Entries by Raymond P. Burkholder

• unDraw - A constantly updated collection of beautiful svg images that you can use completely free and without attribution. From Web Developer Monthly 💻🚀December 2019
• hacker news comments on 33 Amazing Sites with Beautiful Free Icon Sets.

I need to expand on this, but for reference, I found this on reddit - A good C++ (or C, honestly, so long as it works) HTTP server/library, and can be modified to suit:

httperf --hog --num-conns=1024 --num-calls=1 --rate=128 --server localhost --port 8080

In my search for an editing environment, I am currently running Visual Studio Code with a number of extensions. It is a GUI based IDE environment and seems to be relatively performant. When jumping to symbol declarations and definitions, it can take a few seconds while performing the lookup.

Since I also use VIM for editing files, I have been keeping my eye on VIM add-ons for creating a console based IDE. Some tools which might be applicable:

• clangd - the language server protocol daemon for clang
• Using LSP & clangd in Vim - notes on integrating clangd, and with a reference at the end about the JSON compilation database, (which in another link, can be supplied via CMake)
• vim cp enhanced highlight - with clangd, I am not sure if this is required, but helps with syntax high-lighting without clangd
• vim-cpp-modern: Enhanced C and C++ syntax highlighting - another syntax highligher, one is forked from the other, with this one being more current, I believe
• VIM CMake - plugin to make working with CMake a little nicer
• CMake Support for Vim - CMake Interoperability in Vim - not sure what the difference is to the previous link
• Vim Cmake integration - some chatter on StackOverflow on integrating CMake with VIM

NeoVim

• neovim
• clangd with neovim

• Proxmox Ceph Server
• Manage Ceph Services on Proxmox VE Nodes
• Manage Ceph Services on Proxmox VE Nodes - reformatted copy of above link
• Proxmox VE Ceph Benchmark 2018/02 with a referral to Benchmark Proxmox VE Ceph Cluster Performance
• Install Ceph Server on Proxmox VE - video tutorial
• Ceph PGs per Pool Calculator

• As Ceph handles data object redundancy and multiple parallel writes to disks (OSDs) on its own, using a RAID controller normally doesn’t improve performance or availability. On the contrary, Ceph is designed to handle whole disks on it’s own, without any abstraction in between. RAID controller are not designed for the Ceph use case and may complicate things and sometimes even reduce performance, as their write and caching algorithms may interfere with the ones from Ceph.
• Ceph Object Storage Daemons are storing objects for Ceph over the network. It is recommended to use one OSD per physical disk.
• We recommend a Ceph cluster size, starting with 12 OSDs, distributed evenly among your, at least three nodes (4 OSDs on each node).

On my Debian desktop, I have both of my primary monitors in portrait mode, with a third monitor in landscape mode. The login screen is therefore rotated 90 degrees from how it needs to be. After login, I need to manually go into System Settings, and manually rotate the monitors.

That is, up until now. A little poking around says I need to:

apt install arandr

This is a GUI application which will create a script in .screenlayout which can be auto-started upon login:

$ cat .screenlayout/bythree.sh
#!/bin/sh
xrandr \
  --output DisplayPort-0 --primary --mode 3840x2160 --pos 0x8 --rotate right \
  --output DisplayPort-1 --mode 3840x2160 --pos 2160x0 --rotate right \
  --output DisplayPort-2 --off \
  --output DisplayPort-3 --mode 2560x1600 --pos 4320x0 --rotate normal \
  --output HDMI-A-0 --off \
  --output HDMI-A-1 --off

This can be autostarted in LXDE with:

$ cat ~/.config/lxsession/LXDE/autostart
@lxpanel --profile LXDE
@pcmanfm --desktop --profile LXDE
@xscreensaver -no-splash
#@~/.screenlayout/bythree.sh    <= does not work
#@${HOME}/.screenlayout/bythree.sh   <= does not work
# make sure there is a line return at end of command:
@/home/me/.screenlayout/bythree.sh

Instructions for the autostart file can be found at LXSession.

Continuing on in the search for a responsive IDE for building large C++ codesets with CMake, the next stop is Visual Studio Code.

The initial install supplies a basic IDE editing environment.

Usability occurs when extensions are loaded. I have the following installed (versions are as of this writing):

• C/C++ for Visual Studio Code, v0.26, by Microsoft <== some sites say to disable this, but it is required by the debug function
• CMake, v0.0.17, by twxs, which provides CMake language support
• CMake Tools, v1.2.3, by Microsoft, which provides the build capability
• vscode-clangd, v0.0.19, is the clang language server, which provides code completion and symbol tables

Prior to installation of the extensions, on Debian, I installed the following packages first (in addition to the standard compilers):

• cmake
• clangd
• clangd-9

reddit - PROTIP: Use clangd instead of the official C/C++ extension suggests adding the following to .vscode/settings.json:

"C_Cpp.autocomplete": "Disabled",
"C_Cpp.formatting": "Disabled",
"C_Cpp.errorSquiggles": "Disabled",
"C_Cpp.intelliSenseEngine": "Disabled",

