Posts on Artem Sidorenko

Full encrypted Proxmox installation

Sat, 21 Sep 2019 21:56:04 +0200

Proxmox is a hypervisor software running on Debian Linux.

This post describes the full encrypted installtion of proxmox hypervisor with unlocking of encryption via ssh.

Fan in and progress counters pattern

Thu, 31 Jan 2019 22:30:33 +0100

The pipeline blogpost of Sameer Ajmani gives a good overview over the design pattern “fan-in” in Go. Sometimes, you might have a slightly different situation within fan-in code, where you need a different approach.

Example: you might need some progress counters, which get incremented during the fan-in operation, e.g. to display the processing progress of some operation to the user.

Let’s have a look how this can be done.

Testing of functions with channels in Go

Thu, 24 Jan 2019 19:25:04 +0100

Go or Golang has a very nice mechanisms for dealing with concurrency: channels and goroutines. This post describes my approach about testing of functions, which are used within goroutines and consume input or provide output via channels. There is no rocket science at all, just the typical channel handling in the tests.

Hugo on GitHub Pages with Travis CI

Tue, 11 Dec 2018 15:00:40 +0100

I already wrote about deploying Hugo websites to the shared hosting by using Travis CI. GitHub Pages support HTTPS for custom domains from May 2018, so now it’s worth to have a look at this topic again.

This blogpost describes the setup of deploying Hugo with Travis CI to the GitHub Pages.

OpenStack Networking: Open vSwitch and VXLAN introduction

Thu, 08 Nov 2018 12:30:00 +0100

In my new job I had to deploy a new OpenStack environment. It was about 5 years ago when I did last time anything related to the OpenStack infrastructure deployment. Unused knowledge vanishes pretty fast, besides that OpenStack is developing. So I had to refresh a lot of things and even to build knowledge from scratch in some areas.

From my point of view OpenStack networking is one of the most complicated parts if you want to do it right. This series of posts aims to give a brief introduction to this topic. It will cover following setup:

usage of common IP network as a transport network for overlay networks (virtualised networks of VMs)
usage of Open vSwitch as technology for overlay networks and connectivity of VMs cross over different hypervisors
usage of VXLAN for tunnelling of overlay network communication between different nodes
dedicated control node, where all OpenStack API services are running
dedicated network node, where L3 agent, metadata agent and dhcp agents are running
examples are done on the RHEL/CentOS 7 Linux distribution

OpenStack uses Open vSwitch and VXLAN heavily in this setup, so I start first with introduction to Open vSwitch and VXLAN in this post. OpenStack networking architecture and implementation will be covered in the further posts.

CentOS VM image for Synology

Sun, 28 Jan 2018 21:38:00 +0100

Synology released a stable version of Virtual Machine Manager extension for DSM OS, which runs on the Synology NAS boxes. This extension uses KVM/QEMU and allows execution of VMs on the Synology boxes.

Obviously you can install VMs each time using an iso image and installer. However, if you would like to use this feature for some Linux playgrounds (or maybe you want to deploy many VMs?) you would probably like to create a prepared VM template and create new VMs using this template. This blog post covers exactly this case: creation of CentOS template, which can be used for fast and easy deployment of further VMs on the Synology. Image templates with Ubuntu or other Linux distributions can be prepared on the similar way.

Nice tagcloud with Hugo

Fri, 21 Jul 2017 15:42:16 +0200

In my old blog with octopress I used the tag cloud plugin with logarithmic distribution for calculation of tag sizes. The rendered tag cloud was pretty nice from the optic side. All existing approaches I saw for hugo(1, 2) were not so nice, the main reason is the usage of logarithmic distribution in the calculation of tag size.

Using travis to deploy hugo site to a shared hosting

Sat, 27 May 2017 18:00:00 +0200

GitHub Pages are quite popular for hosting static sites built by site generators. However, GitHub Pages have some limitations:

no SSL/TLS for custom domains
proper support of Jekyll sites only

One possible alternative is to use GitLab Pages, which does not have this limitations. Another possible alternative is to use Travis CI and deploy the site to some shared www hosting. Hetzner offers some good plans, they also include a free-of-charge SSL certificate.

