I should finish that post today about what I went through.

I have a situation where the developers of an application I support have a line that truncates their command history upon login. This is in .bash_profile and the /etc/skel directory across hundreds of systems. I would like to remove that line/function for users of a certain Unix group (70+ people) across every system. Doable in Puppet? @DennisKaarsemaker @freiheit @MichaelHampton

@ewwhite sure

@ewwhite Various ways, yes.

Also, @MikeyB, I'm really getting pissed off at MailFoundry. I told them about the AAAA queries being made and showed the packet capture, and here's the response I just got: "The Mailfoundry does not have any ability to query for that. It simply queries the DNS servers for updates.mailfoundry.net. The telnet command that we are running is a straight forward telnet command from 2004."

@DennisKaarsemaker I can't tell if that's Puppet, chef, etc... It's not Salt thought.

So they're flat out saying "No, we don't ask for a AAAA record. Ever. At all."

@freheit In CFEngine, it would be a case of commenting out the line. I need this to take care of the /etc/skel file (easy) and the individual users' .bash_profile without impacting other aliases/settings that may be in place.

@Wesley They're right. It's the system resolver asking for it. Which is fine. The problem lies entirely at OpenDNS.

exec{"undo-dev-stupidity":
    command => "sed /some-proper-match-here/d -i /etc/skel/.bash_profile /home/*/.bash_profile"
    onlyif => 'grep "some proper match here" /etc/skel/.bash_profile /home/*/.bash_profile'
}

@DennisKaarsemaker snort

@ewwhite So you need to do some crazy exec shit, like what @DennisKaarsemaker gave an example of.

@MikeyB What they're saying is that nothing on the box asks for AAAA. They are implying that a request for a AAAA is not coming from the hardware at all, but it's magically being inserted into the wire by the Travelocity Gnome or something.

Just an in-place sed. I was hoping there was a way to avoid a nutty exec.

@Wesley They're saying "we never explicitly ask for AAAA records" poorly.

also, @DennisKaarsemaker Would it be a one-time puppet run?

or would you bake it into a module...

@DennisKaarsemaker For real magic, you pull the group info into puppet some way or another and use create resources or define tricks to create individual versions of that.

@ewwhite I'd bake it into base::common (the module that is on all servers here) and remove it a day later.

I mean, getting the skel file (and managing it) handles future user additions

@MikeyB "The Mailfoundry does not have any ability to query for that." sounds to me like they're not even allowing for the possibility that the host OS knows how to query for a AAAA.

@freiheit fuck that. I'm lazy :)

@ewwhite sure, you can completely puppetize /etc/skel as well, that's not unreasonable. But that doesn't fix /home/*/.bash_profile

Like it's just not even possible that anything on the box has any capacity to ask for a AAAA under any circumstances.

@DennisKaarsemaker I have a default group, so it could be applied there.

@Wesley OK, they're wrong. Move on.

@DennisKaarsemaker yes, skel is easy. It was the home directory issue that scared me

@MikeyB I AM AN ANGRY BITTER MAN THAT CAN'T LET THINGS GO!!!

@Wesley Paging @PauskaSock - @Wesley needs some release.

is an exec across 75 users' files across 200 systems a good idea?

Also I have even less trust for this vendor since they're obviously incapable of accurate communication at best and completely clueless about their own product at worst.

@MikeyB @Wesley needs to get laid...

@ewwhite Also, next time around, don't mess with /etc/skel/.bash_profile, instead stick shit into /etc/profile.d/

@kce I'd say that's your problem right there :P R2, plz

@ewwhite what could possibly go wrong

@DennisKaarsemaker everything

@DennisKaarsemaker ewwhite might bang him...

@freiheit Oh, I know that. This is a relic from 1996.

@freiheit did you SEE the .bash_profile?

@ewwhite ooooh definitely

@ewwhite No, and you've convinced me that it's better for my brain not to look

@ewwhite some things are not meant to be shared

Take a look: pastebin.com/bRVVVQiN (It's not like I'm exposing myself indecently... you can unsee this)

@ewwhite oh wow: echo "POSSIBLE BAD UNIX DISK(S)"

@MikeyB And take note of the password aging mechanism

@ewwhite > $HISTFILE? Why not just unset HISTFILE?

...

