Jun
15

By

Installing Open-Xchange 7.8 on UCS when the master is on 4.3

Category: Cloud, HowTo, Linux, UCS

OX is on the verge of releasing Version 7.10. That version will not be supported on (or packaged for) Debian 8 Jessie, but only on Debian 9 Stretch (and of course RedHat and SuSE). On the other hand, 7.8.x will not be supported on (or packaged for) Stretch.

The latest UCS version is 4.3 at the moment. This is based on Debian Stretch.

Therefore the current OX is not supported on UCS 4.3, but according to Open Xchange an  Univention, OX 7.8.4 on UCS 4.2 is supported in an environment with 4.3 servers.

So, when your UCS master is running 4.3, you can theoretically run OX on a 4.2 server. This works fine when you installed OX while the master is still on 4.2 or earlier.

In my case, my master was on 4.3. In order to install OX, I set up a server with UC 4.2 and joined it to the master. This already broke on installation but worked in a later step flawlessly.

Next, I started to install OX:

Oopsie. But consistent: univention-app list doesn’t show oxseforucs on the master, therefore there are no package sources and no packages. Fsck.

So let’s do this manually:

Now you can install OX on the 4.2 server.

Done

 

Dec
27

By

Howto: Using check_mk/WATO via ssh and jumphost

Category: check_mk, Debian, HowTo, Linux, Monitoring, nagios, Sysmgmt, VPN

I thought I’d pen this down right here as it took me a bit to really figure this out.

Problem: I have some Hosts I would like to monitor but I cannot access them directly (VPN also isn’t an option in this case), so I would like to monitor them using SSH, some directly, some behind a jumphost.

 

Usually the check_mk uses xinetd listening on Port 6556 only limited by allow_from in xinetd config and maybe iptables. This is fine in a closed, trusted environment but not really over public networks.

We could now either use VPN or tunnel the port through ssh port forwarding, but I found it more convenient just using ssh as a datasource program.

Preparing the nodes

We surely won’t use passwords for this, but rather a key with very limited capabilities.

So, first go to the monitoring site (make sure to do this as the monitoring user) and create a key pair:

Don’t use a passphrase. Now append the public key to the authorized_keys file on the monitored nodes. I am using ansible for this:

This results in:

Now you can ssh to that node from the monitoring host using the key, you should then get the output of the check_mk_agent.

Fine.

Case 1: Directly accessible node

In WATO, go to Host & Service Parameters => Datasource Programs => Individual program call instead of agent access.

We give a simple name and the command line using the <IP> macro.

Some hosts have issues spawning a tty, so we omit that with -tt. I also had some issues with the host keys which afford disabling StrictHostKeyChecking.

I am using this rule for all monitored hosts, therefor I don’t need any rules set up. If you only want to apply these rules to single hosts, just add their names below, or better create a rule as shown in the jumphost example below.

Case 2: Nodes behind jumphost

We use the same approach with a jumphost, just adding that host in between.

We extend our ssh line by -J jump@jumphostMake sure that you don’t use the root account on the jump host!

If you are using an older or different version of SSH which doesn’t support the -J switch, you need to do it using the old style -W version.

As I only want specific nodes to be monitored using the jumphost, I created another choice in the networking host tags, so all Hosts tagged with “No ping possible” are monitored using the jumphost.

Now another issue arises: Ping fails, which means that all services are being monitored properly while the host has the status “down”. So we need to change that, too with another rule, also tagged with the same tag above.

Go to Host & Service Parameters => Monitoring Configuration => Host Check Command and add a new rule.

Switch the command from PING to Use the status of the Check_MK Agent and chose the correct host tag.

Done.

 

Sep
8

By

Bridged Xen on Debian Wheezy on a Hetzner Server

Category: Debian, English, Hetzner, HowTo, Linux, Sysmgmt, Tagwerk Leave a Comment

Xen (not XeServer, btw!) seems to have taken a bak-seat recently, RedHat/CentOS/Fedora concentrating on KVM and Debian silently neglecting it.

This is reflected in documentation, there is a lot of outdated stuff around, especially about bridged setups. Same occurs to packages, at least in Debian Wheezy (NB: I also tried on testing, same results with fairly newer packages).

