Grokbase
Topics Posts Groups | in
x
[ help ]

Ray Van Dolson (r...@bludgeon.org)

Profile | Posts (1)
1) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
It gets even worse... whoever had set up the system first didn't now how to get the IP address...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 01:54:32PM -0500, Robert Moskowitz wrote:
> Ray Van Dolson wrote:
> > On Fri, Dec 19, 2008 at 01:14:34PM -0500, Ross Walker wrote:
> >   
> >> On Dec 19, 2008, at 12:20 PM, Ray Van Dolson <rayvd@bludgeon.org> wrote:
> >>
> >>     
> >>> How about lots of GRE tunnels? :-)
> >>>       
> >> Well PPTP is PPP over GRE, so that's basically it.
> >>
> >> PPTP can run without encryption too if the OP really doesn't care
> >> about encryption.
> >>
> >>     
> >
> > The only thing I'll say in the world of using PPTP (via PoPToP) is to
> > consider what happens when most or all of your clients reconnect at one
> > time (network glitch, etc). This was my biggest challenge as the
> > original configuration had PPP calling all sorts of perl scripts and
> > such from its ip-up mechanism. The server would come to a complete
> > crawl as 800+ of these ip-up scripts would fire off along with their
> > associated tasks. This would result in clients timing out, links
> > failing, etc -- the server could never "catch up".
> >   
>
> I was recommending it based on the protocol. I did mention that I have
> limited deployment experience.
>
> OUCH. All that perl could really kill the user experience.....
>
> Almost as bad as a D-H exponentiation!
>

It gets even worse... whoever had set up the system first didn't now
how to get the IP address correctly from a variable in the ip-up
script.  So what'd they do?  They called grep on /var/log/messages to
look for it.

You can imagine the fun this created.... :-)
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
2) Ray Van Dolson Re: [CentOS] FTPS setup problem
| +1 vote
To the OP (sorry, jumping into a lot of threads late); what version of vsftpd are you using? A few...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 01:37:55PM -0500, Bob Hoffman wrote:
>
> >
> > When i try, i get this error message:
> >
> > SSL/TLS client handshake failed (Error = 0x80090308)
> >
> >
> >
> > Does anybody could give me a pointer on this?
> >
> >
>
> I really hope you post the end fulfillment of this problem as I want to do
> ssl with my vsftp and have not gotten around to it.
>
> Have you tried just restarting vsftp?
> I also find that I had to play with the user list allow/deny to get mine to
> work right.
>
> Can you, if you take out the ssl stuff, access it via ftp normally?
>

To the OP (sorry, jumping into a lot of threads late); what version of
vsftpd are you using?

A few months back FileZilla released a new version that "broke" TLS/SSL
support with a number of FTP servers.  I ran into the problem with
ProFTPD specifically:

http://bugs.proftpd.org/show_bug.cgi?id=3094

But vsftpd had this issue as well and was patched in v 2.0.7.  I don't
know if this fix was backported by RH or not....

I also don't know if SmartFTP client would exhibit the same problem.
You could try an older version of FileZilla (< 3.1.0) to see if it
works correctly...

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
3) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
The only thing I'll say in the world of using PPTP (via PoPToP) is to consider what happens when...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 01:14:34PM -0500, Ross Walker wrote:
>
>
> On Dec 19, 2008, at 12:20 PM, Ray Van Dolson <rayvd@bludgeon.org> wrote:
>
> > How about lots of GRE tunnels? :-)
>
> Well PPTP is PPP over GRE, so that's basically it.
>
> PPTP can run without encryption too if the OP really doesn't care
> about encryption.
>

The only thing I'll say in the world of using PPTP (via PoPToP) is to
consider what happens when most or all of your clients reconnect at one
time (network glitch, etc).  This was my biggest challenge as the
original configuration had PPP calling all sorts of perl scripts and
such from its ip-up mechanism.  The server would come to a complete
crawl as 800+ of these ip-up scripts would fire off along with their
associated tasks.  This would result in clients timing out, links
failing, etc -- the server could never "catch up".

The band-aid solution was to rate limit SYN packets that established
the connection... the permanent solution was to write a plugin for PPPd
in C that replaced most of the ip-up functionality with something a bit
more efficient.