1996

and HPUX

and SCO

@ewwhite It's not that bad, just quirky.

@ewwhite you are exposing yourself indecently...

@MikeyB so I have one customer who uses the password aging

and it's rough

@ewwhite if you are using stdlib there is file_line which (I think) can remove a line as well

@MikeyB Oh? man cat... hmmm... man unzip... hmmm... OK READY!

@DanilaLadner I got your quote request. Are you sure you want 450GB 2.5" 15k disks?

(bad value)

@ewwhite github.com/puppetlabs/puppetlabs-stdlib#file_line -- you could comment it out via stdlib...

@freiheit I can use a shell pattern to select the homedirs using the exec approach. How would I do the same in pure Puppet?

@ewwhite You'd... write a fucking custom fact to return a list of all the users (or at least their homedirs) and then manipulate that fact into an array that you pass to a custom define that's just a wrapper around file_line with ${name} used heavily and... yeah, stick with the shell pattern thing

@ewwhite No i am not married to it. but we need 4 disks in raid 10 with at least 600G on that server, and we wanted to try to use 2 pcie drives with HP smart cache.

@DanilaLadner Remember what I said about 900GB 2.5" disks being the sweet-spot?

@DanilaLadner the PCIe drives won't be compatible with smart cache.

hmm, but HP says any available drives.

you just select them, well then whatever SSDs which are compatible.

You'd need an genuine HP Enterprise SSD connected to the RAID controller for that.

If you are only testing, I can lend you some of my 400GB SAS Enterprise disks for that.

@ewwhite GEN-UEWE-WINE!

or sell them to you

@DanilaLadner If not, Sameer can sell you some, but they're $2000 at least for 400GB

or you can use a SATA SSD from HP from $500... but that would be ~200GB

Oh that's good...just scanning through some devices and apparently the synology we have is vulnerable to heartbleed

the web admin interface specifically..

SATA SSDs for caching?

@freiheit shell pattern. Got it.

@DanilaLadner HP SMartCache is only read... so you can use any HP supported drive for it

ok. sure.

But luckily, there's a patch. Whew.

most people can't afford the enterprise SAS SSDs, so they use a cheap HP SATA SSD

but they are all low-performing

I do not think that will be an issue, aren't hp enterprise disk low performing as well?

@DanilaLadner they are.

They don't perform that great. I use them, but they're just not that good... except for endurance

Okay I think I'm less angry now. I'm going to close this flaming email I was writing and... go... I don't know. Write a blog post or something.

@ChrisS You clicked on a bestgore link didn't you.

@DanilaLadner When do you need the quote?

@ewwhite whenever it will be ready.

@ewwhite Thank you.

@Wesley Commentary on "NSFW" links on Reddit lately... like this one: What porn looked like in the 80s NSFW (Is actually SFW)

@DanilaLadner but let me understand... you just want to try caching?

Oh Plesk... seclists.org/fulldisclosure/2014/Apr/255

I do have some enterprise SSDs in my private collection, if you just want to test

ZFS is better, though ;)

@ewwhite I have two mint eMLC 200GB SAS SSDs to sell :D IBM though.

@ChrisS That's what porn looked like up till about '96

@DanilaLadner the cheaper SATA option is 653118-B21 -

Apparently the NAS hates me. Hit "install update", gives me an unauthorized message and boots me out. Can't log in via LDAP anymore. This is gonna be fun..

Oh, it's updating in the background...interesting.

If anyone's writing an answer, finish quick - about to go read-only

@ShaneMadden gulp

@ewwhite No we want caching to be there.

i just wanted to try to use pcie ssds with smart cache

@DanilaLadner Won't work.

@ewwhite yeah, then with reg hp ssds

sata

The HP Smart Cache isn't that great.

they wanted to go with 400G 2K ones, but i told them they weren't making big difference.

K. Just remember. The PCIe cards are meant for ZFS or software RAID.

The HP SSDs are meant for hardware RAID.

@ewwhite I was under assumption you can tell HP Smart Cache to use for caching the fastest disks you have in the system regardless of them being on raid controller, i guess i was wrong.

@DanilaLadner naw... I can double-check, but I couldn't even get it to recognize my HP-branded Fusion-io cards last time I tried.

that's ok, no problems.

kk

@voretaq7 fucking-ubuntu

Ubuntu: An ancient African word meaning "Aw hell you don't really NEED a GUI environment on a laptop, do you?"

