Balling's Bits

LUKS Encrypted Hetzner VX6 vServer With Ubuntu 14.04 LTS

2015-05-31T09:05:54+02:00

This is a guide to installing Ubuntu 14.04 LTS on an Hetzner VX6 vServer using LUKS encryption of the root partition. The guide is inspiried by blog posts of Martin Carpella and Oliver Feiler. On reboot you will be able to log in via ssh to provide the password for the LUKS partition (using dropbear and busybox).

As pointed out by Martin Carpella it may sound stupid to encrypt the disk of a virtual machine as the private key can be pulled from memory by the host (i.e. Hetzner). However, encrypting all data on the disk protects it in case you cancel the vServer, or the vServer gets moved to a new host, or a failed disk is returned to the manufacturer or discarded etc. So it is more a matter of protecting the data if the VM is cancelled/offline rather than online. If you do not want Hetzner to be able to pull the private key, go for something other than a virtual machine (e.g. a root server).

Anyway, here we go!

When signing up for the vServer select the Hetzner Ubuntu 14.04 LTS 64-bit minimal-install image. Once the server is setup log in via SSH and make backups of these files:

/etc/hostname
/etc/hosts
/etc/resolv.conf
/etc/network/interfaces

Log into the Hetzner robot interface and select 64-bit Linux rescue system, take note of the password for rescue system ssh login displayed on the page. Reboot your vServer in rescue mode and log in.

Setup disk partitions using fdisk:

fdisk /dev/vda

Create a boot partition of 256 MB (/dev/vda1) and a root partition of the remaining free space (/dev/vda2). Mark the boot partition as bootable. My partition table looks like this:

Disk /dev/vda: 26.8 GB, 26843545600 bytes
255 heads, 63 sectors/track, 3263 cylinders, total 52428800 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00044f0a

   Device Boot      Start         End      Blocks   Id  System
/dev/vda1   *        2048      526335      262144   83  Linux
/dev/vda2          526336    52428799    25951232   83  Linux

Create the encrypted partition (enter passphrase when prompted):

cryptsetup --cipher aes-xts-plain64 -s 512 --iter-time 5000 luksFormat /dev/vda2

Decrypt the partition and create a volume group and two logical volumes (root and swap):

cryptsetup luksOpen /dev/vda2 vda2_decrypt
vgcreate vg-encrypted /dev/mapper/vda2_decrypt
lvcreate -L 2G -n swap vg-encrypted
lvcreate -L 22G -n root vg-encrypted

Create file systems:

mkfs.ext2 /dev/vda1
mkswap /dev/vg-encrypted/swap
mkfs.ext4 /dev/vg-encrypted/root

Record the UUIDs of the partitions:

blkid /dev/vda1 /dev/vda2 /dev/vg-encrypted/root /dev/vg-encrypted/swap
# These are my UUIDs
/dev/vda1: UUID="409938b1-7244-4c34-a665-8f086dd1c5f9" TYPE="ext2"
/dev/vda2: UUID="b360acf3-b392-417f-bc08-90f378a5d26b" TYPE="crypto_LUKS"
/dev/vg-encrypted/root: UUID="efc68b96-de3d-4cb9-a884-127dca8c97d5" TYPE="ext4"
/dev/vg-encrypted/swap: UUID="6556fbea-0e34-4f4e-92cc-c18b3ccb0ece" TYPE="swap"

MAke a chroot directory (/mnt/ubuntu) and mount volumes:

mkdir -p /mnt/ubuntu && \
mount /dev/vg-encrypted/root /mnt/ubuntu && \
mkdir /mnt/ubuntu/boot && \
mount /dev/vda1 /mnt/ubuntu/boot

Download and install the latest debootstrap, then debootstrap 64-bit Ubuntu 14.04 LTS to the chroot directory:

cd
wget "http://archive.ubuntu.com/ubuntu/pool/main/d/debootstrap/debootstrap_1.0.67_all.deb"
dpkg --install debootstrap_1.0.67_all.deb
debootstrap --arch amd64 trusty /mnt/ubuntu http://archive.ubuntu.com/ubuntu/

Mount proc, dev and sys and chroot into the bootstraped Ubuntu system:

mount -t proc none /mnt/ubuntu/proc
mount -o bind /dev /mnt/ubuntu/dev
mount -o bind /sys /mnt/ubuntu/sys
cp /etc/resolv.conf /mnt/ubuntu/etc/
LANG=C chroot /mnt/ubuntu /bin/bash

Create /etc/fstab (use your own UUIDs from above):

echo "
UUID=efc68b96-de3d-4cb9-a884-127dca8c97d5 / ext4 defaults,noatime 0 0
UUID=409938b1-7244-4c34-a665-8f086dd1c5f9 /boot ext2 defaults,relatime 0 1
UUID=6556fbea-0e34-4f4e-92cc-c18b3ccb0ece none swap sw 0 0
proc /proc proc defaults 0 0
sys /sys sysfs defaults 0 0
" > /etc/fstab

Copy hostname to /etc/hostname (use the hostname you recorded above):

echo "Ubuntu-1404-trusty-64-minimal" > /etc/hostname

Create /etc/hosts:

echo "127.0.0.1 localhost
127.0.1.1 Ubuntu-1404-trusty-64-minimal
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
" > /etc/hosts

Create /etc/network/interfaces (using your own IP and gateway information as recorded above):

echo "
auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
  address   78.47.247.195
  broadcast 78.47.247.207
  netmask   255.255.255.240
  gateway   78.47.247.193
  # default route to access subnet
  up route add -net 78.47.247.192 netmask 255.255.255.240 gw 78.47.247.193 eth0

iface eth0 inet6 static
  address 2a01:4f8:d16:a8f::2
  netmask 64
  gateway 2a01:4f8:d16:a8f::1
" > /etc/network/interfaces

Setup apt to use Hetzner mirrors:

echo "
# Packages and Updates from the Hetzner Ubuntu Mirror
deb ftp://mirror.hetzner.de/ubuntu/packages trusty main restricted universe multiverse
deb ftp://mirror.hetzner.de/ubuntu/packages trusty-updates main restricted universe multiverse
deb ftp://mirror.hetzner.de/ubuntu/security trusty-security main restricted universe multiverse

deb http://archive.ubuntu.com/ubuntu trusty main
deb-src http://archive.ubuntu.com/ubuntu trusty main

deb http://security.ubuntu.com/ubuntu trusty-security main
deb-src http://security.ubuntu.com/ubuntu trusty-security main
" > /etc/apt/sources.list

