Schlomo Schapiro

Apache HTTPD 2.4 has a very useful new feature for large deployments: Replacing the remote IP of a request from a request header , e.g. set by a load balancer or reverse proxy. Users of Apache HTTPD 2.2 as found on RHEL6 can now use the backport found on  https://github.com/ImmobilienScout24/mod_remoteip-httpd22 . I pulled this backport together from various sources found on the Internet and "it seems to work". Working with C code ( which I did not do for 14 years !) tought me again the value of test driven development and modern programming languages. Unfortunately I still can't explain a change like this without a lot of thinking: You can easily build an RPM from the code on GitHub. The commit history shows the steps I had to undertake to get there.  Configuration is as simple as this: LoadModule remoteip_module modules/mod_remoteip.so RemoteIPHeader X-Forwarded-For RemoteIPInternalProxy 10.100.15.33 with the result that a reverse proxy on 10.100.15.33 can s...

2 years ago I wrote about creating a repository for DEB packages with the help of reprepro . And since then I suffer from the complexity of the process and cumbersome reprepro usage: Complicated to add support for new Ubuntu version which happens every 6 months Need to specifically handle new architectures I actually don't need most of the features that reprepro supports, e.g. managing multiple repos in one or package staging This week I realized that for there is a much simpler solution for my needs: apt-ftparchive . This tool creates a trivial repo with just enough information to make apt happy. For my purposes that is enough. All what I want from a DEB repo is actually Work well with 50-500 packages Easy to add new Debian/Ubuntu/Raspbian versions or architectures Simple enough for me to understand GPG signatures It turns out that the trivial repo format is enough for that, it makes it even simpler to add new distro versions because the repo does not contain a...

The guest session  is a very important feature of Ubuntu Linux . It makes it very simple to give other people temporary computer or Internet access without compromising the permanent users of the computer. Unfortunately the separation is not perfect, the guest user can actually modify critical configuration settings on the computer and even access the files of the other users, if they don't take precautions. The following scripts and files help to lock down the guest session so that no harm can be done. How It Works The guest session is actually a feature of the LightDM Display Manager that is used in Ubuntu and in Xubuntu . The guest session is enabled by default. When a user chooses a guest session the following happens: LightDM uses the  /usr/sbin/guest-account script to setup a temporary guest account. The home directory is created in memory (via tmpfs ) and can occupy at most half the RAM of the computer. Optionally, /etc/guest-session/prefs.sh is i...

A site to site VPN is the standard solution for connecting several physical data center locations. Going to the Cloud, the first idea that comes to mind is to also connect the Cloud "data center" with a site VPN to the existing physical data centers. All Cloud providers offer such a feature. But is such a VPN infrastructure also a "good idea"? Will it help us or hinder us in the future? I actually believe that for having many data centers a site VPN infrastructure is a dangerous tool. On the good side it is very convenient to have and to set up and it simplifies a lot of things. On the other side it is also very easy to build a world-wide mesh of dependencies where a VPN failure can severly inhibit data center operations or even take down services. It also lures everybody into creating undocumented backend connection between services. The core problem is in my opinion one of scale. Having a small number (3 to 5) of locations is fundamentally different from h...

I recently got myself a new printer, the HP Officejet Pro X476dw . A very nice and powerful machine, it can not only print double sided but also scan, copy and send faxes. And of course it has very good Linux support, thanks to the HP Linux Printing and Imaging Open Source project. On my Ubuntu 14.10 desktop everything is already included to use the printer. However, the first printouts where very disappointing. They looked coarse and ugly, much worse than prints from my old HP LaserJet 6 printer. After overcoming the initial shock I realized that only prints from my Ubuntu desktop where bad while prints over Google Cloud Print where crisp and good looking. So obviously something has to be wrong with the printer drive on Ubuntu! After some debugging I was able to trace this down to the fact that by default CUPS converts the print job to 300 dpi PostScript before giving it to the hp driver, as it shows in the CUPS logs: D [Job 261] Printer make and model: HP HP Officej...