This blogpost describes how to deploy a static site hosted on GitHub, built with Hugo and Travis CI and deployed via FTPS to Hetzner www space.

Testing chef cookbooks with GitLab CI

Sat, 11 Feb 2017 22:06:03 +0100

Test Kitchen is a common tool for integration testing of Chef cookbooks. Usually a combination of Vagrant&VirtualBox is used to bring up the VMs. This works well for local development setups, but what about Continuous Integration environments? You can find several approaches how cookbooks can be tested in the CI:

if your CI runs on non-persistent VMs (like Travis CI) you might use kitchen-dokken like chef-ssh-hardening does
you can use kitchen providers like kitchen-digitalocean or kitchen-ec2

Well, but what about the case you want to use Vagrant&VirtualBox in the CI too? There are some reasons for this approach:

Maybe you can not use public cloud providers for some reasons and do not have your own on-premise cloud like OpenStack
Maybe you want to use the same setup/technologies in the CI and locally as you want be able to easy reproduce errors and problems

GitLab is quite often used in the enterprise environments, where restrictions on the public cloud usage may apply. GitLab has its own GitLab CI, which can be easily used for cookbook testing.

This post covers a basic GitLab CI setup with Test Kitchen and Vagrant&VirtualBox as backend.

Setting up NAT64 with tayga on Centos

Wed, 04 Jan 2017 21:33:46 +0100

Maybe you are also playing aroung with IPv6 and want to setup IPv6 only network and asking yourself how to reach the IPv4 Internet? Right, with DNS64 and NAT64. This blog post gives an overview about a such setup on CentOS/RHEL 7 with bind and tayga.

IPv6 with prefix delegation, RouterOS and FritzBox

Sat, 10 Dec 2016 23:16:28 +0100

I have a non-flat network with subnetworks at home and I wanted to enable IPv6 in dual stack mode for the desktop systems. This blog post describes this setup and configuration for:

MikroTik CRS125-24G-1S-IN layer 3 switch as switch/router for internal networks (RouterOS 6.36.4)
AVM FritzBox 7390 as internet router (FRITZ!OS 06.51)
DT as ISP with native IPv6 in dual stack mode and dynamic IPv6 prefixes

Using dynamic resources in Chef

Sat, 03 Dec 2016 01:14:44 +0200

Chef has different execution phases. Especially the compile and converge phase are important when writing cookbooks: the resources are collected in the compile phase and are executed in the converge phase.

In some special cases you might want to have dynamic resources, which are created and executed in the converge phase. The main background is that you want to react on something you known in the execution phase only.

Given a situation where you want to cleanup configuration files, which get installed by some package during a chef run (real examples might be apache on debian or freeradius on RHEL). You can try to solve this situation like this:

package 'freeradius'

# Our module configuration
template '/etc/raddb/mods-available/eap-tls' do
...
end

Dir.glob('/etc/raddb/mods-available/*').each do |mod_path|
  file_name = File.basename(mod_path)
  next if file_name == 'eap-tls'

  file mod_path do
    action :delete
  end
end

However this will not work: you try to glob over /etc/raddb/mods-available in the compile phase, but this path doesn’t exist as freeradius gets installed in the converge phase.

Writing inspec tests in the rspec style

Sat, 26 Nov 2016 19:28:58 +0100

Inspec is a modern framework for infrastructure testing. It can be used as replacement for Serverspec.

Usually the inspec tests are describing a particial resource:

describe file('/etc/passwd') do
  its('mode') { should cmp '0644' }
end

However in some case it might be useful to use the common RSpec style with nested describe-context-it statements.

Writing helper cookbooks with shared functions

Wed, 26 Oct 2016 14:50:06 +0200

Sometimes you might need some generic functions, which are used in several cookbooks in your environment. In this case it makes sense to create a cookbook, which contains this functions.

