93 reputation
27
bio website
location
age
visits member for 3 years, 7 months
seen Nov 11 at 0:17

Mar
7
comment ssh-agent forwarding and sudo to another user
I disagree with the statement that "This must NEVER EVER be done!" There are many cases where this risk is acceptable. For example, a small team where everyone has the same permissions and you trust all the other users. It should never be done without understanding the risks it involves. But once those risks are understood, there are times that risk is acceptable.
Dec
18
comment How useful is mounting /tmp noexec?
Installing nVidia CUDA 5.0 on Ubuntu 12.04 failed when /tmp was mounted with noexec.
Jun
9
comment How to prevent GNU screen from expanding tabs into spaces?
I also get the same behavior in tmux. I wonder if this is a difficult problem to solve.
Jun
9
comment How to prevent GNU screen from expanding tabs into spaces?
It could be something to do with both gnome-terminal (I tried versions 2.30.2 and 3.0.1) and screen together, it can't be just gnome-terminal because it "works" when I don't use screen. Also when I use screen's copy mode (CRTL+A ESC), highlight the output (arrow keys, then SPACE, then arrow keys), and write out the output to the screen's temp file buffer, it sees it as spaces.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This seems like a very related question: serverfault.com/questions/190570/haproxy-ssl-farm-options
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
The X-Forwarded-For header is very useful. But this doesn't get at the root of the problem. Both the BigIP and TrafficServer have SSL termination at the load balancer level. Based on my current benchmarks, SSL termination is my bottleneck. If I can get an F5 BigIP (and I might be able to), then it may be fast enough. However, that doesn't answer the theoretical problem (which I still think is interesting). My goal is to allow an SSL farm and still have the original client IP passed along to the app servers. This guarantees (theoretically) that SSL will never be the bottleneck.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This is looking like the best option. Unfortunately (for me) the more I read about LVS the less it seems I know about networking!
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
I am wondering if HAProxy's "usesrc clientip" option might be the best solution. However, it looks like that depends on TPROXY. I'm running RHEL 5.5, which has kernel 2.6.18. TPROXY isn't included until 2.6.28. I'd rather not have to recompile the kernel, but I guess we'll see.
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
Yes. As I mentioned in the original post, this is exactly how I have STunnel setup. The problem with this approach is that request is being decrypted on the load balancer. That creates a bottleneck because you can't just add more load balancers (while maintaining HA) like you can add more app servers. That is the reason for a load balancer before decrypting SSL.