Since ImmobilienScout24 decided to migrate to a public cloud I have been busy looking at various cloud offerings in detail. Amazon Web Services  (AWS) has a special feature which is interesting: Amazon Linux is a fully supported, "RHEL like", RPM-based Linux distribution. While not beeing a true Red Hat Enterprise Linux clone like CentOS or Scientific Linux (which is the standard OS for the ImmobilienScout24 data centers), it is derived from some Fedora version and comes with a nice choice of current software. To me it feels like "RHEL +" because so far all our internal stuff worked well but a lot of software packages are much newer than on RHEL 6 or RHEL 7. The 2014.09 release  updated a lot of components to very recent versions. On the other hand, we also found packages missing from Amazon Linux, most notably desktop-file-utils . This package is required to install Oracle Java RPMs . I found a thread about this on the AWS Forums and added a request fo...

Update:  Read my (German) conference report on heise developer . Last week I was at the DevOps Days Berlin 2014 . This time at the Kalkscheune , a much better location than the Urania from last year. With 250 people the conference was not too full and the location was also well equipped to handle this amount. Proving DevOps to be more about people and culture, most talks where not so technical but emphasized the need to take along all the people on the journey to DevOps. An technical bonus was the talk by Simon Eskildsen about " Docker at Shopify " which was the first time that I heard about a successful Docker implementation in production. Always good to know is the difference between effective and efficient as explained by Alex Schwartz in " DevOps means effectiveness first ". DevOps is actually a way to optimize for effectiveness before optimizing for efficience. Microsoft and SAP gave talks about DevOps in their world - quite impressive to see DevOps...

One full week of Python power is almost more than one can take, but I missing it would be even worse. This was my first EuroPython and with 1200 participants a big upgrade compared to the previous 2 PyCon.DE events in which I participated. The location ( Berlin Congress Center ) deserves kudos, along with the perfect organization. The Wifi worked really well (except for a WAN problem on Tuesday which was fixed quickly) and everybody loved the catering. They even had kosher, helal and vegan food (preordered), which is highly unusual for German conferences. Most amazing was the video crew who managed to upload all videos in about one hour after a talk was given. I managed to give three talks: DevOps Risk Mitigation How we use Test Driven Infrastructure at ImmobilienScout24 as part of our general automation to reduce the risk of giving everybody access everywhere. ( Access Slides or Watch Video ) YAML Reader Lightning Talk about the yamlreader Python library, which provide...

iPXE is a lesser known Open Source  PXE boot loader which offers many interesting features: boot from a web server via HTTP and HTTPS boot from remote block device over  iSCSI , FC , FCoE , AoE SAN boot from VLAN , WiFi, WAN, Infiniband control the boot process with a script user interaction with menus and login prompts display images and splash screens replaces NIC firmware or chain load via PXE Talk & Article Since iPXE plays a role in the ImmobilienScout24 boot automation I gave a talk about it at the LinuxTag 2014 . The talk is half an hour long and gives a quick introduction into iPXE. It covers build, configuration & scripting and shows how to develop boot scripts in iPXE with a very short feedback cycle. Download the  slides to the talk  and the  audio recording  as a podcast. At the conference the German Linux Magazin became interested in the topic and asked me to write an article about iPXE: Der vielseitige N...

I do a lot of pair working and many times I connect a large TV or projector to my laptop for others to see what I am doing. Unfortunately the display resolution of my laptop never matches that of the other display, and Linux tends to choose 1024x768 as the highest compatible resolution. This is of course totally useless for doing any real work. My preferred solution for this problem is to use X scaling to bridge the resolution gap between the different screens. Since none of the regular display configuration tools support scaling, I ended up typing this line very often: xrandr --output LVDS1 --mode 1600x900 --output HDMI3 --mode 1920x1080 --scale-from 1600x900 Eventually I got fed up and decided to automate the process, the result is automirror , a little Bash script that automatically configures all attached displays in a mirror configuration. automirror is available on  https://github.com/schlomo/automirror . Typical Use Cases Connecting a Full HD 1920x1080 disp...