Create /etc/crypttab (use your own UUIDs from above):

echo "#    
vda2_decrypt UUID=b360acf3-b392-417f-bc08-90f378a5d26b none luks
" > /etc/crypttab

Update packages and select time zone:

apt-get update
dpkg-reconfigure tzdata

Install essential packages (install grub to /dev/vda when prompted):

apt-get install aptitude openssh-server linux-image-generic cryptsetup lvm2 busybox dropbear

Extract the dropbear public key and add it to authorized_keys file:

dropbearkey -y -f /etc/initramfs-tools/root/.ssh/id_rsa.dropbear | \
        grep "^ssh-rsa " > /etc/initramfs-tools/root/.ssh/id_rsa.pub
cat /etc/initramfs-tools/root/.ssh/id_rsa.pub >> /etc/initramfs-tools/root/.ssh/authorized_keys

Save the dropbear private key to your own computer as ~/.ssh/id_rsa.hetzner (remember to chmod 600 the file):

cat /etc/initramfs-tools/root/.ssh/id_rsa

Add modules to system and initramfs:

echo "dm-crypt" >> /etc/modules
echo "aes" >> /etc/initramfs-tools/modules
echo "aes_i586" >> /etc/initramfs-tools/modules
echo "aes_x86_64" >> /etc/initramfs-tools/modules
echo "aes_generic" >> /etc/initramfs-tools/modules
echo "dm-crypt" >> /etc/initramfs-tools/modules
echo "dm-mod" >> /etc/initramfs-tools/modules
echo "sha256" >> /etc/initramfs-tools/modules
echo "sha256_generic" >> /etc/initramfs-tools/modules
echo "lrw" >> /etc/initramfs-tools/modules
echo "xts" >> /etc/initramfs-tools/modules
echo "crypto_blkcipher" >> /etc/initramfs-tools/modules
echo "gf128mul" >> /etc/initramfs-tools/modules

IMPORTANT: remove or comment out (#) the grub hidden settings and the default cmd-line, and set the time out to 1 sec (in /etc/defaults/grub):

#GRUB_HIDDEN_TIMEOUT=0
#GRUB_HIDDEN_TIMEOUT_QUIET=true
GRUB_TIMEOUT=1
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
#GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

Update initramfs and grub:

update-initramfs -c -k all
update-grub
grub-install /dev/vda

Check that crytpsetup is in the initramfs sbin:

cd
zcat /initrd.img | cpio -i -d
ls sbin

Set root password:

passwd

Add a user:

adduser akwb

Make added user an admin:

addgroup --system admin
adduser akwb admin

If you experience problems with IPv6 you may need to add the following to /etc/rc.local (before exit 0):

/sbin/ifdown --force eth0
/sbin/ifup --force eth0

Exit the chroot, unmount and reboot:

exit
umount /mnt/ubuntu/boot
umount /mnt/ubuntu/proc
umount /mnt/ubuntu/sys
umount /mnt/ubuntu/dev
umount /mnt/ubuntu
sync
reboot

To enter the LUKS passphrase upon boot, first save the following script as unlock-cryptroot on your computer (not the vServer) and make it executable (chmod +x unlock-cryptroot):

#!/bin/sh

usage() {
    cat <
${0##*/}:  Remotely unlock a LUKS-encrypted Ubuntu root filesystem

Works around bug #595648 

Usage:  $0 [options] [--] 

Arguments:

  -h, --help
    Display this usage message and exit

  -i , --identity , --identity=
    Path to the SSH private key.
    Default: ${idbase}

  -k , --known-hosts , --known-hosts=
    Path to the 'known_hosts' file.
    Default: ${knownhosts}

  -l, --login
    Just log in, don't try to unlock the system.

  --
    End of options; treat the next argument as the hostname even if it
    begins with '-'.

  
    The name of the remote system to unlock
EOF
}

# handy logging and error handling functions
log() { printf '%s\n' "$*"; }
error() { log "ERROR: $@" >&2; }
fatal() { error "$@"; exit 1; }
try() { "$@" || fatal "'$@' failed"; }
usage_fatal() { usage >&2; printf '\n' >&2; fatal "$@"; }

# quote special characters so that:
#    eval "set -- $(shell_quote "$@")"
# is always a no-op no matter what values are in the positional
# parameters.  note that it is run in a subshell to protect the
# caller's environment.
shell_quote() (
    sep=
    for i in "$@"; do
       iesc=$(printf %s\\n "${i}eoi" | sed -e "s/'/'\\\\''/g")
       iesc=\'${iesc%eoi}\'
       printf %s "${sep}${iesc}"
       sep=" "
    done
)

# parse arguments
knownhosts=~/.ssh/known_hosts.initramfs
idbase=~/.ssh/id_rsa.initramfs_
unset id
runscript=true
while [ "$#" -gt 0 ]; do
    arg=$1
    case $1 in
        # convert "--opt=the value" to --opt "the value".
        --*'='*) shift; set -- "${arg%%=*}" "${arg#*=}" "$@"; continue;;
        -h|--help) usage; exit 0;;
        -i|--identity) shift; id=$1;;
        -k|--known-hosts) shift; knownhosts=$1;;
        -l|--login) runscript=false;;
        --) shift; break;;
        -*) usage_fatal "unknown option: '$1'";;
        *) break;;
    esac
    shift || usage_fatal "option '${arg}' requires a value"
done
[ "$#" -ge 1 ] || usage_fatal "no hostname specified"
host=$1; shift
[ "$#" -eq 0 ] || fatal "unknown argument: '$1'"

[ -n "${id+set}" ] || id=${idbase}${host%%.*}
[ -r "${id}" ] || fatal "can't read ssh key ${id}"


script='#!/bin/sh
PATH=/sbin:${PATH}

p() { printf %s\\n "$*"; }
log() { p "$@"; }
warn() { log "WARNING: $@" >&2; }
error() { log "ERROR: $@" >&2; }
fatal() { error "$@"; exit 1; }
try() { "$@" || fatal "'\''$@'\'' failed"; }

getpid() {
    psout=$(try ps) || exit 1
    psout=$(p "${psout}" | grep "$1") || return 0
    pswc=$(p "${psout}" | try wc -l) || exit 1
    [ "${pswc}" -eq 1 ] || fatal "more than one instance of $1:
${psout}"
    p "${psout}" | try awk '\''{print$1}'\'' || exit 1
}

