Alex Scoble's IT Notes - An Information Technology Blog

Networking for OpenStack

When using Mirantis Fuel Web to build up an OpenStack cloud, it requires 6 separate networks to be created. Simplest way to do this is by using virtual networks (VLANs), however this presents a few challenges because of the complexities of configuring VLANs.

This post is specific to Cisco switches, but may be relevant for other networking equipment as well.

For test purposes, this was all done on one switch and each bare metal server had one interface cabled to the switch. In production environments, it is likely that, at a minimum, a completely separate storage network would also exist, but more complicated networking schemes are quite possible.

For each port on the switch that will be connected to one of the bare metal servers, the following needs to be done:

switchport mode trunk
switchport trunk allowed vlan 10,100-104
switchport trunk native vlan 10
spanning-tree portfast trunk
switchport nonegotiate

Trunking mode must be used because each interface needs to be able to handle all 6 of the virtual networks. In the normal access mode, an interface can only communicate over a single VLAN.

For each interface, it's a good practice to specify which vlans it is allowed to handle.

Trunk native tells the switch that untagged traffic goes over this vlan. VLAN tags are the mechanism that allows a network interface to communicate over multiple discrete subnets. So in this case, only traffic going over vlans 100 through 104 will be tagged.

Spanning-tree portfast trunk tells the switch that this port is a trunk connected to a server or PC and to bypass the usual network loop checks.

Switchport nonegotiate forces the switch to treat this interface as a trunk because the connected device does not understand the protocol the switch uses to negotiate trunking vs access modes.

In the switch config the VLANs also need to be activated using:

vlan10,100,101,102,103,104

For those who normally work with vlans in switchport access mode, the switch automatically does this, but apparently, when working with trunks, adding a vlan to a port does not automatically create and enable that vlan.

I am not a networking expert so some particulars here may have been missed, but I hope this is helpful.

Installing Zabbix agent on Debian

I could not find a tutorial that showed how to install the precompiled Zabbix 2.0 agents on a 64 bit Debian box, so I'm making one here.

The latest downloads for precompiled agents and source code for building servers is here. http://www.zabbix.com/download.php

On the Debian system that is getting the agent (remember this is for 64 bit version of Debian, go to the Zabbix download site for the link to the 32 bit agent if your system is 32 bit):

We need both the precompiled agent and the source files

You should be logged in to a root sudo or su session for the following

cd $HOME

wget http://www.zabbix.com/downloads/2.0.0/zabbix_agents_2.0.0.linux2_6_23.amd64.tar.gz

wget http://downloads.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/2.0.0/zabbix-2.0.0.tar.gz

mkdir zabbix

cd zabbix

tar -xzvf ../zabbix_agents_2.0.0.linux2_6_23.amd64.tar.gz

tar -xzvf $HOME/zabbix-2.0.0.tar.gz

cp $HOME/zabbix/bin/* /usr/bin

cp $HOME/zabbix/sbin/* /usr/sbin

groupadd zabbix

useradd -g zabbix zabbix

mkdir /var/log/zabbix-agent

chown zabbix:zabbix /var/log/zabbix-agent

nano /usr/local/etc/zabbix_agent.conf

Change "Server=127.0.0.1" option to the IP address of your Zabbix server, for example:

Server=192.168.1.10

Exit and save the file

nano /usr/local/etc/zabbix_agentd.conf

Change "LogFile=/tmp/zabbix_agentd.log" to:>/P>

LogFile=/var/log/zabbix_agentd.log

Change "Server=127.0.0.1" option to the IP address of your Zabbix server, for example:

Server=192.168.1.10

Change "ServerActive=127.0.0.1" option to the IP address of your Zabbix server, for example:

ServerActive=192.168.1.10

Rem out the "Hostname=Zabbix server" line:

#Hostname=Zabbix server

Exit and save the file

nano /etc/init.d/zabbix-agent

#! /bin/sh
  counter=0
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  
  start(){
  echo "-------------------------------------------------------------------"
  echo " LAUNCHING ZABBIX AGENT"
  
