Mehr Höhenmeter gehen nicht

December 30th, 2009 Comments off

Zumindest nicht für mich. In einem Tag von Meereshöhe auf den El Teide (mit 3718m) zu laufen, ist nicht besonders zur Nachahmung empfohlen. Aber auch irgendwie cool und wahrscheinlich auf lange Zeit mein persönlicher Guinessbuch-Eintrag.

Categories: Tourenbuch

SSH tunnel Quickie

October 13th, 2009 Comments off

Sometimes I prefer to have a private (read secure and non-observable) web connection – being a developer and admin makes you a bit more paranoid…

So how can you establish a connection that besides from being non-observable may also bypass potential content filters or firewall rules? Of course with a simple SSH tunnel:

ssh -D 8080 -f -C -q -N user@server

Now simply configure your browser to use the SOCKS proxy running on your localhost at port 8080 and off you go.

The drawback is, that you need a Unix server outside to connect to. But who has not such a system somewhere? And even if not by now, maybe just go in the clouds.

And for those unlucky guys running Windows and PuTTY: even you could do that.

Update: It seems like SSH can even be misused to tunnel Remote Desktop connections. This might do the trick:

sudo ssh -D 8180 -p 8999 <SSH user>@<public external IP>  -L 127.0.0.1:3333:<internal IP of target RDP system>:3389

Categories: Admin stuff

Amerikanisches MacBook mit deutschen Umlauten

September 13th, 2009 Comments off

Wie bringe ich einem amerikanischen Mac mit englischer Tastatur unsere heiß-geliebten deutschen Umlaute bei?

Darüber ist schon (zu?) viel geschrieben worden, also darf ich jetzt auch mal ran. Ich erspare mir hier eine ausführliche Auflistung möglicher Gründe, warum man als Kraut ein solches Gerät überhaupt hat (Software-Entwickler, Firmenangestellter, @, Ausnutzung von Währungsvorteilen).

Universell kann die Tastenkombinationen ⌥-u (option-u) gefolgt von dem jeweiligen Umlautbuchstaben benutzt werden, um landes-spezifische Umlaute einzugeben. Ein ⌥-u U erzeugt also ein Ü. Ferner bringt ein ⌥-s das ß hervor.

Mir ist das aber noch zuviel Getippe. Mit Ukulele habe ich mir die Tasten a, o, u, A, O, U in Verbindung mit der option Taste so umbelegt, dass Umlaute ohne Umweg über option-u direkt mittels ⌥-a, -o, -u, -A, -O, -U eingeben werden können.

Und weil so schön einfach ist, kommt das gleich noch auf ⌥-e

Categories: Misc

Stop a long running shell/bash process after timeout

September 10th, 2009 Comments off

Sometimes a process should just run for a maximum amount of time. A nightly long network transfer, a backup, or a statistical report shouldn’t accidentally run until next business hours. A watchdog timer which kills a process once a certain time has passed by is needed.
As usual in Shell programming multiple ways are possible, all of them have certain drawbacks. The simplest one would be just to call the long running process in the background and capture its PID. But then it is not that easy to capture the return value of it. Here is my shot with an additional at job:

#!/bin/sh
MY_PID=$$
TIMEOUT=1 # in minutes

# Install at job as watchdog to remove long running process
WATCHDOG_CMDFILE=/tmp/`basename $0`-$MY_PID
echo &amp;quot;# watchdogfile script&amp;quot; &amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;kill -0 `echo $MY_PID` 2&amp;gt;/dev/null&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;if [ $? -eq 0 ]; then&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;  ps -o pid= --ppid `echo $MY_PID` | xargs kill&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;  echo &amp;quot;long running process aborted because it ran too long&amp;quot;&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;fi&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
echo &amp;quot;rm -f `echo $WATCHDOG_CMDFILE`&amp;quot; &amp;gt;&amp;gt; $WATCHDOG_CMDFILE
at -f $WATCHDOG_CMDFILE now + $TIMEOUT min

# Start my very sophisticated long running task
sleep 3600 # 1 hour
RET=$?

# do whatever you normally do after the long running process finishes
echo $RET

(Note that at sends out emails with the stdout/stderr. If you have another notification method to indicate an aborted job, ensure that nothing is printed to std & stderr.)

Categories: Admin stuff

Summit-Sammlung: Mt. Humphreys

August 24th, 2009 Comments off

Okok, anspruchsvoll ist er ja nicht, der Mt. Humphreys von den San Francisco Peaks in Arizona. Die 1000-irgendwas Hm lassen sich mit etwas Muehe in knapp 2 Stunden bewaeltigen. Aber dann hat man auf 3850 m einen ganz gewaltigen Rundumblick; Grand Canyon eingeschlossen…

Warmduscher koennten auch ein wenig abkuerzen, indem die lokale Sesselbahn den Weg auf den hoechten Gipfel von Arizona vereinfacht.

Categories: Tourenbuch

Enough birthday stuff

June 28th, 2009 Comments off

Finally I solved all my struggles with my birthdays calendar at once. I just changed my OS… No more homegrown VBA macros to get what I want from Outlook.

