January 2009 - infrastructure - Fedora mailing-lists

hi, i newly joined fedora infrastructure group
by p sena 17 Sep '10

17 Sep '10

Hi, I am new to the fedora infrastructure group. I am going throug few of the links in the site to get a feel of the work. I have submitted my .ssh_rsa_key.pub from the site. I think I will get some intimation on this. Please someone can let me know further proceedings from here onwards. Cheers. Regards & Thanks Prabir Senapati mailto: senapati2001(a)yahoo.com

3 5

Hello, My intro
by Chris Johnson 18 Sep '09

18 Sep '09

Hi all, I've been lurking on the mailing list for a while and I finally registered for my fedora account today (username: chrisj) I'm interested in helping out as time permits. I got on irc once (lurking again) and haven't really logged in since. I'll try to make a few meetings after the holidays I'm planning to get my personal test systems setup soon. I just moved and still getting things straight at home. Bought a 750GB drive last night and will be installing F10 over the weekend. I had been running the U... distro and it's time to get back to the fedora/RH rpm way of doing things :-) I've used RedHat since before Fedora existed (I think 6 was the first one). Started as a hobbyist, 2 years. Then got a job as an admin and have been doing Linux admin and Cisco networks for the last 5 years. My current employer is a Win shop so I just get to run the DNS, email, and network, but the network is 50 remote offices and 3 different data centers in the midwest. I don't mind the Windows too much and can find my way around them, it's also kinda fun to get the Linux and MS products to play nice together. I've worked with a lot of different linux and OSS software products including: postfix, openldap, apache, bind, samba, mailman, pam, built some custom rpm's, etc. I use RHEL mostly at work and some fedora and Cent for testing (some suse, deb, and slackware in the past). I used to do lots of security firewall apliances with various linux distros (I was a big fan of LRP when it would fit on a floppy), most of this is now done with Cisco in my world. I can shell script pretty well and I've written several perl scripts in the last few years (dabbled in php but not enough to know it well). I've always been interested in python but don't have much if any exp with it. I also don't have much experience with SQL/DB or source control. I was looking at the FIGs and would be interested in the base sysadmin and sysadmin-noc for now while I figure out where everything is and what it does. I'm also interested in more info on the sysadmin-tools and sysadmin-web FIG. So, next just apply for the FIGs, keep lurking, ask some questions, show up for IRC meetings? Thanks all, -- Chris Johnson ++++++++++ j.chris.johnson(a)gmail.com ++++++++++++++++++++

2 2

Re: /releases/10/Everything: several packages changed
by Jesse Keating 01 Feb '09

01 Feb '09

On Sat, 2009-01-31 at 20:10 +0200, Axel Thimm wrote: > a current rsync shows that thousands of files have been changed in the > last week. This is not expected as /releases/ is considered to only > change for the release day and then never again. > > The files have a date of Jan 23rd. Although I don't have a copy to > compare with looking at the internal date it looks like the files have > just been `touch'ed (but I only checked a coupl of the 2000+ changed > ones). Could someone bring back the old dates to make it consistent > again? Thanks! Hrm, there was no action on my part to touch everything, so I'll have to do some investigation into what's going on. Looking on the server, all the files in releases/10/Everything/i386/os/Packages/ have varying timestamps, but I do indeed see some things with a stamp as new as Jan 22. Its certainly not every file, but I'm still not quite finding any commonality in my brief looking. More investigation to follow. -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating

2 5

Change Request -- mediawiki auth plugin
by Toshio Kuratomi 31 Jan '09

31 Jan '09

The Mediawiki auth plugin has to contact admin.fedoraproject.org in order to lookup the users and verify their passwords. It's using curl to do so. One of the options being given to curl is the following: # This is only required because of the wildcard cert on pt10 curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); That turns off verifying the host via SSL. From the comment it appears to only be needed with the test FAS server. I'd like to comment this line out. This is a flaw that potentially opens us to a DNS spoofing attack to compromise authentication. Luckily for us, there is a problem with routing to admin.fedoraproject.org within PHX so we have an /etc/hosts entry for admin.fp.o that directs the wiki to use an internal IP address. That means for this flaw to affect us, someone would have to compromise the /etc/hosts files rather than a DNS server. So we should fix this but compromising it is not as easy. If this fails, we will see authentication failures when we try to login to the wiki and can revert. Can I get a couple +1's? -Toshio

