my home directory ? Apart from the paranoia and conspiracy implications I decided to spend some time learning how to chroot skype (and iceweasel for that matter, since I don't really trust javascript, flash and the mozilla plugin model) in a chroot.

I started from this article :
http://www.debian-administration.org/articles/566

This recipe didn't work out of the box. This is mine:

Now step by step:
First we install the software. I'm working on a debian unstable...
apt-get install schroot debootstrap

Then we create the chroot with debootstrap, we install skype and let apt-get do the rest. Installing skype will cause a lot of broken dependencies. apt-get -f install will fix them all. Quick and dirty.
Note: you have to copy the package inside the chroot!

sudo debootstrap --variant=minbase --arch i386 sid /home/chroot/sid http://ftp.fr.debian.org/debian


sudo schroot -d / -c sid -p -- dpkg -i /skype-debian_2.0.0.68-1_i386.deb

sudo schroot -d / -c sid -p -- apt-get -f install

At this point the chroot is ready. To run an application, we still need to convince the xserver to accept xsessions from the chroot to be displayed. Since but default my xserver doesn't accept tcp connections (--nolisten tcp), we need to bind-mount the tmp directory inside the chroot.

Notice that this is not the safest solutions. We could re-start the xserver to listen to tcp connections and avoid this step. I've chosen to go this way at the moment.

mount --bind /tmp /home/chroot/sid/tmp

Then we need to authorize the client using xauth and run you command using this little wrapper
xauth extract - $DISPLAY | xauth -f /home/chroot/sid$HOME/chhome/.Xauthority merge -


schroot -- "$@"

rm -f /home/chroot/sid$HOME/chhome/.Xauthority

Depending from your settings you might want to fix the display variable. Running schroot with the -p option let you pass your env variables to the application in the chroot. I suggest you don't do that but add a .bashrc in your chroot home to set only selected variables.

We are ready to skype away in our chroot:
./wrapper skype

Installing iceweasel is just a matter of apt-get in the chroot.

Maybe now they won't be able to tap in your computer so easily, but they will still be able to record you conversations and messages !!!

mod rewrite rule

abate — Sun, 13 Apr 2008 20:52:23 +0200

A quick one about mod_rewrite. I added ssl to cduce.org for our user pages. However I've no use of ssl to serve our static pages. This rule will redirect all https requests (^443$) that are not related to userdirs (!^/~) to http:// .

RewriteEngine on RewriteCond %{SERVER_PORT} ^443$ RewriteCond %{REQUEST_URI} !^/~ RewriteRule ^(.*)$ http://www.cduce.org$1 [L,R]

Openldap + SSL

abate — Sun, 13 Apr 2008 20:47:27 +0200

There are many many howto on the net regarding this topic. Here I'll not give another howto, but just a list of mistakes I've done today. I hope this will same some time to others.

openssl certs

With debian we generally use make-ssl-cert to generate self signed certs. This tools works fine also to generate ssl certs for ldap. The only important thing to remember is to specify your FQN as host name while creating the cert. Failing to do that will make the openldap server fail to start. Remember also to change the permissions of the server certificate to allow the openldap user to read it.

self signed certs VS signed certs

If I understand correctly, openldap works just fine with self signed certs, but this is not optimal. To generate signed certs, you first need to create a CA cert and then use this to sign you server cert. In debian you can find scripts to do that in /usr/lib/ssl/misc/

TLS_REQCERT allow

If you use a self signed cert you need to specify TLS_REQCERT allow in /etc/ldap/ldap.conf and TLSVerifyClient allow in you /etc/ldap/slapd.conf. The first is necessary to get the ldap clients working. I'm not sure about the second one in the server configuration file.

pam and nss

cat /etc/libnss-ldap.conf 

base dc=cduce,dc=org

uri ldaps://osmium.pps.jussieu.fr

ldap_version 3

ssl on

cat /etc/pam_ldap.conf 

base dc=cduce,dc=org

uri ldaps://osmium.pps.jussieu.fr

ssl on

ldap_version 3

pam_password crypt

nss_base_passwd ou=people,dc=cduce,dc=org?one

nss_base_shadow ou=people,dc=cduce,dc=org?one

nss_base_group  ou=group,dc=cduce,dc=org?one

nss_base_netgroup ou=netgroup,dc=cduce,dc=org?one

The important bits here are the ssl on to force the client to use ssl. Of course, remember to specify ldaps in the uri.

