infrastructure January 2009

infrastructure@lists.fedoraproject.org

51 participants
43 discussions

RE: transport maps for bastion
by Chris Johnson 19 Jan '09

19 Jan '09

I'm new to the environment but have exp with postfix @ $DAYJOB, so I figure this might be something I can contribute to without sounding too dumb, but if I do please take it easy. :) >Currently all mail which goes through bastion (for example all >@fedoraproject.org mail) then relays through mx.util.phx.redhat.com. I'm not sure what bastion is but my question is why is the relay going through mx.util.phx.redhat.com currently? I'm guessing bastion is the host the @fedoraproject.org email is delivered on. (?) I can't find mx.util.phx.redhat.com in public dns is there an ACL on the zone or is this an /etc/host entry? Is the relay to mx.util.phx.redhat.com done via a relayhost entry in main.cf? Also, where does mail go after mx.util.phx.redhat.com, I'm guessing there's another hop before the internet because of the dns failure. >Which are all redhat.com boxes. So our mail goes from there, to bastion >to expand out the aliases we have (ultimately) then back to >mx.util.phx.redhat.com to be relayed out to the rest of the world. back to mx.util.phx.redhat.com? does it come from their or from the MX hosts? > >For various reasons mail bound from bastion to @redhat.com addresses >probably needs to go through mx.util.phx.redhat.com, however, mail not >bound for @redhat.com shouldn't have to. Just curious as the the "various reasons" you mention here. >I'm proposing using a postfix transport map which explicitly says: >.redhat.com smtp:mx.util.phx.redhat.com >redhat.com smtp:mx.util.phx.redhat.com >* : > I believe you could also remove the last line and if a relayhost is used in main.cf comment it out. It should do the same thing since postfix uses dns mx or A record for next hop delivery. > >So my question for all you nice people is: > >Can anyone see any problem with doing this? I've tested it out on a >different mail server I take care of and it works fine. I would wonder if this is needed at all? why can't the redhat.com domain go to the mx too? just curious. As long as redhat.com isn't one of bastion's postfix mydestination I would expect everything to still work and be a much easier config to change or troubleshoot later. /me likes things as simple as possible :-) PS. was there a meeting yesterday? I was planning on joining but had a conf call scheduled and didn't see notes from the list. JCJ

2 1

transport maps for bastion
by Seth Vidal 19 Jan '09

19 Jan '09

Currently all mail which goes through bastion (for example all @fedoraproject.org mail) then relays through mx.util.phx.redhat.com. So, if we look at our mail route it is: primary mxes for fedoraproject.org are: ;; ANSWER SECTION: IN MX 40 smtp.fedora.redhat.com. IN MX 10 mx1.fedoraproject.org. IN MX 20 mx2.fedoraproject.org. IN MX 30 mx3.fedoraproject.org. Which are all redhat.com boxes. So our mail goes from there, to bastion to expand out the aliases we have (ultimately) then back to mx.util.phx.redhat.com to be relayed out to the rest of the world. For various reasons mail bound from bastion to @redhat.com addresses probably needs to go through mx.util.phx.redhat.com, however, mail not bound for @redhat.com shouldn't have to. I'm proposing using a postfix transport map which explicitly says: .redhat.com smtp:mx.util.phx.redhat.com redhat.com smtp:mx.util.phx.redhat.com * : This says: for mail bound to redhat.com or anyhost.redhat.com - relay to mx.util.phx.redhat.com for any other email, relay normally (ie: by the destinations normal paths) So my question for all you nice people is: Can anyone see any problem with doing this? I've tested it out on a different mail server I take care of and it works fine. -sv

2 2

Why puppet uses config instead of configs?
by susmit shannigrahi 19 Jan '09

19 Jan '09

Hi, In puppet when we add a new file, we use this lines in the .pp files: source => 'puppet:///config/web/applications/FreeMedia-error.html', where as the actual location of the file (FreeMedia-error.html) is [susmit@puppet1 puppet]$ find -name FreeMedia-error.html ./configs/web/applications/FreeMedia-error.html So the source in the .pp file should be 'puppet:///configs/web/applications/FreeMedia-error.html' Why this discrepancy? Just curious... Thanks. -- Regards, Susmit. ============================================= ssh 0x86DD170A http://www.fedoraproject.org/wiki/user:susmit =============================================