5 6

[Fwd: Re: CMS Option: Zikula]
by Toshio Kuratomi 30 Jan '09

30 Jan '09

I sent this to the docs list when they started considering Zikula. Now that we're setting up a test instance and getting some people on the infrastructure team to work on it it seems like a good point in time to forward it here. -------- Original Message -------- Date: Fri, 23 Jan 2009 16:55:03 -0800 From: Toshio Kuratomi <a.badger(a)gmail.com> To: fedora-docs-list(a)redhat.com Paul W. Frields wrote: > I think we should also be considering the other major players in the > CMS game, if there are people available to deploy and maintain them. > Drupal and Joomla! immediately come to mind, the latter especially > because it actually has some DocBook XML support. Features aren't > particularly compelling, though, if we have no one around to help with > the maintenance. > One of the things I didn't know until I did some browsing around their website is that Zikula started off as PostNuke but that they changed the name in June. So they are a long term player in the CMS market. > None of this has any bearing on the quality of Zikula, which I'm sure > is excellent. > I was impressed by a few of the things I've learned since this morning :-) The answers to how proactive the security is was a nice change from the usual thoughts I've seen:: https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20 Here's my naive search of cve.mitre.org for issues reported in 2008. Note that some people would say to exclude plugins from this but my view is that we're going to be running plugins as part of our deployment and we'll want to know if we can expand our capabilities by pulling in functionality via plugins without compromising security. So knowing this does a *little* towards understanding whether the Core provides an API for writing secure plugins and the plugin community is security minded as well as Core developers. And like I say, this is naive :-) 91 Joomla -- Lots of plugins a few in core 79 Drupal -- Lots of plugins a few in core 60 Wordpress -- Lots of plugins, a few in core 53 Mambo --Lots of plugins, at least one in core 4 zikula + postnuke -- 1 in Core, 3 in plugins 1 midgard 0 zikula 0 enano For reference, mediawiki, which we think has an acceptable security-to-benefit ratio had 8 vulnerabilities reported in 2008 using the same naive count. -Toshio

4 4

Introduction Teb (Zikula / Documentation project)
by Teb (Zikula NL) 30 Jan '09

30 Jan '09

Hi all, I have just subscribed to both the fedora-infrastructure-list and the fedora-docs-list to keep you (and myself) updated about the documentation project. My name is Arjen Tebbenhof, 32 years old and currently employed at AMB-IT / ChampionChip in the Netherlands as a (web) software engineer. In this function, I maintain a backend-portal for our clients, and I am responsible for planning and implementation in this specific field (using PHP and an Oracle DBMS). Before this, I owned a company specialized in delivering CMS solutions, but that never really got lucrative enough to make a living :) I have a Bachelors Degree in Econometrics and Operations Research, at the Erasmus University Rotterdam, The Netherlands. I am the current maintainer of the packaging environment for the Zikula Application Framework for the last year or so. Besides that, I am the team leader of the Dutch Zikula Community for the last five years, and maintain all dutch translations for the project. I never really contributed any code to the project, but behaved more as a sidekick between developers and the users, mainly providing support. I have basic knowledge of *nix systems, but have better specialties in PHP OOP, Databases, CVS/SVN repositories and packaging. For the Documentation Project, I will assist Simon and the rest of the newly involved list members with the new Fedora Docs portal. And therefore have applied to the sysadmin and sysadmin-test groups. Arjen (aka Teb)

3 2

Introduction
by David Nalley 29 Jan '09

29 Jan '09

Let me first apologize for what will inevitably be a stream of people introducing themselves for work on setting up Zikula. My name is David Nalley, and I am ke4qqq on IRC. Eric (sparks) has asked me to come work with the Zikula guys on getting things setup on Fedora's infrastructure. I work as a mainly Linux sysadmin in Liberty, SC and have done so for around 6-7 years now. The bulk of my work focusing on RHEL/CentOS 3-5. So as far as identifying what I want to work on, Ticket 1155 is I suppose my first priority, though I did tell Mike I'd volunteer to do some inventory-type stuff for him. I've applied for sysadmin and sysadmin-test for the time being. Let me know if there is more needed of me.