Enable ldaps

On debian you need to modify /etc/default/slapd and add this line:

SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps://cduce.org:636/"

I decided to keep ldap without ssl on localhost, but only ldaps on the external interface.

More about Kerberos + SASL + OpenLdap soon...

nagios

abate — Wed, 19 Mar 2008 18:48:34 +0100

This week I spent some time configuring nagios to track our infrastructure, including web services and hardware.

Nagios is an interesting piece of software. It's very flexible and kinda easy to setup. I've to say that the documentation is not particularly well written. However sites like http://www.nagiosexchange.org/ make like very easy. Setting it up on debian is pretty straightforward.

It took me a while to understand how the various configuration files are organized and what is the object hierarchy. My small contribution today is about this plugin to check if a web service is up and running.

you can put this snippet in /etc/nagios-plugins/config/url.cfg

define command{

        command_name    check_url

        command_line    /usr/lib/nagios/plugins/check_http -H $HOSTADDRESS$ -I $HOSTADDRESS$ -u $ARG1$

}

define command{

        command_name    check_url_ssl

        command_line    /usr/lib/nagios/plugins/check_http -H $HOSTADDRESS$ --ssl -u $ARG1$

}

Then to use it, you have to add a file (eg. web_services.conf) in /etc/nagios2/conf.d with this content:

define service {

        host_name                       WebService

        service_description             PYTHON

        check_command                   check_url_ssl!https://trac.cduce.org/

        use                             generic-service

        notification_interval           0

}

to check if a particular service is there. The trick is to define a host named WebService to organize all service under one heading.

Next Step is to integrate munin with nagios.

Recursive subtyping revealed

admin — Fri, 14 Mar 2008 14:16:37 +0100

The other day I read the article: "Recursive Subtyping revealed". A Functional Pearl by Gapeyev, Levin and Pierce. This is a bit of code I wrote to convince myself of the algorithm described in the paper.

You can get the article here

type at =

    |Top |Nat |Bool |Even | Odd

    |Times of ( at * at )

    |Arrow of ( at * at )

    |Mu of ( string * at )

    |Var of string

module S = SortedList.Make(

    struct

        type t = (at * at)

        let compare = compare

        let hash = Hashtbl.hash

        let equal (t1,t2) (s1,s2)  =

          ((compare t1 s1) = 0) && ((compare t2 s2) = 0)

    end

    )

module B = SortedList.Make(

    struct

        type t = string

        let compare = compare

        let hash = Hashtbl.hash

        let equal t s  = (compare t s) = 0

    end

    )

(* canonical substitution *)

let rec sub x t = function

    |Var s when s = x -> t

    |Times(t1,t2) -> Times(sub x t t1,sub x t t2)

    |Arrow(t1,t2) -> Arrow(sub x t t1,sub x t t2)

    |_ as t -> t

(* free variables *)

let rec fv = function

    |Var t -> B.add t B.empty

    |Times(t1,t2) -> B.cup (fv t1) (fv t2)

    |Arrow(t1,t2) -> B.cup (fv t1) (fv t2)

    |_ -> B.empty

exception Undef of (at * at)

let rec subtype (a,s,t) =

    if s = t then S.add (s,t) a

    else if List.mem (s,t) a then a

    else

        let a0 = S.add (s,t) a in

        match (s,t) with

        |_,Top -> a0

        |Mu(x,s1),_ ->

                subtype(a0,sub x s s1,t)

        |_,Mu(x,t1) ->

                subtype(a0,s,sub x t t1)

        |Times(s1,s2),Times(t1,t2) ->

                let a1 = subtype(a0,s1,t1) in

                subtype(a1,s2,t2)

        |Arrow(s1,s2),Arrow(t1,t2) ->

                let a1 = subtype(a0,t1,s1) in

                subtype(a1,s2,t2)

        |_ -> raise (Undef (s,t))

let (<:) t s = subtype([],t,s);;

(* ------------- parser -------------------*)

open Camlp4.PreCast

module TypeGram = MakeGram(Lexer)

let expression = TypeGram.Entry.mk "expression"

EXTEND TypeGram

  GLOBAL: expression;

  expression: [

      "arrow" [ e1 = SELF; "->"; e2 = SELF -> Arrow(e1, e2) ]

    | "prod"  [ e1 = SELF; "x";  e2 = SELF -> Times(e1, e2) ]

    | "var" [

          "Nat" -> Nat

        | "Even" -> Even

        | "Odd" -> Odd

        | "Bool" -> Bool

        | "T" -> Top

        | "mu"; `UIDENT x ; "." ; e = SELF -> Mu(x,e)

        | `UIDENT x -> Var x

        | "("; e = SELF; ")" -> e

    ]