In addition, I have a more recent version of clangd, so in .vscode/settings.json, I also have:

"clangd.path": "/usr/lib/llvm-9/bin/clangd",

My over all file looks like:

{
  "clangd.path": "/usr/lib/llvm-9/bin/clangd",
  "C_Cpp.autocomplete": "Disabled",
  "C_Cpp.formatting": "Disabled",
  "C_Cpp.errorSquiggles": "Disabled",
  "C_Cpp.intelliSenseEngine": "Disabled",
  "C_Cpp.default.intelliSenseMode": "clang-x64",
  "editor.tabSize": 2
}

In the root directory of the project, a link is required (the setting "compileCommands" in .vscode/c_cpp_properties.json does not appear to be used by the clangd module) :

ln -s build/compile_commands.json .

As a note, if compile_commands.json is not provided, then the following flag needs to be passed to CMake (seems to be defaulted "on" in current Visual Studio Code):

-DCMAKE_EXPORT_COMPILE_COMMANDS=1

Documentation for clangd is found at Getting started with clangd.

On a Windows platform, I use SSH tools in two incarnations: a) Cygwin, or b) PuTTY.

When using PuTTY, to connect to a destination host, it is convenient to use pageant as a memory resident program to hold 'opened' private keys.

When using SSH on Cygwin, ssh-pageant can be installed via the Cygwin installer. The trick for linking ssh-pageant to the Windows resident pageant is to put the following into .bashrc:

 # ssh-pageant
 eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME")

• Sandboxed Execution Environment (SEE) is a framework for building test automation in secured Environments. The Sandboxes, provided via libvirt, are customizable allowing high degree of flexibility. Different type of Hypervisors (Qemu, VirtualBox, LXC) can be employed to run the Test Environments.
• OWASP Zed Attack Proxy (ZAP) - helps you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. Its also a great tool for experienced pentesters to use for manual security testing. With more tools at OWASP™ Foundation - the free and open software security community.
• Upgrade Your Security Incident Response Plan (CSIRP) : 7 Step Checklist 1) conduct a complete risk assessment, 2) identify key team members & stakeholders, 3) define security incident types, 4) inventory resources & assets, 5) plan hierarchy of information flow, 6) prepare a variety of public statements, 7) prepare an incident event log
• CISA - Assessments: Cyber Resilience Review (CRR)
• What is a Security Operations Center (SOC)? Best Practices, Benefits, & Framework - 1) establishing asset awareness, 2) preventive security monitoring, 3) keeping records of activity and communications, 4) ranking security alerts, 5) modifying defenses, 6) maintaining compliance

Security Web Sites

• Hacking Tools presented for pentesters - Kali Linux, Parrot Security OS, Black Arch, Nmap, Metasploit, Nikto (how to at Admin Magazine), Wireshark, SQLMap
• Mining Adminers – Hackers Scan the Internet For DB Scripts - I found "GET /adminer-4.4.0-mysql.php HTTP/1.1" in my own logs, one of many similar entries

When needing to rebuild a personal linux machine, some suggested commands to collect state:

dpkg --get-selections > ~/mint/Package.list
apt-key exportall > ~/mint/Repo.keys
crontab -u wgking -l > ~/mint/crontab.backup

For some odd reason, my Bluetooth based mouse stopped working on my Debian Linux workstation. Going into the Bluetooth control panel in Settings indicated that no Bluetooth Adapter could be found.

In scouring the help groups, the solution is to go into BIOS, disable Bluetooth, reboot, restart into BIOS, and enable Bluetooth. In the end, this revived my Bluetooth adapters and devices.

One handy command I found to restart into the BIOS settings:

# systemctl reboot --firmware-setup

Building an enterprise datacenter is easy. When building multiple datacenters, and trying to share workloads, that is an animal of a totally different colour.

The goal is to have a separation of services into availability zones (which in itself, has multiple definitions).

From a very high level perspective, I looked at VMware NSX, Microsoft SDN, OpenStack, and ProxMox to see how they function.

VMware NSX

First up is VMware NSX. NSX comes in two flavours: a) NSX-V, better known as NSX-vSphere, which uses VxLAN as the encapsulation layer, and b) NSX-T, better known as NSX Transformers, which uses Geneve as the encapsulation layer. VMware appears to be no longer adding services to NSX-V, and is only performing bug fixes. VMware is instead putting the development effort into NSX-T, which has ties into a broader range of platforms such as KVM, as well as ESXi/vSphere. Since NSX-V is, for all intents and purposes, being deprecated, I will focus on NSX-T. The key technology document supplied by VMware appears to be DOC-39405 - NSX-T 2.4 Multisite - a document which goes into great detail on how to build a multi-site NSX solution.

