/dev/chat

12:47 AM

@FaheemMitha re: You have to be a professional sysadmin to ask questions, actually, you have to be on a professional context instead, ie. how to configure my system ip vs how to configure my systems IP when PXE booting a linux image based on blah

is more a matter of "scale"

Jenny D

6:42 AM

I think I'm the only ServerFault person to spend much time here... I agree that most of us old-timers are a little nuts, it comes from having spent too many years as a sysadmin.

Jason B

6:55 AM

Hello, hope someone here can help me. I want to post a question on the linux.stackexchange.com page, but I think I should gather more information before posting. I have a laptop with dual boot, windows and linux. A few months ago the wifi stopped working on my linux, but it still works in Windows. I tried some things, changing the network manager, can't remember everything I tried, but finally I decided I should just wipe the system and do a fresh install. So I replaced Ubuntu 12.04 by the latest version of Mint, but the problem is still there. I log in, it connects to the router, and…

Jenny D

7:25 AM

@JasonB I'd start with booting into Linux. Once you're in, do netstat -nr and ifconfig -a and save the output to a text file. Then, after you've lost internet connection, do the same things again and save to a second text file.

Also, your logs are in /var/log but I don't know which of all the files there - probably the file called syslog or messages, it depends on your exact setup. You can just grep for the timestamps, e.g. grep * ^Jul 16 09:26 to grep for everything that happens during that minute.

Jason B

8:01 AM

@JennyD, thank you very much, I will do that.

Jenny D

@JasonB You might also want to check the WiFi access point logs

Jason B

You mean logs the router keeps? I hadn't thought of that

Jenny D

@JasonB yeah, it took me half an hour to think of it too :-)

Faheem Mitha

@JennyD No offense intended. I was just talking about the SF site policies. And that is hearsay, anyway.

@JasonB Actually, it's unix.stackexchange.com.

Jenny D

@FaheemMitha None taken! It's very true that SF is the odd one out, by covering several different OSes but having restrictions on what you're doing with them instead of what OS you're doing it with.

Faheem Mitha

8:14 AM

@JennyD Well, as one of the few people here who is actually active on SF too, you're probably better qualified to advise about what they want/require from questions.

Jenny D

@FaheemMitha I think the main thing is that SF expects the poster to have done a lot more homework before asking, as compared to UL or SO. Take for instance unix.stackexchange.com/questions/216381/… - that would have been closed immediately because you're expected to be able to know or at least know how to figure out how to duplicate a daemon, or how to add a user without messing up /etc/passwd.

Also, if you're trying to run a business on consumer-grade hardware, SF is unlikely to be very helpful.

Faheem Mitha

@JennyD Well, adding a new user by editing /etc/passwd is deranged, assuming I understood the context correctly. I guess he had special requirements and thought his only option was to do it manually?

@JennyD I don't see why the hardware matters.

Jenny D

@FaheemMitha @FaheemMitha I got the impression he simply didn't know how to do it right - if he had, he would at least have used vipw which would have done it properly for him instead of leaving him with a conflict betwen passwd and master.passwd.

Faheem Mitha

@JennyD Yes, I see.

Jenny D

@FaheemMitha Usually it doesn't with a pure unix question. But if you start talking about network, or e.g. RAID setups, then it starts getting important.

Faheem Mitha

8:20 AM

@JennyD ok

Anyway, I don't see myself asking a question (or answering one) on SF. And in fact, I haven't yet.

Jenny D

@FaheemMitha SF also gets questions from people trying to run stuff on personal editions of Windows because they don't want to shell out the money for a business license, and then they get all upset when it doesn't work the way the business edition does...

@FaheemMitha I started there first, being an old grumpy sysadmin :-)

Faheem Mitha

@JennyD Oh. I tend to forget that SF is not OS-specific.

@JennyD Well, hopefully not that old, or that grumpy. :-)

Jenny D

@FaheemMitha In my mid-forties, and having been a sysadmin for nearly 20 years... and no, usually not very grumpy :-)

Faheem Mitha

When I see people using Windows I want to talk gently to them and show them the error of their ways. But often they don't want to know.

Jenny D

@FaheemMitha I've stopped doing that... In fact, when it's my family, I'm happy they use Windows because that means they'll ask my brother or my mother for help instead of me!

Faheem Mitha

8:25 AM

And in my opinion, running servers using MS software makes increasingly less sense as the free software ecosystem becomes more mature.

Jenny D

But more seriously - for some people and some things, Windows is the best tool for the job. It's not a job I want to do...

Faheem Mitha

@JennyD Well, I don't do it often. The operative word is "want".

@JennyD What things?