@voretaq7 Ubuntu: Ancient African word for "May your family die from the infestation of a thousand sand ticks in their crotches."

@voretaq7 "No X? I'll send someone down with a replacement 'X' key for your keyboard as soon as we find one."

Or would your lead developer not be amused?

@HopelessN00bGeniusofnetwork Lead developer probably makes $200,000 a year no matter what, so he's always going to have some level of amusement.

@DanilaLadner Ubuntu. Not even once.

@Wesley >:/ Fucking developers.

@Wesley Don't like Ubuntu do you?

@HopelessN00bGeniusofnetwork yeah, fuck developers.

@Wesley gotta love tha money!

@DanilaLadner That's my plan! As soon as I can find a decent-looking female one that pulls down a quarter mil a year, I hope to be a boytoy.

@BigHomie I honestly don't care that much. I've seen large systems based on Ubuntu that can be sane. I just think Debian is a saner distro if you must have apt. I simply don't trust Ubuntu's repos and don't trust their package defaults.

smile.amazon.com/GreenWorks-25322-16-Inch-Battery-Charger/dp/…

huh...cordless mower for the same price as a corded one with an extension cord

@Wesley agreed

@BigHomie My default distro is CentOS (or RedHat if the project has money), but I'm not religious about it.

@Wesley I've actually been doing CentOS lately for server stuff, Mint @ home but I want to become a purist and run Debian instead of mint

Really, I'm personally convinced that there's only two distros that are drop-in ready for enterprise stuff in the Linux landscape: RedHat and Debian. Not sure about SUSE, but I think it can be done if you have a support contract and people that are SUSE specific. Unbreakable if you're into getting taken to pound town in a leather bar.

@HopelessN00bGeniusofnetwork a quater mil a year

Debian tends to be in neckbeard land, and RedHat is more the Robert Half, button-down-two-sizes-too-big corporate shill land.

But really, everything sucks.

i actually know someone, but you have close her face with the pillow though.

It's just a matter of how big a blood blister you want.

@DanilaLadner "close her face with a pillow" I can actually appreciate that translation.

Has there ever been any chat room 'events' here? Like official ones

@BigHomie No, usually a special room is made for that.

every day is an event here

@DanilaLadner I should qualify that, I guess. A quarter mil a year, here. Not in like SanFran where that'll get you a 1200 square foot, 2 bedroom apartment, surrounded by an assortment of hipsters and hobos.

@JohnD True that

Speaking of which, whom do I talk to about more stars? meta.SO meta.SE? meta.SF? mods? Trolls?

@BigHomie Stars?

@ShaneMadden Stars.

@ShaneMadden >>>>>>>

@BigHomie What about them?

@ShaneMadden MOAR

30 won't do here, too much action

I've seen other rooms where they barely star anything for months

Here, you can't make it 30 seconds w/out someone saying something out of context

That depends on policy what a star is for a specific room.

@kaiser Come again?? I don't know what you mean by 'policy'

@kaiser There's a policy?

@BigHomie use more words to explain yourself. I was reading your explanation while on the phone and clearly don't understand what you're aiming for.

Yay, another fire alarm test. About to be jumped in 3...2...1...

@ShaneMadden like unwritten agreement on what stars are meant for. agreement between people who constantly hang out there.

Well, the thing says Star as interesting, so I kinda thought that's what it was for

all jokes aside

@kaiser Ahh, gotcha.

> LoopChat quotes

Plenty of interesting stuff here

@BigHomie Just like votes on main: people can star for whatever reason (or lack thereof) they want.

@ShaneMadden Exactly, and there's no upvote limit on main, so.... or is there?

all taken from our stars over there - that's what we use stars for: "seems like a wise mans saying", "hilarious!" ... "best rant since a long time".

Question: is there any point for ipv6 if the reserved blocks of ipv4 are sufficient for a network?

@BigHomie Yup, there is a vote limit and a star limit per day.

@Basil You can't talk to anyone else, and you have limited room to grow the network without resorting to NAT, which as we all know is evil.

@ShaneMadden Hmm, what's the vote limit

@MichaelHampton What do you mean you can't talk to anyone else? You mean outside the network?