Based upon that document, it is difficult to design a two-semi-autonomous-datacenter solution. Basically, the lack of ‘local egress’ on stretched vlans without massive, all-or-nothing scripted gateway migration reduces perceived flexibility of their solution. That is, if you want to have a controller instance at each site, licensing costs are driven up by about double. And there are limitations to WAN round trip times if you want to split the controller across sites, which gets into split brain problems and resiliency. As another observation, VMware seems to be going to more of the MS PowerShell for automation. (and leaving Python in the dust?)

One more item is Brief History of VMware NSX saying "Active-active multi-site deployment is a joke and works almost as well as stretched data center fabric control plane - when you lose the inter-site link in an active-active setup, one of the sites shuts down".

With VMware no longer allowing kernel level insertions, there are very few effective avenues for providing third party routing/encapsulation engines. Cisco's ACI is said to have a plug-in for vSphere, and for insertion into each virtualization guest (which is a bit grotesque, I think). [2019/11/16 - Update - Cisco programs directly against the VMware API now for the things they need to do]

Microsoft Hyper-V

So... moving on to Microsoft Hyper-V with the (Software Defined Networking) SDN add-on. Most of the docs, as of this writing, appear to reference Windows 2016, when Windows 2019 is 'out there'. And in those docs, the underlay/overlay does not appear to handle IPv6!! And in a similar manner to VMware, if two separate datacenters are required, a lot of SCCM and controller licensing is probably going to have to be doubled up. And I'm not really sure how two sites will connect or inter-operate.

Another interesting fact is that the Microsoft SDN solution appears to use the Open vSwitch engine under the hood. But it appears as though they have disabled or hidden all the interesting command line and troubleshooting tools for Open vSwitch. More embrace, extend, and extinguish philosophy?

The documentation didn't provide any indication how the Microsoft VxLAN encapsulation would interact with, say Cisco Nexus switch VxLAN VTEP provisioning, which would allow third party devices access to the various VxLAN domains.

And as a final observation, Microsoft SDN does use the VxLAN encapsulation capability. Cisco is said to have an ACI shim to fit in there to help with the network side provisioning aspects.

OpenStack

One open source possibility I've been examining, and I have been examining this one in more depth: OpenStack. No licensing fees. Automated via Python. Runs VxLAN as the encapsulation layer. Knows how to work with Open vSwitch and keep the related engine diagnostic commands visible. It can also integrate with Free Range Routing for the BGP-EVPN side of things. Cisco has a tool called Cisco Nexus Fabric OpenStack Enabler for integrating OpenStack into a Cisco Nexus VxLAN enabled solution. With a standard multi-site deployment, OpenStack works with a single instance of Horizon and Keystone. I will need to experiment with that to understand the ramifications for Availability Zones.

ProxMox

Last on my list of candidates, is ProxMox which is a complete open-source platform for enterprise virtualization. It is designed mostly as a single site solution. But having access to the underlying networking, and with a simple to use API, engineering the appropriate integration with the network and with other sites is straight-forward. There is easy access to Free Range Routing, Open vSwitch, LXC, KVM, iproute2, ifupdown2, and related toolsets.

• ZFS
• OpenZFS Developer Summit 2019
• Storage Configurator - from the conference
• iX Systems - storage vendor
• ZFS: Fun with ZFS – is compression and deduplication useful for my data and how much memory do I need for zfs dedup?
• How-To: Using ZFS Encryption at Rest in OpenZFS (ZFS on Linux, ZFS on FreeBSD, …)
• Performance tuning - OpenZFS

At one point in time, removing 'quiet' and placing 'text' on the grub/linux command line would boot in to console mode, the current way to do that is the remove 'quiet' and add the following to the linux kernel command line:

systemctl set-default multi-user.target

I need to keep this around and see what it does to the boot up log listing (based upon Force Debian console into text mode, it can be used when ILO complains of "Monitor is in graphics mode or an unsupported text mode.":

GRUB_CMDLINE_LINUX_DEFAULT="nomodeset"

Another useful function is the following to disable graphical terminal in the grub boot file (use update-grub after any changes):

GRUB_TERMINAL=console

To build a wpa_supplicant configuration file:

# wpa_passphrase testap >> /etc/wpa_supplicant/testap.conf
  a_password
# cat /etc/wpa_supplicant/testap.conf
  # reading passphrase from stdin
  network={
          ssid="testap"
          #psk="a_password"
          psk=1b97a5c02076ac80739263fb33db49c7c50d3199202872e06097e7baf305f35e
  }

Additional info at How to connect to a WPA/WPA2 WiFi network using Linux command line.

To limit the amount of memory supplied to each container, place something similar to the following in the container configuration file:

lxc.cgroup.memory.limit_in_bytes = 5120M

The lxcfs daemon/service/package should be installed, and should be seen to be mounted on /var/lib/lxcfs

Prior to setting the memory limit, unfettered memory useage can be determined with

cat /sys/fs/cgroup/memory/lxc//memory.max_usage_in_bytes

When inside the container, something like 'free -m' should show the memory available to the container.

# free -m
              total        used        free      shared  buff/cache   available
Mem:          16029        5121        5890         444        5017       10046
Swap:          9535           0        9535