Presumably quite specialist things.

Jenny D

@FaheemMitha Spreadsheets and stuff like that, I would guess...

Faheem Mitha

@JennyD Excel?

Jenny D

@FaheemMitha Yes. Apparently it's still better than the free alternatives.

Faheem Mitha

8:27 AM

People still insist of running databases and web servers on MS for example, even though free alternatives exist, and are just fine.

@JennyD ok

Jenny D

But there's also the issue of having to spend the time to learn a new tool. If all your staff are able to handle Windows, but none know much about Unix, then switching to Unix is going to be a major hassle. It might be cost-effective in the long run, but it's hard to see that it will be good in the short run.

Faheem Mitha

@JennyD Yes, it depends how short term you are thinking.

Jenny D

@FaheemMitha For a small business it's usually very short. They usually don't have the resources to run a dual IT operation for the time it would take to switch over.

Faheem Mitha

@JennyD I see. Even if it will save them money in the long run? And probably the not very much longer run.

MS licenses are yearly, right?

Jenny D

Though amusingly I was visiting a potential client a while back, they're looking into getting a new system that we might help them with. And I said that "given your small Unix staff, maybe a Windows system would be better for your specific needs - we'll have to take a close look at that." And he replied "On the other hand, this could be just what we need to be able to hire more Unix people"

@FaheemMitha I think so - I don't know. OTOH, Redhat support licenses aren't cheap either - and that's the second concern for a business, they often want a support contract so they'll have someone to yell at when things go pearshaped

Faheem Mitha

8:31 AM

@JennyD Yikes, you were recommending Windows? <registers horror>

@JennyD Is a part time support contract from a sysadmin type person (like yourself) not an option?

Jenny D

@FaheemMitha Not exactly recommending... just not ruling it out. In this case there's also a high degree of interoperability with existing systems, of which many run Windows. And I can't go into details for NDA reasons.

Faheem Mitha

I mean, does it need to be a corporate support contract?

@JennyD ok

Jenny D

@FaheemMitha They seem to usually want "vendor support", which is apparently a special magic kind of support.

Faheem Mitha

I guess I would never be good at this kind of job. I can't imagine myself suggesting MS to anyone.

@JennyD Magic Support? Hmm.

It's true that RH does support a lot of free software, so they probably have a lot of in-house expertise.

I mean, if you want some fancy kernel stuff done, RH would probably have the people you need.

Though I don't know if they would bring them in for everyone. Don't know a thing about RH or how it works.

Though judging by their stock price, they're doing pretty well.

Jenny D

@FaheemMitha What's going to happen with this client is me and a coworker will go out and do an analysis of their needs and requirements and then recommend a solution. Since they want us to implement the solution too, it's unlikely that it'll end up being Windows, because we don't have any Windows people in our company. But by not being locked in to a Unix solution from the start, I am showing that I am more interested in their needs than in selling them the package that we prefer to work with.

@FaheemMitha They're decent support-wise, but their licensing is extortionate.

Which means that businesses trust them more than the cheaper alternatives, because if something costs a lot then it's obviously serious.

/me shakes head

Faheem Mitha

8:37 AM

@JennyD Fair enough. Though using MS is also a form of lockin. Using Linux or the BSDs doesn't lock you into anything whatever, afaik. You can always switch distributions or whatever.

@JennyD hence the good stock price, I guess. Care to quote numbers?

Jenny D

@FaheemMitha This is PKI. Once you've set up your root CA, it's not easy to move it.

Faheem Mitha

@JennyD :-)

Jenny D

@FaheemMitha I don't have the numbers to quote... but it's actually not that much cheaper than Windows, according to my clients, especially if you want to run lots and lots of VMs.

Faheem Mitha

@JennyD Public Key Infrastructure? But surely they could move distributions if they needed to?

Jenny D

@FaheemMitha Yes, provided the new distribution has the proper drivers for the hardware security module... Basically, with PKi there are three ways to go. One is the Windows CA which works well with Windows clients, mostly, but has some really weird issues.

Faheem Mitha

8:41 AM

@JennyD Ok. But a business can get support cheaper from some small custom place, right? Or even an individual sysadmin? But they prefer to get a RH support contract, just because they think it is more reliable, or "better"? Is that a fair statement?

Jenny D

The second is a PKI software on top of any Unix box - I'd recommend EJBCA because that's my favourite.

The third is an appliance, which has the advantage that you don't need to know the OS at all, and the EJBCA appliance is lovely to work with. Costs more to buy, costs a lot less to run.

And which is best for a given client will depend on that client's needs.

Faheem Mitha

@JennyD Yes, I see.