2 1

mod_wsgi issue: solved
by David Malcolm 14 Jan '09

14 Jan '09

I've been trying to deploy rpmgrok (a Turbogears 1 app [1]) behind mod_wsgi, and finally figured out why mod_wsgi stopped working when I added a WSGIProcessGroup directive (which avoids having to start a new process per http request) I know bpeck has had similar issues with his "beaker" code [2] It was working on publictest14.fp.org, but not on my local workstation (both RHEL-5 running mod_wsgi from EPEL). Attempts to browse led to no response coming from httpd, and no log. It turned out, I had mod_python installed on the box. Upon disabling "LoadModule python_module modules/mod_python.so" from /etc/httpd/conf.d/python.conf it worked. Known issue? http://code.google.com/p/modwsgi/wiki/InstallationIssues describes another mod_wsgi/mod_python incompatibility, but the symptoms seem different [3] Hope this helps Dave [1] https://fedorahosted.org/rpmgrok/ [2] https://fedorahosted.org/beaker/ [3] debugging attempts led me to find "stuck" httpd threads waiting forever for the global interpreter lock, presumably acquired by mod_python elsewhere in the process: (gdb) bt #0 0x005bf402 in __kernel_vsyscall () #1 0x0018331e in sem_wait(a)GLIBC_2.0 () from /lib/i686/nosegneg/libpthread.so.0 #2 0x01d97f3b in PyThread_acquire_lock () from /usr/lib/libpython2.4.so.1.0 #3 0x01d74d57 in PyEval_RestoreThread () from /usr/lib/libpython2.4.so.1.0 #4 0x01d9104f in PyGILState_Ensure () from /usr/lib/libpython2.4.so.1.0 #5 0x00c65785 in wsgi_start_process (p=0x918a550, daemon=0x92b91a8) at mod_wsgi.c:8706 #6 0x00c661b3 in wsgi_hook_init (pconf=0x918a550, ptemp=0x91b8608, plog=0x91bc618, s=0x918c3f0) at mod_wsgi.c:8919 #7 0x00c27783 in ap_run_post_config (pconf=0x918a550, plog=0x91b8608, ptemp=0x91bc618, s=0x918c3f0) at /usr/src/debug/httpd-2.2.3/server/config.c:91 #8 0x00c1311d in main (argc=152602056, argv=0x9281448) at /usr/src/debug/httpd-2.2.3/server/main.c:706 and: grep /proc/$PID/maps mod_ showed mod_python to be loaded.

3 3

Introduction - François Cami
by FD Cami 11 Jan '09

11 Jan '09

Hi list, I'd like to get involved in the Fedora Infratructure projet, helping with RHEL/Xen administration, network security, backups... I have been running Linux for close to ten years, going from then-Mandrake to Slackware, then Gentoo, CentOS and Fedora. I know Bash, Python, C, and some Perl/PHP ; and also LVM, squid, apache, postfix, iptables/netfilter, bind, samba, and assorted apps like mailman and request-tracker. My day life gravitates between RHEL5/Xen and Cisco PIX and Catalyst administration. I live in UTC+1/UTC+2. My Freenode IRC nickname and FAS account are both fcami. Best regards, F.D. Cami

1 0

Introduction
by Ricardo Ichizo 11 Jan '09

11 Jan '09

Hi all, I'm Ricardo Ichizo from Brazil. Currently, I'm involved with Fedora Ambassador project, but I'd like to contribute and help this project too. I'm a LPI 2 certificate and I work as System Analyst (C and Python/Django). I have three year of experience with PostgreSQL and Oracle Databases (DBA). And I also work as infrastructure consultant (independent). Before send this email I was looking the trac system of Infrastructure project and I guess I could help a little ;) Best Regards, -- Ricardo Ichizo

