David Hajek - It Just Works

VoIP Trends in 2009

2009-01-07T09:51:00.002+01:00

I went over the nice article about VoIP Trends in 2009 published by VoIP News. Its a good summary of what can happen in VoIP industry in 2009.

The main points covered are:

* Hosted IP PBX functions requiring only IP or other phones on a customer's premises
* Service providers will start pushing HD voice
* Increased IP PBX, call-center and CRM integration
* Yet more mobile WiFi VoIP

I'm missing two things in the document. First we should have seen WiFi phones with roaming capabilities and second important one is security. Does anyone in VoIP industry cares about security? We have standards like SRTP but service providers are not pushing them hard. I think we will see similar scenario as it happen with HTTP and HTTPS.

External 1TB

2008-08-07T22:42:00.002+02:00

I just get my first external terabyte disk for holding my personal backups. Replacing my 500 GB one which is much lighter! ;-)

Holidays

2008-08-07T21:50:00.002+02:00

Tried to make several calls today and most of them were not answered because of vacation. Time to figure out some vacation as well!

IT ops becoming more business and application savvy

2008-08-01T09:22:00.003+02:00

I wish more companies follow this recommendation (grabbed from Forrester article):

"Start by getting IT operations professionals to enroll in application boot camps, brush up on certifications, and spend more time interfacing with business counterparts. For example, one large Wall Street bank requires that IT ops managers spend one week per quarter “outside the datacenter” rotating among business units. Not only do frontline IT managers come to understand true business pains, but it also provides an opportunity for soft marketing ops to demonstrate IT-business alignment, even if it’s just a water cooler chat on technology that boosts productivity."

We've doubled the number of R&D servers over the last 6 months

2008-08-01T09:02:00.008+02:00

We are continuing in moving our R&D services into virtualized environment and finally we have reached 1:1 ratio between number of virtualized servers and physical dedicated servers in R&D serveroom. We have actually doubled the # of R&D servers over the last 6-8 months and # of physical servers is lower.

I have already mentioned in my previous posts that we're running VMWare infrastructure and so far its running OK. We have had some performance issues in the past which were caused mainly by storage performance issues. We didn't buy enterprise storage (FC SAN) yet as I believe properly configured NFS servers on high-speed LAN can do (almost) same job for fraction of costs. Anyway we have had to deploy "cluster" of NFS servers to share and distribute the load between them. We also invested into more RAM for our physical VMware hosts, so most of them have 20 GB of RAM.

UniConvertor - Universal vector graphics convertor

2008-05-19T22:17:00.004+02:00

I have found a very nice, free, multiplatform tool called UniConvertor which can convert between various vector graphics formats.

Now I can use my favorite Inkscape for reading formats like .ai (adobe illustrator) .cdr (corel draw) and others.

Packet filtering in Microsoft Windows

2008-05-09T15:11:00.005+02:00

I needed to configure little bit advanced firewall on Windows 2003 machine. Builtin Windows firewall GUI is poor. Its not possible to specify inbound firewall and link it with only specific IP subnets, use port ranges etc.

The solution for this is to use builtin netsh command which is used to configure not only ipsec rules but also packet filtering rules. I created file with netsh command rules (aka iptables) and then run netsh -f and gotcha it worked!

I used these two scripts as templates to make my own:

1/ Template 1
2/ Template 2

Taiwan made firefox add-on: IE Tab

2008-05-08T00:49:00.005+02:00

I was not aware about firefox IE Tab extension. This add-on allows to use regular expression language to specify sites for which you want to use IE rendering engine.

Robbed

2008-04-25T15:35:00.009+02:00

Friday morning, 9:30 AM, I parked my car before kindergarten. Barely 2 minutes - 120 SECONDS - I was away from the locked car and I returned, much to my horror, to find the two car windows smashed and complete mess inside. Stolen laptop, mobile phones, wallet, credit cards, identity card, driving licence, car registration book, etc.

Not much help I saw these bastards to run away with my shit in silver Peugeot 206.

Thanks to Cobian backup and SaaS I was fully operational with new laptop on Friday evening.

