Reputation
2,422
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
2 18 37
Impact
~223k people reached

  • 0 posts edited
  • 1 helpful flag
  • 105 votes cast
Jan
27
comment How do I allow user to reload zone file?
sudo is your friend.
Dec
16
comment Ansible Playbook: Ensure a process is running on any one node of a cluster?
Should work, by the look of it, though I still need a way to check with every relevant machine and work out the combined state before I can decide to start a new process. It might be simpler to solve this outside of the automation tools, although I would have thougt that with Ansibles suite of node discovery, dynamic inventory and cluster management features there would be a pretty straight forward way of doing this.
Sep
10
comment Why Place Load-Balancer Behind Firewall?
While the application delivery controllers from F5 are capable of extending basic protection to the associated web servers, few think of them as a fully capable firewalls and fewer still would expect it to be able to protect itself to any significant degree. In other words, the built in firewall can in some cases replace the typical inner firewall, that is behind BigIP, facing the web servers. It cannot replace the typical outer firewall, that is the one in front of the BigIP, facing Internet.
Sep
10
comment Why Place Load-Balancer Behind Firewall?
The primary function of the firewall described here would be to protect the ADC which in turn protects the web servers, in many ways as a firewall would, but with the added benefit of also being a load balancing reverse proxy with traffic management and having the additional features of a web application firewall.
Jul
17
comment Configuring the hostname on Red Hat Enterprise Linux
Nah, we'll be on Oracle Linux 6 for many years yet. Systemd 25 can go away and stay there, as far as I'm concerned.
Oct
24
comment Synchronize clock with NTP while online, and with RTC while offline?
This is the kind of solution I had in mind when I wrote my previous comment. Also, if the system clock is currently in sync via ntpd, you can use hwclock to measure and set a fairly precise drift rate for the RTC.
Oct
23
comment Synchronize clock with NTP while online, and with RTC while offline?
As I understand it, a combination of ntpd and hwclock already allows you to do all of these things.
Oct
19
comment rm on a directory with millions of files
find -delete tends to cause too much I/O and easily impacts production performance. Perhaps with ionice.
Mar
4
comment How to kill a <defunct> process with parent 1
@AndrewH I'm not sure SIGKILL depends on a signal handler in the target process, but it's true that the typical kernel will ignore a SIGKILL to init. However, should you run out of cooler ways to trigger a kernel panic, I think you will find that on most Linux systems a SIGSEGV will do quite nicely.
Jul
30
comment Encryption over gigabit carrier ethernet
I think part of the point is that WANs and LANs are growing a lot closer together technology wise. About line costs, around these parts, the cost of upgrading from virtual wire to dedicated wire/frequency (where MACSec is obviously fully supported) is a LOT less than acquiring dediacted L2 encryptors. We're talking an order of magnitude.
Jul
2
comment Encryption over gigabit carrier ethernet
There are few formal requirements in this case, other than the need for reasonable measures to prevent theft of data in transit. I suppose one could argue that widespread use provides validation. If there's something wrong with AES-GCM I'm sure we'll hear about it.
Jul
2
comment Encryption over gigabit carrier ethernet
Considering you get 20 Gbps worth of MACSec from leading vendors for less than $3,500 I still think the layer 2 devices I know about are insanely overpriced. One might pay 200 times more for the same bandwidth and comparable encryption latency.
Jul
2
comment Encryption over gigabit carrier ethernet
In these parts I believe they are listed around $35,000 (+ tax) per unit (1 Gbps ethernet edition)
Jul
2
comment Encryption over gigabit carrier ethernet
Yes, I have considered fork lifting to layer 3 and doing IPSec encryption and tunnel through L2TP or GRE ; see my first comment. I'm not sure I see any advantages with such solutions. Does L2TPv3 offer any improvements on latency and small packet overhead? Is there reason to think that IPSec encryption hardware capable of saturating 1 Gbps full duplex might have a lower cost that can make up for the disadvantages of encapsulation and fork lifting?
Jul
1
comment Encryption over gigabit carrier ethernet
I don't know about overkill, the CN1000 was already my backup plan, if a less expensive solution can not be found
Jul
1
comment Encryption over gigabit carrier ethernet
Either the header is encrypted, or changes made to the header as it traverses a non MACSec bridge breaks frame integrity. Putting a dumb switch between the two MACSec switches certainly breaks the protocol. I see the theoretical possibility of sending the encrypted traffic through Q-in-Q provided the frame is dumbly forwarded without interpretation or modification, after all that's why EoMPLS works. I have not been able to confirm whether this could work or not.
Jul
1
comment Encryption over gigabit carrier ethernet
I might add that the price tag of two ASAs capable of maintaining 1 Gbps full duplex IPSec adds some motivation for exploring the alternatives. By comparison you can get a Catalyst supporting 10 Gbps/wirespeed MACSec for less.
Jul
1
comment Encryption over gigabit carrier ethernet
Layer 2 connectivity is a requirement. One would think that encrypting a layer 2 network on layer 2 rather than doing tunneling and fork lifting would be faster, simpler and more secure. However, IPSec/L2TP or similar (with encryption and encapsulation done in ASIC) may still turn out to be the best available option; that is essentially what I'm trying to figure out.
Mar
28
comment Nagios monitoring with SMS alerts via Clickatell
See my comment above about deleting the temporary file after running send_sms from the command line. This had me puzzled for a while.
Mar
28
comment Nagios monitoring with SMS alerts via Clickatell
If you are using the send_sms script I think you are using: If you test the script by running it as some other user than the nagios user, remember to delete /tmp/sms.html else the wget in send_sms will fail when run by nagios. Better yet, change the send_sms script to delete the tempfile at the end.