xen sucks

February 12, 2007 | etbe

According to Debian bug #399113 and linked discussion it is impossible to run a stable system on Xen without enabling PAE. It seems that no-one is considering the fact that a hypervisor that runs on both 32bit and 64bit architectures should be able to support 32bit systems with <4G of RAM (IE not using the PAE feature).

But instead to work around this bug the Debian developers have decided to just enable PAE. This is annoying for me as I have to either buy a new laptop or reduce my use of Xen.

I wonder what will happen if a Xen bug is discovered that only happens on PAE systems? Would that make Xen only an AMD64 thing?

John Howard is bizarre

February 12, 2007 | etbe

Our despicable prime minister said “I think that would just encourage those who wanted completely to destabilise and destroy Iraq, and create chaos and victory for the terrorists to hang on and hope for (an) Obama victory“.

That statement is wrong in many ways, firstly the US (with Australian help) has destabilised and destroyed Iraq already. Claiming that removing US troops at this stage will do any further harm is unproven (and except for the Kurdish area extremely unlikely). Trying to link a presidential candidate with a terrorist organisation is the worst type of dirty politics.

Texas Republican senator John Cornyn requested that the Australian government stay out of US politics. It sounds like a reasonable request. But I wonder whether John Cornyn got involved when the US ambassador spoke out against the leader of the Labor party at the last Australian Federal election…

Senator Obama suggested that if John Howard wants to criticise his policies in Iraq then he should first send another 20,000 Australian troops (there are currently 140,000 US troops compared to 1,400 Australians). According to the CIA World Fact Book Australia has a population of 20.3M while the US has a population of 298.4M. If the ratio of serving soldiers was to match the populations then Australia would have 9,500 troops in Iraq. If Australia was to be a full military partner of the US (but scaled down due to the smaller population) and therefore had troops in South Korea, Japan, and Germany then the number of Australian troops committed might be closer to the 20,000 number cited.

But this is no criticism of Senator Obama. For a number that was made up to demonstrate his point that Australia is not pulling it’s weight in Iraq it’s a quite reasonable estimate.

The US Democrat Senator Ron Wyden correctly described Howard’s comment as “bizarre“. This may become a catch-phrase for the Howard regime (as the Bush regime is described as a “miserable failure“).

Johnny seems to think that it’s in his best interests to send Australians to fight a war that has no benefit for Australia (or the US for that matter), but he doesn’t have the guts to do it properly. Fortunately for him the Bush regime understands his position and allows him to send a token force to demonstrate support without the risk of any significant number of casualties or having to conscript soldiers.

This mutual meddling in elections is a demonstration of the way Bush and Howard conspire against the interests of the Australian and US citizens. Both countries need governments that look after the interests of their citizens at home and let the UN take a larger role in world issues.

names

February 11, 2007 | etbe

Wouter wrote an interesting post about names. I wonder how many people know me as Russell SELinux…

execmod

February 10, 2007 | etbe

Ulrich Drepper has written a good web page about text relocation which is most often noticed as execmod failures reported when running SE Linux. When an AVC message reports a failure of execmod against a shared object it means that the object has text relocations (the shared object code writes to code that it executes to fix up addresses). This is due to being compiled without -fPIC or -fpic.

The command eu-findtextrel (from the elfutils package) when run with a parameter of the shared object in question will tell you which functions were compiled without -fpic or -fPIC.

The module in question must be recompiled with -fpic or -fPIC to generate the correct code.

Without SE Linux it’s still a bug to compile a shared object without position independent code, so any shared object which can’t run under SE Linux because of execmod will probably have problems in other situations anyway (maybe only on certain architectures).

xen and yoyo

February 9, 2007 | etbe

One of the benefits of Xen is that it allows a machine to be easily rebooted. Remote console and remote power management technologies are either expensive or implemented on the motherboards of expensive machines. With Xen the virtual machines can be managed without such expense and also with less effort.

This raises immediate possibilities for training sys-admins. One problem with training system administrators is that they need to have servers to administer and the mentor needs to be able to easily access them and fix them when they become unbootable. Xen makes these problems easy to solve on cheap hardware.

Monash University has for many years had a machine named Yoyo which is used for training sys-admins. It’s not expected to be up as much as machines that are run by experienced sys-admins (hence the name) but I expect it would still have better uptime than a lot of corporate servers.

Unfortunately until recently there were no options available to people who weren’t Monash students for learning about system administration. To solve this I want to run some sys-admin training with a server.

My plan is to set up a machine running Xen at a server room and provide a basic Debian install in a domU. I will then give the root password to a small group of trustworthy people (who I have known for some time or who are local and can be verified) and start the training. My plan is to set up a mailing list for emergency communication on one of my servers and have the trainees set one up for regular use on the domU. I will provide DNS secondary service and have an NS record for yoyo.coker.com.au point at the machine in question so the first task for them would be to run a DNS server.

I won’t have unlimited bandwidth so I will track the bandwidth use from the dom0, and I will use the dom0 to make backups of the system via LVM snapshots.

The terms of service etc will be mostly copied from the Monash machine.

Please let me know if you have any suggestions for how to run this.

Hopefully this will work out and other people will want to do the same. If you run such a machine then please add a comment to this post with the URL for information on it.

phone spam

February 4, 2007 | etbe

Recently I had someone call my mobile phone asking whether I wanted to change phone providers. I asked them if they could hold the line – then I put my phone down and went back to work.