# if cryptroot is not running, then there is no password prompt so
# there is nothing to do
log "checking if /scripts/local-top/cryptroot is running..."
cr_pid=$(getpid "/scripts/local-top/[c]ryptroot") || exit 1
[ -n "${cr_pid}" ] || fatal "/scripts/local-top/cryptroot is not running"

unset pw

# keep prompting for a password over and over until cryptroot has
# finished running
while true; do
    cs_pid=$(getpid "/sbin/[c]ryptsetup") || exit 1
    [ -n "${cs_pid}" ] || {
        log "waiting to see if there will be another passphrase prompt..."
        # the next commands are all on one line so that they are still
        # in busybox memory if the root filesystem is mounted during
        # the sleep (which would cause this script to disappear during
        # execution)
        sleep 1; [ -d /proc/"${cr_pid}" ] || { log "done"; exit 0; }
        continue
    }

    log "getting /sbin/cryptsetup command-line arguments..."
    cs_args=$(try tr "\\0" "\\n" 
    set --
    while IFS= read -r line; do
        set -- "$@" "${line}"
    done <
${cs_args}
EOF
    log "command: $@"

    [ -n "${pw+set}" ] && {
        log "trying previously entered passphrase..."
        printf %s "${pw}" | try "$@"
    } || {
        pw=$(try /lib/cryptsetup/askpass "Enter passphrase: " && echo x) \
            || exit 1
        pw=${pw%x}
        printf %s "${pw}" | try "$@" || exit 1
    }

    log "passphrase accepted; killing passphrase prompt..."
    for ap in \
        "/lib/cryptsetup/[a]skpass" \
        "[a]sk-for-password" \
        ;
    do
        log "  checking for ${ap}..."
        ap_pid=$(getpid "${ap}") || exit 1
        [ -n "${ap_pid}" ] || continue
        log "    killing PID ${ap_pid}..."
        try kill "${ap_pid}"
    done
done
'

run_ssh() {
    unset forcetty
    case $1 in -t) forcetty=$1; shift;; esac
    ssh -o UserKnownHostsFile="${knownhosts}" \
        -i "${id}" \
        ${forcetty} \
        root@"${host}" "$@"
}

# $1 is the shell command to run; must be < 1024 characters (busybox
# limitation?)
run_ssh_cmd() {
    unset forcetty
    case $1 in -t) forcetty=$1; shift;; esac
    sshcmd='sh -c '$(shell_quote "$1")' -'
    run_ssh ${forcetty} "${sshcmd}"
}

"${runscript}" || {
    while IFS= read -r line; do
        log "${line}"
    done <<\EOF
After you are logged in:
  1. use 'ps -l' to get cryptsetup's command-line arguments
  2. run:
         /lib/cryptsetup/askpass "Enter passphrase: " \
             | /sbin/cryptsetup 
  3. kill 'plymouth ask-for-password' or 'askpass' as appropriate
  4. log out

EOF
    run_ssh
    exit $?
}

log "sending script to ${host}..."
printf %s\\n "${script}" |
run_ssh_cmd 'cat >tmp.sh && chmod +x tmp.sh' \
    || fatal "unable to create script"

log "running script on ${host}..."
run_ssh_cmd -t './tmp.sh'

Use the script like this (enter passphrase when prompted, use the IP address of your own vServer)

./unlock-cryptroot -k ~/.ssh/known_hosts.initramfs -i ~/.ssh/id_rsa.hetzner 78.47.247.195

Should something go wrong you can always boot the Hetzner rescue system and chroot to your vServer:

cryptsetup luksOpen /dev/vda2 vda2_decrypt
/etc/init.d/lvm2 start
mkdir -p /mnt/ubuntu && \
mount /dev/vg-encrypted/root /mnt/ubuntu
mount /dev/vda1 /mnt/ubuntu/boot
mount -t proc none /mnt/ubuntu/proc
mount -o bind /dev /mnt/ubuntu/dev
mount -o bind /sys /mnt/ubuntu/sys
LANG=C chroot /mnt/ubuntu /bin/bash

Setting Up NEMID on Hardware on Ubuntu 14.04 LTS

2014-11-25T20:49:12+01:00

In Denmark we have a public single-sign-on solution, NEMID. To set up NEMID on Hardware (if you have the Gemalto USB token) on Ubuntu 14.04 you have to install the proper token driver and a build environment for building the NEMID driver. These are the required commands (inspired by this post):

sudo apt-get install pcsc-tools libccid opensc libpcsclite-dev libboost1.55-dev libboost-system1.55-dev libboost-thread1.55-dev libboost-filesystem1.55-dev pkg-config zlib1g-dev
sudo apt-get install build-essential

Then download the driver from NEMID, extract and configure:

wget https://www.nemid.nu/dk-da/support/aktiver_nemid/aktiver_nemid_paa_hardware/installer_driver/drivers/libgtop11dotnet_2.2.0.12.tar.gz
tar xpzf libgtop11dotnet_2.2.0.12.tar.gz
cd libgtop11dotnet-2.2.0.12
./configure

Next, make and make install:

make
sudo make install

You will also need the icedtea-plugin (for web-browsers).

Dell Inspiron 1720 Will Not Boot - CAPS Lock Blinking

2014-11-15T08:59:27+01:00

Our daughter dropped our old Dell Inspiron 1720 that she uses for kids television. After the fall it would not boot and CAPS lock was blinking. Apparently, the RAM had been unseated, so it was an easy fix. The following procedure worked:

Unplug the AC and battery. Remove both the RAM modules as well.
Press the power button. This will help to loose all electrical static remains left in it. Hold it for about 10 seconds.
Then plugin the AC and turn on - it should automatically shut itself off again due to the absence of the RAM modules. However if it doesn’t or if it blinks again then just power it down.
Remove the AC, then re-install both the RAM modules, then press the power button again for the same 10 seconds to loose all discharge especially from the RAM itself. Then plugin only the AC. Power it. See if it works this time round.

Installing R Packages RCurl and XML on Ubuntu 14.04

2014-11-03T20:14:16+01:00

Installing R packages RCurl and XML on a fresh Ubuntu 14.04 LTS throws a few errors.

RCurl throws the following error:

checking for curl-config... no
Cannot find curl-config
ERROR: configuration failed for package ‘RCurl’

The fix is easy. Install libcurl4:

sudo apt-get install libcurl4-openssl-dev

And then re-install the RCurl package.

XML throws another error:

checking for xml2-config... no
Cannot find xml2-config
ERROR: configuration failed for package ‘XML’

To fix it install libxml2:

sudo apt-get install libxml2-dev

And then re-install the XML package.