Jenny D

I do like the appliance boxes though, they're really well done. They're not just "here's a Unix box with our software loaded on it and you can't ever patch it" - it's well thought through, separate VMs with separate content and network, really hard to crack and very easy to patch

Faheem Mitha

@JennyD Sounds good. I've only ever used routers. Which kind of suck. Proprietary hardware/software by default, lots of bugs. Doesn't work well with Linux.

I've used free firmware like Tomato on those things.

Jenny D

@FaheemMitha There are a lot of shoddy so-called appliances out there... My previous job was at a bank - my friends in the security department had some horror stories of some appliances they'd vetted for security issued and then refused to allow within our walls

Faheem Mitha

8:48 AM

@JennyD Yes, I guess you need to know what to get.

Are there free third-party firmware for such things too?

Jenny D

@FaheemMitha for PKI?

Faheem Mitha

@JennyD Yes, or similar appliances.

Jenny D

You wouldn't get free firmware for a PKI appliance - a major reason to use them is to get something that's FIPS-compliant and you'd lose that and a lot of security if you start messing with the hardware or firmware. The same goes for if you use free PKI software such as EJBCA but with a HSM - you want the proprietary drivers for the HSM in order to retain compliance.

For other appliances, I don't really know - most of the horror stories I've heard have been about some vendor just giving you a pre-installed Ubuntu or something with their appliance smacked on top and a web GUI to config it, so that it would be very easy to just move it to something else except then you'd lose support.

Faheem Mitha

@JennyD Oh. Support from the vendor?

Jenny D

@FaheemMitha yep

Faheem Mitha

8:57 AM

ok

Jenny D

which in those cases would be crap anyway...

Maybe I was wrong about not being so very grumpy :-)

Faheem Mitha

So this PKI thing is instrinsically proprietary? If so, that's unfortunate.

Jenny D

@FaheemMitha It's possible to run it entirely on free software, too, but you won't get full FIPS compliance. For most companies that may not matter, if all you do is create certificates for your own employees and systems. But if you're using it to encrypt, sign or verify very important data, then you're going to want to pay someone who knows how to build secure hardware.

In my own lab I've got EJBCA setup to use softhsm - i.e. a piece of software that pretends to be an HSM but it stores all its tokens in a database, so that they could be accessed or changed by an intruder. You could build something like that that would be secure enough for a small company, that only uses the certificates in-house.

If you want to mess with PKI for fun, ejbca.org and opendnssec.org/softhsm are a good place to start

Anyhow, I need to go away for a while now - I'm on vacation and I've promised to look in on the horses at the stable where I keep my horse. They're all out in the summer pastures and I need to check that none of them are hurt and they have enough water and so on.

Faheem Mitha

@JennyD Ok. Have fun. And thanks for the explanations.

Jenny D

@FaheemMitha You're welcome! I actually think cryptography and PKI are really fun things to work with, so I'm happy to talk about it until I bore everyone else rigid :-)

Faheem Mitha

9:09 AM

@JennyD Clearly, you are in the right profession, then. :-)

Hmm, FIPS is a US thing. Why does Europe care about it?

Fabby

10:10 AM

@FaheemMitha They care about privacy... :D

Faheem Mitha

@Fabby Well, Ok. But why would they sign off on a US standard?

Fabby

@FaheemMitha It was just a joke... No deeper meaning intended!

:P

Jodka Lemon

1:20 PM

Why didn't I get the bounty on the linked question? unix.stackexchange.com/questions/214166/…

Jeff Schaller

@JodkaLemon unix.stackexchange.com/help/bounty says there's a 24hr grace period

Jenny D

@FaheemMitha Why set up a separate EU standard when the US one is sufficient?

Jeff Schaller

apparently they have not explicitly awarded the bounty, but it seems your answer will get it

Jodka Lemon

@JeffSchaller Yes, but this ended, too.

Jenny D

1:44 PM

@JodkaLemon how long ago? Because I'm fairly sure it's not usually instantaneous.

Braiam

it fires at schedule if I'm not mistaken

Jeff Schaller

@Braiam "at now + $(Jodka_Lemons_patience + 24)"? :)

Jodka Lemon

2:23 PM

Ok, I undersstand. Just asked, because it would have not been the first time I misundersstood something. stack Exchange is not so easy to understand, as it seems at first.

Jenny D

2:37 PM

@JeffSchaller see meta.stackexchange.com/a/147577/214153

Faheem Mitha

3:19 PM

@JennyD If Europe agrees with it, then I guess it's Ok.

Faheem Mitha

4:01 PM

@terdon The ELU room seems to be turning into a loony bin. Or is it always like that?

Transcript for