Configuring chefdk

Sun, 09 Oct 2016 10:10:21 +0200

Chef Development Kit contains a chef-dk gem with chef executable. chef generate is a pretty usefull command for generation of skelettons. Per default the information like author, license or email looks like this:

$ cat testcookbook/metadata.rb
name 'testcookbook'
maintainer 'The Authors'
maintainer_email 'you@example.com'
license 'all_rights'
...

How to get your own data instead of this defaults?

Hybrid suspend with systemd

Thu, 29 Sep 2016 11:37:34 +0100

Hybrid suspend is a suspend mode, where suspend-to-disk and suspend-to-ram are executed together in the same time. Its a quite usefull mode for notebooks:

fast wake up because of suspend-to-ram
no data loss in case of empty battery during the suspend

Creating container base image of CentOS

Fri, 01 Jul 2016 06:30:00 +0200

Docker docs and ACI docs decsribe the steps how to create base images from existing tarballs/folders with root file systems of distribution. If you make a deeper look, you will probably find the CentOS tarballs which are used by docker for creation of centos base images.

But how to get this root file system tree? This blogpost covers the creation of this root file system tree for CentOS and the creation of base images for Docker and Rkt.

Installing chef on raspberry pi with centos

Thu, 30 Jun 2016 17:40:38 +0200

Chef is building omnibus packages only for x86. But probably you want to run chef on raspberry pi 3 with ARM. There is a blogpost, which describes the chef installation on Raspbian. This blogpost covers the steps for chef installation on raspberry pi with centos.

Build packages with OpenBuild service

Thu, 26 May 2016 11:40:11 +0200

As I already mentioned in the previous blog post, initially I wanted to use OpenBuild Service from openSUSE (OBS) to build packages of CoreOS rkt. OBS allows you to build packages for different platforms, e.g. RPMs for CentOS, RH, Fedora, OpenSUSE and in the same time DEBs for Ubuntu, Debian. Another positive thing: OpenBuild Service provides yum and apt repositories, which allow easy distribution and updates of packages.

CoreOS rkt provides the tgz archives with compiled software. The idea is to package this archives to RPMs/DEBs with help of OBS.

This blog post covers the required steps in order to achieve this goal with this simple use case. However you should keep in mind, the packaging instructions (e.g. spec or rules files) are representing a simple example only: they have low quiality claim compared to the distributions.

A short way to a deb package

Wed, 25 May 2016 19:15:29 +0200

I’m playing with coreos rkt, and I was missing rkt DEB packages for Ubuntu systems. CoreOS rkt provides the tgz archives with compiled software. My idea was just to package this archives to DEBs in order to get easy distribution or updates of rkt on my systems.

The easy way is to use fpm for this, but I wanted to use OpenBuild Service of OpenSuse in order to build RPMs and DEBs in the same time (this is covered in the next blogpost). This was the main reason to go more or less the Debian packaging way.

Debian packaging way is powerful, really. On the other hand, this power and the amount of possible solution ways are a bit confusing for beginners: actually you have to read the big amount of debian packaging resources in order to get a picture about all existing use cases, different tools and sometimes different information sources you need.

My situation was quite similar: I was missing a guide or some tutorial for my simple use case and I didn’t want to invest so much time for a simple “repackaging” from tgz to deb, but I had to. This blog post provides a such tutorial, based on my simple use case. But keep in mind, this short post doesn’t replace the debian packaging resources like Debian New Maintainers Guide or Debian Policy Manual and has low quality claim then usual packages provided by distributions.

Flashing BQ Aquaris X5

Tue, 12 Apr 2016 15:20:52 +0100

Since couple of months the Aquaris X5 from BQ is available in Germany. Its a pretty cool device, besides the fair price it has Dual-SIM and MicroSD support and a battery run-time up to several days. Another interesting thing is this smartphone is offered in two editions: with Android or with CyanogenOS software flashed. CyanogenOS is the commercial version of CynanogenMod and its quite promising especially from the view on software updates and security patches with a stock software.

This post will describe the (re-)flash procedure of Aquaris X5 with stock Android, CyanogenOS or CyanogenMod. So still if you want to stay on the stock software, but want to switch from Android to CyanogenOS or back, this post might be useful for you.

