4,254 reputation
1234
bio website
location
age
visits member for 4 years
seen 20 hours ago

A self-loathing despair squid.


Oct
29
comment Linux: how to send new lines in log files to remote syslog?
I guess. Generally i've found long term that there's no medals in winning self-inflicted battles. When the technical debt gets to the point it impacts the business ironically the people who diligently worked hard to avoid the elephant in the room tend to end up carrying the can, in my experience. So i'd say cover your ass and get someone to agree in writing the downsides of this.
Oct
29
comment Linux: how to send new lines in log files to remote syslog?
yeah its a jar packed jruby tool. The gui is actually kibana which is packaged into it for easy but is actually a seperate project, so it's not needed just for parsing messages. It's basically a swiss army knife of logging. You define inputs and outputs and in the middle you can optionally grok the logs, which gives them context. -- IT's likely overkill for you unless you also want to use elasticsearch on your log data.
Oct
29
comment Linux: how to send new lines in log files to remote syslog?
yeah, the config is going to look a bit like this: pastebin.com/xeC9hxD3
Oct
29
comment Linux: how to send new lines in log files to remote syslog?
+1. if using rsyslog's file input isnt an option, logstash is the next best thing. In many ways it's better in the long run.
Oct
29
comment Linux: how to send new lines in log files to remote syslog?
@MichaelMartinez imho, that sounds like a pretty quick route to crippling levels of technical debt.
Oct
22
accepted freeipa ssl ldap and round robin dns
Oct
18
comment Amazon EC2 security groups
its deny by default, so allowing just tcp port 80 (And someway for you to ssh in) should be ample.
Oct
17
comment freeipa ssl ldap and round robin dns
well after a few hours fiddling i got pretty stuck: fedorahosted.org/freeipa/ticket/3977 -- it seems ipa isnt smart enough to tell dogtag what it needs to signa cert with alt names, and i know way too little about dogtag to know how to do it directly.
Oct
17
comment freeipa ssl ldap and round robin dns
This is pretty encouraging, esp not needing to touch the clients. Now that i think of it, it throws one more dumb question; If i'm going to be needing a load balencer function and i don't want that to be a single point of failure, is it madness to cluster that (haproxy i assume) between two of the ipa servers themselves ?
Oct
16
comment freeipa ssl ldap and round robin dns
good info. think I'm at least thinking down the right path... The option to add a subjectaltname would mean re-enrolling the clients, right? To do the load balancer, wouldn't I need a new cert anyhow? Not sure how the client asking a load balencer dns entry and getting back a cert with a cn of one of the servers wouldn't be an issue?
Oct
16
revised freeipa ssl ldap and round robin dns
added 125 characters in body
Oct
15
comment vagrant and puppet security for ssl certificates
what we do is put all the secrets into hiera-gpg, and have a placeholder version of the hiera data in which all passwords are dummy ones. So essentially you just need a common.gpg which has a default for all passwords and so on.
Oct
15
revised freeipa ssl ldap and round robin dns
added 98 characters in body
Oct
14
revised freeipa ssl ldap and round robin dns
added 76 characters in body
Oct
14
asked freeipa ssl ldap and round robin dns
Sep
13
comment Can Docker help me install Oracle 11g database on Ubuntu?
@EEAA, browsing around their github issues when people were asking for the (elephant in the room) RHEL support and seeing how there were comments considering a needed move away from aufs due to ubuntu ditching it. The consensus was to move to btrfs which isn't out of tech preview until RHEL7. There were also some pretty caviler attitudes to putting 3.10+ custom kernels onto RHEL boxes to make docker go. Overall i really liked the concept, but i think it'll be some time before i'd be happy to roll it out. Only a quick cursory glance though, so YMMV.
Sep
13
comment Can Docker help me install Oracle 11g database on Ubuntu?
I looked into docker just this morning, it didn't strike me as production ready, at all. tbh.
Aug
14
comment How do you PREPEND an iptables rather than APPEND?
iptables -L --line-numbers is a little more platform independant
Aug
13
comment Remove old puppet repo configuration
+1, this is exactly what we did.
Aug
13
comment Why does this puppet node definition not run on the hostname it matches?
to clarify (as this question just wen't back to the top of SF), the node should be called anything else, myserver01 or such, and use that for matching the node name, not 'puppet' (which would be the cname)