Setting Up Nginx for SSL/TLS

2014-10-22T09:27:08+02:00

Before you can setup Nginx for serving pages via SSL/TLS you should obtain a certificate (e.g. test.wbnet.dk.crt) and a private key (e.g. test.wbnet.dk.key).

To server pages via SSL/TLS with SSL 3.0 disabled (due to Poodlebleed) use a Nginx configuration like (adapted from this):

server {
  listen       443 ssl;
  server_name  test.wbnet.dk;
  ssl on;
  ssl_certificate      /opt/local/etc/nginx/ssl/wbnet.dk/test.wbnet.dk.crt;
  ssl_certificate_key  /opt/local/etc/nginx/ssl/wbnet.dk/test.wbnet.dk.key;

  # enable session resumption to improve https performance
  # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
  ssl_session_cache    shared:SSL:1m;
  ssl_session_timeout  5m;

  # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  # to generate use: openssl dhparam -rand – 2048
  ssl_dhparam /opt/local/etc/nginx/ssl/dhparam.pem;

  # read more here http://tautt.com/best-nginx-configuration-for-security/
  # don't send the nginx version number in error pages and Server header
  server_tokens off;

  # config to don't allow the browser to render the page inside an frame or iframe
  # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
  # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with
  # ALLOW-FROM uri
  # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
  add_header X-Frame-Options SAMEORIGIN;

  # when serving user-supplied content, include a X-Content-Type-Options: nosniff
  # header along with the Content-Type: header, to disable content-type sniffing
  # on some browsers.
  # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  # currently suppoorted in IE > 8
  # http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
  # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
  # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
  add_header X-Content-Type-Options nosniff;

  # This header enables the Cross-site scripting (XSS) filter built into most
  # recent web browsers. It's usually enabled by default anyway, so the role
  # of this header is to re-enable the filter for this particular website if
  # it was disabled by the user.
  # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  add_header X-XSS-Protection "1; mode=block";

  # enables server-side protection from BEAST attacks
  # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
  ssl_prefer_server_ciphers on;

  # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure
  # then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  # ciphers chosen for forward secrecy and compatibility
  # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';

  # enable ocsp stapling (mechanism by which a site can convey certificate
  # revocation information to visitors in a privacy-preserving, scalable manner)
  # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  resolver 8.8.8.8;
  ssl_stapling on;
  ssl_trusted_certificate /opt/local/etc/nginx/ssl/wbnet.dk/test.wbnet.dk.crt;

  # config to enable HSTS(HTTP Strict Transport Security)
  # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
  # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

  #... the rest of your configuration

}

Setting Up Nginx and PHP-FPM in an OmniOS Zone

2014-10-21T22:41:35+02:00

Start by configuring a zone and install the Joyent/SmartOS package manager.

Then install Nginx and PHP-FPM (v5.5):

pkgin install nginx php55-fpm
calculating dependencies... done.
nothing to upgrade.
7 packages to be installed: xmlcatmgr-2.2nb1 perl-5.20.0nb2 pcre-8.35nb1 php-5.5.16 libxml2-2.9.1nb2 nginx-1.6.0 php55-fpm-5.5.16 (28M to download, 105M to install)
proceed ? [Y/n] y
downloading packages...
[...]
nginx-1.6.0: Creating group ``www''
nginx-1.6.0: Creating user ``www''
[...]
============================================================================
This package has SMF support.  You may use svcadm(1M) to 'enable', 'disable'
or 'restart' services.  To enable the instance(s) for this package, run:

        /usr/sbin/svcadm enable svc:/pkgsrc/nginx:default

Use svcs(1) to check on service status.  See smf(5) for more information.
============================================================================
[...]
installing php55-fpm-5.5.16...
php55-fpm-5.5.16: copying /opt/local/share/examples/php/php-fpm.conf to /opt/local/etc/php-fpm.conf
============================================================================
This package has SMF support.  You may use svcadm(1M) to 'enable', 'disable'
or 'restart' services.  To enable the instance(s) for this package, run:

        /usr/sbin/svcadm enable svc:/pkgsrc/php-fpm:default

Use svcs(1) to check on service status.  See smf(5) for more information.
============================================================================

As seen above a www user and www group is created for Nginx/web content. Start the Nginx web-server:

svcadm enable nginx

Browse to http://ip-address, and you should see the Nginx welcome page.

Here is a minimal Nginx configuration file (/opt/local/etc/nginx/nginx.conf) to enable PHP-FPM:

user   www  www;
worker_processes  1;
events {
    worker_connections  1024;
}
http {
    include       /opt/local/etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen       80;
        server_name  localhost;

        location / {
            root   /www;
            index  index.php index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   share/examples/nginx/html;
        }

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        location ~ \.php$ {
            root           /www;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            include        /opt/local/etc/nginx/fastcgi_params;
        }
    }
}

Create a /www directory to hold html/php files and create an index.php file:

php
phpinfo();
?>

Then restart Nginx and start PHP-FPM:

svcadm disable nginx && svcadm enable nginx && svcadm enable php-fpm

Browse to http://ip-address to verify that the PHP installation is working and to view PHP information.

Extensions

Search for available PHP extensions:

pkgin search php55-*
php55-zlib-5.5.16nb1  PHP extension for zlib compression
php55-zip-5.5.16     PHP extension for ZIP archive handling
php55-zendoptimizerplus-7.0.0  Zend opcode cache and optimizer for PHP
php55-yaz-1.1.1nb9   PHP extension for YAZ
php55-xsl-5.5.16nb1  PHP extension for XSLT functions
php55-xmlrpc-5.5.16  PHP extension for XML-RPC support
php55-wddx-5.5.16    PHP extension for WDDX support
php55-uploadprogress-1.0.1  PHP extension to track progress of a file upload
php55-tt-rss-fever-plugin-1.2  Fever emulation plugin for Tiny Tiny RSS
php55-tt-rss-1.12    Tiny Tiny RSS is an open source web-based RSS feed reader
php55-tiki6-6.8nb1   Tiki Wiki CMS Groupware web-based application
php55-tidy-5.5.16    PHP extension for tidy functions
php55-sysvshm-5.5.16  PHP extension for SysV shared memory support
php55-sysvsem-5.5.16  PHP extension for SysV semaphore support
php55-sysvmsg-5.5.16  PHP extension for SysV IPC Message Queues support
php55-ssh2-0.12      PHP bindings to the functions of libssh2
php55-ssdeep-1.0.2   PHP extension for ssdeep
[...]