My aim was a virtual host which is directly connected to the internet without any external firewall running different virtual machines which ARE thoroughly firewalled. In order to archive this, I am running the quite decent Sophos UTM (formerly Astaro) as a VM, this is the only virtual machine with direct access to the external network interface. It’s other interface just like all other VMs are connected to an internal bridge without any link to the rest of the world. This is why routing isn’t an option.

This article focusses on the Xen server and the bridging setup, maybe I will write another one later about Sophos UTM etc.

xenserver

 

I am running this setup on some servers at Hetzner, though this should be working at most other hosters (some tend to drop the switch connection when they sense a pseudo ARP-spoofing, take care!), I am in no way affiliated to Hetzner.

My setup needs a secondary IP address (the main IP address is used for management of the host, I am assuming the following setup:

External Host-IP: 1.2.3.4

Secondary IP, used on UTM: 1.2.3.6. At least at Hetzner, this IP address needs to have it’s own MAC address assigned, this can be done in their Robot tool.

Setting up the host

I want to have my host running directly on the (Software-)RAID, I personally don’t really like running the OS on LVM. But I also want to have my VMs live in an LVM realm in order to easily take snapshots, clone etc.

This means that Hetzner’s default setup isn’t very helpful. But they have an answer file based installation using the rescue system. Therefore: boot into the rescue system and run install image.

Note: Preserve the temporary password for the rescue system, you will need it for the freshly installed system!

This lets you define your custom install file and then installs everything within a few minutes. I chose Debian Wheezy Minimal. The only two settings I changed were the hostname (I am using dome in this example) and the partition setup:

installimage2

I chose 50GB for my root filesystem and 12GB swap.

After saving the file and starting the installation, I had to wait for about five minutes and was presented with a brand new Debian system.

installimage3

After the first boot I changed the root password and added my own SSH key.

Note: This document doesn’t cover hardening your server, which you really should do!

First thing to do is updating all package sources:

I tend to install emacs23-nox as soon as possible, YMMV.

It is quite handy to add your domain, if you are using one, to /etc/resolv.conf and to /etc/hosts.

Next is changing the network setup, so edit /etc/network/interfaces :

So we transformed our (only) network card eth0 into a bridge called virbr0 and added a secondary bridge, virbr1.

Set up Xen

First install the xen system (4.1 on Wheezy) and the xen-tools which are quite helpful setting up VMs.

This will install xen and all the necessary tools.

In order to boot into a xen enabled hypervisor, we need to adapt GRUB:

Before we reboot we also adapt the boot command line in /etc/default/grub :

This basically limits resources on Dom0.

Now update grub and reboot:

After reboot we can check if Xen is up and running.

Looks fine.

Now we need to set up the network, which is quite straight forward:

Edit the file /etc/xen/xend-config.sxp  and comment out everything about networking, routing and vif except this line:

You  may also fine tune your Xen setup by changing the following lines:

The first thing we changed tells Xen to run a script called vif-bridge  located in /etc/xen/scripts/  as soon as a virtual machine is being created. The script basically checks if the bridge exists and connects the VMs virtual network card to the bridge.

Now we need to adapt this file to our naming convention, so let’s replace the occurrences of xenbr  to virbr  in the file /etc/xen/scripts/vif-bridge :

Now restart xend (for some reason the service is called xen  on Debian.

Getting the first VM up and running

Using xen-create-image  from the xen-tools makes it a piece of cake installing our first VM:

You can safely ignore the warning about vif-bridge.

Now there’s a little bug in the xen-tools:

So edit /etc/xen/test.cfg and remove the m from 512m:

Now let’s run it:

We can now connect a console to the vm and see why’s going on (you can also create it with the -c parameter above …).

Hint: CTRL + 5 gets you to of the console again.

Jun
10

By

HowTo: Hetzner Backup-Server Automount

Category: Debian, Hetzner, HowTo, Linux Leave a Comment

Das Problem: Hetzner bietet bei einem Root-Server zwar 100GB Backup-Space an, auf den kann man aber nur per FTP, SFTP oder CIFS zugreifen, es ist z.B. kein direktes rsync möglich.

