Hmmm, this is the second time in 1 year that I had a corrupt filesystem on my raid partition. I saw no other option than mke2fs -j /dev/md7.

My first problem with XFS started on my fileserver, which only had 256 MB of memory. Turns out XFS was OOM-ing inside the kernel, this in turned messed up the filesystem. xfs_repair was also running out of memory. When I finally got enough virtual memory in this box xfs_repair was kind enough to segfault. Ok, shit happens, mkfs.xfs and try again.

The GNOME decadence thread got me thinking. What does GNOME give me? (I consider myself a hardcore UNIX user). Well… it gives a nice interface with a nice terminal implementation (gnome-terminal). Further more with the recent Ubuntu 8.04, it also provides

• PulseAudio, never got that working btw, went back to ALSA.
• Tracker, what the hell was ever wrong with locate? Never got that working, and when I did, it was dog slow.
• I should be using evolution for emailing… no thanks! I’m a happy mutt user.
• There is no support for VI-key bindings in GTK… (which is not gnome’s fault, but irritating none the less)

So I purged GNOME from my system and started using Xmonad, a tiling window manager. I’m still using GTK applications, because most of them still rule. But I’m happy that I’m leaving this whole GNOME business behind.

I’m publishing this for my own future reference. A short usage guide on git for an ex-svn addict.

Note: this is an older article that I’ve revived. Also note: in todays email flood I don’t know if such a popup is something you want to use…

#intro I’ve used gnubiff, xbiff and God knows what to provide a simple notify when receiving mail. But I wanted more. I want to be able to tweak certain settings, without going in to the source code of the application. Also the way mail notifiers mess with your mailbox is not something I particularly like.

On Jun the 7th I gave a little presentation about DNSSEC at the NLLGG meeting. The presentation is in Dutch and the title is: “DNSSEC, wat is het? Komt het er ooit nog van?”

(DNSSEC, what is it? Does it ever happen?)

the pdf of the presentation

I’ve been using git for some time now, but as mentioned elsewhere the learning curse for this ‘stupid content tracker’ is quite steep.

Right now I finally seem be getting the hang of it and can use it in a svn like manner.

So we have:

• adding a file to a reposity: git add <file>
• committing it to the local branch: git commit -a -m"log"
• uploading it to the remote master: git push origin master

And the one that took about 2 months to find:

I had this small problem, how to you check if a directory is empty in the shell? Suppose I want to do

cmd po/*

this fails, if the po directory is empty, which in turn makes my compile barf, but that is another story. I needed something to would check the emptiness of the directory, and if it is not empty perform the command, otherwise it skip it.

The trick here is to remember that if a shell wildcard can not be expanded it will be left alone. So an unexpanded * will stay a *.

Hmmpf, those Ubuntu guys are good. If just finished a painless upgrade to the new Ubuntu: Hardy Heron.

Some subtile differences; better Gnome (new metacity with composer). And some other stuff that I’m discovering right now. :-)

The default VIM7 install is equipped with the English dictionary, but as I’m Dutch I wanted to use the Dutch spelling, unfortunately these spell files are not included in Ubuntu. The following article is a short howto on how to add this wonderful feature to your VIM.

Dutch spelling

Download your language from the debian experimental archive.

I needed Dutch so I downloaded:

/main/v/vim-spellfiles/vim-spellfiles-nl_20060604-1_all.deb

Install this with:

dpkg -i vim-spellfiles-nl_20060604-1_all.deb

This will put some files in /usr/share/vim/addons. By default VIM will not look in that directory. To fix this I’m creating some symlinks from my local .vim directory:

Vim tip 21 allows you to copy text between VIM session running in different terminals! No more using your mouse to copy, just yank in one terminal and paste in another!

Put this in your .vimrc:

set clipboard=unnamed
set go+=a

Usually people use SSH as a replacement for rsh, which is of course a good thing. SSH uses encryption to transport your password to the remote server for authentication.

But SSH can do more, you can use a public/private key pair and set it up in such a way (google around for howto’s), that SSH will only transport a public key over the Internet. This way no passwords are transported, so even if someone breaks the encryption, no harm is done. Well… at least your private key is still safe (for now).

Goal

The name of the game is getting a minimum maintenance RAID server up and running. The OS should be bootable from an USB stick and the RAID disks will be SATA disks.

Installation and setup

This section handles the initial installation and setup procedure. By keeping the OS small (and on USB) it will (hopefully) make backups and restores more easy,

USB stick First install Debian/Ubuntu on the USB stick. I created two partitions on the 512 MB sized stick: /boot and /.

I’ve been running a development release of metacity for some time know and I really like it. Especially with the new composer that you can enable.

I’ve made some screenshots of my setup:

drop shadows

Every menu and window has a drop shadow now, this shows the workspace switcher. Too bad this hasn’t got a fixup (yet?).

alt-tabbing The new alt-tab screen. This looks quite a bit like the one from Compiz, but its very nice to have this in metacity itself.

older article that I’ve revived.

Problem

The problem: you have a laptop and you’re not always connected to the Internet. Still you want to sent mail even when you’re offline. You cannot use just any mail server out there, ‘cause a lot of them don’t relay. So you must use your own mail server.