To install a PHP extension install it, add the extension to /opt/local/etc/php.ini, and then restart PHP-FPM:

pkgin -y install php55-gd
calculating dependencies... done.

nothing to upgrade.
4 packages to be installed: png-1.6.12 libjpeg-turbo-1.3.0nb1 freetype2-2.5.3nb1 php55-gd-5.5.16nb1 (2201K to download, 6474K to install)

downloading packages...
[...]
installing packages...
installing png-1.6.12...
installing libjpeg-turbo-1.3.0nb1...
installing freetype2-2.5.3nb1...
installing php55-gd-5.5.16nb1...
===========================================================================
$NetBSD: MESSAGE.module,v 1.2 2004/11/05 21:50:11 jdolecek Exp $

To enable this module, add the following to /opt/local/etc/php.ini:

    extension=gd.so

and make sure extension_dir points to the dir where gd.so is.

Then restart your PHP5.5-enabled HTTP server to load this module.
===========================================================================
pkg_install warnings: 0, errors: 0
reading local summary...
processing local summary...
updating database: 100%
marking php55-gd-5.5.16nb1 as non auto-removable

Restart PHP-FPM

svcadm restart php-fpm

Now browse to http://ip-address and check that the extension (gd) is enabled.

Obtaining a Free One-Year StartSSL SSL/TLS Certificate

2014-10-19T12:51:02+02:00

StartSSL offers free 1-year SSL/TLS certificates. The advantage of having a SSL/TLS certificate signed by a certification authority recognised by most recent browsers (and not your own CA) is that these browsers will not issue all kinds of warnings when they read the certificate; instead the browser will present a nice green padlock next to the https-address.

Before you can issue valid SSL/TLS certificates you must own a domain (e.g. wbnet.dk) and validate that you are the owner of the domain, by being able to receive mails from StartSSL to the postmaster address of the domain. Also, you must validate any mail-addresses (e.g. test@wbnet.dk) you plan to use as the contact person in the certificate(s).

Ars Technica has a nice how-to on obtaining a free StartSSL SSL/TLS certificate. The following notes are more of a personal reminder on key and certificate request generation.

In this post-Snowden and post-Heartbleed era I would recommend a separate 4096-bit private key per certificate. Generate a password protected 4096-bit private key:

openssl genrsa -des3 -out test.wbnet.dk.private.key 4096
Generating RSA private key, 4096 bit long modulus
...................................++
...................................++
e is 65537 (0x10001)
Enter pass phrase for test.wbnet.dk.private.key:
Verifying - Enter pass phrase for test.wbnet.dk.private.key:

If you do not want to enter the password every time you start your web-server, create a password-less version of the private key:

openssl rsa -in test.wbnet.dk.private.key -out test.wbnet.dk.key
Enter pass phrase for test.wbnet.dk.private.key:
writing RSA key

Make sure the password-less key is kept in a safe place (only stored on the web-server) and is only readable by root (chown root.root and chmod 400)

Proceed to create a certificate signing request (csr) (in this case for a 4096-bit certificate using the sha256 algorithm, since sha1 is deprecated) without a challenge password (important information is the Common Name, i.e. the hostname, and the Email Address):

openssl req -new -newkey rsa:4096 -sha256 \
  -key test.wbnet.dk.private.key -out test.wbnet.dk.csr
Enter pass phrase for test.wbnet.dk.private.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DK
State or Province Name (full name) [Some-State]:Hovedstaden
Locality Name (eg, city) []:Roedovre
Organization Name (eg, company) [Internet Widgits Pty Ltd]:wbnet
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:test.wbnet.dk
Email Address []:postmaster@wbnet.dk

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Copy the certificate request:

root@www:~# cat test.wbnet.dk.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIEyDCCArACAQAwgYIxCzAJBgNVBAYTAkRLMRQwEgYDVQQIDAtIb3ZlZHN0YWRl
bjERMA8GA1UEBwwIUm9lZG92cmUxDjAMBgNVBAoMBXdibmV0MRYwFAYDVQQDDA10
ZXN0LndibmV0LmRrMSIwIAYJKoZIhvcNAQkBFhNwb3N0bWFzdGVyQHdibmV0LmRr
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtSoD0QpXSIkOoa6WF4Bj
9Eoewr+BxveSHT0J/fBJTP9jI/XErU1WXLgJUbR444upRV/7RQlmWFKVUcVnHpDo
Giv+tznsgtNh/Wi6Xj81o4OEhuTz9l2XLkbCvOPBrun6gydDvphDLYKLqHMDX3VL
HubG87SrCt+8yJ29C8Zppbo4yawEFxJJ+0dgk3gzhYCE9Pfiw0NwPOiGgQ1nSRz9
Ms0UPzgThQwTpNiAr8xOyjoddmAi8POHexeKnedNk4zXoH6rbJ+P41poEkG0oqsM
lt5gtiyPaJNXmPww66pX73uJtbo3lhbv9SmN8EO+LmQ3VIMuzaZ+auTJABUzLXPw
pV/KQlu21/OVvBuCHoGuT0I+u7aU0ppba5XpEjINw9/vjOsoDoYQzS2lJp9zcBeW
e9aXgZM0YSd88DmDqXWMtePj/yrOSIQ/z7+JRcwjsa8jkE0ssloZqfHxAIALnhNg
dkmCHrg18Pzg8pX0hLA2IJBc9BVXpr3w0iS/D87cnRmuh96XpbxK6Y8bsNeHQiP7
strKCYYNt44glpgKgYvAT9C8pqWo+Kl5TPlYwLEssDzZHmuyMwzDx6uQ1CzdKEH6
KrDzh20hpupon5V+Vk86ar915CWzZ/zcW4yjvZ+pQtkNGJb1nGX874AbT2Ge1lfq
yJXfRp1rh8+4w9/RLkkvEe8CAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4ICAQCoCeYA
sXiA4V8VFy5Z2RLQ7ZPc4pIyDMLPtzyx1LIFUEaIhPhhMIpj0GPKwm9QtTiydQh2
VYkwFB3dAeGwMcTe/UMz6EzvWBIIU2OEwgGid2ZcBUcFUK3pOw0AgVhKPOLNtobC
ZxVQYkxNEMny6sBaQ+REi+cqJU7UYiYkhtpuX/IcUfuYoN3jqDoTdgsolaVbQ9pq
/C/19//vpHdzQBh5aWzoD8w6Shd5Bva2B4MflRINiemfnItsYEkA4VwfIGnBms2X
6LdwTscuC6fQG6CCRu4T35yWiERLCKXowRZkP43tBx70LOP8PG6I6w3jSaMfHgV/
FbAL9S7uQ1A+2nBtnrPybfL8kZ2LaOkq/65B3VZwJAvlPONUnXKr9Xq6kJSNgA5W
k2WUhtFA5pVpedYMMX3ucoFTMIDjzcGpFruGLosmncPaJhGzsPbogwh1f+fLB0sq
Lwr82DqJ3wfPha/pJ35qk9F7pS5CBYArAHtn/F96CytnJCtmOX8vX5D26ODDcVqB
MPQJzq0fKNoNCqm9jwJxnBYRCk1vjOyGsPGvtGkAFt2AIoHx7e6r0W4TSd1w8g9S
HaANvpGW2A9k2jGlJ+BqMwRjcG4QD/yLptFKJFwdepWVXC8Umou5oYhjeUCS9byJ
aX/OTfESaktZ7q27jB9mcpUzqNGgJLG2LwT5fw==
-----END CERTIFICATE REQUEST-----