Ursprünglich hatte ich den backup space einfach ständig gemounted, allerdings gab es immer wieder Probleme mit hängenden Handles, vermutlich gehen die Backupserver in einen Energiesparmodus etc. Also habe ich auf AutoFS umgeschwenkt, und das funktioniert hier prima (Was ich bei grösseren Umgebungen so nicht behaupten kann, btw).

Also hier kurz eine Anleitung, wie man den Backupspace sehr einfach per CIFS und Autofs nutzen kann.

Achtung: Sämtlicher Datenverkehr findet umverschlüsselt zwischen dem Root-Server und dem Backupserver statt. Wollte ich nur loswerden.

Voraussetzungen

Im Robot (Hetzner Config-Tool) muss ein Backup-Space angelegt sein, dafür gibt es dann einen Servernamen, einen Usernamen und ein Passwort.

Hier gelten folgende Daten:

Backup-server: u12345.your-backup.de
Username: u12345
Passwort: secret

Ausserdem braucht ihr das Paket autofs , ist eigentlich bei jeder Distro im Repo vorhanden.

Ich mounte meinen Backupserver unter /mnt/backup-server/.

Umsetzung

Zuerst legen wir eine neue Mapping-Datei an, wir nennen sie auto.backup und legen sie in /etc. Sie hat folgenden Inhalt:

Der Reihe nach bedeutet diese Zeile:

  • Mounte das Share unter backup-server/ relativ zum übergeordneten Mountpunkt (siehe unten)
  • Mount-typ ist CIFS, also SMB
  • Charset ist UTF8 (wichtig, falls Ihr Umlaute etc. verwendet)
  • rw, also lesen und schreiben
  • Zugangsdaten sind in der Datei /etc/backup-credentials.txt  abgelegt. Achtung: auch hier umverschlüsselt.
  • Neue Dateien werden mit 0660, neue Ordner mit 0770 angelegt.
  • Am Schluss steht der Pfad auf dem Server, der gemounted werden soll. ://  sieht seltsam aus, passt aber.

Die /etc/backup-credentials.txt sieht so aus:

Zuletzt fügen wir dann noch in der /etc/auto.master  folgende Zeile ein:

--ghost  teilt autofs mit, dass es beim umounten den Mountpunkt nicht löschen soll.

Nun noch den Automounter mit service autofs start  starten.

Sobald man nun auf den Ordner /mnt/backup-server  zugreift, wird er gemounted. Feine Sache.

 

Jun
7

By

HowTo: VPN between FritzBox and Sophos UTM (was: Astaro UTM) with DynDNS

Category: Astaro, English, FritzBox, HowTo, VPN Leave a Comment

After searching ans trying quite a lot, I finally managed to connect my Sophos UTM 9 (which is very nice and free for hime users!) to my FritzBox. Especially the fact that I don’t have a fixed IP address at home makes this a bit tricky.

Setup

The UTM is running as a virtual machine on my root server. It has got one public IP (RED, 1.2.3.4) which is bridged (bridge0) to the network card of the host, and one private IP (GREEN) on a secondary bridge (bridge1) in my Xen environment.

SchemaVPN

 

Configuration FritzBox:

My first try was simply using the Add new VPN connections form in the FritzBox. This won’t work, because as soon as you need to rely on a dynamic hostname (as opposed to a fixed IP) the FritzBox forces aggressive mode for IKE, which will fail with the following message:

So I had to create a config file manually, actually I adapted it from a few occurrences in the web:

UTM settings

First, create a policy in UTM:

FritzboxVPN_Policy

Now create a gateway which points to the FritzBox:

FritzboxVPN_Gateway

Make sure that the VPN ID type is set to FQDN and that it matches your dynamic hostname. (usually the same as the gateway). Create a remote network, in this case 192.168.1.0/24, I called it Fidicinstrasse (this is where the Fritzbox lives).

Finally, create a connection:

FritzboxVPN_Connection

That’s all, wait a few seconds and the connection should come up automatically.

 

 

 

 

May
9

By

HowTo: Zwei Geräte an einen Waschmaschinenabfluss anschliessen

Category: HowTo, nass, Weisse Ware 2 Comments

Nachdem ich nun eine ganze Weile rumgesucht habe, und inzwischen erfolgreich war, dachte ich, ich stelle das mal hier hin, vielleicht nutzt es mal jemandem.

