446 reputation
410
bio website
location Edinburgh, UK
age 94
visits member for 3 years, 2 months
seen 21 hours ago

AWS Cloud Consultant with a strong DevOps engineering background


Dec
10
comment strongSwan IPsec server with AWS EC2 VPC VPN client
This is a great useful answer and helped me - thanks.
Oct
30
comment With puppet, can you have the client ask to be a certain set of roles?
@Zoredache - thanks, I had stumbled upon something else alluding to this a little earlier, I will post the links if it works out. You are right though, custom facts appear to be the way to go.
Oct
30
comment With puppet, can you have the client ask to be a certain set of roles?
we are retro fitting puppet to our machines hence we will need to touch all machines anyway, install the puppet client package and modify the /etc/puppet/puppet.conf I guess I was wondering whether there was a setting I could put in there that would specify the roles at the client side.
Oct
24
comment OpenVPN performance: how many concurrent clients are possible?
To clarify - they have not, but I have not been tracking it either.... :-/ The "300" number just seemed reasonable. If we have problems we would just bump up the AWS image to a larger instance. I've never had close to that many connections on a server before, probably only about 100 max, but we run several servers and they approximately balance in line with openvpn randomly choosing a destination from a known list.
Oct
27
comment Setting SPF record on Amazon Route 53 with cli53 tool
Genius! That worked! Why don't you post it as a proper response and I'll mark you as the correct answer! Many thanks!
Oct
5
comment DNS Name lookup (was SSH) Not Working After Snow Leopard Upgrade
Thanks, googling led me here, this fixed it. "arp" reported the wrong IP, dig reported the correct "ip". No amount of dns flushing fixed it before I tried this. I do note that I had to execute the dscacheutil -flushcache as well. I'd also point out that local routers can behave strangely and ISPs don't also play fair in terms of TTL sometimes.
Aug
29
comment Sensibility of using generic client keys with openvpn in this scenario
I appreciate your candid response. I understood a couple of the points above and that was what stimulated the question and validated my niggling doubts. In actual fact the inability to recognise the machine is the deal breaker that would drive a solution to the key pair problem. I need to figure out an automated way of generating this during our machine build process and transferring it to the VPN server to avoid humain intervention (and the associated errors)
Aug
29
comment Sensibility of using generic client keys with openvpn in this scenario
OK, apologies, my mistake, I see what you were getting at
Aug
29
comment Sensibility of using generic client keys with openvpn in this scenario
@Zoredache: putting aside the rights or wrongs of whether you actually should or not for a moment, you can actually do this, it is the "duplicate-cn" option in the openvpn conf file on the server. The comments (from memory) don't suggest it is intended for production
Mar
31
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
Very nice to get to the bottom of it. Hopefully future google-ers will find it useful
Mar
30
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
This is bugging me as I don't doubt your results. I just reran original script (straight cut'n'paste) on Debian 5.0 (bash 3.2.39/i486) and it works perfectly, repeatedly. Then the identical script on an Ubuntu 10.10 (bash 4.1.5/i686) and it generates multiple different results on each rerun. I can only assume there is some sort of difference present in the arch or bash version but i couldn't find anything relevant.
Mar
30
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
I don't understand it either. I just pasted the exact script above into my Ubuntu 10.10 box and ran multiple times with different results each time. The result from md5sum is always consistent (I checked) which implies the problem is with the RANDOM pre-seed behaviour
Mar
30
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
With the benefit of hindsight, and further investigation, on the face of it, this is actually the better answer. The answer is deterministic (same each time) and therefore meets what I need. Having this as a separate little script is not that big a deal as I need to generate this number in more than one place, and my "out of the box" minimal Debian 6.0 runs it with no additional software
Mar
30
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
On further investigation this method is not deterministic (same result each time) - Debian Squeeze 6.0 root@myserver:/my/bin# ./portgen.sh 31101 root@myserver:/my/bin# ./portgen.sh 43840 root@myserver:/my/bin# ./portgen.sh 32097
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
This is equally a great answer and works very well, albeit slightly more complicated, but would be ideal if my tunnel script was in perl. Sadly I can only mark one as answered.
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
I'm marking this one as answered, this is exactly what I was after and elegantly simple using shell. I appreciate you taking the time to post.
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
You live and learn. I'd never really come across RANDOM in bash, nor the pre-seeding
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
This is pretty much what I imagined, but my perl is appaling :) It works great, I get the number, but I also get a warning message "Integer overflow in hexadecimal number at /tmp/hash.pl line 8, <IFCONFIG> line 1." Can this be eliminated?
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
One trick I had in mind (this is slightly OT) is to have the machines email home (or use cfengine or a web API or something like that) their config/public keys when they boot. That way I'd have a copy of the keys. So when they were switched on remotely, they would be knocking on the door, so as to speak, but not allowed in. I could take the config they had sent home, add it to the landing pad machine and then they would be allowed in. Yes I know there are some obvious flaws in this approach!
Mar
28
comment Hash function in shell that could be used for an ssh port from (say) hwaddr of eth0
We use ssh keys on each machine as well but they are equally a pain to manage and add to the authorized keys! I may have a look at using a generic key. I had a look at cssh as suggested and it appears to me to be used for concurrent execution on multiple machines; although i wouldn't rule it out, that isn't what we need this for. The port problem is just to make the remote machines more and more commodity like (eg for swap out in the event of problems)