@Basil Right.

@kaiser "My code is running fast because it is afraid of me." ...bwahaha

@MichaelHampton I am on a computer with a v4 address right now, and it's connected to this chat...

@NathanC :)

@Basil And your connection probably had to be NATted.

@Basil WARLOCK!

@Basil What if this chat does not have IPv4 (because it's a new service and there are no new IPv4's available)

@MichaelHampton right, so what using v6 buys me is the ability to make my computer's actual address appear on the internet?

@MichelZ That's a problem for future basil. I'm just wondering what v6 buys me today

@Basil Yes, which means the stuff NAT breaks will no longer be broken.

@Basil Proper end-to-end communication without NAT

NAT doesn't break things if you are careful.

@MichaelHampton What about the stuff that NAT makes better? Like the fact that I never get pings from unknown hosts?

Wouldn't that need to be worked around if this thing had a v6 address?

NAT breaks everything. It will even eat your breakfast.

@Basil NAT doesn't make anything better. It only seems to.

@Basil LOL @ never get pings! I like that :D

Anyone in here has used PuPHPet and knows a bit about puppet? Would need some basic explanation as the docs are quite ... horrific. I have half a question finished, but not sure if such basic stuff would get any attention.

@BigHomie 30

@Basil Check all the answers, there's a lot of good stuff in there.

@MichaelHampton I searched already, that's why I have half a question finished. I so far don't get the whole picture. Missing piece now is where to add a new module.

@kaiser Um, huh?

:D

Ok. Scenario is like this:

I configured everything on the PuPHPet app/website and downloaded the configuration. It gives me a .vagrant and a puppet folder. Now I need to add some wordpress-puppet module and some other modules. Therefore I cloned them into ~/puphpet/puppet/modules/wp.

I can read how I configure it (in code), but I don't get around how puppet is structured, what gets loaded when, etc. So I'm stuck and "dunno where to put da codez!".

@MichaelHampton Ok, I've read the answers and I think I better understand. So right now, v4 requires NAT, which grants a default slightly-better-than-nothing firewall (stateful, someone called it). v6 has more addresses, and obviously will eventually be the only accepted protocol on the internet. Until then, though, unless v4 doesn't have enough addresses for the network, there's no gain except NAT elimination from going to v6?

@Basil Not incurring technical debt?

@Basil NAT has NOTHING to do with security/firewall!

NAT is NOT a security feature!

@Basil NAT fundamentally is meant to give access to hosts that wouldn't otherwise have it. It is not an access control mechanism. Thats what you use a firewall to do.

@ShaneMadden meh, 30 upvotes I get

Not to mention, getting rid of NAT is such a huge gain that it alone is worth it.

But Comms is...... well..... comms

"The only protection you get from RFC1918 addresses is that allows people to get away with errors/laziness in your firewall config and still not be all that vulnerable."

@MichaelHampton What would getting rid of NAT gain me?

@Basil End to end connectivity, a simpler and easier to maintain network...

Down with NAT!

@Basil you might not notice the gains, because many applications work around NAT by using hacky-messy-workarounds which are not needed without NAT

Question: Is a puppet/vagrant question better asked here or on SO anyway?

@ShaneMadden Can we do a POLL question? Everyone in favor of getting RID of NAT, should upvote :D

@kaiser Depends on the question, but generally here.

@kaiser Those are two things that seem very strange combined. Vagrant is generally frowned on here as a "not serious" developer tool. Though we love puppet...

@MichelZ Heh, people don't like change :)

He. Ok. Guess you are all Docker guys (and maybe girls)?

@ShaneMadden thanks

RFC 1627 makes an interesting read, too.

   This is another point that warrants repetition: the belief that
   administrators can predict which machines will need Internet access
   is quite simply wrong.  We need to reduce or eliminate the penalties
   associated with that error, in order to encourage as much Internet
   connectivity as operational policies and technical security permit.

Ok, I asked a question. Feels like I asked one pretty much like those that I close all day on your SE site :P ... great.

Vagrant. Humph.

Feels good when people nag about Vagrant being the weapon of choice and not telling me that WordPress sucks :D

as this is what normally happens

@kaiser WordPress is great. Vagrant sucks :)

@kaiser Dickies actually. Dockers are nice, but don't last.