Aus Platzgründen sind bei uns im Bad sowohl die Waschmaschine als auch der Geschirrspüler (letzterer auf ersterem). Seltsam, ist aber so. Dummerweise gibt es allerdings nur einen einzigen Wasser- und Abwasseranschluss, eingelassen in die Badewannenrückwand.

Der Wasseranschluss ist kein Problem, einfach ein T-Stück, und in meinem Fall noch ein 90°-Winkel wegen der Wand, und schon passen zwei Schläuche, jeweils mit AquaStop an den Hahn.

Tricky wird es mit dem Abfluss. Die wenigsten Geräte verfügen anscheinend über ein Rücklaufventil, und herauszufinden, welche das sind, ist nicht ganz einfach. Und wer kauft schon Wasch- und Spülmaschine aufgrund eines Solchen.

Ein Anruf bei Bosch (von denen sowohl unsere neue Waschmaschine als auch – wenn auch älter – der Geschirrspüler ist) hilft nur bedingt weiter. “Nein, an einem Wandanschluss können Sie nicht beide Geräte verwenden, das geht überhaupt nicht, auf gar keinen Fall, nein. Das geht höchstens an einem Unterbausiphon mit Trennwand.”. Na gut. Dann halt ohne Hilfe von Bosch, und ohne Trennwand.

Den ersten Versuch wagte ich mit einem einfachen Y-Stück aus dem Baumarkt. Mein Plan war, die beiden Ablaufschläuche in Schleifen oberhalb des Abflusses (der sich in ca. 50cm Höhe befindet) zu verlegen, so dass das Wasser nicht in die jeweilige andere Maschine laufen kann. Gesagt getan. Angeschlossen, Geschirrspüler laufen lassen, prima, kein Wasser in der Waschmaschine. Waschmaschine laufen lassen. Prima, kein Wasser im Geschirrspüler.

Allerdings: beim nächsten Durchlauf stand im Geschirrspüler das dreckige Wasser und das Geschirr war mit einer Schicht aus Fett und Spülmittel überzogen (soviel zu den Tensiden…).

Geschirrspüler aufgemacht, Problem gefunden: Da ist zwar ein Rückschlagventil drin, allerdings wird, wenn die Waschmaschine abpumpt, ganz wie in einer Strahlpumpe , der Geschirrspüler leergesaugt und das Ventil leicht in das Ablaufrohr gezogen. Woraufhin es verklemmt und mechanisch (Nach entfernen von Blende und Seitendeckel) wieder gelöst werden muss.

Temporär also erst mal das Y-Stück entfernt, Ablaufschlauch des Geschirrspülers in die Wanne gehängt. Läuft, ist aber eklig, und die Vorstellung, dass der Schlauch mal neben der Wanne hängt, ist auch nicht toll…

Also weiter gesucht. Und gefunden. Von der Firma Dallmer gibt es einen Waschgerätedoppelanschluss. Feine Sache. Mit Trennwand!

Kreditkarte mit guten 25 Euro belastet (neben dem Anschluss habe ich noch eine Verlängerung gebraucht, damit der nicht dem Zulauf in den Weg kommt).

Drei Tage später geliefert. Eingebaut. Läuft.

Und so sieht’s aus:

May
7

By

HowTo: Create a simple Tag Cloud for existing HTML content using JS with jQuery

Category: English, HowTo, HTML, jQuery, JS, Web Leave a Comment

Everybody loves tag clouds. Hopefully, otherwise I spent an hour for nothing creating one for http://www.doerflinger.org.

There are a lot of plugins for jQuery, or external libs etc. for creating tab clouds, most times with fancy AJAX calls, JSON processing and a neat database backend. We only need plain jQuery and for some sexyness the jquery.timer plugin. Please notice that this plugin needs jQuery.plugin to work.

I just wanted to have something which uses my existing HTML list while just extending that with a few tags. My website consists of one single HTML page optically diverted by jQuery tabs and accordions, therefore my main content isn’t visible when the tag cloud is available. So I will just pick some invisible content and display it in an empty space in my page. Another approach could be to just hide everything NOT sporting the chosen tag.