2 1

CSI (Security Policy)
by Mike McGrath 29 Jan '09

29 Jan '09

Hey all. I've placed our security policy CSI docs in a standard location now. Just a reminder: If you have shell access on any of our servers you need to be compliant with all of these rules by the end of March. Which should be plenty of time to get any oddities worked out. http://infrastructure.fedoraproject.org/csi/security-policy/en-US/ -Mike

3 4

Introducing Myself
by Simon Birtwistle 29 Jan '09

29 Jan '09

All, Having just requested access to the sysadmin and sysadmin-test groups on FAS and on the advice of David Nalley I thought I should introduce myself. I have been working with the docs team over the last week on the possibility of running the Zikula Application Framework as the CMS behind docs.fedoraproject.org. I am a member of the board of the Zikula Software Foundation and the Zikula Steering Committee, and I have been acting as the lead in discussions about how to best address the needs of the docs project on their website, and the needs of the Fedora project at large. My name is Simon Birtwistle, and I'm currently located in Cambridge in the UK. I am in the final year of studying for a degree in Computer Science at Cambridge University, and providing all goes well I'll be graduating in June. I've used Fedora on and off for years and years, though despite thinking about it I never got around to contributing. Most of my time is taken up with the Zikula project, where my work with the Steering Committee involves project management and day to day organisation, but I'm hoping that I can combine my work there with useful work on the Fedora websites where it's helpful. Skills wise, I am mainly a web developer, as you'd expect, with a good knowledge of PHP and MySQL. I also have experience with Java as well as C# .NET and some other less well known languages from my degree course. I have also used Docbook in the past for Zikula project documentation, so I at least have a vague idea where the docs project are coming from. I'm hoping that I, and Zikula as a project, will be able to provide a big boost to the docs project's publishing workflow. Simon

2 1

change request: python-hashlib install on builders
by Jesse Keating 29 Jan '09

29 Jan '09

Since the change on fedorapeople was a success, we need to make this change on the builders as well. The problem is that when we create rawhide each night, we have random builders create a chroot in order to run pungi in. The chroot is generated from the freshly made rawhide repos, which have the newer sha256 sum in them. We need a newer yum and the python-hashlib build in order for the host yum to be able to process that metadata and generate the chroot. -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating

5 9

change request: python-hashlib install on fedorapeople.org and new yum
by Seth Vidal 28 Jan '09

28 Jan '09

in order to stop the rss feed generator from kvetching I'd like to install the new python-hashlib and new yum pkgs (from rhel 5.3) on fedorapeople. Can I get a couple of +1's? thanks, -sv

6 5

Automating hosted projects?
by Paul W. Frields 28 Jan '09

28 Jan '09

Hi Infrastructure team, Not sure if this inquiry belongs here or on websites, but I'll start here. Personally my experience has been that the Fedora admins act on requests for Fedora Hosted projects requests very quickly. Some potential contributors may want or need more instantaneous results, and I would hate to see folks going to somewhere like Google Code if we can keep their projects more open and transparent (and portable) to the community. Does the team have any sense as to whether we could further automate the Fedora Hosted project creation process? -- Paul W. Frields http://paul.frields.org/ gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717 http://redhat.com/ - - - - http://pfrields.fedorapeople.org/ irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug

11 19

What is doing this?
by Mike McGrath 27 Jan '09

27 Jan '09

We've got a cron job that creates the fedorahosted webpage. It produces (on occasion) this output: ========== START ============== ...... done. ...... done. ========== END OUTPUT ========= I've been poking at it for a bit and I just don't know what is causing that, so to the list I came. Anyone have any bright ideas? I've attached the script. My first inclination is that it's the make. But what in it is causing this to happen sometimes but not every time? -Mike

5 6

Change request
by Mike McGrath 26 Jan '09

26 Jan '09

I'd like to diff --git a/manifests/servergroups/phx.pp b/manifests/servergroups/phx.pp index 312b378..038caea 100644 --- a/manifests/servergroups/phx.pp +++ b/manifests/servergroups/phx.pp @@ -10,6 +10,7 @@ class phx { } host { 'admin.fedoraproject.org': ip => '10.8.32.121', + alias => ['mirrors.fedoraproject.org',] } host { 'cvs.fedoraproject.org': ip => '10.8.34.151', Can I get 2 +1's? -Mike

