2,052 reputation
321
bio website gcarrier.fr
location San Francisco, CA
age 26
visits member for 2 years, 4 months
seen Jun 11 at 2:42

Nerd at Airbnb. We're hiring!


Jul
8
comment strongswan can't push DNS resolver to OSX Mountain Lion (split tunnel)
Brilliant. Would UNITY_DEF_DOMAIN support multiple domains?
Nov
17
comment Account Lockout with pam_tally2 in RHEL6
Then the fix would be PermitEmptyPasswords no in sshd_config.
Nov
13
comment Account Lockout with pam_tally2 in RHEL6
It behaves correctly on my RHEL system. I really think inspecting /etc/pam.d/password-auth and /etc/pam.d/sshd would help. Edit: Good to hear, but surprinsing. I double-checked and get the right behaviour by putting them before pam_unix.
Nov
13
comment Account Lockout with pam_tally2 in RHEL6
You probably hadn't disabled PasswordAuthentication, had you? It would have then gone through the PAM stack twice. Edit: if not, I'd like to review your /etc/pam.d.
Jul
20
comment Linux authentication via ADS — allowing only specific groups in PAM
We'd have to review your su PAM configuration. That sounds like another question, though :)
Jul
8
comment How do i use socat as a proxy server?
socat has a very complete man page.
Jul
8
comment How to do a for loop of filenames with spaces using find
-r is not needed for spaces, but in case a backslash appears in the filename.
Jul
8
comment How to do a for loop of filenames with spaces using find
By default read will support escaping, so you need -r. And your solution will break with filenames containing newlines.
Jul
8
comment Why are these UDP packets being dropped?
No, you've changed your question. DNS is expected to move from UDP to TCP for payloads over 512 bytes. DNSSEC pretty much has to use TCP. I believe my questions are still relevant to move forward. Could you answer them?
Jul
8
comment ULogd2.x - Documents - IPFIX data generation
Duh. IPFIX is a superset of Netflow v9. plixer.com/blog/netflow/what-is-ipfix-vs-netflow-v9
Jul
7
comment Apache ProxyPassReverse with parameters from request
Where does it do this replacement?
Jul
7
comment Upgrading mysql 5.0 to mysql 5.1
You can of course refer to its manpage. It outputs a long file that contains a dump of all databases in SQL. It will not drop databases, just include DROP commands in the dump, in case you restore. A common way to use it would be with something like mysqldump --add-drop-database --all-databases | gzip -1 > /var/lib/mysqldump.gz.
Jul
7
comment Sending bulkmail from different server?
Absolutely. From my experience, and I'm not trying to sell their services, not only does sendgrid get good results, but you can't underestimate how much they know about spamming^Wbulk E-mail and will guide you in your DNS configuration. The work involved to please all major E-mail providers is also quite significant. I assume all serious bulk E-mail services will similarly get a lot out of your plate.
Jul
7
comment ULogd2.x - Documents - IPFIX data generation
[follow up] I would use libnetfilter_conntrack in 2 separate processes: 1. to grab all the events I'm interested into (multiple contexts to allow for complex filtering logic as their bsf usage is rather limited) and publish them on a zeromq socket, reencoded in msgpack (obviously with network endianness). 2. to periodically go through all connections and publish a snappy-compressed msgpacked list. That way I can have a good view of the current connections on a host even if the other process dies, or connections are started before it, and get traffic counters reasonably often.
Jul
7
comment ULogd2.x - Documents - IPFIX data generation
Unfortunately it'd have to be more complete then go through a code review before I can publish it. I don't target any IPFIX support on the machines but would rather take care of that centrally as I want a minimal communication layer on the hosts that can adapt to different types of information. I'll do the deduplication given I'll see many connections multiple times (from both machines when within my infrastructure, through 1 firewall in some contexts, through 2 firewalls for many cross-DC connections), and IPFIX tooling can't be as precise as some information will be lost in the translation.
Jul
7
comment Is there an way to get the top level classes included in a puppet node?
You can't have a command running on the client giving you the information, as the external node classifier and manifests are only known by the puppetmaster and never exposed to the puppet agent (only the compiled manifests are). So you'll need a trick like mine in your manifests, which is compiled by the puppetmaster then provided to the agent.
Jul
6
comment ULogd2.x - Documents - IPFIX data generation
I have a project to collect nf_conntrack_netlink data and aggregate it centrally, but if an efficient solution based on ulogd exists I'd love to hear about it!
Jul
6
comment Enabled hyperthreading - causes qthread creation error on Ubuntu Precise 64 bit
OK, then it looks like a kernel bug. Can we have uname -a?
Jul
6
comment Which OS/distributions have 64-bit kernel and 32-bit userspace?
If you do have a lot of pointers, they are double the size and will end up taking quite some memory. What your apps allocate you'll lose in filesystem cache, you'll also get get more cache misses (quite expensive), worse NUMA balancing (I'm fetching quite far here he he).
Jul
6
comment Ubuntu - why would /var/log/dmesg stop updating after boot? does not show panic/cpu_hung errors which the console shows
You also need kern.* /var/log/dmesg (and obviously not commented).