Parking rules in Slovakia

2008-04-24T20:33:00.006+02:00

Earlier this week I spent a day in Slovakia in Zilina. It has been almost 450 km long drive - but I enjoyed it. No internet, no phone calls (yep, switched off). Car sound system played my favorite music. Relaxing fun.

My "lesson learned" from this day is related to parking in Slovakia. There are lot of parking automats on the streets, but no one actually use them. Almost all cars are parked just right on sidewalks. Its legal and its free if you make sure there is "enough" space for pedestrians. Thats it, no exceptions. Yes, its a bug in their law.

Watch this video:

Amazon answer to Google’s AppEngine - persistent local storage on EC2

2008-04-16T00:58:00.003+02:00

Amazon introduced the newest feature of Amazon EC2: Persistent local storage. In general you can mount your S3 volumes to your EC2 instances as a RAW disk volumes. Another milestone for cloud computing!

To quote Amazon:

"...These volumes can be thought of as raw, unformatted disk drives which can be formatted and then used as desired (or even used as raw storage if you’d like). Volumes can range in size from 1 GB on up to 1 TB; you can create and attach several of them to each EC2 instance. They are designed for low latency, high throughput access from Amazon EC2. Needless to say, you can use these volumes to host a relational database."

Squash shortlisted for 2012 olympics

2008-04-11T17:27:00.006+02:00

I'm not usually posting about my other activities, but this one will be an exception. I was part of pretty good squash tournament played on last week's Friday night - 27 players, 5 rounds. I have been so tired after the tournament that I was almost not able to drive my car home safely.

Golf, rugby union and squash have been included in a shortlist of five sports being considered for the 2012 Olympics.

How to save money running a startup....

2008-03-20T09:44:00.006+01:00

I've read an interesting post about how to save money running a startup, which has been posted by Jason. I would agree with most of the tips, except the first one. I don't agree Macintosh is a life saver in terms of no IT department is necessary then.

Good timing for such article when dollar is where it is at the moment. :-)

Have you heard of Big Dog?

2008-03-19T22:36:00.004+01:00

Its amazing from the technology perspective, but my wife says it's disgusting. Watch this on YouTube.

Don't make your AD security group name longer then 20 characters

2008-03-13T21:57:00.007+01:00

I have spent quite some time in last few days by debugging an issue when some users can't connect using remote desktop to their test machines. Our "Virtual Infrastructure" permission model is build on AD domain permissions. Our domain consists of 3 sites around the world and serves more then 1300 users and about the same numbers of servers. We are putting users and servers into security groups (following org chart) and apply various GPO policies to be able to say which user can connect to which server. It works fine and its easily managable. BUT....

I created security group which name has been exactly 21 characters long. What a mistake! In our domain logon script we use semiautomatic script which makes a login user a local administrator - this is necessary for developers to be able to "crash" the machine with their tests and development work. ;-) The login script uses the well known builtin command "net localadmin ... /add" . But this command does not work, when security group name is more then 20 characters long!

SOLVED: VMware cluster storage on Linux NFS

2008-03-05T13:25:00.007+01:00

I have blamed Linux NFS for slow performance with VMware cluster in my last post. I have been contacted regarding this issue by my friend Stanislav Opichal (where's your blog my friend?) who is working for VMware as developer. He has somehow escalated this issue and come back to me with some good hints. They see the problem is somehow related to Linux's brain dead algorithm for coalescing writes marked with the stable flag. They suggested to export my NFS storage with no_wdelay, which causes the server not to wait 10ms to coalesce writes. Good hint, but I have been using async option already which contains no_wdelay option automatically. So this has not been the cure for my issue - but someone else can find this useful.

Anyway my issue was not the NFS or VMware, but slow read/write performance of my Dell PowerVault 220S storage. It does not perform well even on local tests. Solution for this has been to disable Dell's superb Patrol read option in SCSI controller Bios (I'm using PERC 4/D). Patrol read is something which scans your data in background and checks for suspicious or bad blocks and trying to re-alocate the data. This is supposed to be done when system is runing on idle, but its not that much true! Disabling this option makes my storage array almost 3 times faster on reads - coming from 18 MB/s to 55 MB/s with disabled patrol reads.