Although I have to admin that even iCal and Addressbook from MacOS are not capable to manage more than 1 birthday per contact out of the box. But Birthday Scanner X comes to the rescue. And it’s free.

If you’re still interested in my Outlook macros and have problems, let me know. I will be mercy…

Categories: Misc

ERb’in “ActionMailer fixtures” Up

June 16th, 2009 Comments off

I don’t know if my slightly outdated Rails 2.2.2 is the problem. But unlike in the fixtures for normal unit tests, I can’t use ERb for my ActionMailers templates.

Add this method to your ActionMailer::TestCase to let ERb pre-process your fixtures:

  def read_fixture(action)
    a = super
    template = ERB.new(a.join)
    template.result(binding)
  end

Outlook-iPhone birthday synchronisation

May 30th, 2009 2 comments
  • Not satisfied with the way Outlook (2003) handles birthdays and anniversaries?
  • Want to have multiple birthdays just for one contact entry (maybe because you have one contact for a family, but want to track the birthdays of the countless kids)?
  • Do you need to control the reminders for the birthdays?
  • Wish you had the classical Palm solution (Feiertage) for your iPhone or iPod touch?

Yippee! Macro time – (again)!

LegeGeburtstageUndJahrestageImKalendarAn

Add multiple birthdays to the notes of your contact and create proper recurrent events. Basically enter for every birthday you want to track for this contact in a new line with the format GEB Name: 24.12.2000 (Note the European style date format day.month.year and the prefix GEB (german abbreviation for Geburtstag = birthday)). Simply add all of your birthdays or anniversaries to your contacts, run the macro, and of you go. For more details see the linked docu.

LoescheGeburtstageUndJahresTageImKalendar()

Remove all (automatically) created recurrent events (e.g. for cleanup purpose)

And if your Outlook asks you for every single modification for allowance, use Advanced Security for Outlook to suppress those questions.

Read more…

Categories: Programming stuff

No remote root logins (even with SSH)

May 19th, 2009 Comments off

OK. Not really “Programming stuff” anymore. But still important:

Don’t allow remote root logins at all, even with SSH

Why not? Because:

  • User name of root is known, therefore the account is vulnerable for brute-force attacks
  • Working as root should be an explicit switch and not the default policy. Just like being aware of switching hats.
  • Bad for auditing, if multiple users have root access.

But now you say: “I don’t care as I use SSH for logins”.

  • Depending on the auth method, password is still transfered over the wire.
  • But using public key auth instead of passwords might be even worse. Still you have to trust all(!) clients that the private key is stored safely. Read:
  • “Good enough” passphrase.
  • There is no way to tell from the public key (which is the only thing known by the server), if the private key has a passphrase at all.
  • Trust the client system (that it is not compromised)
  • Auto lock of the client system must be enabled after a few minutes of inactivity.
  • Sensible use of background daemons like ssh-agent or Pageant(Putty for Windows) on client systems necessary. What if the users start the keyring app, enters his passphrase and never shuts down his system. And now imagine a laptop running out-in-the-wild without any local password protection having an open private key in its memory!

What to do? Dunno. Maybe:

  • Use “ordinary” user accounts
  • SSH with either public key or passwd auth (depending on your decisions reg the previous points)
  • Enforce sudo (better) or su (less better) to gain temporarily root privileges

Anything else???

Categories: Admin stuff

Resume rsync transfer after SSH connection crash

May 15th, 2009 Comments off

Are you using SSH for your secure maintenance of your servers? – Sure.

Do you copy files with SCP between hosts? – Most likely.

Is there a need to transfer big files over slow and unreliable network connections (*)? – Could be.

Can SCP resume a download after the connection crashed? – No.

So why not simply use rsync over SSH for your file transfer. A minor drawback is, that unless you set up a rsync daemon (not appropriate for my case) you have to call rsync manually. Sadly rsync doesn’t offer something like “automatic retry in case of a connection failure”. (**)

Good for us, because now it’s tool time again; a single bash script does the trick:

#!/bin/sh
# reliable file transfer

# try rsync for x times
I=0
MAX_RESTARTS=5
LAST_EXIT_CODE=1
while [ $I -le $MAX_RESTARTS ]
do
  I=$(( $I + 1 ))
  echo $I. start of rsync
  rsync -av --partial --progress -e "ssh" x-ian@x-ian.net:~/MY_BIG_FILE .
  LAST_EXIT_CODE=$?
  if [ $LAST_EXIT_CODE -eq 0 ]; then
    break
  fi
done

# check if successful
if [ $LAST_EXIT_CODE -ne 0 ]; then
  echo rsync failed for $I times. giving up.
else
  echo rsync successful after $I times.
fi

Ah, just a sidenote as I always forget the syntax: If you need to remote execute a command via SSH with variables from your local shell, take this:

CMD="test -e M_BIG_FILE || cp MY_BIG_FILE `hostname -s`-MY_BIG_FILE"
ssh x-ian@x-ian.net $CMD

(*) If you only have an unstable satelitte link, even 150 MB are way too big.
(**) Make sure that you actually test over the network; using rsync with source and destination files on the same system deactivates the delta-calculation algorithm.

Categories: Admin stuff