This guide covers the steps required on Linux, but it should work on the similar way on Windows. Hoewever I can’t verify it as I do not have any Windows system.

FrOSCon 2015 impressions

Mon, 24 Aug 2015 07:56:54 +0200

FrOSCon is a conference about Free Software and Open Source in Sankt-Augustin near Bonn, Germany. Here I want to give my impressions from the visit this year. (btw, it was the 10th FrOSCon this year)

Easy creation of a simple apt repo

Tue, 19 May 2015 16:12:51 +0200

If wanted to setup a very simple apt repository on RHEL system to server a small environment with Debian/Mint systems. So the goal is just to place some already built deb packages to some apt repository. Unfortunally it turned to be not a straight forward task like with yum repos. All common ways are based on the Debian/Ubuntu scripts, which are not available on the RHEL platform via packages.

This post covers following:

Creation of APT repository on very simple way without involvment of usual tools like apt-ftparchive or reporepo
APT repository will be GPG signed, to allow verification of integrity
APT repository will be build on the CentOS/RHEL platform and serve Ubuntu/Debian clients

Move existing centos installation to encrypted raid and lvm

Sun, 08 Feb 2015 14:43:14 +0100

If you have already some CentOS/RHEL installation and you want to move it to a RAID/LVM with full disk encryption, then this post is for you. We will move a minimal simple CentOS 7 installation on a single disk with LVM to the full encrypted RAID1&LVM setup.

Yubikey or OpenPGP smartcards for newbies

Tue, 04 Nov 2014 20:19:17 +0100

I got a brand new yubikey neo and wanted to get it running on my Mint 17 MATE(based on Ubuntu 14.04 Trusty Tahr) installation for GPG encryption and SSH authentification. It turned out to be not an well-transparent and easy task. So this post gives my expirience on this topic, but isn’t limited to Yubikey only and should apply to other OpenPGP cards as well.

GitLab on Centos or RHEL 6

Wed, 29 Oct 2014 08:40:22 +0100

Gitlab provides manual installation instructions for Ubuntu only, this post covers the procedure how to install it on CentOS/RHEL/RedHat 6.X.

WebEx on Ubuntu or Mint 64bit

Tue, 28 Oct 2014 17:20:22 +0100

If you want to use WebEx on Ubuntu/Mint 64 bit, you will see: it works. But you won’t be able to do screen sharing or probably even to see webcam video streams.

The only one solution is to use 32bit oracle java incl. browser plugin, so browser has to be 32bit as well. If you want to keep 64bit browser on the system and to use 32bit setup only for WebEx, then this howto is for you:)

Telekom Hotspot autologin with NetworkManager

Wed, 15 Oct 2014 13:36:39 +0100

It was always annoying for me to type in the login credentials on the Hotspots of Deutsche Telekom. As I’m lazy, here is a script which can be integrated with networkmanager via dispatcher.d interface, which checks for the right interface and right SSID, then calls the login page with according credentials.

Puppet structure

Mon, 13 Oct 2014 18:42:48 +0100

It not always easy to find a good folder hierarchy and structure for puppetmaster, as you have to find a way to combine it with different tools and workflows like git, librarian or r10k.

As I still miss some kind of best practice whitepaper from puppetlabs, I want to cover here my view on this:

with using hiera
with or without using full autodeployment like r10k
without any git submodules

Virtualbox on hardened gentoo

Wed, 27 Aug 2014 18:11:38 +0100

I wanted to setup phpVirtualBox on my new Intel NUC, which is running gentoo-hardened. Unfortunately VirtualBox can’t run with couple of grsecurity/pax flags enabled in kernel. To get VirtualBox running you have to disable following kernel config flags: CONFIG_PAX_KERNEXEC CONFIG_PAX_RANDKSTACK CONFIG_PAX_MEMORY_UDEREF CONFIG_GRKERNSEC_HIDESYM and to enable: CONFIG_PAX_ELFRELOCS (if you have CONFIG_PAX_MPROTECT)

Easy SSH key management with puppet

Sun, 06 Jul 2014 20:45:13 +0100

SSH key management is required in each environment.