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent was previously running"
  echo " * Number of Zabbix agentd instances= $zabbix_counter"
  echo "-----------------------------------------------------------------"
  fi
  
  # Checking if the user is able to start the agent.... if the user is not able to, script performs su to
  # the user zabbix and starts the agent
  
  if [ $(whoami) != "zabbix" ];then
  sudo -u zabbix zabbix_agentd
  else
  # Script is acting as the zabbix user, so it can start the agent.
  zabbix_agentd
  fi
  sleep 10
  
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent succesfully started"
  echo " * Number of zabbix agentd instances= $zabbix_counter"
  echo "-------------------------------------------------------------------"
  else
  echo " * Zabbix agent couldn't be started, check Zabbix logs"
  echo "-------------------------------------------------------------------"
  fi
  
  }
  
  stop(){
  # Checking if the user is able to stop the agent.... if the user is not able to, script performs su to
  # the user zabbix and kills the agent. Also script tries to kill zabbix-agent processes 5 times using a counter, if at
  # the fith try the agent is still there, script outputs a message to the console.
  
  echo "-------------------------------------------------------------------"
  echo " STOPPING ZABBIX AGENT"
  
  if [ $zabbix_counter -eq 0 ]; then
  echo " * Zabbix agent was not running on this machine"
  echo "-------------------------------------------------------------------"
  fi
  
  while [ $zabbix_counter -gt 0 ] && [ $counter -lt 5 ] ; do
  
  let counter=counter+1
  
  echo " * Number of Attempts (Max 5)=$counter"
  echo " * Stopping zabbix.."
  echo " * Number of zabbix agentd instances= $zabbix_counter"
  
  if [ $(whoami) != "zabbix" ];then
  sudo -u zabbix killall zabbix_agentd > /dev/null &
  else
  killall zabbix_agentd > /dev/null &
  fi
  
  sleep 10
  # Script has a 10 second delay to avoid attempting to kill a process that is still shutting down. If the script
  # can't kill the processes, an error will appear.
  # After 10 seconds script checks again the number of zabbix_agentd processes running,
  # if it's 0, script will exit the loop and continue on
  
  zabbix_counter=$(ps -ef | grep zabbix_agentd | grep -v grep | wc -l)
  
  done
  
  if [ $zabbix_counter -gt 0 ]; then
  echo " * Zabbix agent couldn't be stopped, check Zabbix logs"
  echo "-------------------------------------------------------------------"
  fi
  
  if [ $zabbix_counter -eq 0 ]; then
  echo " * Zabbix agent successfully stopped"
  echo "-------------------------------------------------------------------"
  fi
  
  }
  
  restart(){
  stop
  # Gives system some time to stop processes before script restarts service
  sleep 10
  # Now script can start the agent again
  start
  }
  
  case "$1" in
  start)
  start
  ;;
  stop)
  stop
  ;;
  restart)
  restart
  ;;
  *)
  echo "Usage: zabbix {start|stop|restart}"
  exit 1
  esac
  
  exit 0

Exit and save the file

chmod 744 /etc/ini.d/zabbix-agent

ln -s /etc/init.d/zabbix-agent /sbin/zabbix-agent

update-rc.d zabbix-agent defaults

Go to your Zabbix server's web interface and add the new system to hosts as you normally would and configure accordingly and you are done.

References:

http://www.zabbix.com/forum/showthread.php?p=103244#post103244

Fix for Word not properly displaying Visio drawing lines

I work with Word and Visio a bit for incorporating network diagrams into documents. By default, Word will munge dashed lines of a Visio drawing when the drawing is embedded into Word and this is of course highly annoying when you are embedding Visio drawings with dashed lines into Word.

After some searching I found out that this is known behavior because of the way that Visio saves longer lines to save space, but there is a registry hack to fix the problem.

Go into the registry and 

Locate, and then click the following registry key:
Visio 2007 - HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application
Visio 2003 - HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Visio\Application

On the Edit menu, point to New, and then click DWORD Value. Type MetafileDashLineAsSolid, and then press ENTER.

Make the value of that key 1 instead of 0 (2 is the default behavior, but 1 fixes the problem) and there you have it.