As long as you're not needing to do any sort of complex post login
tasks for each user, this may not even end up being an issue.  But
something to keep in mind and plan for if you're talking 1500 users...
:)

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
4) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
Hmm, not sure. He's from down under and works for HP (last time I checked). Ray
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 01:11:29PM -0500, Robert Moskowitz wrote:
> Ray Van Dolson wrote:
> > On Fri, Dec 19, 2008 at 12:49:08PM -0500, Robert Moskowitz wrote:
> >   
> >> Ray Van Dolson wrote:
> >>     
> >>> How about lots of GRE tunnels? :-)
> >>>       
> >> RED can kill GRE tunnels over the net. Depends on the protocol they
> >> carry. If it is all TCP, you see a lot of slowstart. Of course if their
> >> path is free of congestion, then no RED.
> >>
> >> Plus there is a lot of configuration for GRE, and most platforms come
> >> with 'managed' tunneling like IPsec, SSLvpn, PPTP.
> >>
> >>     
> >
> > Yeah you'd definitely have to do some coding to make it manageable.
> > They always came in 'handy' but sounds like PPTP might be the way to go
> > for this particular question anyways.
> >
> > PoPToP is rock solid in my experience and the maintainer is very
> > responsive and helpful (James Cameron).
>
> same Cameron that maintains webmin?
>
> And for your Windos clients the maintainer is pretty good too. Not so
> responsive, but they pretty much have a stable platform.... :)
>

Hmm, not sure.  He's from down under and works for HP (last time I
checked).

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
5) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
Yeah you'd definitely have to do some coding to make it manageable. They always came in 'handy' but...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 12:49:08PM -0500, Robert Moskowitz wrote:
> Ray Van Dolson wrote:
> > How about lots of GRE tunnels? :-)
> RED can kill GRE tunnels over the net. Depends on the protocol they
> carry. If it is all TCP, you see a lot of slowstart. Of course if their
> path is free of congestion, then no RED.
>
> Plus there is a lot of configuration for GRE, and most platforms come
> with 'managed' tunneling like IPsec, SSLvpn, PPTP.
>

Yeah you'd definitely have to do some coding to make it manageable.
They always came in 'handy' but sounds like PPTP might be the way to go
for this particular question anyways.

PoPToP is rock solid in my experience and the maintainer is very
responsive and helpful (James Cameron).

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
6) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
How about lots of GRE tunnels? :-) Ray
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
How about lots of GRE tunnels? :-)

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
7) Ray Van Dolson Re: [CentOS] regarding vpn server for 1500 clients
| +1 vote
To OP; anecdotal evidence only -- and I certainly wouldn't recommend using PPTP for a secure VPN...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 19, 2008 at 03:42:08PM +0000, Karanbir Singh wrote:
> Rainer Duffner wrote:
> >> 1500 clients is quite a lot, but not hard to handle from a single
> >> machine if you select a cpu capable of doing ssl quickly. eg a power6
> >> machine with a few cores would handle that without any problems.
> >
> > And what is the suggested RRP of such a thing?
> > (If one may ask).
>
> I am sure if you ask someone who sells them, they will tell you :D
>
> >> If you want to stick with commodity hardware, a couple of quad core
> >> amd's should also fit right in.
> > Or use an SSL-offloader.
> > Then, you can handle the same load with much less CPU-power.
>
> Can get fiddly, with specific drivers and patches required to various
> bits.. But thats a solution that could work too.
>

To OP; anecdotal evidence only -- and I certainly wouldn't recommend
using PPTP for a secure VPN solution :)  At my previous job we ran
PoPToP (PPTP) on CentOS and the older HP DL140 G1 1U servers and were
handling up to 1000 clients pretty comfortably per machine.  This was
with 1GB of RAM per server and a single 2.4GHz Xeon processor.

Left before we could migrate to OpenVPN which I think would have
slightly higher processing requirements. :)

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
8) Ray Van Dolson Re: [CentOS] OT: Need some riser card advice...
| +1 vote
I think that's why the SuperMicro riser I found was $150. Others were cheaper, but probably...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Fri, Dec 12, 2008 at 03:53:42PM -0700, Joseph L. Casale wrote:
> >Any advice?
>
> Only that PCIe in my experience needs a quality riser for signal interference.
> If this is a server running anything important, I would be leery about "engineering"
> my own setup from generic components.
>

I think that's why the SuperMicro riser I found was $150.  Others were
cheaper, but probably suspect.

I'm going to return my 12-way card and get two 8-way cards instead.

Thanks for the reply,
Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
9) Ray Van Dolson [CentOS] OT: Need some riser card advice...
| +1 vote
Fellow server-builders out there, this is for you. :) I was trying to build a cheap JBOD type...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
Fellow server-builders out there, this is for you. :)  I was trying to
build a cheap JBOD type storage solution running CentOS.  Ended up
snagging a Supermicro SC826TQ-R800LPB 2U case (12 drives slots) and a
Supermicro X7DBE-O motherboard.  Unfortunately, without thinking I
snagged a 3ware 9650SE-12ML SATA RAID card which is a full height card
and thus does not fit in my case.

I have a few options here:

  - Go with a 3U case instead.  Now I have a 16-drive case with only a
    12-way card. :-)
  - Return the 3Ware and order two of the 8-way cards which are
    half-height.  This means I love some of my space now however as I
    have to have an extra spare drive per card.
  - Get a PCI-E riser.

The riser option I like, except I also have the BBU unit for my RAID
card meaning I need to ensure that I have enough clearance and support
for it when the card is mounted horizontally.  You can mount the
battery elsewhere, but not the logic module...