In this post I want explain how to do it with puppet on the simple way.

I’ve created a module, which is a wrapper around core puppet types User and Ssh_authorized_key. This wrapper enables an easy key management via integration with hiera on puppet. (and it was a good exercise in rspec-puppet:) )

Puppet hiera hash merge and automatic parameter lookup

Sat, 05 Jul 2014 19:29:27 +0200

Hiera within Puppet is a great thing, especially starting with puppet 3.

But there are still some limitations, like priority lookup only with automatic parameter lookup.

Default iptables rules

Thu, 20 Mar 2014 12:27:37 +0100

I use following iptables and ip6tables rules as a default. This rules provide basic security level:

statefull inspection
port knocking for management services like ssh
port scan protection

Secure SSL configuration for apache, postfix, dovecot

Thu, 13 Feb 2014 13:50:13 +0100

There are already several articles about perfect forward secrecy and safe ssl configuration with according recommendations on the net, like this

But I missed somehow a short overview for me with verification instructions and all information links in one place. So this article is going to cover Perfect Forward Secrecy(PFS) for the software: apache, postfix, dovecot and represents somehow a summary over different information.

How to install Linux Mint on encrypted raid 1 with LVM

Tue, 31 Dec 2013 18:00:48 +0100

The installer of Linux Mint doesn’t support the installation on encrypted raid 1 with LVM out of the box.

Following steps are required to do this with Linux Mint 16 (without GPT&UEFI)

Flashing Android 4 on Samsung Galaxy S II with heimdall

Sun, 30 Dec 2012 18:02:04 +0100

We are using only Linux and no Odin and VirtualBox to update Galaxy S II to Android 4 alias Ice Cream Sandwich.

How to root Galaxy Tab 2 10.1 with heimdall

Wed, 11 Jul 2012 21:19:05 +0100

We are going to install ClockworkMod Recovery on the Galaxy Tab 2 10.1 (GT-P5100) with heimdall. After that you can root your stock image or install CyanogenMod on your tab. If you have another version of Galaxy Tab 2 you will need other images for it, for links take a look at the links at the bottom.

How to backup mysql

Wed, 16 May 2012 17:10:00 +0100

We are going to create a simple cron job to dump the DBs, so you can save this dumps on the regular way with your backup software.

How to build APC or eAccelerator for PHP on windows

Fri, 20 Apr 2012 21:49:47 +0100

If you running some php web applications with heavy load you should use some accelerators like APC or eAccelerator for PHP. I noticed that official build instructions in readme’s and official homepages are not completely usable to get it working.

Flashing clockmod recovery on Samsung Galaxy S II i9100

Mon, 16 Apr 2012 17:15:00 +0100

You may need custom recovery if you want to do nandroid backups of flash some zip files. I will use Linux to flash it.

How to create VMFS partition on the local disk without label

Thu, 05 Apr 2012 11:50:00 +0100

If you are going to create the VMFS partition on the some mew local hdd or hardware raid volume, you can get in trouble with a message “Failed to update the disk partition information”. The reason for it is a broken/missing dos label on the device.

DRBD recovery from split brain

Wed, 07 Mar 2012 12:50:00 +0100

If you get degraded DRBD with log messages like “Split-Brain detected but unresolved, dropping connection!”, you have to manually resolve split brain situation.

How to access MSSql from PHP via ODBC

Fri, 02 Mar 2012 12:40:00 +0100

Install everything

Install freetds for your distribution, you can find RH packages at atrpms.net.
Depending on your distribution you will need to install libtdsodbc
Install php odbc extension

Using One-Time-Password with Apache

Sun, 29 Jan 2012 13:35:42 +0100

We are going to implement authentication with One-Time-Passwords generated via the HOTP/OATP algoritm(see RFC) with Apache. We will use mod_authn_otp for it.

This example is for Gentoo.

Authentication with One-Time-Passwords

Sun, 29 Jan 2012 13:19:04 +0100

This article is about implementing One-Time-Password authentication with PAM, so you can use it with ssh and other pam enabled services.