I created a small fiddle at http://jsfiddle.net/zapalotta/bWuFy as an example.

So, this is what I got:

I would like to display each group of <dt></dt><dd></dd> when their tags are highlighted. Therefore we need some Tags. I decided to use the name attribute, as it is deprecated though still usable in HTML5 without breaking anything. You could of course also use e.g. class or anything self defined.

Tags are separated by blanks as we really only want single worded tags in this case. You can easily change the separator in order to use tags including spaces, though you would need to display the tags with a border and recreate the selector…

We also need some space for the tags and the highlighted content to be displayed.

Cloud will contain the tag cloud while cloudcontent will be used to display the chosen content.

So, let’s create some dynamics.

We will create a function consisting of three parts. The variable tags will hold an associative array { "tag" => number_of_occurrences }  with all tags.

The first part gathers all tags and fills our associative array with each tag and the number of occurrences.

Here we iterate over all <dt>s, check if they have a name attribute and if so get it’s value and split it into an array.

We now iterate over this array. If the value (i.e. the tag) already exists in our tags list, it increments the number of occurrences of this tag, otherwise it will create a new item with the name of the tag and a number of one.

This is our tags array:

The next part appends all tags to the cloud div

I created different CSS classes with different shades of grey and font sizes. These are applied to a span surrounding each tag, making the higher number be larger and darker. In order to keep it nice, I limited it to 8 levels.

Now we need to create some dynamics when hovering the tags.

As we applied the class cloudelement to all tags, we can simply bind the mouseover() event to them.

We first clear the cloud content div and then append a definition list, then we select all <dt>s where the tag exists in the name attribute and iterate over these. We simply append new <dt></dt><dd></dd>s to our new dl consisting of the <dt>s we have found, the <h3> above it and the following <dd>.

Finally we start a timer which will remove the shown items after five seconds.

The timer will be initialized like this:

So, when time ran out, the callback function will be executed which fades out the complete cloudcontent div, clears it when fading finished and shows it again (empty now) to be prepared to display the next content.

Put the timer initialization together with a call to the tagcloud()  function in the classical $(function() .

 

 

 

Apr
28

By

HowTo install Ubooquity on QNAP

Category: English, HowTo, Leisure, Linux, QNAP, Sysmgmt, Tagwerk Leave a Comment

Ubooquity is a very nice little server which scans your eBooks and Comics and displays them in a tablet friendly way.

It is Java-based and runs fine on your Desktop, but if you’re running a (QNAP-)NAS which already stores all your books, why not have them served nicely.

Ubooquity

Ubooquity

Prerequisites

I did this on A QNAP TS-421 (ARM-CPU) Running OS version 4.x, though this should work the same way (except the Java installation on x86 see link below) on any other QNAP NAS.

I am assuming that you already have IPKG installed and are able to log in via ssh and already have some experience with the (Linux-)shell.

Install coreutils, procps and Java

The start script for the daemon requires the nohup and pgrep command which unfortunately aren’t shipped with the basic installation.

So simply do a

Install Java

Follow the instructions on http://wiki.qnap.com/wiki/Category:JavaRuntimeEnviroment in order to install Java. In brief:

Install Ubooquity

Download the jar from http://vaemendis.net/ubooquity/static2/download and put it on your QNAP NAS. I created a Folder Ubooquity in Public/ where everything from Ubooquity lives, so it is in /share/Public/Ubooquity/ now.

Do a test run on the shell:

Now you should be able to connect to the admin server on http://<qnapaddress>:2202/admin

Set a password for administration and play with the Web ui.

Install as a service

As soon as you close the shell from above, Ubooquity quits itself. Not very cool. So we need to install it as a daemon, a service starting on system start and then running all time.

Ubooquity provides a nice startup script called ubooquity.sh at http://vaemendis.net/ubooquity/downloads/scripts/. Get it and put it next to Ubooquity.jar. As pgrep on QNAP doesn’t support the -c (count) option, we need to change one line:

Replace all occurrences of the line

with

QNAP provides a quite easy way to register an application as a service. Simply edit the file /etc/config/qpkg.conf and add the following block.

You may have to adapt the paths to your installation.

Now you can start Ubooquity in the App Center just like any other app.

Ubooquity.start

QPKG View