Forcing environment in SSH

It's quite easy to force environments variables in an SSH session, since /etc/profile, /etc/bash.bashrc etc. are read. But when you launch commands with SSH without opening a session, these files are not parsed, so it gets harder to set the environment.

So it can be useful to know that /etc/environment is read by SSH aswell as login. The format is "VARIABLE=VALUE" for each line. In my case, I needed to force TMPDIR to "/var/lib/gforge-dop/chroot/tmp" so I just put "TMPDIR=/var/lib/gforge-dop/chroot/tmp" in /etc/environment and it worked :)

You can test if your variable is added by doing :
ssh user@host env

and see if your variable is listed properly by env.


If you need to set environment variables per user, you can use ~/.ssh/environment. In order to do that, you need to set PermitUserEnvironment to "yes" in sshd_config and restart sshd.

SSH + pam_chroot

I've been trying to get pam_chroot to work with ssh. There's a few little things to do to get it to work.

• Install pam_chroot and set your chroot. See http://singe.za.net/blog/archives/378-Linux-SSH-Jail-with-pam_chroot.html
  
• Set UsePrivilegeSeparation to "no" in sshd_config and restart sshd
  
• Add the pam_chroot line to /etc/pam.d/ssh aswell as /etc/pam.d/login.
  
• Make sure there's a /tmp dir in your chroot. If not, create it : mkdir -m 1777 $CHROOTDIR/tmp
  
• Make sure you have the libs to execute your shell inside the chroot. A bit of a barbarian way to do that (adapt to your shell) is :
  cp $(ldd /bin/bash | sed -e "s/.* => \([^\)]*\) .*/\1/") $CHROOTDIR/lib/
  
  
  If you need to debug:
  
• Turn on debug in the pam_chroot line of /etc/pam.d/ssh. This will display the debug messages in /var/log/auth.log on Debian.
  
• Turn on debug in sshd ('SSHD_OPTS="-d"' in /etc/default/ssh) and restart sshd.
  
• Use verbose on your ssh client.
  
• Check the logs inside the chroot too, if you have syslogging on.
  

Thou shalt not loop

I've been using incron extensively to write a CVS synchronizer for my company lately (the last post about Perl modules was part of that). This synchronizer uses incron to monitor all CVSROOT/history files. When history files are modified, the script is launched, analyzes the changed files and synchronizes them (using the tar|tar method described in my last post) to the fallback machine. This allows to have a pretty much synchrone fallback... but that's without counting on the developers using the machine... Some of them commit as much as 300 files a minute, which triggers the script just as many times!

Of course, one of the first things I wrote in the script is a lock. In that case, it uses Proc::Processtable to make the script exit if it is already running on the same history file. But that was not enough.

Then I discovered IN_NO_LOOP. This optional parameter in incrontab is described this way:


Additionaly, there is a symbol which doesn't appear in the inotify symbol set. It is IN_NO_LOOP. This symbol disables monitoring events until the current one is completely handled (until its child process exits).



This solved my problem. When an history file is changed, incron fires the command and disables the monitoring on this history file until the command returns.

Modular tar pipe tar in Perl

I was trying to write a nice tar pipe tar system in a perl script, and got to this, which I think can be useful:



#!/usr/bin/perl


use Archive::Tar;
use Net::SSH;


my $tar = Archive::Tar->new;

my $dir = "/path/to/dir";
# Copy files from dir without recursion
my @files = glob("$dir/*");
$tar->add_files(@files);


$user = "root";
$host = "myhost.example.org";
$cmd = "cd / && tar xf -";

Net::SSH::sshopen2("$user\@$host", *READER, *WRITER, "$cmd") || die "ssh: $!";

print WRITER $tar->write;
close(WRITER);
close(READER);





If you know of a nicer way to do it, I'm open to ideas :)

Its name is...

Playing the Ubuntu meme, too...


I usually name my machines after the characters in Narnia. For a long time, my main desktop machine was thus called aslan. My laptop was peter, and my online server was caspian. Then I reinstalled peter and renamed it lucy, and my online server died and I gave the caspian name to ... my USB key!

Now I tend to use names from Bible characters. The last machine I installed is called caleb, after Joshua's companion when the Hebrews reached Israel.

Look Ma, no mouse!

I have recently set up a small LTSP network for an association in my street. Some days ago, I was asked if it was possible to display photos on all of the LTSP machines at the same time to show the activities of the association. This is of course very easy to set up, but I didn't want to leave keyboards or mice on the computers, to make sure nobody would exit the photo program or try to reboot the machine.

The quickest solution I found to do that easily was to use synergy and wireless keyboard and mouse. Synergy allows to share keyboards and mice between several computers, running Windows, MacOS or Linux. It actually goes further than this, since you can also copy and paste contents (text, images, etc) from one computer to another. The down side of it is that it's not secure, but that was not a problem in my case at all.

So in my case, I just started synergys on the main machine (the LTSP server) having set virtual screens in synergy.conf for all the ltsp thin clients. Then I started synergyc on each client with synergyc --name ltsp1 localhost, adapting the name for each machine. Finally, I removed all keyboards and mice from the computers and only left the wireless keyboard and mouse on the LTSP server. This left me with a group of computers without any keyboards or mice plugged to them, which could each be controlled by a wireless devide, by simply dragging the wireless mouse from a screen to another. All that was left to do was to launch the slideshows on each machine and hide the keyboard and mouse in a corner, to be used only when necessary.

Comme un grain de riz...