At the end I'm getting good performance in VMware guest at the moment. I still can see NetApp storage a bit faster, but its nothing significant. If you need low-cost storage for VMware, Linux NFS can be a good candidate.

Thanks to Standa and his team to help me to solve this.

VMware cluster with Linux NFS storage is slow!

2008-02-19T22:26:00.009+01:00

Foreword: Currently I have about 130 servers in my lab. About 90% are x86 platforms and utilization of these servers is very poor, maintenance hard and last (not least) it consumes lot of energy even running on idle. And developers are continue to ask for new servers and lab floor space is running out.

This is quite ideal situation for start playing with virtualization and automatic server deployment.

Phase one:
We have installed automatic server deployment based on Altiris. We have various OS images for different servers and with one click we can deploy any server which is part of Altiris system. System boots up using PXE, download pre-boot image (Linux) and then perform tasks you need. The goal is to prepare a job which is a set of tasks which install OS, configure new server for your environment (eg. join some domain), install necessary applications (eg. antivirus, devel tools). Once you have a pre-set job its a one click task to deploy a server. Of course you can create images of your servers and deploy/use them for some other servers (cloning), etc.

Phase two:
Install and configure VMware cluster and have VMware machines part of Altiris for automatic deployment. The goal is to be able to deliver a new "computer" to business within 30 mins after the request is received. Fully installed and pre-configured for our environment and all that with several mouse clicks. The computer is actually VMware machine.

We're now somewhere in the middle of Phase two. For the pilot we use 3 VMware ESX servers which runs on HP 460c blades. All that is managed by VMware Virtual center. The crucial part of this setup is a storage, which must be centralized and visible by all blades. The recommended solution is FC (fiberchannel) SAN - like HP Eva StorageArray. VMware supports FC, iSCSI and lately NFS storage for your cluster. I was very curious about NFS and wanted to run some tests. I have read positive posts about NFS with VMware cluster is a good idea and that it performs really well. Why not? FC is 2 GB pipe, NFS server is usually connected to 1 GB ethernet today. But 10GB ethernet is starting to adopt, and FC will be having hard time then as it is expensive and you can build a separated 10GB ethernet for iSCSI which can outperform FC. And with current 1GB ethernet you can use NIC bonding (use more cards) to get over 1 GB speeds limit. VMware can do that and most NFS servers (NAS) can do that as well.

So, I have build my Linux NFS server running RHEL 4.5, connected to Dell PowerEdge 220 array. What a bad idea that was. When mounting the NFS disk from some other Linux server it performs quite well, I can get transfer speeds up to 50-55 MB/s. Then I connect this NFS storage to VMware cluster, create virtual server utilizing this storage and run few tests. In guests I can get (non-cached) copy transfer speeds on guest filesystem between 2-4 MB/s - not more! I have tested both Linux and Windows. I tried various options sync, async, write cache, configure tcp caches on Linux NFS server but no luck. I was close to say that NFS with VMware sucks.

Then I have read some whitepaper from NetApp about using their storages for VMware. NetApp makes really good storages and what a luck I have two NetApp Storages in my lab. I find some space, create volume and export it for VMware. Copy over to NetApp the guest VMware files from Linux NFS and boot them up curious about performance. What a difference I found - copy non-cached data between filesystem up to 13-22 MB/s. These are good numbers in terms of performance and proves that its a good setup for production environment.

I could not believe Linux is so poor in such tests and re-installed RHEL with latest Fedora 8. The speeds were slightly different around 3-5 MB/s, but still very low. I should note that Linux NFS server is a Dual Core Intel Xeon running on 3 GHz with 1 GB of RAM.

Does anyone have good experience with Linux NFS as a storage for VMware cluster? I could not find any good answers on any VMware forums.

When your mother asks you about mortage crisis

2008-02-07T11:21:00.000+01:00

Let her watch this video. It Just Works (like it says).

Quality assurance in IT

2008-01-26T22:43:00.000+01:00

I was trying to dig some info about how to make quality assurance in IT organization. Its interesting that this topic is quite rare and I could not find any good reference for interesting reading. Quality assurance is so common in software development but not in IT services organizations.