2 1

Introduction: This is me...
by Jeff Williams 10 Jan '09

10 Jan '09

Hello. My name is Jeff Williams and have been looking for a Fedora group to join to contribute in at least a small way. I have been a Unix and Linux sysadmin for at least 13 years (in addition to other sysadmin experience on other platforms). I am also a systems programmer (mostly C but lots of ksh/bash/awk) and all-around computer handyman. I don't have a ton of time to contribute to the efforts of this group right now but would like to at least see how the group operates and what the processes are. Looking forward to it. Jeff

2 2

Hello List...
by Matthew ... 10 Jan '09

10 Jan '09

Hi all, Just a quick introduction, to say my names Matt, and after using Linux for several years I thought I'd try and make a contribution of some sort. Not really sure what I can do to help but thought i would start by just watching what goes on. I have a few skills that may/may not be of help. I'm quite good with PHP/AJAX/XML I can use mysql, but have never done anything overly complicated with it. I have done some Bash/Perl scripting and I'm not afraid to do more! I would like to learn more about Python. I'm a certified RHCE and i'm pretty good with RHN-Satellite although that probably is not so useful :) other than that... i'm pretty good with Cisco ASA's and switches and general networky things. Hope I can be of help, Regards, Matt.

2 1

Installed Trac plugins not showing up.
by susmit shannigrahi 08 Jan '09

08 Jan '09

Hi, I am talking about this one https://fedorahosted.org/freemedia/ I have installed the eggs of customfield plugin and webadmin plugin. But they are not showing up. May be I need to enable them trac.ini. I don't find it in puppet and neither can I see it through TracAdmin panel. -- Regards, Susmit. ============================================= ssh 0x86DD170A http://www.fedoraproject.org/wiki/user:susmit =============================================

6 14

FUDCon
by Mike McGrath 08 Jan '09

08 Jan '09

Just a reminder to everyone, FUDCon is on the way soon. Many of us (myself included) will be traveling and not as available as usual. Please be extra careful about any changes you make. For example, don't make a change to our global.pp file and then get on an air plane. -Mike

3 2

koji and package dependencies
by Doug Reiland 08 Jan '09

08 Jan '09

Is this list the right place to ask koji releated questions? If so: I am playing with koji by setting up a local build system. I have am able to do some examples like build the bash package. I am now attempting to setup a large collection of packages and wondering about package dependencies and ordering. How do you prepare a koji-builder system or is that taken care of? For example, if package X requires program foo to build, do I need to be aware of this and make sure foo is on koji-builder system. Thanks

2 1

[Fwd: Account Security Question]
by Ignacio Vazquez-Abrams 07 Jan '09

07 Jan '09

For your consideration. -------- Forwarded Message -------- From: Michael Tant <mtant621(a)charter.net> To: webmaster(a)fedoraproject.org Subject: Account Security Question Date: Wed, 7 Jan 2009 14:22:20 -0500 Upon creating my account on the fedoraproject site, I was asked to submit a public key and download a client certificate. First, what is the public key used for? I sent a 1024 rsa pubkey made with ssh-keygen. Does it have to be rsa or can I change that to a 2048 dsa key? I commonly use my windows side to access the internet and my linux side more as a server than a terminal side, though it has client side available. Should the dsa public key be kept on the browser side, or isolated to the linux side? The Private Key is kept offline on removable media. In regards to the certificate, it requests I add this to a particular location in the system. Is the certificate used to authenticate my sessions with fedoraproject or just for the purposes of linux developing? If it is used for authentication, can this be used on a windows based system, or should I login from my linux side? I'm not a developer as of yet, my programming skills are hardly up to par yet. Regardless of the use, events of yesterday lead me to ask, is this a MD5 hash or SHA1 or SHA2 hash? I ask this because of the collision exploit to md5 certificates. Please let me know, and if it is a MD5 hash, can I request a SHA clientside certificate? Being new to Linux, I am thrilled to to have membership in fedoraproject, as I have found linux nearly superior to windows in many areas. Thank You, Michael Tant -- Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>

2 1

error syncing archive.fedoraproject.org
by Adrian Reber 05 Jan '09

05 Jan '09

Syncing archive.fedoraproject.org::fedora-archive/fedora/ I get following errors: rsync: send_files failed to open "/fedora/linux/core/1/i386/iso/.yarrow-SRPMS-disc3.iso.zLIL8J" (in fedora-archive): Permission denied (13) rsync: send_files failed to open "/fedora/linux/core/1/x86_64/iso/.yarrow-x86_64-disc1.iso.kBKjTE" (in fedora-archive): Permission denied (13) Adrian