3 4

DRBD
by Mike McGrath 26 Jan '09

26 Jan '09

I have a small research project if someone is interested in taking it up. I want to know of Debian, Ubuntu, SuSE and the other major distributions, How many of them include DRBD by default or via some official channel. Also, of people on this list, how many of you use DRBD, in what capacity and what do you think of it? -Mike

11 12

Change Request: python-bugzilla and packagedb on app servers
by Toshio Kuratomi 23 Jan '09

23 Jan '09

The update of the packagedb yesterday has a problem. The bugzilla checking code doesn't work when started as the apache user because python-bugzilla issues a traceback when it's unable to write to a cookiefile in the user's home directory. This is preventing anyone from taking ownership of a package including new branch requests. I've got an updated python-bugzilla and packagedb that address this. I'd like to install them on the app servers. Can I get some +1's to do this tomorrow? -Toshio

3 2

Alpha Release Readiness
by John Poelstra 22 Jan '09

22 Jan '09

With the Alpha Release for Fedora 11 scheduled for Tuesday, February 3, 2009, this means it is time to meet again with representatives from each of the teams to have our release readiness meeting. We usually have this meeting at 18:00 UTC (13:00 EST) the Wednesday before, which means next Wednesday, January 28, 2009, is the day. On Monday, January 26, 2009, I will be sending out the dial-in information and a meeting reminder to all the attendees. In the meantime I need to know who will be representing your group at these meetings for the Fedora 11 meetings. Usually this is the designated team leader, but I wanted to ask to make sure you coordinate within your team to make sure someone comes. When responding to this list, please CC me so that I am sure to see the reply. This message is going out to the respective mailings lists for these groups: Ambassadors Artwork/Design Documentation FESCo Infrastructure Marketing Quality Release Engineering Translation Websites Thanks, John

2 1

Change freeze
by Mike McGrath 22 Jan '09

22 Jan '09

We are FROZEN! Sorry for the short notice, the alpha always sneaks up on us. But we are now FROZEN! Whats this mean? Well, http://fedoraproject.org/wiki/Infrastructure/SOP/Release#Change_Freeze BAM! It means that. This is a pre-freeze so many things aren't frozen (see that link to find what does and does not apply to you). We will unfreeze 2009-02-04. If you've got something to do, make sure it gets +1'ed. Also, we'll be doing a fairly major upgrade after the Alpha ships of moving from RHEL 5.2 to RHEL5.3 I haven't done any work on this yet but will over the coming months to see if we will run in to any issues. -Mike

1 0

Disk IO issues
by Mike McGrath 22 Jan '09

22 Jan '09

Lets pool some knowledge together because at this point, I'm missing something. I've been doing all measurements with sar as bonnie, etc, causes builds to timeout. Problem: We're seeing slower then normal disk IO. At least I think we are. This is a PERC5/E and MD1000 array. When I try to do a normal copy "cp -adv /mnt/koji/packages /tmp/" I get around 4-6MBytes/s When I do a cp of a large file "cp /mnt/koji/out /tmp/" I get 30-40MBytes/s. Then I "dd if=/dev/sde of=/dev/null" I get around 60-70 MBytes/s read. If I "cat /dev/sde > /dev/null" I get between 225-300MBytes/s read. The above tests are pretty consistent. /dev/sde is a raid5 array, hardware raid. So my question here is, wtf? I've been working to do a backup which I would think would either cause network utilization to max out, or disk io to max out. I'm not seeing either. Sar says the disks are 100% utilized but I can cause major increases in actual disk reads and writes by just running additional commands. Also, if the disks were 100% utilized I'd expect we would see lots more iowait. We're not though, iowait on the box is only %0.06 today. So, long story short, we're seeing much better performance when just reading or writing lots of data (though dd is many times slower then cat). But with our real-world traffic, we're just seeing crappy crappy IO. Thoughts, theories or opinions? Some of the sysadmin noc guys have access to run diagnostic commands, if you want more info about a setting, let me know. I should also mention there's lots going on with this box, for example its hardware raid, lvm and I've got xen running on it (though the tests above were not in a xen guest). -Mike

