The Comms Room

freiheit

11:00 PM

Apparently I have 92 puppet nodes

Michael Hampton

@ewwhite Oh come on, you have things that are common to all your servers... NTP, SNMP, /tmp mounted exec...

ewwhite

@MichaelHampton not much beyond what's kickstarted and post-configed.

@MichaelHampton it would be helpful for a handful of clients at work...

Michael Hampton

Sure, but what happens when you have to make a change?

freiheit

Another handy thing about puppet: when the security auditors asked about if we checked this thing and that thing I could basically say "yes, automatically every 30 minutes, here are the config rules we use for that"

ewwhite

I need to go to 120 servers and type:

authconfig --enablesssd --ldapserver=ldap://ldap1v.LOLWUT.saas --ldapbasedn="dc=LOLWUT,dc=saas" --enablerfc2307bis --enablesssdauth --krb5kdc=ldap1v.LOLWUT.saas --krb5realm=LOLWUT.SAAS --disableforcelegacy --enablelocauthorize --enablemkhomedir --updateall

freiheit

11:02 PM

@MichaelHampton for host in $(cat allrhelboxes); do scp ntp.conf root@$host:/etc/ntp.conf; done

Joel E Salas

@WesleyDavid There's one step between using git to manage your configs and using puppet to manage your servers

ewwhite

to move from nslcd to sssd

freiheit

@ewwhite And what if 1 of the 120 servers happens to be down?

ewwhite

@freiheit it isn't... this is a client's private cloud

freiheit

@ewwhite So you do that and you have to change the kickstart/post-config, right?

ewwhite

11:04 PM

but this doesn't work in all cases, because some of the systems have glibc errors, or mismatched kernel/OS combinations, or some have nscd memory leaks that require the process to be killed -9...

Michael Hampton

All I do in the kickstart is have the machine enroll itself with the puppetmaster.

freiheit

If you use puppet for your post-config in the first place, you just make the change in one place so that new boxes and existing boxes get it...

ewwhite

right, in the past, I used kickstart to bootstrap puppet

I'm just saying that it'd be too difficult to get it in place with the customers we have at work

Michael Hampton

Oh yeah, and install VMware Tools.

ewwhite

@MichaelHampton I'm still using VMware OSP's

and a client went into a server and ran "kill -9 vmtoolsd" today.

Michael Hampton

11:06 PM

repo --name="vmware-tools" --baseurl=packages.vmware.com/tools/esx/5.1/rhel6/x86_64

%packages
vmware-tools-esx-nox

ewwhite

@MichaelHampton they asked how to restart it.

Matt Bear

omg...

ewwhite

Do YOU know?

Zypher

service vmware-tools start ?

ewwhite

nope

Michael Hampton

11:08 PM

Matt Bear

i've been trying to get Portecle to open a keystore for the last 2 hours... Long story short, the password I used on the export was longer then java was capable of reading

3

freiheit

@ewwhite reboot!

ewwhite

@freiheit seems like it

Michael Hampton

You reboot the whole ESX host.

freiheit

@MichaelHampton No, that wouldn't fix one broken VM, since the VMs would just migrate elsewhere in the ESX cluster

ewwhite

11:10 PM

but they only killed the tools in order to mount /tmp with the exec flag!

This one is a 14-host cluster, too

with all sorts of odd vcloud bits

Michael Hampton

And what is this piece of shit they're trying to install?

freiheit

@ewwhite WUT?

ewwhite

@freiheit See the question.

I think my linux skills are atrophying...

Michael Hampton

...Do I even need to say it?

MDMarra

@ewwhite Because of this massive influx of new Windows knowledge!

ewwhite

11:14 PM

@MichaelHampton a large, um, application...

Michael Hampton

@ewwhite Does it start with O and end with racle?

ewwhite

I guess I can't say much about who they are, but it's complex....

@MichaelHampton Oh, the Oracle boxes all have a nice # in front of my noexec /tmp entries.

voretaq7

@MattBear Security through "Well now you have to brake 512-bit AES because you can't enter a password that long ever again!"

Michael Hampton

@ewwhite Oh, so it's something the client developed in house by violating every possible principle of good programming?

voretaq7

@ewwhite stab. him.

ewwhite

11:16 PM

I don't even know what software is... it's probably jboss and other middleware-y type things

MDMarra

Isn't that whole jboss/websphere/java shit old crusty crap?