  ];

END

let p s = TypeGram.parse_string expression (Loc.mk "<string>") s

(* ------------- parser -------------------*)

(* Examples *)

let a = p "mu X . ( Nat -> (Nat x X))" ;;

let b = p "Nat -> (Nat x (mu X . (Nat -> (Nat x X))))" ;;

let d = p "mu X . ( Nat -> (Even x X))" ;;

let e = p "mu X . ( Even -> (Nat x X))" ;;

(* suppose Even is subtype of Nat *)

let (<::) t s = subtype([Even,Nat],t,s);;

d <:: e;;

mysql + ssl and xen headahe

abate — Tue, 11 Mar 2008 17:37:09 +0100

Well today I tried to understand why our production server (shame shame) has rebooted twice in a row in the last 3 days. The only visible problem in the logs is the infamous xen error : " xen_net: Memory squeeze in netback driver." . Googling around it seems kinda common and the recommended solution is to add dom0-min-mem to xend.conf and dom0_mem as a kernel option. I've done that and updated the xen hypervisor to the latest bakcported version. The machine is up and running and everything seems fine at the moment. I didn't touch the kernel. This is an other avenue that I might explore if what I've done today didn't fix the problem.

The second problem today was related to mysql. I wanted to configure it to use SSL. Configuring mysql and the client is not too difficult. And this is working just fine. On the other hand I haven't manage to convince php5 to connect via ssl. Googleing around didn't help much.

By default mysql allows non encrypted connections. To force the connection to use SSL, you must specify it per user basis with REQUIRE SSL in a grant statement.

magacli, openipmi, ipmitool

abate — Fri, 07 Mar 2008 13:44:03 +0100

If you manage a dell poweredge, it will come a time where you are curious to know about the health of your machine. These are few notes.

The first thing you will try is probably the dell management server. It's the usual java monster with web interface and all in it. I don't like it. So I installed openimpi and got the megacli bianry from the lsi website.

openimpi is easy: apt-get install opemimpi impitools

Then we need to load the impi kernel modules:

ipmi_si

ipmi_devintf

ipmi_msghandler

ipmi_poweroff

ipmi_watchdog

more info about impi on debian can be found here.

The next thing is to get the LSI raid monitoring tool. This is a compendium for this tool. This utility is not packaged for debian and actually is a 32 bits binary. You can download it from here. Then you just need to extract the binary with unzip and rpm.

If you really want to use omsa this page gives you all the info you need.

Monitoring Script

From HERE.

#!/bin/sh

CONT="a0"

STATUS=0

MEGACLI=/root/bin/megacli

echo -n "Checking RAID status on "

hostname

for a in $CONT

 do

   NAME=`$MEGACLI -AdpAllInfo -$a |grep "Product Name" | cut -d: -f2`

   echo "Controller $a: $NAME"

   noonline=`$MEGACLI PDList -$a | grep Online | wc -l`

   echo "No of Physical disks online : $noonline"

   DEGRADED=`$MEGACLI -AdpAllInfo -a0  |grep "Degrade"`

   echo $DEGRADED

   NUM_DEGRADED=`echo $DEGRADED |cut -d" " -f3`

   [ "$NUM_DEGRADED" -ne 0 ] && STATUS=1

   FAILED=`$MEGACLI -AdpAllInfo -a0  |grep "Failed Disks"`

   echo $FAILED

   NUM_FAILED=`echo $FAILED |cut -d" " -f4`

   [ "$NUM_FAILED" -ne 0 ] && STATUS=1

 done

exit $STATUS

Open source RAID card monitor

http://megactl.svn.sourceforge.net/viewvc/megactl/trunk/

It would be nice to have a munin plugin for this monitoring tools.

ocamlbuild + camlp4 + ocamlfind

abate — Fri, 07 Mar 2008 10:39:43 +0100

Recently I tried to answer to a problem posed on the OCaml mailing list. Basically the problem is how to compile using ocamlbuild using ocamlfind and camlp4. The Camlp4 wiki has already all the ingredients. Here I mix them up in a short example.

_tags : is the ocamlbuild dep file
bar.ml : is a ml file that uses the syntax extension pa_float to compile.
foo.ml : is a ml file that depends on bar.ml and the str module (fetched via ocamlfind)
pa_float.ml : is the source code of the camlp4 syntax extension.

