Thursday, November 19, 2009

permissions with rsync

Quoting from rsync man page: to give destination files (both old and new) the source permissions, use --perms. To give new files the destination-default permissions (while leaving existing files unchanged), make sure that the --perms option is off and use --chmod=ugo=rwX

Example: 
 rsync -av --no-p --chmod=ugo=rwX -e "ssh -i /path/to/key" src dest
Posted by at 2 comments:

Tricky Back Button

I'm working on a web portal that uses CAS authentication, and would like to prevent someone from using the browser back button to see secure/private contents of a logged out user. It basically requires disabling the browser cache for dynamically generated pages. Obviously it's nothing new and got to have tons of perfect solutions out there. However, after spending days poking online, following tricks satisfied me a lazy amateur web developer:

  • JavaScript onUnload event: either use
     <body onunload="">
    at the beginning of the HTML page, or
     <script> window.onbeforeunload = function () {} <script>
    before the end of HTML body tag.

  • Above worked with Safari and IE, but not Firefox 3.5. Next trick is to use HTTP Cache-Control attributes in a response header. Django code example: 

    response['Pragma'] = 'no-cache'
    response['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
    response['Expires'] = 0


  • I have a form using the POST method in the page. After logging out, browser back button would resubmit the form information to the expired user session, and cause the browser to display unexpected connection drop error. Redirecting the page using 
     window.location.replace(URL)
    right after the form submission solved the issue.

Posted by at 1 comment:

Friday, August 21, 2009

Apache2 Configuration on SLES

Different but rather organized. A few tips:

To enable a properly installed module, edit APACHE_MODULES in the file /etc/sysconfig/apache2

Most server configuration directives are located in /etc/apache2/default-server.conf
Posted by at No comments:

Readline Not Found with Python Installation

After installing a different version of Python (2.5.4) on my SLES server, it complains about "readline" module not found, though it does exist on the system.

Fix is to install the readline-devel package and rebuild/reinstall Python.
Posted by at No comments:

Thursday, August 20, 2009

To Blow a Hole on SuSE firewall

Yast --> System -> /etc/sysconfig editor --> network --> firewall --> susefirewall2 --> FW_TRUSTED_NETS

Or edit the corresponding variable in the file /etc/sysconfig/SuSEfirewall2 directly
Posted by at No comments:

Tuesday, July 21, 2009

Exclude Packages From Rug Update

Use additional rug features.

rug lock-add *kernel* prevents any kernel updates.
Posted by at No comments:

Monday, July 20, 2009

S.M.A.R.T resources

Smartmontools for SCSI devices

Monitoring Hard Drive Health on Linux with smartmontools (a nice blog entry)

And then there's man page
Posted by at No comments:

Init Script Templates

RHEL: /usr/share/doc/initscripts-*/sysvinitfiles

SLES: /etc/init.d/skeleton
Posted by at No comments:

Myri10ge under SLES 10

A mysterious kernel update happened on my SLES server, maybe I was not paying enough attention when saying "yes" to "rug update". It would have gone unnoticed for a long time if I were not just reading /var/log/messages for entertainment. I'm really unhappy to have a running kernel quietly overwritten under me, even if it's somewhat my fault. The new kernel broke the 10GigE interface, which real sysadmins helped to fix when I just installed SLES 10. Here are steps to bring things back to normal:

	rmmod myri10ge
	lsmod | grep myr10ge
	download, build and install the latest driver from Myricom
	modprobe myri10ge
	modinfo myri10ge
	ethtool eth2


At least this time I didn't need to have /etc/sysconfig/kernel modified with MODULES_LOADED_ON_BOOT="myri10ge" to make it load automatically on boot.
Posted by at 1 comment:

Monday, March 30, 2009

To Play a Storage Sysadmin

Create a large partition on Linux

LVM HOWTO, especially how to setup striping. Or use the fancy GUI of system-config-lvm.

XFS FAQ.
Enable additional file system support in RHEL, a very nice guide considered by others.

Some discussions on LVM vs. RAID, and Partition Alignment.

Benchmark with iozone.