Jeudi matin, Jimena et moi sommes allés chez le radiologue... C'était déjà notre deuxième rendez-vous médical cette semaine, le premier était chez le gynécologue. Et c'est ce jeudi matin que nous l'avons aperçu pour la première fois.

Grand comme un grain de riz, à peine 15 mm, l'embryon qui grandit pour devenir notre enfant a déjà le coeur qui bat à 158 battements par minute!


Nous remercions Dieu de sa fidélité et lui remettons cette grossesse, puisqu'il sait mieux que nous les bénédictions qu'il réserve pour l'avenir.

Augeas 0.3.1

Augeas 0.3.1 is out! This is the announcement from the augeas-devel mailing-list:

I am pleased to announce the release of Augeas 0.3.1; it has been much
longer than I'd like since the last release, and this release contains
many more changes than is betrayed by the small change in version
numbers.

There has been a tremendous amount of activity both in enhancing
existing lenses and in writing new ones. I have tried to keep track of
all the contributors in the NEWS - if you sent a patch and didn't get
credit for it, please remind me (gently ;) With that much activity in
lens-writing, I feel that we need to figure out a way to indicate which
lenses we consider 'finished' and which ones we consider 'experimental',
so that users know where changes in the tree are likely.

The release can be downloaded from:

Tarball: http://augeas.net/download/augeas-0.3.1.tar.gz
Fedora RPM's are making their way through the build system

Detailed NEWS:

- Major performance improvement when processing huge files, reducing
some O(n^2) behavior to O(n) behavior. It's now entirely feasible
to manipulate for example /etc/hosts files with 65k lines
- Handle character escapes '\x' in regular expressions in compliance
with Posix ERE
- aug_mv: fix bug when moving at the root level
- Fix endless loop when using a mixed-case module name like
MyMod.lns
- Typecheck del lens: for 'del RE STR', STR must match RE
- Properly typecheck the '?' operator, especially the atype; also
allow '?' to be applied to lenses that contain only 'store', and
do not produce tree nodes.
- Many new/improved lenses
* many lenses now map comments as '#comment' nodes instead of just
deleting them
* Sudoers: added (Raphael Pinson)
* Hosts: map comments into tree, handle whitespace and comments
at the end of a line (Kjetil Homme)
* Xinetd: allow indented comments and spaces around "}" (Raphael Pinson)
* Pam: allow comments at the end of lines and leading spaces
(Raphael Pinson)
* Fstab: map comments and support empty lines (Raphael Pinson)
* Inifile: major revamp (Raphael Pinson)
* Puppet: new lens for /etc/puppet.conf (Raphael Pinson)
* Shellvars: handle quoted strings and arrays (Nahum Shalman)
* Php: map entries outside of sections to a '.anon' section
(Raphael Pinson)
* Ldap: new lens for /etc/ldap.conf (Free Ekanayaka)
* Dput: add allowed_distributions entry (Free Ekanayaka)
* OpenVPN: new lens for /etc/openvpn/{client,server}.

conf (Raphael Pinson)
* Dhclient: new lens for /etc/dhcp3/dhclient.conf (Free Ekanayaka)
* Samba: new lens for /etc/samba/smb.conf (Free Ekanayaka)
* Dnsmasq: new lens for /etc/dnsmasq.conf (Free Ekanayaka)
* Slapd: new lens for /etc/ldap/slapd.conf (Free Ekanayaka)
* Sysctl: new lens for /etc/sysctl.conf (Sean Millichamp)

David

An updated package is already in Debian, thanks to Free, and Nicolas (aka nxvl) will try to get an exception to include it in Intrepid before it's too late.

In other news, I'm likely to give a talk on Augeas at the JM2l in Sophia Antipolis.

NaturalDocs

While the collection of available Augeas modules is increasing dramatically, there is more and more of a need for a good documentation. Some time ago, R. I. Pienaar (aka Volcane) made a proposition to write standard inline documentation in Puppet modules, using the NaturalDocs tool. I thought I would just try to see if it could easily be used to document Augeas modules.

After a few attempts, I found that I was rewriting all my code in the comments, and that was not very optimized, so I wrote to the NaturalDocs's developer, Greg Valure, to ask him about how hard it would be to support the Augeas language in ND. Not only did he answer quickly, but he provided better configuration files for ND, aswell as a Perl Module to enhance Augeas's support in ND! Thank you very much Greg, you are a great help!

So I spent some more time trying to enhance the comments in the example modules I chose. After talking with David about it, we still feel like it would be better if we didn't have to prefix every declaration with a comment to get it included in the documentation, and if parameters and parameter types could be detected automatically by parsing the code. From what I understand, all this should be possible with ND by improving the Augeas.pm and ideally turning it into a full language support Perl Module. One down side of this is that ND is currently being rewritten in .Net/Mono, so the current work on Perl modules will not work with ND 2.0 anymore.

I also spent quite a few hours yesterday modifying the CSS stylesheet to match the Augeas website.

Now for the demo: you can see it here!

Back on Planet Ubuntu

I just updated the feed URL to my new blog on Planet Ubuntu, so my posts are now shown again on it.

I just noticed something though... The very old posts I restored on my blog are appearing as new posts, even though I set their date to their original posting date (back in 2004, 2005 and so on), so there's some posts about testing Warty that appear on Planet. It will pass soon as other people post. I don't really know how to fix this right now. Sorry guys.

Old posts restored

I took some time to go on archive.org and find old posts I had on my previous blog and on multiply, going back all the way to 2004. I added these posts to this new blog, so they can be seen again. Some posts may be broken, in case of missing images or javascript functions.