Then go to the StartSSL control panel. Select Certificates Wizard and select Web Server SSL/TLS Certificate in the drop down and click Continue.

On the next page, skip the generation of a private key (Skip). Then paste your Certificate Signing Request into the text box.

Click Continue and then Continue again on the next page. Select the proper domain in which the host (test.wbnet.dk) resides (wbnet.dk) and click Continue.

On the next page, enter the hostname and click Continue.

On the next page click Continue again.

For some hostnames (including test), a manual verification must be made by StartSSL and you will be shown the message below. Otherwise, you will be taken directly to the certificate.

After a short period of time (max 3 hours) go to Control Panel and click Retrieve Certificate. Select the proper certificate in the drop down menu:

Then click Continue. On the next page your signed certificate is displayed in the text area. Copy this text to a file (test.wbnet.dk.pem) .

Next download the StartSSL CA root certificate and class 1 server certificate and concatenate all three certificates into a new certificate:

wget https://www.startssl.com/certs/ca.pem
wget https://www.startssl.com/certs/sub.class1.server.ca.pem
# Note, the order of concatenation IS IMPORTANT
cat test.wbnet.dk.pem sub.class1.server.ca.pem ca.pem > test.wbnet.dk.crt

Now deploy the certificate test.wbnet.dk.crt and the private key test.wbnet.dk.key on your web-server. An example configuration for Nginx is shown below:

[...]
  server {
    listen       443;
    server_name  test.wbnet.dk;
    ssl on;
    ssl_certificate      /opt/local/etc/nginx/ssl/wbnet.dk/test.wbnet.dk.crt;
    ssl_certificate_key  /opt/local/etc/nginx/ssl/wbnet.dk/test.wbnet.dk.key;
    [...]
  }

Photo of the Day: Furnace.

2014-10-19T00:00:00+02:00

Photo of the Day: Chestnut Yarn Spider.

2014-10-18T00:00:00+02:00

Photo of the Day: Autumn Is Here. Winter Is Coming.

2014-10-17T00:00:00+02:00

Photo of the Day: Freshly Ground

2014-10-16T00:00:00+02:00

Photo of the Day: House of Stone ... And Glitter

2014-10-15T00:00:00+02:00

Run a QEMU/KVM Virtual Machine in an OmniOS Zone

2014-10-10T09:29:31+02:00

It is possible to run QEMU/KVM virtual machines inside an OmniOS zone but it requires that the kvm kernel module is made available to the zone. Also, any raw volumes for the virtual machines must be made available to the zone. Here is an example zone configuration file for a QEMU/KVM capable zone:

create -b
set zonepath=/tank/zones/example
set ip-type=exclusive
set autoboot=true
add net
set physical=dmzexample0
end
add net
set physical=dmzexample1
end
add device
set match=/dev/kvm
end
add device
set match=/dev/zvol/dsk/tank/zones/kvmexample-vol
end
commit

The set match=/dev/kvm makes the kernel kvm module available to the zone and the set match=/dev/zvol/dsk/tank/zones/kvmexample-vol makes the zfs volume tank/zones/kvmexample-vol available in the zone.

The presence of two virtual network interfaces (dmzexample0 and dmzexample1) makes it possible to use one for the zone (and thus VNC into the virtual machine) and the other for the virtual machine.

A sample QEMU/KVM configuration script (/root/kvmexample.sh), in this case for a Plex Media Server, could look like this (ubuntu 14.04 iso mounted in the zone at med/iso via nfs):

NAME=kvmexample
VNIC0=dmzexample1
HDD0=/dev/zvol/dsk/tank/zones/kvmexample-vol
CD=/med/iso/ubuntu-14.04-server-amd64.iso
VNC=1
MEM=8192

mac0=`dladm show-vnic -po macaddress $VNIC0`

/usr/bin/qemu-system-x86_64 \
-name $NAME \
-boot cd \
-enable-kvm \
-vnc 0.0.0.0:$VNC -k da \
-smp cores=10,threads=1,sockets=1 \
-m $MEM \
-no-hpet \
-localtime \
-drive file=$HDD0,if=virtio,cache=none,index=0 \
-drive file=$CD,media=cdrom,if=ide,index=2  \
-net nic,vlan=40,name=net0,model=virtio,macaddr=$mac0 \
-net vnic,vlan=40,name=net0,ifname=$VNIC0,macaddr=$mac0 \
-vga std \
-pidfile /root/$NAME.pid \
-daemonize

if [ $? -gt 0 ]; then
    echo "Failed to start VM"
fi

port=`expr 5900 + $VNC`
public_nic=$(dladm show-vnic|grep vnic0|awk '{print $2}')
public_ip=$(ifconfig $public_nic|grep inet|awk '{print $2}')

echo "Started VM: $NAME"
echo "VNC available at: host IP ${public_ip} port ${port}"
echo "QEMU Monitor, do: # telnet localhost $TLN. Note: use Control ] to exit monitor before quit!
"

To control (start/stop) the virtual machine as a service using svcadm create a /root/kvmexample.xml manifest (file):

 type='manifest' name='export'>
     name='kvm/kvmexample' type='service' version='0'>
         enabled='true'/>
        
         name='network' grouping='require_all' restart_on='none' type='service'>
             value='svc:/milestone/network:default' />
        
         name='filesystem' grouping='require_all' restart_on='none' type='service'>
             value='svc:/system/filesystem/local:default' />
        
         name='start' type='method' exec='/root/kvmexample.sh' timeout_seconds='60'/>
         name='stop' type='method' exec=':kill' timeout_seconds='60'/>
         value='Unstable'/>
        
    

Import the manifest:

svccfg import -f kvmexample.xml

And start the virtual machine:

svcadm enable kvmexample

Use a VNCviewer to connect to the zones ip-address (on port 5901) to view the display output from the virtual machine.