Posted by at No comments:

Wednesday, March 4, 2009

Bad Script Interpreter

I ran into the exact same problem with python today as described in this blog post.

In short, if a shell barks at the interpreter line like "#!/usr/bin/python" in your script while the path is absolutely correct, try run "dos2unix" on the source file.

I am a PC and I'm 4 and a half.
Posted by at No comments:

Monday, February 16, 2009

Linux Shell Meets Java UID

Java Unique ID generator (java.rmi.server.UID().toString()) can come in handy when needing unique directory names. However some basic Linux shell commands like ls, cd, rm, etc. may not like the "-" part in directory names like "-2374f8d0", Either "ls ./-2374f8d0" or "rm -- -2374f8d0" can do the trick.
Posted by at 4 comments:

Ant Launcher

I don't remember (or ever know) if you can use ~ in place of /home/username/ for Java classpath settings. But I got "Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/tools/ant/launch/AntMain" for ant-launcher.jar. Internet says one should also check $ANT_HOME value when running into similar errors.
Posted by at No comments:

Change Axis2 Client Read Timeout

RPCServiceClient serviceClient = new RPCServiceClient();
Options options = serviceClient.getOptions();
options.setTimeOutInMilliSeconds(180000);

Posted by at No comments:

Thursday, February 12, 2009

MarsEdit

Finally found this not so pita blogging tool for Mac, especially when it comes to handling image insert to Blogger. Maybe I should pick up blogging again.

vladstudio_blogger_800x600.jpg
Posted by at No comments:

Friday, June 13, 2008

Apache Security

When hosting an Apache web server for very concerned customers, authentication, authorization, and access control can all flood in the way. Some may even ask for host-based methods. Just keep in mind that Apache has its own way for them all, including where to write logs. Don't go mess with usual files like /etc/hosts, /etc/hosts.allow, /etc/hosts.deny, or /var/log/messages. Unless, of course, your boss told you to.
Posted by at 1 comment:

Tuesday, June 3, 2008

MySQL in Non-standard Locations

Sometimes one ends up with a machine containing multiple MySQL installations, and no clue how and why it happened in the first place. Besides normal which password to use for which server confusions, it also requires some attention when installing packages like Perl DBD-mysql module. Be sure to specify the correct -I and -L paths at "perl Makefile.PL" step of the installation.

For example:
perl Makefile.PL --cflags="-I/usr/local/mysql/include -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fwrapv" --libs="-L/usr/local/mysql/lib -lmysqlclient -lz -lcrypt -lnsl -lm -L/usr/lib64 -lssl -lcrypto"


A Perl DBI client connection string can specify the non-standard socket location like this:
"DBI:mysql:mydb:localhost:mysql_socket=/tmp/mysql.sock"
Posted by at No comments:

Friday, May 30, 2008

What CoG Really Wants

I ran into various error messages from the CoG Kit when attempting a fresh install of GridFTP enabled CIMA portal. After figuring out and fixing all mishaps on my part, I wonder if anyone else also find those messages cryptic.

  • Using wrong Java.

    $ java --version
    java version "1.5.0"
    gij (GNU libgcj) version 4.1.2 20070925 (Red Hat 4.1.2-27)

    $ ./cog-myproxy -h myproxy.teragrid.org -p 7514 -l username -S anonget
    Enter MyProxy Pass Phrase:
    Error: MyProxy get failed. [Caused by: Authentication failed [Caused by: Miscellaneous failure. [Caused by: Bad certificate (java.security.SignatureException: MD5/RSA/PKCS#1: Not initialized)]]]

    Should have used the following one from Sun instead:

    $ java -version
    java version "1.5.0_14"
    Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_14-b03)
    Java HotSpot(TM) Client VM (build 1.5.0_14-b03, mixed mode, sharing)


  • Missing the remote host/server CA certificate from $HOME/.globus/certificates. In the following example, it's missing the NCSA certificate, CA who signed the BigRed cluster. Insiders may like this reference.