Michael Hampton

Interestingly, Nagios XI's installation script also wanted to run out of /tmp...

ewwhite

@MichaelHampton as a sidenote, our NOC staff is taught to deploy vmware tools on linux by uncompressing the package in /tmp and executing from there

MDMarra

I mean, I don't know anything about it really, but it seems like that's a lot of peoples' attitudes toward it

Michael Hampton

Java is so 1995.

ewwhite

11:17 PM

@MDMarra prolly...

freiheit

@MDMarra Please add tomcat to that list

MDMarra

Oh sorry, yeah tomcat

voretaq7

@ewwhite stab. them. too.

ewwhite

for those of you in MA, this app would affect you

MDMarra

I mean, it was the answer to cross platform applications before javascript was a thing, right? That's the whole appeal?

Or is there something else keeping it alive besides huge entrenched installs?

freiheit

11:18 PM

@MDMarra Also all the ways you can use the strict OO...

Michael Hampton

@MDMarra Pretty much..only Sun thought it would drive sales of Solaris, which it didn't quite...

freiheit

@MDMarra I think the love of XML configuration files helps, too...

voretaq7

@MichaelHampton but we got JumpStart

@freiheit Stockholm syndrome is a terrible thing.

freiheit

@voretaq7 I'm sure that if I tweak the XML file just right, tomcat won't beat me this time...

MDMarra

@freiheit I only know enough programming to have fulfilled my major requirements, so I don't know exactly what java has over other languages in that regard, but with a new vulnerability every 10 seconds it can't be the best choice in 2013 for new projects, right?

ewwhite

11:20 PM

Naw

voretaq7

Tomcat will bite you.
You will like it.
You will say "Thank You Tomcat May I Have Another Sir?"

ewwhite

getting drunker....

4

freiheit

@MDMarra Based on that metric, everybody should stick with Perl. All the other popular languages just discovered hash randomization DoS avoidance techniques that Perl had a decade ago.

Matt Bear

@voretaq7 im playing with tomcat right now....

ewwhite

with buffalo wing sauce stuck to my macbook...

WesleyDavid

11:22 PM

@ewwhite Don't toss your wild wings.

freiheit

@voretaq7 Thank you for the fresh bleeding hole on my arm, Tomcat. Would you please scratch my other arm up really good now?

Matt Bear

SSL keystores can kiss my ass

MDMarra

@freiheit But I mean, java is bad though right? No other platform gets as much bad press about vulnerabilities. Or is that just because it's so ubiquitous?

WesleyDavid

@freiheit Yes, everyone should have stayed with perl. Glad you see things my way! =P

freiheit

@MattBear You should just stick with the "letmein" default keystore password

voretaq7

11:23 PM

@freiheit Now you're getting it. Except you best be showing respect and calling Tomcat SIR or it's gonna crash some respect into you!

MDMarra

@ewwhite That thing takes a beating huh

voretaq7

(Oracle is "Ma'am")

Matt Bear

@freiheit its "changeit"

freiheit

@MDMarra Java is quite ubiquitous, but I really hate it too much to answer that fairly

MDMarra

@freiheit l3tmein

voretaq7

11:23 PM

@MDMarra l3tme1n

freiheit

@MattBear oh, sorry, maybe that's it... I'd have to check my java keystore creation script...

Matt Bear

l33tm3n?

voretaq7

but I prefer Halp!

Matt Bear

@freiheit i hate webhelpdesk now... is freaking retarded

MDMarra

Oh dude

I forgot you use that

You're, literally, the only other person I've ever heard of that has used it

Matt Bear

11:25 PM

@MDMarra yeah, IT's been bugging me to clear up some issues

put sharepoint on hold for a bit while I deal with it...

MDMarra

@MattBear Go buy ISupport. That's what we did

Well, at my last job anyway

Trust me, there's no fixing webhelpdesk

Matt Bear

@MDMarra not my call, helpdesk purchased it, helpdesk wants to use it

MDMarra

Fuck it, just implement ticket tracking in SP when you're done :)

Matt Bear

coupled with lansweeper

MDMarra

There are modules for that

never heard of lansweeper

sounds like minesweeper

Matt Bear

11:27 PM

@MDMarra its a network scanner the integrates with WHD for building inventory lists or somthing like that

ewwhite

@mdmarra I'm looking at Valley.