Now when you insert Visio drawings into Word as embedded objects, your dashed lines will show up correctly and will print properly as well.

This fix is based on the information in the Microsoft KB 837294 article.

Enterprise Linux tools need packaging

With few exceptions (Puppet being one of them, because it just rocks) open source enterprise tools need to be packaged and available in one of the mainstream repositories (even EPEL is good enough! The bar isn't that high!) or your tool just isn't ready for primetime.

Looking at you Plone, LogAnalyzer, nxLog and LogStash! OSSEC gets a pass, but just barely because they are using the funky Atomic repo.

This is where tools like Zabbix and OSSIM come out ahead. The last thing you want to be doing when managing an enterprise, particularly in the industrial control space because of the funky requirements, is worrying about manually updating ANYTHING.

Really, the only reason why Puppet gets a pass is because it's so hugely useful in an enterprise.

And no, I don't want a bunch of excuses on why your tool isn't in a repository, whether it's for Debian, Ubuntu or the Red Hat side of things. If it's not available as a managed package, chances are your tool isn't going to be deployed by me or other IT people like me...and we tend to be a very stodgy group.

Ever wanted to know how secure a Linux password file, with hashed passwords using SHA-512 and salt, is? I think this is a good answer: http://security.stackexchange.com/questions/4687/are-salted-sha-256-512-hashes-still-safe-if-the-hashes-and-their-salts-are-expos Pretty damn secure.

Problems sending OSSEC logs to rsyslog

Pulling OSSEC logs into syslog is really a mess. It doesn't format stuff at all how a syslog client would.

For instance, it buries the agent name in the message text instead of reporting it as the system name, which instead gets reported as the OSSEC server name that got the logs in the first place.

Plus it ranks everything as MEDIUM in syslog terms regardless of how they are ranked within the OSSEC logs.

So a priority 1 (very low) OSSEC event gets prioritized the same as a priority 10 (high) event.

This is all making me think that syslog just isn't all that great for use with log analysis tools in a heterogeneous environment.

Although it does seem possible to get rsyslog to change the way it handles certain kinds of logs...I'll have to do some digging to see if I can find instructions for doing this with OSSEC.

**Update: My friend Mike recommends http://www.ossec.net/doc/syntax/head_ossec_config.syslog_output.html?highlight=syslog#syslog_output for a possible solution.

Linux Guide for Windows Admins

A while back I posted on my Computerworld blog about my experiences with several flavors of Linux and my thoughts of each.

Today, over on Mark's (We)blog, Mark Wilson posts his thoughts on recent experiences with different *NIX flavors including Solaris 10, Red Hat 4 and SUSE Linux 10.

Good read for anyone interested in getting their toes wet in the Linux pool.

Of particular interest is the information on the "root" account, run levels and how *NIX systems set up a disk hierarchy (partitions, folder and such).

Remotely install SNMP Service to XP clients?

Been trying to figure out some centralized network admin solutions to configure systems remotely.

First, I've been trying to figure out how to remotely turn on the Wake-On-Lan (WOL) functionality on our Dell systems. Would like to turn this on so I can better manage systems using VNCScan (going to have to blog about this some other day). Been trying to use Dell's OpenManage software, but without much success so far. Documentation isn't the greatest and I've run into some permission problems...

Which brings me to problem two. In order to properly connect with Dell's OpenManage IT Admin software, all our XP clients need SNMP Service installed. Problem is, I'd like to do this remotely if possible.

Just haven't found a good economical (you can read that as free) solution to do either of these things. So if you know of any good ways to remotely turn on WOL or install SNMP Service on XP, drop me a line.

AD design in 90 seconds

Want to know what you really need to understand to implement Active Directory in your network?

Go here...read, chew, digest and then go forth and plan your AD deployment with a clear head.

UltraVNC: Good VNC flavor to spice up your desktop support

Need a VNC flavor that has the fix for "blackscreen" problem when used in conjunction with Windows Remote Desktop?

Do you want to use NT or 200x Active Directory authentication with VNC instead of a generic password?

Check out this post of mine at Computerworld.