    $ ./cog-file-transfer -s gsiftp://gridftp.bigred.iu.teragrid.org/N/dc/projects/cima/lustre_iumsc_frames/07108/a_071081.001 -d file:///tmp/a_071081.001
    ERROR - File transfer failed
    Authentication failed. Caused by Failure unspecified at GSS-API level. Caused by
    COM.claymoresystems.ptls.SSLThrewAlertException: Unknown CA
    at COM.claymoresystems.ptls.SSLConn.alert(SSLConn.java:235)
    at COM.claymoresystems.ptls.SSLHandshake.recvCertificate(SSLHandshake.java:304)
    at COM.claymoresystems.ptls.SSLHandshakeClient.processTokens(SSLHandshakeClient.java:128)
    at COM.claymoresystems.ptls.SSLHandshake.processHandshake(SSLHandshake.java:135)
    at org.globus.gsi.gssapi.GlobusGSSContextImpl.initSecContext(GlobusGSSContextImpl.java:488)
    at org.globus.ftp.extended.GridFTPControlChannel.authenticate(GridFTPControlChannel.java:208)
    at org.globus.ftp.GridFTPClient.authenticate(GridFTPClient.java:104)
    at org.globus.ftp.GridFTPClient.authenticate(GridFTPClient.java:89)
    at org.globus.cog.abstraction.impl.file.gridftp.old.FileResourceImpl.start(FileResourceImpl.java:97)
    at org.globus.cog.abstraction.impl.file.gridftp.FileResourceImpl.start(FileResourceImpl.java:47)
    at org.globus.cog.abstraction.impl.fileTransfer.DelegatedFileTransferHandler.startResource(DelegatedFileTransferHandler.java:415)
    at org.globus.cog.abstraction.impl.fileTransfer.DelegatedFileTransferHandler.prepareService(DelegatedFileTransferHandler.java:191)
    at org.globus.cog.abstraction.impl.fileTransfer.DelegatedFileTransferHandler.run(DelegatedFileTransferHandler.java:434)
    at java.lang.Thread.run(Thread.java:595)


  • Missing the NCSA MyProxy CA certificate.