It took over eight minutes before they hung up on me.

Next time someone phone-spams you try to beat that record, please post a comment on this blog entry if you can beat eight minutes and twenty seconds of dead-air.

The call might have lasted longer if I had periodically picked up the phone and said “I’m almost ready“. It’s something I may test in the future.

classic security mistake

February 2, 2007 | etbe

One of the most obvious (and yet most common) computer security mistakes is to take input from an untrusted (and potentially hostile) source. A classic example of this is in Windows Vista where audio output from the system speakers can be taken as input to the speech recognition system. According to the BBC article an MS representative said “it would be unlikely the user would not be in the room to hear the file with malicious instructions being played“.

It seems that according to MS it’s OK for your computer security to be breached, just as long as you are around to witness it!

ssh tunneling of email

January 28, 2007 | etbe

On a Debian mailing list someone claimed that it was inconvenient to use ssh tunneling for sending and receiving email due to the issue of broken connections.

On my source-dump blog I have posted an entry with xinetd configuration for doing this in a reliable manner.

how to run dynamic ssh tunnels

January 28, 2007 | etbe

service smtps
{
       disable         = no
       socket_type     = stream
       wait            = no
       user            = USER
       server          = /usr/bin/ssh
       server_args     = USER@HOST -C /home/USER/bin/localsmtp
       bind            = 127.0.0.1
}

service pop2
{
       disable         = no
       socket_type     = stream
       wait            = no
       user            = USER
       server          = /usr/bin/ssh
       server_args     = USER@HOST -C /home/USER/bin/localpop
       bind            = 127.0.0.1
}

I have the above in my xinetd configuration to automatically generate ssh tunnels. I configure my MUA to talk to localhost on the pop2 port for POP connections to my real POP server and I configure Postfix (my local MTA) to relay all mail through localhost on the smtps port with the directive “relayhost = 127.0.0.1:465“.

The localpop script contains the command “nc 127.0.0.1 110” and the localsmtp script contains the command “nc 127.0.0.1 25“. I use the localpop and localsmtp scripts so that if I change anything on the server end then I can easily adjust the scripts without reconfiguring the workstations that relay their mail.

The same configuration can be used whenever you have shell access via ssh to a machine that runs a MTA. It’s not difficult and the ssh connections are terminated whenever the MUA or the MTA that initiated them times out and closes it’s connection. This means that there is no need to have cron jobs monitoring the ssh tunnels or anything else that is difficult.

presentation laptops

January 25, 2007 | etbe

I suggested in a previous blog entry that conferences should provide computers that speakers can use for their presentations. The reason for this is that getting one computer working with the beamer in each room is an easy task, while getting the laptop of every speaker to work is much more difficult.

It seems that my idea has been rejected by almost everyone who read it, so I’ll document some tips for getting a laptop working.

 SZ:    Pixels          Physical       Refresh
*0   1400 x 1050   ( 474mm x 356mm )  *50
4    640 x 480    ( 474mm x 356mm )   50
5    800 x 600    ( 474mm x 356mm )   50
6   1024 x 768    ( 474mm x 356mm )   50
8   1280 x 960    ( 474mm x 356mm )   50
9   1280 x 1024   ( 474mm x 356mm )   50

Firstly there is the command xrandr which can be used to change the resolution without logging out. Above are the most useful lines produced by running xrandr with no options on my Thinkpad T41p. The left column is the index to the list of resolutions. For example I run xrandr -s 9 to use mode 1280×1024 and xrandr -s 0 to use mode 1400×1050. This takes much less time than editing an X config file!

The next thing to note is that my Thinkpad has a refresh rate of 50Hz, apparently most beamers expect at least 60Hz, this explains why I have had ongoing problems in getting my Thinkpad to correctly work for presentations for the entire time that I have owned it. If you own such a Thinkpad then I recommend that you just bring another laptop to do your presentation on the assumption that the display possibly won’t work and probably won’t work properly! I had developed this habit anyway after repeated problems in getting my Thinkpad working (occurring on a number of occasions in several countries). It’s good to now know the reason for this (thanks Keith).

When setting the resolution there are often tweaks that can be used. For example in my talk for the Debian Miniconf of LCA 2007 I used mode 800×600 (I think – Keith set it up and I didn’t look closely after verifying that things basically worked). Even though the beamer didn’t have good support for a low refresh rate it worked when the resolution was low enough. Fortunately the xrandr program allows changing resolution fast enough that all 13 resolutions could be attempted in about a minute.

The support for better display detection and configuration is steadily improving. Hopefully this year the problems will be solved (which means that for the Debian and RHEL releases in 2008 the problem will be solved).

A possible work-around is to use Xephyr (the replacement for Xnest). In a previous blog entry I described how to get Xephyr going for use by Xen images. It seems to be a common symptom of display synchronization problems that the edges of the screen will be clipped. The most common work-around for this is to not use the full-screen mode of OpenOffice – which means that instead of having a small amount of text clipped there is a large amount of OpenOffice menus etc on the screen. As Xephyr accepts any resolution it should not be difficult to arrange for it to use 98% of the screen space and then run the presentation full-screen in the Xephyr window. This will be particularly useful for programs such as MagicPoint (my favorite presentation program) which don’t support a windowed mode of operation.

If you have any other suggestions on how to solve or work around display problems with laptops then please leave comments.

etbe – Russell Coker

Linux, politics, and other interesting things