Well, what do you want to test? You can ask. I will answer the question with a question. How many times you ask your IT organization for a service and how many times you get a solution which works on first attempt.

There's no doubt about IT admins are lazy same way as software developers are. So it is interesting that even big organizations don't have established quality assurance processes within their IT service organization. The common practise is to measure the quality of service which is already given (CRM tools reporting etc) but not before the service is given to customer.

Makes sense?

Its official - http://dell.com/voip

2008-01-24T14:00:00.000+01:00

I have been saying for a long time that Dell needs to do "someting" if he wants to stay in top 5 in server hardware business. Its official about Dell decided to enter a $17B VoIP market and has signed partnership with Fonality for delivering IP PBX solutions for SMB market. Fonality is a very well established startup who deliveres IP PBX solutions built on top of Asterisk PBX. They have gain a huge credit in the market so far, good for them.

Dell also signed up Nortel for enterprise market.

When will VMware support non-x86 platforms?

2008-01-17T10:40:00.000+01:00

I'm now up for various automatic deployment solutions and virtualization technologies. I will write about my experiences sometime later.

VMware have great set of solutions for all variants of guest OSes running on x86 platforms. There is lot of confusion around about you can use VMware for virtualizion of AIX, HP-UX and other Unixes. No way, these OSes are strictly non-x86 plaforms and VMware simply can't do that. But it will be so cool to buy some blade system with VMware ESX server burn into the blade hardware. Then by using other VMware products and technologies we can build a VMware cluster which can be nicely managed by VirtualCenter console. Then with few clicks we will be able to create any virtual server, either x86 or non-x86. Currently you can actually do that but with x86 plaforms only.

I was thinking why is this the case. Is it really so hard to emulate eg. PA-RISC or IBM Power platforms? Maybe the answer is related to the fact that PA-RISC and IBM Power server solutions can offer virtualization technologies already. You can divide eg. HP-UX server into two or more partitions and they are separated like you have two servers.

If VMware will bring the support of non-x86 platforms who will buy the real HP-UX or AIX servers? I would not be afraid that this can hit or change the market significally. There are situations (banks, financials, ...) where having strong and redundant eg. HP-UX server is strictly a must.

But for development purposes having this support in VMware can be very nice and usable. And who knows maybe opensource will bring even more support for non-x86 platforms (as everyone can have it installed as a virtual image on laptop) and non-x86 business can be bigger then.

Example of Sun pricing

2008-01-16T10:56:00.001+01:00

I'm running few Sun Fire V210 servers and got request to upgrade them with more memory.
I opened V210 case and realized that I have plenty of free slots available. These servers can work with PC2700 ECC Registered memory. I then asked certified Sun hardware distributor in Czech Republic for a quote to upgrade 4 servers from 2 GB to 8 GB.

I was shocked by the quote I received. Such upgrade is priced by Sun to 20.000 Euros and I will need to send back the 2 GB memory modules. I called them and make sure the quote is correct and if proper currency is used. I thought like it can be 20.000 CZK. No way, its really 20k Euros.

Whats behind such policy and pricing model? Not sure, most probably its Sun's stupidity.

Remote server management cards

2008-01-10T21:56:00.000+01:00

I have been using remote server management cards for quite a long time. In one word I like them, but missed them in many installations as IT admins do not know about such possibilities in general. This little and cheap piece of addon hardware for your server can help you to manage your server remotely like you are sitting by the console screen plus you can manage and monitor a lot other things - power buttons, track hardware errors, mount virtually DVD from your laptop, temperature monitoring, etc.

And all of the above works through rather nice web interface which is full of ActiveX compoments and usually requires JRE on your laptop. Sooner or later you will come into situation where management of older servers (like one year old) will require JRE version XY and management of newest servers will require JRE version YZ. And this happen even you have same hardware vendor - youh Dell? So its hard to manage more server with one laptop and have the same level of management comfort for which you paid.

If your time is too expensive to solve such ridicolous issues than there's nothing else left then go back to oldschool administration via terminal console - which these cards offer as a standard.

I should not forget the fact that access to these cards can be authenticated against LDAP/AD directories with the possibility to granulate access rights.