Matt Bear

dunno dont care that much

ewwhite

want to set default OU?

voretaq7

OK VMWare, I'm buyin' - but if I don't get zero downtime I'm going to SUE YOUR ASSES!

hashtag-BeCarefulWhatYouAdvertise

MDMarra

@MattBear Things integrate with that? It doesn't even work by itself!

ewwhite

11:29 PM

@voretaq7 @WesleyDavid, see!

MDMarra

@ewwhite For?

ewwhite

@MDMarra for new users

MDMarra

Oh at valley?

Or at davalgfasfasdSALES.local.cc?

ewwhite

valley

MDMarra

sure

Matt Bear

11:29 PM

@MDMarra thats what they tell me...

MDMarra

@ewwhite Is that all you need?

Matt Bear

its built on java...

ewwhite

@MDMarra I guess...

MDMarra

@MattBear And Frontbase by default, right?

freiheit

@voretaq7 They're guaranteeing infinite 9s of uptime! Woo!

MDMarra

11:30 PM

@ewwhite haha you don't sound so sure

ewwhite

@mdmarra and I need an answer on instant messenger

Matt Bear

@MDMarra yuuup

MDMarra

@ewwhite For what?

Internal? External? Both?

ewwhite

@MDMarra They called and asked for IM.

MDMarra

Free or $$?

ewwhite

11:31 PM

the local guy was like, "I was about to download MSN messenger, but I figured it needed to be installed in a special manner"

WesleyDavid

@ewwhite Yeah, except if you're a service provider. Ratfinks.

MDMarra

Lync is cool but probably a sledgehammer for a thumb tack

Matt Bear

@ewwhite isnt MSN messenger gone now?

MDMarra

Yeah, I'm not up on public IM services. I just gchat

ewwhite

@MDMarra The owner wants to be able to IM other people on the server

MDMarra

11:32 PM

Lync is the Microsoft hotness, but overkill for this place. Openfire gets a lot of mentions but I've never set it up or used it

Matt Bear

@MDMarra were moving from openfire to Lync right now

Lync is good, very good, I like it a lot

Openfire is... free

ewwhite

Lync costs $?

"Note: Red Hat Enterprise Linux 6 Update 3 (6.3) and Oracle Linux 6 Update 3 (6.3) with the Red Hat Compatible Kernel is currently not supported"

Matt Bear

honestly... I dunno, its part of our o365 subscription

ewwhite

so is that a good reason NOT to use RHEL 6.3?

freiheit

@MDMarra I tried out openfire, jabberd and ejabberd, and openfire was the best of those 3 free options...

@ewwhite It is a good reason to avoid anything from Oracle

Michael Hampton

11:35 PM

@ewwhite It's a good reason to ask the vendor what in hell they're smoking.

MDMarra

@ewwhite Yeah. It's what they rebranded Office Communication Server

ewwhite

@freiheit The super HARD security image I built apparently is not compatible with Oracle's cluster FS>

voretaq7

I SHARE:

amazon.com/SPAM-Bacon-12-Ounce-Cans-Pack/dp/B001EQ5NLU

MDMarra

@ewwhite It does video, text, desktop sharing, etc. It's way more than just IM

It has separate CALs too

voretaq7

US Inspected and passed by Department of Agriculture -- who wants to eat it?

MDMarra

11:35 PM

Definitely awesome, but it can get pricey

ewwhite

@MDMarra I priced it for wife's company... was like $5k for them

voretaq7

@MDMarra ...I'm going to assume you were referring to the baconated SPAM :)

Michael Hampton

@voretaq7 Spam is one of those exotic Asian delicacies, like squid, or dog.

Matt Bear

@MDMarra we use it for collaberation, its realy handy to just be able to IM a dev in another office with a problem, one click to share your screen, another click to give him control. And its integrated with AD

voretaq7

@MichaelHampton Brits still eat it I think

then again, Marmite.

ewwhite

11:40 PM

@MattBear Lync?

Tanner

@voretaq7 Nomnomnom that made my stomach growl.

MDMarra

So, @ewwhite, the answer to your question if you're looking for a free public IM service is Skype

Microsoft is retiring MSN Messenger and pushing everyone to Skype now that they own it.

ewwhite

@MDMarra That's good information

Recommended to have Skype on a terminal server?