WordPress sucks too ... honestly :)

@kaiser You should have seen it ten years ago.

I have used it since v1.9 or 2 ... I don't have the feeling that it now is really better. Just more bloated.

@kaiser what's in your Vagrantfile?

Bloatware

does it set puppet.module_path?

lol, not in the Vagrantfile

@kaiser I first used version 1.2 in 2004. I can tell you it's dramatically improved since then.

@faker let me check that

@faker It's from PuPHPet, so it's quite large. Do you want a Pastebin/Gist/Pastie?

@faker wait, pretty sure it doesn't as I searched for moduleand didn't find much. checking anyway.

@kaiser And yes, it's large now because it has a lot of features. But for the most part they all make sense and have a place. Back then... let's just say I had to fork WordPress once because of some bad code.

no, there's no puppet.module_path.

@MichaelHampton sounds valid. but believe me: I want to fork it every day. sadly it's so bloated that it's not possible.

@kaiser interesting, usually you set a couple of puppet options there, puppet.module_path, puppet.manifest_file and puppet.manifest_path

All occurrences of puppet happen in one place:

config.vm.provision :shell, :path => "puphpet/shell/update-puppet.sh"
config.vm.provision :shell, :path => "puphpet/shell/r10k.sh"

config.vm.provision :puppet do |puppet|
ssh_username = !data['ssh']['username'].nil? ? data['ssh']['username'] : "vagrant"
puppet.facter = {
  "ssh_username"     => "#{ssh_username}",
  "provisioner_type" => ENV['VAGRANT_DEFAULT_PROVIDER'],
  "vm_target_key"    => 'vagrantfile-local',
}
puppet.manifests_path = "#{data['vm']['provision']['puppet']['manifests_path']}"

@kaiser What would you remove?

@MichaelHampton first I wouldn't really remove something (maybe senseless post formats), but rewrite the admin part to eat its own dog food.

Currently "Comments" is the only page/request in admin that actually is registered by using the API.

Um, go for it?

Then the whole admin menu should just be a normal menu that anyone can configure.

Which would make it a post type.

You want to make the admin screens into post types?

yes

at least every menu item already is a post type

Weird...I never thought of that. What would it fix?

reduce the code base by approximately 70%

bringing real standards

example:

There are two types of views for all list table views: List and Excerpt

I tried adding a third one "Calendar" by extending WP_List_Table. Endless hooks/callback hell massacre just to intercept the global(!) that holds the instance of that table singleton(!).

Oh yeah, WP_List_Table is a huge mess. I remember that.

And now everyone else in here is looking at me as if I were possessed by demons...

the wordpress admin ui is just a like a yogurt that you forgot in your fridge for a decade: grown over and no one wants to touch it.

@kaiser Oh yeah. Hell, I remember once they completely redid the look and feel of it three times in a year.

@faker sorry for the wp intermezzo :)

@MichaelHampton I wrote a patch to separate login and admin four years ago. rewrote with each new version until I gave up.

@MichaelHampton No, they never accepted my patches. I ranted too much about WP :D Seems like it's getting better since some versions. Nacin (lead dev) fixed Trac some month ago so people can see my avatar now and they started digging some patches up and discussing it. But I'm already too fed up.

@kaiser I don't like the multi-site stuff myself. I just want a simple website not a full-fledged WP network!

Although, if I wanted a simple website wordpress is probably not the best tool

Yeah, static site builders aren't all that bad (and maintenance heavy) and Ghost (the new Node thingy) has quite a nice writing experience if you need just a blog.

I love the multi-site stuff and use it extensively.

Eh, just an actual website for me (my own little side business) ...nothing special. If I thought about it more before springing a year's worth of hosting i'd just use S3 and a static site lol

multisite isn't bad per se. actually it can be nice if used right. you could break one site up into multiple mini apps, etc. etc. and at the end of the day you don't have to use it and most plugins and themes out there anyway aren't network ready.

I want to see domain mapping integrated (better).

I want to see a real router in wp ... instead of that WP_Rewrite Regex hell.

I couldn't set up an easy rewrite so I didn't have WP files scattered in the web root...I asked the host and they said "install it on your root folder"

since somehow the documented way was impossible >_>

Installing in subdir now somehow is possible. Still not perfect, but it got better.

Seems like it's a mess.