Develop your Puppet Modules Inside of a Sandbox
When you want to develop a new Puppet module, it’s best to work outside of your production environment. You could use Puppet’s built-in environments feature to slice up your site, but there are a handful of caveats and it’s not always the most convenient. Enter Puppet Sandbox…
Puppet Sandbox is a multi-VM Vagrant-based Puppet development environment that can be used for creating and testing new modules independent from your production servers. It’s also a great way to get your feet wet if you’re new to the whole world of Puppet and automated configuration management software. While you could manually configure this type of development environment yourself, Puppet Sandbox makes the whole process trivial, reproducible, and fast!
Ideally, you would first develop your modules using Puppet Sandbox, then move them to a staging environment where they would be applied to a limited number of real hosts, and then finally you would put the modules into production. This type of development cycle will provide confidence that your modules will work as expected, when you need them to.
Here’s a short screencast to give you an overview of how the project works:
Puppet Sandbox is open source, and available on GitHub: https://github.com/elasticdog/puppet-sandbox
Postfix Dovecot User Admin Script
While working on a postfix/dovecot non-mysql virtual domain configuration, I needed a simple admin script to add new users. The script below is what I came up with after about 30 minutes.
I was unable to find something that met my needs on the interweb, so I hope this post finds someone else in need!
Please submit bugs/suggestions to: nick.wilkens@mnxsolutions.com
Terabytes on a budget – 106TB for $8788
When working with a client, we were discussing storage for an application they have developed. Storage price was a key component for success of this product. I read the BackBlaze posts here, and here — but I wanted a mix of cost savings, off the shelf parts, and hot-swappable drives.
Two Factor SSH Authentication with Duo Security
As is probably obvious from our blog posts on Yubikey SSH/WordPress two factor authentication and Google Authenticator SSH two factor authentication, we at MNX Solutions are big proponents of multi-factor authentication schemes to add security to infrastructure. On the other side of things, though, we have to be agile system administrators in order to offer customers efficient and timely service when a problem occurs. While we still really enjoy our Yubikeys (especially for WordPress), we’ve found that the offering from Ann Arbor, MI based Duo Security is the one for us.
Read more
Designing for failure with Amazon Web Services
Avoid single points of failure. You can and should assume everything will fail.
Start by listing all major points of your architecture, then break it down further, and then maybe one more level. Now review each of these points and consider what would happen if any of these failed.
Read more
Securing SSH and WordPress with two factor authentication
I wrote a post about using Google Authenticator for SSH a month ago. After writing this post, I started looking at other solutions in the space for two factor authentication.
Yubikeys are USB based, and require no device drivers. They work with Mac, Linux, or Windows and are priced starting at $25 each. Compared to the security gained — Yubikeys are inexpensive.
If your going to be at the Indiana Linux Fest this coming weekend (March 25-27th 2011), stop by and visit us — we have extra Yubikeys to spare.
Read more
Safari providing an SSL error “client certificate rejected” when other browsers work
If you’re receiving an error message such as:
Safari can’t open the page “https://example.com”. The error was: “client certificate rejected” (NSURLErrorDomain:-1205) Please choose Report Bug to Apple from the Safari menu, note the error number, and describe what you did before you saw this message.
It’s likely because the web server you are connecting to has Apache configured for “SSLVerifyClient optional”. It appears that with Safari 5 (or perhaps even earlier) the browser will negotiate client certificates improperly with the web server. While other browsers like Google Chrome and Firefox will not have an issue, Safari is rendered incapable of connecting to these sites without a server-side change.
Once you alter the Apache configuration to ‘none’ rather than ‘optional’, the browser will once again be able to connect as expected.
If anyone has experienced this issue or knows of a work-around for the Safari side of the equation, please comment!
How little you know, and some useful commands for the week
Early in my career, I was writing a shell script and needed to print a line-number for each line in a text file. I ended up coming up with some function that did just what I needed.
I don’t recall the exact method, but it was something like:
Read more
Two Factor SSH with Google Authenticator
Last week, Google enabled two factor authentication for everyone. This article explains how to install and configure Google Authenticator in conjunction with SSH for two factor authentication. Two-factor authentication relies on something you know (a password) and something you have (your phone).
Read more
Automatically purge old configuration from Nagios deployed by Puppet
A problem that Puppet administrators have likely noticed when deploying its built-in Nagios functionality (called Naginator) is that creating configuration is very easy but ‘cleaning’ old configuration isn’t as straight-forward. If you are like me, you’d delete the affected file(s) that had cruft and let Puppet re-build the service configuration without the old services or hosts. Read more