3 2

Is executing php scripts from fedorapeople possible?
by susmit shannigrahi 04 Jan '09

04 Jan '09

http://susmit.fedorapeople.org/freemedia/form.php When I click on submit, it shows the code, but does not execute. Is there any workaround for this? Or I am missing something really easy? Thanks. -- Regards, Susmit. ============================================= ssh 0x86DD170A http://www.fedoraproject.org/wiki/user:susmit =============================================

2 2

calling out for a sponsor
by Sascha Thomas Spreitzer 04 Jan '09

04 Jan '09

Hello list, im shouting out for a sponsor, is someone willing to sponsor me? -- Mit freundlichen Grüßen, / with kind regards, Sascha Thomas Spreitzer http://spreitzer.name/

3 2

Outage Notification - 2009-01-03 04:16 UTC
by Mike McGrath 03 Jan '09

03 Jan '09

There is a current unscheduled outage starting at 2009-01-03 UTC, which will last for an unknown amount of time. To convert UTC to your local time, take a look at http://fedoraproject.org/wiki/Infrastructure/UTCHowto or run: date -d '2009-01-03 04:16 UTC' Affected Services: Fedora Hosted (Auth) Mail Websites (FAS, PackageDB and other applications that use PostgreSQL) Any services that require authentication that are not shell based or cert based Unaffected Services: Buildsystem Database (Partial) CVS / Source Control DNS Mirror System Torrent Translation Services Reason for Outage: The server that hosts db2 is currently down. The biggest impact of this is authenticated services are offline. A technician has been called and services will be restored as soon as possible. ETA for tech on site is around 3-4 hours. Contact Information: Please join #fedora-admin in irc.freenode.net or respond to this email to track the status of this outage.

1 1

Getting Started
by Luiz Augusto Machado da Silva 01 Jan '09

01 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I am the Fedora Ambassador and work as network administrator using Red Hat. I have experience with openldap, squid, samba, virtualization among several other routine services to a sysadmin, as always worked to support the infrastructure that I believe this is my place. - -- Luiz Augusto Machado Administrador de Redes Fedora Ambassador luizmachado(a)fedoraproject.org + 55(63)84298414 FINGERPRINT: 9490 A0EB C4DA 2FEA BAB4 AD85 58CF BA2B 4381 D7E1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkldawsACgkQWM+6K0OB1+Hg0QCeNBjAbcFz4GbqyDk+o99cSf73 cJwAoMavDLPrc2r0PwHYbEsSomsWtAly =hTXX -----END PGP SIGNATURE-----

1 0

Fwd: Fedora-infrastructure-list post from josemanimala@gmail.com requires approval
by Jon Stanley 01 Jan '09

01 Jan '09

My bad, Jose had posted an apology to the list (below) but I accidentally deleted it rather than released it I think. Anyhow, here it is. Jose - I've removed the moderation bit from your subscription. Sorry for the inconvenience. ---------- Forwarded message ---------- From: "jose manimala" <josemanimala(a)gmail.com> To: fedora-ambassadors-list(a)redhat.com, fedora-infrastructure-list(a)redhat.com Date: Wed, 31 Dec 2008 23:47:49 +0530 Subject: Sorry Hi everyone, I am really sorry about the accidental forward. I apologize for my mistake sorry again. The website imported my entire address book and I didnt know that every email address I ever used was included in it. regards -- Jose M Manimala Ph: +919790824111 http://www.jmmblog.in.eu.org GPGkeyID: F5DD9656 ---------- Forwarded message ---------- From: fedora-infrastructure-list-request(a)redhat.com To: Date: Subject: confirm a414d19abae28acc2742ed364e7060a853196212 If you reply to this message, keeping the Subject: header intact, Mailman will discard the held message. Do this if the message is spam. If you reply to this message and include an Approved: header with the list password in it, the message will be approved for posting to the list. The Approved: header can also appear in the first line of the body of the reply.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure January 2009