Mike Renfro

1,116 reputation

148

bio	website	blogs.cae.tntech.edu/mwr
	location	Cookeville, TN
	age	41
visits	member for	2 years, 2 months
	seen	7 hours ago
stats	profile views	57

R&D Engineer, Center for Manufacturing Research, Tennessee Tech University. Maintainer of unofficial TTU LaTeX thesis style. UNIX/Linux systems administrator for TTU Computer Aided Engineering Network.

Githubs of minor note: firewall-bootstrap, puppetmaster-bootstrap, puppet-bootstrap.

	1,116 reputation	bio	website	blogs.cae.tntech.edu/mwr	visits	member for	2 years, 2 months
148 badges		location	Cookeville, TN		seen	7 hours ago

summary answers questions tags badges favorites bounties reputation activity

143 Actions

suggestions reviews revisions comments badges posts accepts all

May 5	comment	Why should I never run software as root, yet it is frequently recommended to give an account root-access to run software? `sudo apt-get update` as a regular user (which prompts for a password), instead of `apt-get update` as root.
May 5	comment	Why should I never run software as root, yet it is frequently recommended to give an account root-access to run software? Two notes on the first comment: first, I know I've seen instructions where a regular user account that needs root access will have a `user ALL=(ALL) ALL` line, but I've never heard of doing that for a system account (like `www-data`, `mail`, etc.). Second, an attacker would have to either guess the root password, or guess both the admin's username and password. Either of these routes can be mitigated with a tool like fail2ban to slow down dictionary attacks. On the third comment, the admin user would run the elevated command through sudo, such as:
May 5	comment	How to forbid user to bind a socket on other than a certain address? The "easiest" thing I can think of is to give the specific user their own VM, where you can set the rules differently than for the other users who use your original server. I'm not saying there's no way to do exactly what you want without changing the architecture, but I have to wonder if making a separate VM would fix other (currently unexpected) problems in the future.
May 5	comment	How to forbid user to bind a socket on other than a certain address? Block all inbound connections on the external interfaces by default, and whitelist the specific ports you need to work? If he can bind, but nobody outside can connect, does that fix it?
May 4	answered	Any Alternatives to retchmail
May 2	comment	python script crash prevent/reason check I've seen things like that die if they try to write to stdout or stderr and no valid device is available. To troubleshoot, you can either explicitly redirect both stdout and stderr when you background your program, or else background it from a `screen` session, and see if you ever see things get written to the terminal inside screen when you reattach to it.
Apr 21	comment	Using Puppet to manage shell commands Not to contradict any existing answers, but to add: `apt` also uses the directory `/etc/apt/sources.list.d` for repositories. Each file can contain one or more entries, and you can manage each file via Puppet `file` resources. Much easier than trying to work up idempotency via `grep` or other tools.
Apr 11	comment	get informations from x servers per ssh by bash script dsh can handle this for any arbitrary command.
Apr 10	comment	Creating a /home partition Assuming you have an empty partition somewhere: format the partition, mount it as something other than `/home`, shut down any services that might need `/home`, `rsync` all the `/home` data to the new mount point, rename `/home` to `/home.backup`, `mkdir /home`, umount the new partition, remount the new partition under `/home`, update `fstab`.
Apr 7	answered	How to shutdown ESXi 5 in N minutes
Apr 6	awarded	Citizen Patrol
Mar 23	comment	What to do when local usernames conflict with network usernames Regardless, KDE apps don't require KDM to function. KDM just runs a login screen.
Mar 23	comment	What to do when local usernames conflict with network usernames That's certainly possible. But I was hoping the company had the option to replace display managers instead of firing Mr./Mrs. KDM or forcing him/her to get a name change. They might run into a similar problem with GDM, less likely with XDM. And problem solved if they switch to LXDM or abandon display managers entirely.
Mar 23	comment	What to do when local usernames conflict with network usernames Also, at least on one Ubuntu 10.04 workstation I manage, there is no `kdm` user, since there is no KDM package installed. If you just have to have a `kdm` username for a real person, just don't install KDM, and use a different display manager.
Mar 23	comment	Force to apply changes through puppet on a puppet agent, through master? If the agent is running on the client, you can do whatever you want by editing manifests on the puppetmaster and waiting on the agent to check in: install packages, copy ssh keys from the puppetmaster, rewrite configuration files, etc. If the agent is not running on the client, and you have no other working means of remote access as root, you will have to fix it physically with a rescue CD or some other method, which would be a different question.
Mar 21	comment	Force to apply changes through puppet on a puppet agent, through master? Similar to what Zoredache mentions below, if the agent isn't running, there's no way to force it to check back in. Puppet is a pull system, not a push one (the agent decides when to check in, not the master). To reduce the chance of this happening in the future, you could (a) set up ssh key exchange between the puppetmaster and the clients for root login, (b) create cron jobs to start puppet agent if it's not running.
Mar 21	answered	How to loop through entries in nodes definition for puppet
Mar 19	comment	How to install packages from source code with Puppet? Feel free to grab the puppetmaster and puppet agent bootstrap tarballs I have in my Github (linked in my profile). I won't claim they're perfect, but they get you a relatively prouduction-ready setup quickly.
Mar 19	comment	How to install packages from source code with Puppet? Been there, done that. I'm actually in the middle of rebuilding my Puppet infrastructure to clean up 6 years of learning experiences and outright hacks. If it was me, I'd backport the zookeeper package from testing or unstable, build a local Debian repository if zookeeper had to be updated frequently and/or deploy on multiple nodes, and then use `package`, `file`, and `service` as given before. The packaging could be as simple as `apt-get -b source zookeeper`, with appropriate deb-src lines in /etc/apt/sources.list.
Mar 18	comment	How to install packages from source code with Puppet? If I was going to stick with my understanding of "the puppet way", I'd think steps 1, 2, and 4 are best handled by building a package for zookeeper, and possibly using a `package` resource to ensure you have the latest version. Steps 3 and 5 would be best handled with `file` and `service` resources. The whole thing could then be wrapped up into a self-contained zookeeper module. Do zookeeper packages already exist for your distribution? Or are they the wrong version, etc?