Stop the virtual machine using:

svcadm disable kvmexample

Install Packages From Joyent/SmartOS Repository in OmniOS

2014-10-10T09:28:19+02:00

There are a few issues with the OmniOS package repositories as mentioned by gea of napp-it:

Applications are spread over several repositories
Applications are sometimes outdated without regular updates
The repositories contain only a few applications
The repositories are OS dependent

In contrast, the Joyent/SmartOS package repositories contain a lot of useful packages in one place, and are frequently updated.

To use Joyent/SmartOS packages in OmniOS (here in a zone) start by installing gnu-tar (gtar):

pkg install gnu-tar
           Packages to install:  1
       Create boot environment: No
Create backup boot environment: No

DOWNLOAD               PKGS       FILES    XFER (MB)
Completed               1/1       41/41      0.9/0.9

PHASE                                        ACTIONS
Install Phase                                123/123

PHASE                                          ITEMS
Package State Update Phase                       1/1
Image State Update Phase                         2/2

Next, install the Joyent/SmartOS bootstrap loader (modify 2014Q2-x86_64 to match current repository and architecture):

curl http://pkgsrc.joyent.com/packages/SmartOS/bootstrap/bootstrap-2014Q2-x86_64.tar.gz | \
gtar -zxpf - -C /
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 30.9M  100 30.9M    0     0   587k      0  0:00:54  0:00:54 --:--:--  642k

Since Joyent/SmartOS packages are installed in /opt/local update your path (this can be done permanently by modifying the PATH in ~./profile):

export PATH=/opt/local/sbin:/opt/local/bin:$PATH

Update the repository database:

pkgin -y update
reading local summary...
processing local summary...
updating database: 100%
pkg_summary.bz2                                    100% 1919KB 479.8KB/s  29.3KB/s   00:04
processing remote summary (http://pkgsrc.joyent.com/packages/SmartOS/2014Q2/x86_64/All)...
updating database: 100%

You are ready to search or install packages:

pkgin search php55-*
pkgin -y install apache-2.4.10

All packages can be viewed at the repository.

Creating and Cloning an OmniOS Zone

2014-10-10T08:51:53+02:00

An OmniOS/Solaris (non-global) zone acts as completely isolated virtual server within a single operating system instance and shares the kernel with the global zone. It shares resources (CPU and memory) with the global zone and there is close to no overhead in performance. It is an ideal way to isolate different services on a server.

If you are planning on running multiple zones (e.g one for each service), you can save time and resources (disk space) by installing a template zone (base) and then cloning it to make new zones (see end of this post on how to clone an existing zone).

To create a new zone start by creating a zone configuration file (example.conf):

create -b
set zonepath=/tank/zones/example
set ip-type=exclusive
set autoboot=true
add net
set physical=dmzexample0
end
commit

A ZFS volume will be created at the zonepath /tank/zones/example. The ip-type=exclusive implies that the network stack is separate from the global-zone. The zone will boot upon system boot due to autoboot=true. A single network interface (dmzexample0) is available from within the zone.

Next create the network interface (in the global zone):

dladm create-vnic dmzexample0 -l aggr0 -v 40

In this case the dmzexample0 VNIC uses the link aggr0 and is assigned to vlan 40, since the zone is to reside in the DMZ.

Import the zone using zonecfg (in this case the name of the zone will be example):

zonecfg -z example -f example.conf

Next install the zone using zoneadm (this takes a couple of minutes):

zoneadm -z example install
A ZFS file system has been created for this zone.
   Publisher: Using omnios (http://pkg.omniti.com/omnios/release/ ).
   Publisher: Using ms.omniti.com (http://pkg.omniti.com/omniti-ms/).
       Image: Preparing at /tank/zones/example/root.
       Cache: Using /var/pkg/publisher.
Sanity Check: Looking for 'entire' incorporation.
  Installing: Packages (output follows)
           Packages to install: 379
       Create boot environment:  No
Create backup boot environment:  No
            Services to change:   4

DOWNLOAD                                  PKGS       FILES    XFER (MB)
Completed                              379/379 38943/38943  249.4/249.4

PHASE                                        ACTIONS
Install Phase                            56633/56633

PHASE                                          ITEMS
Package State Update Phase                   379/379
Image State Update Phase                         2/2

        Note: Man pages can be obtained by installing pkg:/system/manual
 Postinstall: Copying SMF seed repository ... done.
        Done: Installation completed in 200.260 seconds.

  Next Steps: Boot the zone, then log into the zone console (zlogin -C)
              to complete the configuration process.

Boot the zone and log in using zlogin (to exit the zone just type exit):

zoneadm -z example boot
zlogin example
[Connected to zone 'example' pts/2]
OmniOS 5.11     006     June 2014
root@example:~#

List available network interfaces:

dladm show-vnic
LINK         OVER         SPEED  MACADDRESS        MACADDRTYPE         VID
dmzexample0  ?            1000   2:8:20:8:51:e9    random              40

Create the IP interface and setup static networking:

ipadm create-if dmzexample0
ipadm create-addr -T static -a 192.168.0.10/24 dmzexample0/v4static
# for DHCP use
# ipadm create-addr -T dhcp dmzexample0/v4

Setup routing (if using static networking):

route -p add default 192.168.0.1
# Additional routes can be set up using
# route -p add 10.0.0.0/24 192.168.0.2

Setup name resolution by adding nameservers to /etc/resolv.conf:

nameserver 192.168.0.1

Finally configure NSS to use DNS:

cp /etc/nsswitch.conf{,.bak}
cp /etc/nsswitch.{dns,conf}

Verify internet access:

ping google.com
google.com is alive

After having successfully installed the zone you might want to take a look at:

To clone an existing zone start by shutting down the zone (from the global zone):

zoneadm -z example halt

Copy the configuration file (cp example.conf exampleclone.conf) and modify as appropriate (at least zonepath and physical network):

create -b
set zonepath=/tank/zones/exampleconf
set ip-type=exclusive
set autoboot=true
add net
set physical=dmzexampleconf0
end
commit

Remember to create any new network interfaces:

dladm create-vnic dmzexampleclone0 -l aggr0 -v 40

Import the new configuration as a new zone:

zonecfg -z exampleclone -f exampleclone.conf

And then clone the existing example zone using zoneadm and boot it:

zoneadm -z exampleclone clone example
zoneadm -z exampleclone boot

Next, login and modify network settings (see above).