We will use oath-toolkit for it. So install it, gentoo ebuild for it is provided in my overlay.

Problems with P4 Clockmod and CPU frequency scaling

Sun, 29 Jan 2012 12:00:00 +0100

If you are going to use CPU frequency scaling on P4 you will probably use p4-clockmod and get in trouble with ondemand governor like me. If you try to switch to the ondemand governor you can see following message in dmesg:

ondemand governor failed, too long transition latency of HW, fallback to performance governor

How to root HTC Desire S

Thu, 14 Jul 2011 20:31:10 +0100

Why root? I want to use some advanced features like DroidWall(frontend for iptables), Titanium Backup, OpenVPN, so I need root. With root you can also remove some annoying apps installed by vendor.

I was using Linux for it, but it should work at the same way with Windows.

How to get root on Samsung Galaxy S II I9100

Tue, 28 Jun 2011 20:48:09 +0100

Why root? I want to use some advanced features like DroidWall(frontend for iptables), Titanium Backup, OpenVPN, so I need root.

How to root HTC Desire

Wed, 27 Apr 2011 21:02:33 +0100

Why root? I want to use some advanced features like DroidWall(frontend for iptables), Titanium Backup, OpenVPN, so I need root.

How to activate privacy extensions with IPv6

Wed, 27 Apr 2011 20:10:00 +0100

If you are using auto-configuration with IPv6, the last part of your IPv6 address will be usually your MAC address. So its possible to create mobility profiles on the simple way. To prevent this you can activate privacy extensions, documented in RFC3041. After you’ve done it, the last part of your IPv6 address will be random generated

How to batch delete old files after installworld

Mon, 25 Apr 2011 22:01:00 +0100

After you have build and installed the world, you want probably to clean up your system. If you do it on the way described in the Makefile, and start make delete-old you will be prompted for configuration for each file have to be deleted.

Using bind from ports

Mon, 25 Apr 2011 21:15:00 +0100

There are some reasons to use bind from ports and not from world. One reason could be if you want to use DLZ.

How to wireshark with user rights

Tue, 04 Jan 2011 20:46:00 +0100

It’s often nessesary to run wireshark with user rights.

Workaround for Anaconda network timeouts and spanning tree with Kickstart installations

Mon, 08 Nov 2010 20:01:00 +0100

If you are running spanning tree you may get in trouble with anaconda network initialization. Spanning tree needs about a 30 seconds to bring the switch port up, so you may run in dhcp timeout.

vSphere Client CLI options

Thu, 04 Nov 2010 19:03:00 +0100

There are several command line options you can use with vSphere client.

How to use the correct interface for kickstart installations

Fri, 22 Oct 2010 18:25:00 +0100

When your system has more than one network interface anaconda asks you which one you’d like to use for the kickstart process. This decision can be made at boot time by adding the ksdevice paramter and setting it accordingly. To run kickstart via eth0 simply add ksdevice=eth0 to the kernel command line.

Using native SATA on systems with IDE emulation

Thu, 21 Oct 2010 22:21:21 +0100

Some systems have this IDE emulation enabled for compatibility purposes. IDE module and devices are normally initiated by linux kernel before SATA modules and devices. So, our SATA device is blocked by IDE kernel module and can’t be used as native SATA device. Is also not possible to use this emulated IDE device with DMA, so we have a real performance problem with hard disk I/O on this system.

How to edit initrd image

Thu, 21 Oct 2010 22:13:24 +0100

It usefull sometimes to edit the initrd/initramfs image of the system. This howto describes the simple and usual way to do it.

How to determine the switch port with tcpdump

Thu, 21 Oct 2010 22:09:09 +0100

We are going to use the Cisco Discovery Protocol, CDP

How to setup the link timeout on the HBAs on the ESX

Thu, 21 Oct 2010 16:32:00 +0100

You may need it for example for an firmware upgrade of the disks on the storage system. Please ensure that you don’t have huge IO in the time frame and you applications will not timeout because of missing disk and will retry disk IO operations.