Most of the PCI-E 8x risers I've seen out there seem to be pretty small
profile and I'm not sure if they'd give the clearance needed (see the
Supermicro provided CSE-RR1U-E8).  It looks like I need around 35mm of
clearance to get the card in sideways with the BBU attached...

Another solid option would looke to be a 2U riser, but I am having a
harder time finding somethign reasonably priced.  The RSC-R2UE-A3E8
from Supermicro looks perfect and would definitely give me the
clearance I need, but is priced 10x higher than the 1U riser!

Any advice?

Apologies for the off-topic post.. this *will* be running CentOS
however and there doesn't seem to be a more appropriate mailing list
for general stuff like this.. :-)

TIA,
Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
10) Ray Van Dolson Re: [CentOS] Miredo 1.1.5
| +1 vote
Look inside the .spec file. The Release line should contain a dist tag as follows: Release:...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Wed, Dec 10, 2008 at 01:33:39PM -0500, Robert Moskowitz wrote:
> I found a src.rpm for 1.1.5-1 for fc8 (not rh8!). I was able to rebuild
> it on my Centos build system.
>
> The rpms are identified as 1.1.5-1.i386.rpm, no el5 or other
> identification was placed in the files. I don't see how to control this
> when you rebuild from an existing src.rpm. Interestingly the fc8
> designation was lost.
>
> I also rebuild it on my fc10 system. It worked, and the rpms have fc10
> in their names.
>
> Don't know how well they will work. I will be trying them over the next
> couple weeks. If anyone wants a copy, let me know....
>

Look inside the .spec file.  The Release line should contain a dist tag
as follows:

Release:        1%{?dist}

The "1" will vary of course.

Then, when you build, just define the dist flag to be what you like:

  % rpmbuild --define 'dist .el5' <whatever>.spec

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
11) Ray Van Dolson Re: [CentOS] XFS or JFS on CentOS 5?
| +1 vote
Thanks for the reply John. However, my question wasn't so much "if I should" but how the xfs...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
On Wed, Nov 19, 2008 at 10:46:00PM -0800, John R Pierce wrote:
> Ray Van Dolson wrote:
>> Hi folks... trying to pick between jfs and xfs for a filesystem. In
>> the past we've used jfs with CentOS + centosplus, however, ...
>
> CentOS and its upstream source, RHEL, support ex3fs. I'm not sure why
> you'd want to use anything else. If you have a specific requirement for
> JFS, I'd suggest running a BSD or AIX system where JFS is native... If you
> need XFS, I'd run a Linux distribution that supports it natively.
>
> If you roll your own hybrid operating system, you get to test and validate
> it, and if it breaks, you get to keep both pieces.

Thanks for the reply John.  However, my question wasn't so much "if I
should" but how the xfs support in CentOS compares to jfs.  It seems to
me that xfs is a bit more up-to-date.

If you'd like, consider the question academic vs giving me a
recommendation that pushes me down the path of unsupported filesystem
doom. :-)

Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
12) Ray Van Dolson [CentOS] XFS or JFS on CentOS 5?
| +1 vote
Hi folks... trying to pick between jfs and xfs for a filesystem. In the past we've used jfs with...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
Hi folks... trying to pick between jfs and xfs for a filesystem.  In
the past we've used jfs with CentOS + centosplus, however, an older
post indicated that this may not be the best choice as the version of
jfs included with the centosplus kernel would only be as new as the
version that was included in the 2.6.18 kernel as RH doesn't backport
fixes...

It looks like xfs isn't part of the centosplus kernel, but instead is
provided as a kmod -- so I'm thinking it might be the better choice
based purely on the fact that it's likely to be current.  Is my
understanding correct there?

What would stop us from building a kmod-jfs against the latest jfs from
the up-upstream kernel and not building jfs.ko in the centosplus kernel
at all?  It looks like jfsutils is a fairly recent version...

Thanks,
Ray
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
13) Ray Van Dolson [CentOS] L2ARC (disk caching) for Linux?
| +1 vote
First off; are there any storage-centric mailing lists that target Linux specifically? Secondly,...
CentOS
[ Profile | Reply to group ] [ Flat  Thread  Threaded ]
First off; are there any storage-centric mailing lists that target
Linux specifically?

Secondly, I'm wondering if there's anything in the works or already out
there similar to Sun's L2ARC[1] for ZFS.  Basically this is a
filesystem (or maybe lower-level) cache for reads, writes that can be
comprised of faster media like SSD.  I think it could make SATA-based
JBOD solutions a lot more attractive from a performance perspective.

Anything out there along these lines already or suggestions on a better
place to dig for information?

Ray

[1] http://blogs.sun.com/brendan/entry/test
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos
14) Ray Van Dolson Re: [CentOS] HA Storage Cookbook?
| +1 vote
Hehe, I think the somewhat confusing part about SAS is that you expect it to be a SCSI disk and...
CentOS