You'll need:

1. postfix, only used for queuing and forwarding the mail
2. openSSH, for setting up a tunnel

OpenSSH config You will need to create a ssh tunnel to your mail server. This is the command I use:

I’ve reworked my older DNS filesystem Perl script to make something nicer. It’s still not perfect, but works much better.

You can now cat files for instance. The filesizes are something that should also be fixed, if set them to 512 bytes.

From a DNS standpoint some other things can be improved. Right now everything is shown from a zone (everything that can be discovered that is), however this also includes glue…

Open recursors are a problem. They can be used by attackers to amplify a packet stream to a victim. As such you should only be running a recursor on your internal network and an authoritative server on your interfaces facing the big, bad Internet.

You can run BIND9 with a split view (also called ‘split brain’), or use my setup: a NSD serving the outside world, and using BIND9 as recursor for your internal network.

I like tweak my prompt and I use zsh, thus I have infinite possibilities :-)

I owe much the phil’s prompt which gave me a lot of ideas.

My prompt is ofcourse in full color, as I’m a fan of that too. (Old UNIX users may shrudder at this point…)

Right now I have a prompt that keeps out of my face, but when needed has some usefull extras; like showing background jobs and showing the exit code of the previous command if it wasn’t equal to zero.

Co-author of RFC 4641 a BCP (Best Current Practice) for DNSSEC operations. This was written together with Olaf Kolkman.

At the time I was employed at NLnet Labs

This RFC gives guidelines on how to setup secure zones in a world with DNSSEC. It also gives pointers for public and private key handling and deals with the key lengths and how to handle key rollovers.

Well, after having used the go’old mbox format, I have now changed my mail setup to maildir. What a difference. I think the load on my machine is actual less then before the transition.

I used google (mbox convert maildir) to convert my setup to maildir, this was all relatively easy. Both postfix and procmail were “fixed” this way.

After restarting I indeed saw mail being deliverd to my newly created Maildir directory in my homedir. But I couldn’t read it…

published in 2003

DNSSEC mini HOWTO

By Paul Wouters (paul@xtdnet.nl)

Introduction

This article is a translation of the article “Secure DNS, Het beveiligingen van DNS in de praktijk that appeared in C’T magazine on March 14 2003.

DNSSEC in the .nl zone

The Dutch NIC (SIDN [http://www.domain-registry.nl/]>), The European Regional Internet Registry (RIPE), and NLnetLabs have created the first toplevel secure DNS. The experiment is running its own set of nameservers to guarantee that the experiment will not interfere with the production nameservers. The project started in November of 2002 with the goal of gaining experience in running DNSSEC for a TLD Registry.

This is an older publication (from 2004).

This report gives an outline of the current status of SECREG, the Dutch experiment for introducing DNSSEC in NL.

It is written for SIDN (the people who take care of .nl) and it tries to explain what DNSSEC will mean for a registry.

Downloads are here:

• DNSSEC in NL Postscript
• DNSSEC in NL pdf

Ik beheer mijn eigen DNS en mijn eigen mail/web server op de computer die ik thuis heb staan; gewoon om te blijven leren hoe zulke zaken in elkaar steken. Ik zal hier vertellen hoe ik een site op heb gezet.

Tis wel ontzettend lang geleden sinds ik dit allemaal opgezet heb, dus ik hoop dat ik het nog juist vertel.

voorbereiding

Dit verhaal gaat er vanuit dat je een domein hebt geregistreerd en dat er een A (address) record met de naam ‘www’ bestaan. Dit address record heeft het IP adres van jouw host. Ik zal het hier over het domein miek.nl hebben. Ik ga verder niet in op de details die je moet regelen omdat voor elkaar te krijgen.

I’ve worked with cfengine in the past and really like it. It really cuts down on management for the systems that used it. For my home network I thought I try something else, that something turned out to be puppet.

I must say that I already like it more than cfengine as you can write much smaller manifests.

goals

I want to centralize the management of the files in /etc and I want to keep track of changes of the file. For the management I’m going with puppet and for the versioning I choose git.

more

Compare the following:

$ touch -- -x
$ less -- -x
<control-C>
$ more -- -x
more: unknown option "-x"
usage: more [-dflpcsu] [+linenum | +/pattern] name1 name2 ...

WTF? more doesn’t know what “–” means. Okay, time for a patch.

uniq

$ uniq --help
Usage: uniq [OPTION]... [INPUT [OUTPUT]]

Ah, so we support an INPUT file and an OUTPUT file…that’s not really unix like IMHO. And what you suppose does:

Installing Ubuntu (the modern way)

Right now I’m installing Ubuntu (gutsy) on some PC. The default install CD from ubuntu forces you to do this in X-window. And it all runs from a live-cd…. It’s slow and not usefull, and looking over my shoulder I see it has crashed in ‘Detecting Filesystems’…. Great.

I also hit an issue where the bottom of the installer program (ubuigity they call it) wasn’t completely visible on the screen, so I couldn’t click the forward buttons. I’m downloading the alternate install CD right now. That at least works quickly and ok.