At the 2014-06 Berlin DevOps Meetup this week we had an interesting fish bowl discussion about What is the risk of giving DEVs root access in production? Since I suggested the topic I was asked to give a short introduction into the topic: The discussion that followed was suprising in several aspects: A major concern is safeguarding the production data, but nobody had a really good solution for that. Many people have more problems with Developers seeing live customer data than with Develops changing something in production. "Nobody should have root" was proposed by a security specialist, but he had no practical working example for this approach. The question is tightly coupled to the degree of automation. The more automation you have the less need for anybody (Dev or Ops) to use their root privileges. Not everybody having root access knows what to do with it, Developers are sometimes afraid of using their power if granted root. This is mostly a question for lar...

I love my "smart" TV - it got Linux inside which is the base for a whole range of nice hacks. TV Router The most important one is that the TV is actually a wireless router that provides Internet via Ethernet to my TV rack. Usually the Ethernet connection is used by the Playstation or a Raspberry Pi. The original reason for this hack was simple: The Playstation 3 has a really really bad Wifi reception which made watching Netflix nearly impossible and the unavoidable PS3 updates painfully long. The USB Wifi adapter connected to the TV has a much better reception, sharing it with the PS3 solved all the performance problems. Samsung Linux TV And here comes the good part. The TV ( Samsung LE32C650 ) runs Linux inside and there is an Open Source project ( SamyGO ) that "opens up" the TV firmware and extends this Linux with useful tools. In my case I only had to enable IP forwarding, configure a static IP on the Ethernet interface (eth0) and start a DHCP server...

Does your company care about employer branding ? Probably yes. Does your company care about corporate social responsibility ? Probably yes. Does your company combine these two to create a win-win situation? Most likely not! Take my employer ImmobilienScout24 as a typical example: The about us page mentiones that ImmobilienScout24 is a great place to work (4th in our region) and the CSR team talks about the social engagement, e.g. blood donations or the social day where all employees donate their work time to non-profit organizations. However, there is no obvious connection between these two things. I would like to suggest a simple way how to combine both employer branding and corporate social responsibility: A company should make it a priority to support charitable organizations and social projects related to their own employees. Examples: Sponsor non-profit organizations or neighborhood/community projects that employees are involved with. On social day, go to ...

The "Start Menu" of a Linux Desktop usually comes with a predefined set of categories that make up the sub menus. If you have a lot of custom applications then you might want to group them under a dedicated sub menu instead of having them spread out over all the menu categories. Adding sub menus and new categories on Linux Desktops is defined in the Desktop Menu Specification in Appendix C . It turns out that it is really simple and the following example from ImmobilienScout24 can serve as a base for your own custom menu. You will need the following parts: A Desktop file using a custom category A Directory file defining the icon and description for the new sub menu The icon for the sub menu An XML file describing how to integrate the new sub menu into the menu structure and which categories of Desktop files to show in the new menu The Desktop file describes the menu entry, in this example the VPN client: The important part here is the Categories  entry whic...

Playing videos in an endless loop is a common problem: Product demos at a trade show or fair Infomercials in a public place or foyer Background fun at a party ... When I faced this problem at the last LinuxTag we did not want to take a full blown computer with us but make do with a Raspberry Pi . The question was how to turn the Pi into a simple video player with a minimum amount of fuss. The solution is simple and elegant: Install OpenELEC (an Kodi distribution) on a SD card Boot it up once in the Pi to initialize the storage partition Add the following file in the storage partition as .kodi/userdata/autoexec.py Add any amount of multimedia files in the storage partition under videos/ Boot up the Pi and enjoy your videos You can also interrupt the playback and use OpenELEC normally. To go back to the automatic playback simply reboot the system. And here is our booth with the demo videos in front: Update 2016-05-13: Adjust for Kodi instead of XBMC. Ev...