16 43

FYI: New packagedb depends on python-bugzilla snapshot
by Toshio Kuratomi 21 Jan '09

21 Jan '09

Just a heads up. I've updated the app servers with a new version of the packagedb today. This reflects the most recent code from the bzr repository. It requires a snapshot package of python-bugzilla in order to do checking of bugzilla email accounts. I've added both python-bugzilla-0.4-0.2.20080121git packages and packagedb packages to the infrastructure repo for epel-5[1]_ and fedora-10[2]_. If you need it for a different release, the SRPMs are present so you should be able to do a rebuild. .. _[1]: http://infrastructure.fedoraproject.org/el/5/ .. _[2]: http://infrastructure.fedoraproject.org/fedora/10/ -Toshio

1 0

TMOUT
by Mike McGrath 21 Jan '09

21 Jan '09

Hey guys, so we talked about this... well, a long time ago and decided to do it but it never got implemented. So I'm going to implement it now and its likely going to cause some people pain for now. I'm going to set the default bash TMOUT value to 32400 (9 hours). If you need to overwrite this, you can do it in your bashrc though its recommended that you not do that. I'm going to add this to the security policy as this is a security measure. I'll do it tomorrow morning so get ready. -Mike

1 1

Fedora Security Policy
by Mike McGrath 21 Jan '09

21 Jan '09

So I've added some suggested changes and would like to do this on the list instead of on IRC. So here's what I propose: http://mmcgrath.fedorapeople.org/policy/ [1] 1) I'd like everyone in a sysadmin* group to be compliant with this policy as part of orientation for new members. 2) I'd like everyone who is already in a sysadmin* group to become compliant with this standard by March 31st 2009. PLENTY of time to make whatever changes you need to make. 3) We'll continue to refine this policy but never with the assumption that everyone is immediately compliant. Notice will be given. -Mike [1] I'm working on finding permanent hosting for that, but for now fedorapeople will work.

3 3

Infrastructure FAD?
by Jeffrey Ollie 20 Jan '09

20 Jan '09

Regarding: https://www.redhat.com/archives/fedora-advisory-board/2009-January/msg00017… What do people think of having an Infrastructure-related FAD (Fedora Activity Day)? Something more along the lines of a hackfest rather than a barcamp style thing. Rel-Eng folks would be welcome too since I'm sure buildsystem stuff will get discussed. Having it in Chicago or the vicinity would be cool since Mike McGrath and Dennis Gilmore are nearby (and I'm not that far off either). Or if you really wanted to get crazy we could have it in Des Moines and I'd be willing to take care of most of the legwork. I might even be able to get some conference space at $DAYJOB for relatively little cost (one bonus of this would be better-than-most-hotel wireless and Internet). Timewise I'm thinking a Saturday in February... Anyway, as long as it's no further from Des Moines than Chicago I'd make a serious attempt to attend... (It's really sucked that I haven't been able to get to a FUDCon). -- Jeff Ollie "You know, I used to think it was awful that life was so unfair. Then I thought, wouldn't it be much worse if life were fair, and all the terrible things that happen to us come because we actually deserve them? So, now I take great comfort in the general hostility and unfairness of the universe." -- Marcus to Franklin in Babylon 5: "A Late Delivery from Avalon"

5 7

Fedora Weekly news
by Mike McGrath 20 Jan '09

20 Jan '09

Any volunteers to keep in touch with FWN about our goings on? https://fedoraproject.org/wiki/FWN/Issue159 -Mike

3 3

RFC - sysadmin guidelines
by Mike McGrath 19 Jan '09

19 Jan '09

This isn't really required but it's my intention to implement these policies (or what we come to after some discussion). This is targeted _ONLY_ at this team and those with shell access to our servers. Its not my intention to roll it out to the larger community, though its certainly a good idea for people to read through it. http://mmcgrath.fedorapeople.org/policy/ Give these a read and think on them some. There's quite a bit there. I understand that much of what is listed there is impossible to enforce, and I certainly don't think we'll be at the point where I'm removing people from groups who aren't following the policies but I'm hoping it won't come to that. For now though I'm thinking the honor system. -Mike

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure January 2009