2,179 reputation
11332
bio website dolicapax.org
location Norway
age 35
visits member for 4 years, 6 months
seen Mar 20 at 11:26
unix dude, dba, founder, photographer, podcaster, blogger and coffe-drinker. Certified Oracle DBA, UNIX ASE and Clariion Admin. HA specialist.

Mar
4
comment How to kill a <defunct> process with parent 1
@AndrewH I'm not sure SIGKILL depends on a signal handler in the target process, but it's true that the typical kernel will ignore a SIGKILL to init. However, should you run out of cooler ways to trigger a kernel panic, I think you will find that on most Linux systems a SIGSEGV will do quite nicely.
Jul
30
comment Encryption over gigabit carrier ethernet
I think part of the point is that WANs and LANs are growing a lot closer together technology wise. About line costs, around these parts, the cost of upgrading from virtual wire to dedicated wire/frequency (where MACSec is obviously fully supported) is a LOT less than acquiring dediacted L2 encryptors. We're talking an order of magnitude.
Jul
2
comment Encryption over gigabit carrier ethernet
There are few formal requirements in this case, other than the need for reasonable measures to prevent theft of data in transit. I suppose one could argue that widespread use provides validation. If there's something wrong with AES-GCM I'm sure we'll hear about it.
Jul
2
comment Encryption over gigabit carrier ethernet
Considering you get 20 Gbps worth of MACSec from leading vendors for less than $3,500 I still think the layer 2 devices I know about are insanely overpriced. One might pay 200 times more for the same bandwidth and comparable encryption latency.
Jul
2
comment Encryption over gigabit carrier ethernet
In these parts I believe they are listed around $35,000 (+ tax) per unit (1 Gbps ethernet edition)
Jul
2
comment Encryption over gigabit carrier ethernet
Yes, I have considered fork lifting to layer 3 and doing IPSec encryption and tunnel through L2TP or GRE ; see my first comment. I'm not sure I see any advantages with such solutions. Does L2TPv3 offer any improvements on latency and small packet overhead? Is there reason to think that IPSec encryption hardware capable of saturating 1 Gbps full duplex might have a lower cost that can make up for the disadvantages of encapsulation and fork lifting?
Jul
1
comment Encryption over gigabit carrier ethernet
I don't know about overkill, the CN1000 was already my backup plan, if a less expensive solution can not be found
Jul
1
comment Encryption over gigabit carrier ethernet
Either the header is encrypted, or changes made to the header as it traverses a non MACSec bridge breaks frame integrity. Putting a dumb switch between the two MACSec switches certainly breaks the protocol. I see the theoretical possibility of sending the encrypted traffic through Q-in-Q provided the frame is dumbly forwarded without interpretation or modification, after all that's why EoMPLS works. I have not been able to confirm whether this could work or not.
Jul
1
comment Encryption over gigabit carrier ethernet
I might add that the price tag of two ASAs capable of maintaining 1 Gbps full duplex IPSec adds some motivation for exploring the alternatives. By comparison you can get a Catalyst supporting 10 Gbps/wirespeed MACSec for less.
Jul
1
comment Encryption over gigabit carrier ethernet
Layer 2 connectivity is a requirement. One would think that encrypting a layer 2 network on layer 2 rather than doing tunneling and fork lifting would be faster, simpler and more secure. However, IPSec/L2TP or similar (with encryption and encapsulation done in ASIC) may still turn out to be the best available option; that is essentially what I'm trying to figure out.
Mar
28
comment Nagios monitoring with SMS alerts via Clickatell
See my comment above about deleting the temporary file after running send_sms from the command line. This had me puzzled for a while.
Mar
28
comment Nagios monitoring with SMS alerts via Clickatell
If you are using the send_sms script I think you are using: If you test the script by running it as some other user than the nagios user, remember to delete /tmp/sms.html else the wget in send_sms will fail when run by nagios. Better yet, change the send_sms script to delete the tempfile at the end.
Mar
24
comment Nagios http url check fails with “Temporary failure in name resolution”
Lovely, I noticed this way http_check does a HTTP/1.1 request instead of HTTP/1.0. Much better this way, thanks again.
Mar
24
comment Nagios http url check fails with “Temporary failure in name resolution”
I don't think this will work without changing the command definition, will it? Anyway, I found the typo in my configuration, it just needed an extra dollar sign in $HOSTADDRESS$
Mar
24
comment Nagios http url check fails with “Temporary failure in name resolution”
Thanks, I didn't consider that way of doing it. Will it work with virtual hosts?
Mar
24
comment Nagios http url check fails with “Temporary failure in name resolution”
Found it .. simple typo - needs another $ in $HOSTADDRESS$
Feb
25
comment VMware Player - Running as a Service
-1 Technically, the question is whether VMware Player can be run in the background, not which alternatives are available that may or may not be more ideal.
Nov
26
comment How to have 20-30TB space with many 2TB HDDs?
Based on general recommendations, there are too many drives to recommend RAID 5 or 6. Should consider RAID 5+0 or 6+0 instead. Manageable rebuild times points towards RAID 6+0. Similarly, due to the number of disks, the risk of running a JBOD (the typical concatenated LVM configuration) will be very high, and likely can not be recommended.
Nov
22
comment Oracle Import Dump
You do not need the same version or cpu platform, data migration is supported across both versions and platforms! You should however run the exp and imp using the highest version, eg. if you want to migrate data from 10g to 11g, you should use the 11g version of the utilities.
Oct
15
comment How do I permanently disable Linux's console screen saver, system-wide?
Seems to be nicely answered over at askubuntu: askubuntu.com/questions/138918/…