The code

_tags

"pa_float.ml": use_camlp4, pp(camlp4of)

"bar.ml": camlp4o, use_float

bar.ml

let x = Float.( 3/2 - sqrt (1/3) )

let f x =

  Float.(

    let pi = acos(-1) in

    x/(2*pi) - x**(2/3)

  )

foo.ml

open Str

let x = Bar.x

myocamlbuild.ml

open Ocamlbuild_plugin;;

open Command;;

let packages = "str";;

let ocamlfind x = S[A"ocamlfind"; x; A"-package"; A packages];;

dispatch begin function

| Before_options ->

    Options.ocamlc := ocamlfind& A"ocamlc";

    Options.ocamlopt := ocamlfind& A"ocamlopt";

| After_rules ->

    flag ["ocaml"; "pp"; "use_float"] (A"pa_float.cmo");

    flag ["ocaml"; "link"] (A"-linkpkg");

    dep  ["ocaml"; "ocamldep"; "use_float"] ["pa_float.cmo"];

| _ -> ()

end;;

pa_float.ml

module Id = struct

  let name = "pa_float"

  let version = "1.0"

end

open Camlp4

module Make (Syntax : Sig.Camlp4Syntax) = struct

  open Sig

  include Syntax

  class float_subst _loc = object

    inherit Ast.map as super

    method _Loc_t _ = _loc

    method expr =

      function

      | <:expr< ( + ) >> -> <:expr< ( +. ) >>

      | <:expr< ( - ) >> -> <:expr< ( -. ) >>

      | <:expr< ( * ) >> -> <:expr< ( *. ) >>

      | <:expr< ( / ) >> -> <:expr< ( /. ) >>

      | <:expr< $int:i$ >> ->

        let f = float(int_of_string i) in <:expr< $`flo:f$ >>

      | e -> super#expr e

  end;;

  EXTEND Gram

    GLOBAL: expr;

    expr: LEVEL "simple"

    [ [ "Float"; "."; "("; e = SELF; ")" -> (new float_subst _loc)#expr e ]

    ]

    ;

  END

end

let module M = Register.OCamlSyntaxExtension Id Make in ()

To Compile

$ocamlbuild foo.byte -classic-display

/usr/bin/ocamlopt -I /usr/lib/ocaml/3.10.0/ocamlbuild unix.cmxa /usr/lib/ocaml/3.10.0/ocamlbuild/ocamlbuildlib.cmxa myocamlbuild.ml

+ /usr/lib/ocaml/3.10.0/ocamlbuild/ocamlbuild.cmx -o myocamlbuild

/usr/bin/ocamldep -modules foo.ml > foo.ml.depends

/usr/bin/ocamldep -pp camlp4of -modules pa_float.ml > pa_float.ml.depends

ocamlfind ocamlc -package str -c -I +camlp4 -pp camlp4of -o pa_float.cmo pa_float.ml

/usr/bin/ocamldep -pp 'camlp4o pa_float.cmo' -modules bar.ml > bar.ml.depends

ocamlfind ocamlc -package str -c -pp 'camlp4o pa_float.cmo' -o bar.cmo bar.ml

ocamlfind ocamlc -package str -c -o foo.cmo foo.ml

ocamlfind ocamlc -package str -linkpkg bar.cmo foo.cmo -o foo.byte

RedMine experiments

abate — Fri, 29 Feb 2008 16:45:23 +0100

RedMine is a hosting solution for Open projects conceptually similar to Trac. At first sight, the main difference with trac is that redmine is multi-project, while trac has a narrower vision where each trac instance is a project. To be fair there are extensions in trac to administer multiple projects at once, built this is not shipped with the system.

It's written in ruby. This is not a problem per-se, but since I never worked with Rails, it took a bit more then necessary to get it going. In the end, I configure redmine to run as a cgi as I didn't manage to get the fast-cgi interface going. The problem is mostly related with apache. It's fairly slow in this way, but this is by design.

I've used Rails 2.0 shipped with debian unstable on a stable machine. The installation was painless as rails doesn't have conflicting dependencies.

I've to play with it a bit more, but it seems a good system , somehow better then trac if you want to have a forge-style site without installing gforge itself.

New Cduce Release 0.5.2.1

admin — Fri, 29 Feb 2008 16:32:47 +0100

This is a minor bug-fix release. A new MacOsX binary package is avalaible. See the Download page for download information, or the CHANGES file to know what's new.

Not much to add.