MDMarra

So your choices are:

On Premise - Lync, Openfire

Public - Skype

@ewwhite Oh, I'm sure it's not

But I don't know for sure

community.skype.com/t5/Windows-desktop-client/…

That looks like a big red flag to me

ewwhite

Valley is asking on how much Lync costs.

Matt Bear

11:46 PM

@ewwhite yeah, Lync, sorry distracted

@ewwhite it depends... For us it comes with o365, so $0... plus like $2000 a month lol

MDMarra

@ewwhite No clue. My numbers are skewed with non profit licensing. I also care about things like CALs :)

ewwhite

Welcome!

Congratulations on your newly accepted Open License with Microsoft, ending in 01032. You have been assigned Administrator permissions on the Microsoft Volume Licensing Service Center (VLSC) site.

Matt Bear

standard I think is $4 per user per month or somthing like that

Journeyman Geek

01032?

Mark Henderson

@ChrisS @voretaq7 - never been accused of being on "medical marihuana" by a user before

Matt Bear

11:48 PM

/start whd and /hope SSL works

Mark Henderson

(or at all, for that matter)

Matt Bear

/fail... again WTF

voretaq7

@MarkHenderson whut?

ewwhite

@MattBear do I need to license EVERYONE?

Michael Hampton

Do I need the "IP Helper" Windows service?

Mark Henderson

11:48 PM

@voretaq7 That tool on the mod messages

pauska

Lync is licensed per user, so yes - every user you enable in Lync needs a CAL

voretaq7

@MarkHenderson ohhhh

well as long as they pass the bong what do I care? :)

ewwhite

@pauska but if I have 180 people there, but only 50 people who need chat...

Matt Bear

@ewwhite everyone who uses it

pauska

make sure you (and your client) is fully aware of what each license gives.. the Lync standard CAL is chat and being able to set a status like "busy". That's it.

@ewwhite then you only enable those 50 in the lync server, and buy 50 cal's

ewwhite

11:49 PM

@pauska interesting...

pauska

but don't these have core cal suite?

ewwhite

(I really don't know what lync does)

Matt Bear

@pauska damn CAL's... you hear about the new IE cals?

pauska

@MattBear !?

Matt Bear

apparently you now need a CAL for every set of eyes that sees the IE browser

human or otherwise

pauska

11:50 PM

@ewwhite Chat, Group Chat, Video, Audio, SIP, Telephony, Screen sharing, Application Sharing, powerpoint presentation, web app (netmeeting) and so on

it's really powerful, and quite honestly one of the best products microsoft has

Matt Bear

@pauska I agree with that

pauska

it's silly how much money companies save on travel when they implement it fully with proper rooms

we had ONE meeting today with lync 2013 and 6 different parties

Matt Bear

we did away with gotomeeting in favor of Lync

pauska

we saved the same amount of money that we would on buying one 55" display for that room

ewwhite

@pauska This particular site only has a terminal server... will Lync be useful there?

MDMarra

11:52 PM

@MattBear Thats only if you subscribe to Office365. That's not normal pricing

voretaq7

OK, GoHome time

bbl maybe

ewwhite

@voretaq7 storm?

pauska

@ewwhite lync on terminal server is kind of balls, since video/audio doesn't work.. can still use it for chat with the standard CAL. There is a new VDI plugin (which also works for RDS) for Lync 2013, where you install a small lync client on the thin client PC

Matt Bear

@MDMarra I havent even looked at normal pricing... lol

voretaq7

@ewwhite depends if I jog or not :P

pauska

11:53 PM

but it's very "these features are not supported or limited": <list of 15135 things>

MDMarra

Ok, @ewwhite. All new users in valley will automatically be created in ou=users,ou=valley unless they're explicitly created elsewhere

pauska

again, does not matter if you're at Core CAL or Lync Standard licensing, as it's only chat and availability

ewwhite

I mean, I just had the local guy go around to a bunch of HP thin clients (running HP's linux) and update them with a USB key so that they'd connect to 2008 R2 RDS.

so it's old stuff...

Matt Bear

hmm $28 a CAL isnt bad

pauska

ye, the lync 2013 vdi plugin requires WIN7/WES7 or higher

ewwhite

11:58 PM

@MDMarra o rly? So I'll create a user in ADUC and maybe Exchange EMC

Transcript for