    $ ./cog-file-transfer -s gsiftp://gridftp.bigred.iu.teragrid.org/N/dc/projects/cima/lustre_iumsc_frames/07108/a_071081.001 -d file:///tmp/a_071081.001
    ERROR - File transfer failed
    org.globus.cog.abstraction.impl.file.FileResourceException: Exception in getFile
    at org.globus.cog.abstraction.impl.file.gridftp.old.FileResourceImpl.getFile(FileResourceImpl.java:312)
    at org.globus.cog.abstraction.impl.fileTransfer.DelegatedFileTransferHandler.doSource(DelegatedFileTransferHandler.java:251)
    at org.globus.cog.abstraction.impl.fileTransfer.DelegatedFileTransferHandler.run(DelegatedFileTransferHandler.java:438)
    at java.lang.Thread.run(Thread.java:595)
    Caused by: org.globus.ftp.exception.ServerException: Server refused performing the request. Custom message: (error code 1) [Nested exception message: Custom message: Unexpected reply: 451 active connection to server failed
    org.globus.common.ChainedIOException: Authentication failed [Caused by: Failure unspecified at GSS-API level [Caused by: Unknown CA]]
    Authentication failed. Caused by Failure unspecified at GSS-API level. Caused by COM.claymoresystems.ptls.SSLThrewAlertException: Unknown CA
    at COM.claymoresystems.ptls.SSLConn.alert(SSLConn.java:235)
    at COM.claymoresystems.ptls.SSLHandshake.recvCertificate(SSLHandshake.java:304)
    at COM.claymoresystems.ptls.SSLHandshakeClient.processTokens(SSLHandshakeClient.java:128)
    at COM.claymoresystems.ptls.SSLHandshake.processHandshake(SSLHandshake.java:135)
    at org.globus.gsi.gssapi.GlobusGSSContextImpl.initSecContext(GlobusGSSContextImpl.java:488)
    at org.globus.gsi.gssapi.net.GssSocket.authenticateClient(GssSocket.java:107)
    at org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:145)
    at org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:166)
    at org.globus.ftp.extended.GridFTPServerFacade.authenticate(GridFTPServerFacade.java:550)
    at org.globus.ftp.dc.GridFTPActiveConnectTask.execute(GridFTPActiveConnectTask.java:86)
    at org.globus.ftp.dc.TaskThread.run(TaskThread.java:71)
    at java.lang.Thread.run(Thread.java:595)
    ] [Nested exception is org.globus.ftp.exception.UnexpectedReplyCodeException: Custom message: Unexpected reply: 451 active connection to server failed
    org.globus.common.ChainedIOException: Authentication failed [Caused by: Failure unspecified at GSS-API level [Caused by: Unknown CA]]
    Authentication failed. Caused by Failure unspecified at GSS-API level. Caused by COM.claymoresystems.ptls.SSLThrewAlertException: Unknown CA
    at COM.claymoresystems.ptls.SSLConn.alert(SSLConn.java:235)
    at COM.claymoresystems.ptls.SSLHandshake.recvCertificate(SSLHandshake.java:304)
    at COM.claymoresystems.ptls.SSLHandshakeClient.processTokens(SSLHandshakeClient.java:128)
    at COM.claymoresystems.ptls.SSLHandshake.processHandshake(SSLHandshake.java:135)
    at org.globus.gsi.gssapi.GlobusGSSContextImpl.initSecContext(GlobusGSSContextImpl.java:488)
    at org.globus.gsi.gssapi.net.GssSocket.authenticateClient(GssSocket.java:107)
    at org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:145)
    at org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:166)
    at org.globus.ftp.extended.GridFTPServerFacade.authenticate(GridFTPServerFacade.java:550)
    at org.globus.ftp.dc.GridFTPActiveConnectTask.execute(GridFTPActiveConnectTask.java:86)
    at org.globus.ftp.dc.TaskThread.run(TaskThread.java:71)
    at java.lang.Thread.run(Thread.java:595)
    ]
    at org.globus.ftp.exception.ServerException.embedUnexpectedReplyCodeException(ServerException.java:101)
    at org.globus.ftp.exception.ServerException.embedUnexpectedReplyCodeException(ServerException.java:110)
    at org.globus.ftp.vanilla.TransferMonitor.run(TransferMonitor.java:195)
    ... 1 more




Maybe they don't look as cryptic now as before, when I was scratching my head over them...
Posted by at No comments:

Friday, February 29, 2008

Example PolarGrid Web Feeds

To get all existing entries: http://pg3.ucs.indiana.edu/cgi-bin/getPolarGridFeed

To experiment GeoRSS feeds in Google Maps, point http://pg3.ucs.indiana.edu/cgi-bin/gm_getPolarGridFeed?entries=10 in the search bar, and click on "Search Maps". The value for entries is adjustable with the maximum 64 limit imposed by Google Maps.

To play with KML in Google Earth, point "Add->Network Link" to http://pg3.ucs.indiana.edu/cgi-bin/gm_getPolarGridKML?entries=10, where entries is similarly adjustable. The KML works in Google Maps too.
Posted by at 3 comments:

Perl with Atom Feed

While working on the PolarGrid web feed generator, I found a helpful document on how to create an Atom feed in Perl. But it's slightly out of date, and here's a short summary of my journey:

  • The latest version of Perl CPAN module XML::Atom supports Atom 1.0, and the default Atom 0.3 version can be overwritten in either the Version parameter of XML::Atom::Feed and XML::Atom::Entry, or the global variable $XML::Atom::DefaultVersion.

  • The Feed Validator is a very helpful debugging tool. In my case, besides everything I wanted to display in a feed, id, updated, author, self_link for the feed, and id, updated for an entry are also required. In addition, note the specific DateTime and id formats.

  • To add GeoRSS encoding in the feed, don't forget to include the corresponding XML namespace: xmlns:georss="http://www.georss.org/georss"

  • Use the following to output/return the feed as a HTTP response:
    print "Content-type: application/atom+xml; charset=utf-8\n\n";
    print $feed->as_xml
Posted by at No comments:
Subscribe to: Posts (Atom)