POSIX File Capabilities

Sometimes you need a particular program to do a specific task that requires administrative (root) privileges. You can run your program with sudo or chown your program to root and use the setuid bit (that allows to run a program with its owner uid). However, the setuid bit has serious security issues: if you are able to change the flow of execution of the program (and if the program does not drop his root privileges once no longer necessary), you can get a root shell.

More specifically, I needed a program to be able to create raw sockets without requiring full root privileges. It's possible! Using POSIX File Capabilities that relies on capabilities architecture.

Enabling Wake-on-LAN

The first thing you do when you configure Wake-on-LAN is to enable it in your motherboard BIOS (on my ASRock it's "wake on PCI device -> enabled").

However, this is not enough because when you leave Linux (or Windows), your network card may not be set to wake up from LAN. Thanks to tjansson, I'm now using the following root crontab to enable Wake-on-LAN everytime Linux starts (I prefer that to an init/rc6 script).

@reboot /usr/sbin/ethtool -s eth0 wol g

I invite you to read tjansson's blog entry for more information.

Wake on Lan in Python

I love Wake on Lan because it allows me to shutdown my little server at home, and still be able to remotely wake him up if necessary.

The well-known Depicus WoL pages provide Windows binaries (GUI and CLI) to send WoL packets, as well as an online form.

If you are on Linux or prefer sending it on your own (I mean, not using a closed binary), you can use a few lines of Python as explained by myf00 with Python3 code.

SheevaPlug

Earlier this year, I was looking for some small boxes where I can embed a little server and I've stumbled upon the following story of Martin Michlmayr. PlugComputer.org promotes the SheevaPlug, an impressive box in terms of low price (~100 USD), high performances (see the specs) and with low power consumption. Finally, the community behind has a great wiki it shouldn't be hard to start playing with it.

All that to say if you're looking for embedded systems, have a look at it, it is worth it.
I bought one and I'm starting to play with it... :)

Logging smartd (or any daemon) messages with rsyslog

Rsyslog is the enhanced syslogd for Linux and Unix, extending the good syslog-ng.

If you use smartmontools to monitor your disks with smartd, you can see that your logs are filled with too many information related to your disks. The first solution is to tell smartd to send messages into a local facility (1-7 are available) and then in syslog-ng write all messages sent to that facility into file smartd.log. It's a good solution, as long as this facility is not used for something else.

Logging iptables messages with rsyslog

Rsyslog is the enhanced syslogd for Linux and Unix, extending the good syslog-ng.

If you use netfilter's iptables, you may know that a target could be LOG (with a prefix that can be configured) sending detailed information in the kernel log (since netfilter runs in the kernel). Rsyslog and syslog-ng regularily read the kernel log and save it to kern.log (among others).

IPv6 NDP Proxy

A few days ago, I wrote an article about IPv6 NDP Proxy for a blog that I love to read. The problem discussed is that some routers who provide you an IPv6 prefix want to see the IPv6 addresses on the same L2 segment, so you can't use routing directly.

This problem can be encountered at OVH - an European dedicated server provider - if you want to set up virtual machines with IPv6 routing; or, if you have a Freebox - the set-top box provided by Free.fr provider - and want to use your own router behind.

In the article, I explain a solution based on the use of the NDP Proxy included in the linux kernel, with the example of a dedicated server at OVH.

Read the article (French)

Reducing the number of devices in a RAID-5

(This blog entry has already been published in French on Nibbles' microblog)

Since 2006, linux RAID allows to grow a RAID-5 volume by adding new devices, and thus allowing to grow the filesystem underneath in order to have more free space. The opposite operation was missing, that is shrinking a RAID-5 volume by removing devices, assuming the underneath filesystem has already been reduced (otherwise data would be lost).
This summer, Neil Brown developed this feature among others, as he announced on his blog.

SATA2 and linux software RAID performance

A server I have to manage has 9 SATAII disks of 1TB each. Six of them are plugged directly to an ASRock motherboard, and three of them on a Promise PCI card providing 4 SATA II ports. These disks are partitioned on the same design: 2 partitions, a small one (1GB) for a RAID-1 and a the remaining for a RAID-5. I am therefore not using dedicated hardware but the great software RAID implemented in linux kernel.

Welcome

I finally decided to start a blog, in English to reach a broader audience. I don't know exactly what will be the topics discussed, but I guess mainly technical stuff about computers, system and network administration, security, linux...

With this blog, I want to thank all the blogs I read for everything I learned.
I expect nothing in return, so please do the same and nobody will be disappointed. ;)