Finally, to delete a zone start by shutting it down:

zoneadm -z exampleclone halt

Then uninstall using zoneadm:

zoneadm -z exampleclone uninstall -F

And delete the configuration using zonecfg:

zonecfg -z exampleclone delete -F

Make sure the zone no longer appears in the list of zones:

zoneadm list -iv

Solaris/OmniOS Tape Drive and Autochanger Device Names

2014-10-09T14:28:58+02:00

In Solaris (and thus OmniOS) tape drives are mapped to /dev/rmt (raw media tape) using the following device naming scheme:

/dev/rmt/XAbn

X is the drive number (0-n)
A is the optional density (c for compressed, u for ultra)
b for BSD compatible behaviour (needed for bacula)
n is an optional no-rewind (n) [omit for rewind]

So, using compression and BSD compatible behaviour with no-rewind, the two LTO3 tape drives in my PowerVault ML6010 are at:

/dev/rmt/0cbn
/dev/rmt/1cbn

The autochanger is mapped to:

/dev/scsi/changer/cXX

Where cXX is the SCSI controller number.

Cisco SG300 and OmniOS Link Aggregation Hash Policy Issues

2014-10-09T12:31:21+02:00

Having installed OmniOS on my SuperMicro X9DR7-LN4F I configured a link aggregation to my Cisco SG300-28 switch, but found the network connection to be very erratic. It turns out that OmniOS by default uses a L4 LACP hash policy (piping by mac-address, IP-address and TCP/UDP port) whereas Cisco SG300 to my knowledge (i.e. the SG300 administration interface) only supports L3 LACP hash policy (mac-address, and IP-address). In other words, what traffic goes down what pipe was not in sync between OmniOS and the switch.

The fix is simple, specify the hash policy when creating the link aggregation (aggr0):

dladm create-aggr -P L3 -d igb0 -d igb1 -d igb2 -d igb3 aggr0

or update an existing link aggregation (aggr0) using:

dladm modify-aggr -P L3 aggr0

That stabilized network connections.

Nexus 7 (2013) LTE Error While Searching for Networks

2014-10-08T20:51:31+02:00

Back in September my Nexus 7 LTE (2013 model) tablet lost the ability to connect to cellular networks out of the blue while running Android 4.4.3. My network is 3 (in Denmark) and the SIM card works in an iPad. So this is specific for the Nexus 7 LTE. When I browse to: Settings->More...->Mobile Networks->Network Operators->Search Networks all I get is “Error while searching for networks”.

Selecting Choose automatically results in “Can’t connect to this network right now. Try again later.”

A lot of people have the same issues with lost cellular connectivity of Nexus 7 LTE tablets.

I have tried the following remedies (none of them worked):

Factory reset
Downgrade to Android 4.4.2 (KOT49H) using the official google factory image (razorg)
Downgrade to Android 4.3 (JLS36C), using official image
Re-install Android 4.4.3 (KTU84L) and perform official OTA update (via wifi) to Android 4.4.4
Airplane mode enable/disable

The airplane switch is somewhat interesting. When airplane mode mode is off, the cellular status reads “No Service”, but when airplane mode is on it reads 3 (my network provider). So the Nexus 7 LTE can at least read my SIM card, how else would it know I am using 3?

According to this thread Google was aware of the issue well in advance of the release of Android 4.4.4 for the LTE model, but did not fix it. That is really lousy customer service by Google and Asus. According to Google tech (in the same thread), we are told to wait for Android L which might be released for the Nexus 7 (2013) model and might fix the issue.

I filed an RMA (return merchandise authorization) with Media Markt today and they will do a repair or replacement of my Nexus 7 LTE under warranty (less than a year old). Now that is good customer service.

SuperMicro X9DR7-LN4F SATA Issues When Using On-board LSI SAS2308 Controller

2014-10-07T16:31:03+02:00

One of the reasons I bought a SuperMicro X9DR7-LN4F for my All-in-One server was the ability to use a total of 18 drives with the on-board controllers:

8 disks on the LSI SAS2308 (SAS2)
6 drives on the Intel C602 (Port 0-5, two SATA3 and four SATA2)
4 drives on the SCU (SATA2).

Unfortunately this turned out not to work (running BIOS v3.0a from 10-Sep-2013, latest available at the time of writing). Thomas Krenn mentions issues with simultaneous use of the 4 SCU SATA2 ports and the SAS2308 controller. In my experience only the 2 SATA3 ports can be used when the SAS-2308 is operational rendering this this motherboard capable of supporting only 10 disks rather than 18. I would have liked to have that information before the purchase!

I ended up buying an LSI SAS 9201-16i HBA ahead of time.

Preparing Samsung HD204UI as 4K Sector Drive for Use in ZFS Zpool

2014-10-07T16:22:20+02:00

I had six Samsung HD204UI drives from a previous NAS that I wanted to use in a zpool (two vdevs each consisting of a three-way mirror). The HD204UI drives are advanced format drives with 4k sectors, but they report a 512 byte sector size to the OS. This can be overcome in zfs by forcing 4k size in sd.conf and using ashift=12 when creating the zpool.

Before creating a zpool the drives must be prepared so that zfs and disk sectors are aligned. The following approach is gleaned from the illumos wiki entry on the subject by George Wilson.

To find the device names of all disks use the format command (use Ctrl-C to exit):

root@srv01:~# format
Searching for disks...done
...
AVAILABLE DISK SELECTIONS:
...
       2. c3t50024E900496C9E7d0 
          /scsi_vhci/disk@g50024e900496c9e7
...
Specify disk (enter its number):

To use 4K sectors the partition table must be changed to a GUID partition table (GPT). Use the mklabel gpt command to change partition table (this will destroy all data on the disk):

parted /dev/rdsk/c3t50024E900496C9E7d0 mklabel gpt

To align sectors create a partition which starts at sector 256 (256 sectors of 512 bytes is 131072 bytes or 32 4K sectors, i.e. aligned). The size of the partition should be total number of disk sectors minus 16640 sectors (256 sectors for start + 16384 sectors for down-sizing to allow new disks of identical size to have slightly different geometry and still be used as replacement for the drive we are partitioning). 3907029168 sectors minus 16640 sectors equals 3907012528 sectors:

parted /dev/rdsk/c3t5000CCA23DC00778d0p0 uni s mkpart zfs solaris 256 3907012528

The disk is now ready to use in a zpool.