HP's ILO Management

Dell's DRAC

Japanese invented new branch of soccer/football

2007-11-22T14:05:00.000+01:00

Watch this video and don't ask me any question. ;-)

It is not about hardware

2007-11-20T22:52:00.001+01:00

I have found quite interesting newsletter from Dell in my morning spam. They're marketing new promo action for their PC hardware.

Optiplex desktop PC, Dual Core Pentium, 1 GB RAM, SATA 80 GB HDD with 5-years on-site next business day service for less then $400. I know this is not a hardware for everyone and is dedicated for specific segment only. But price is quite amazing. When you try to buy similar parts in your favorite PC stock, there will not be significant price difference. Plus where is the fee for 5-years on-site service? I'm not sure where this price does come from, but lets believe Dell understands this Taiwan hardware will probably not work without service for 5-years.

Anyway, it is evident that it is no more about hardware. My post about HP acquired Opsware two months ago. And latest news about Dell's intention to acquire another software company. Lets believe its not too late, Michael.

Lesson learned about IT in Czech companies

2007-11-13T01:46:00.000+01:00

I have been visiting many well established companies in Czech Republic over the last few months. I meet lot of different IT managers, visited many SMBs and even large organizations. I was thinking about what should be the "lesson learned" for me from such visits.

The average Czech IT manager has absolutely no clue about what are the latest IT trends. I feel lack of experience and knowledge during my visits. I wish you to see the server rooms of companies which are considered to be a top class in the field. Horrible "kitchen" like server rooms are quite a standard - running on latest LAN technology - 10 mbits ethernets.

Even companies with hundreds of employees are not willing to invest too much in reliable IT environment (people, hardware, etc). They don't care too much about such basic things like an email system which can easily be down for the whole day. "Well, we have phones which we can use instead. Not a big deal."

I cannot imagine companies like this will find something interesting on webservices, REST, hosted services, blades, ... they should start with investments into IT like server room, working email system, working phone system etc.

Of course, there were exceptions, but most of the companies are exactly like I described.

Mythmania continued, home made IPTV

2007-11-05T22:09:00.000+01:00

I finally switched my new HTPC into "production". I took the testing phase quite seriously as I wanted to prevent someone to ask me a stupid question similar to "Can you explain to me why TV does not work?" ;-) I know that I will be having hard time to explain (her) that EIT scanner is causing some issues to mythbackend process and that I need to debug it.

Anyway its working now even I have few things to work out yet - I haven't played with HDTV playback too much yet. I'd like to test the HDTV 1080i DVB-T broadcasting of "CT1" and "TV NOVA".

I was looking for some sort of streaming TV over the local LAN and WiFi networks. I wanted to use MythTV protocol to achive this goal. I googled quite cool MythTVPlayer client for Windows XP. Now I can watch TV recordings or LiveTV on any laptop/computer at home - it works even via WiFi. At the same time my son can watch his favorite TV show at living room on biggy plasma.

I have boxed mythtv player window into google sidebar panel and hitting "F" for "FullScreen" when needed - pretty cool.

Are you Left-Brained or Right-Brained?

2007-10-16T16:01:00.000+02:00

Try this test for getting to know. After a while I was able to see the girl dancing anti-clockwise for few sec, but I can't reproduce it. :-)

My Vista experince: Slow

2007-10-16T01:06:00.000+02:00

I was trying to install Vista Business edition on my home laptop. I was quite surprised with the enhanced installer which is nicer then the old fashioned (read DOS based) Windows XP installer. But my initial enthusiasm got cold rather quickly after I tried to boot my new Vista system. It takes nearly two minutes to boot up.

Not sure what to say about new GUI - its just OK. Maybe too many effects, too many dialog box and questions which regular user can't answer. But I belive Microsoft will find some good compromise here with second or third service pack. If not, then community will bring some tools and themes. I don't see this as a big issue.

But what I'm most concerned is the speed and perfomance. Its noticably slower for regular daily usage then previous XP system. I've heard (or read somewhere from Vista believers) about graphics performance is much better. Well, not an argument for me and other users. We're not going to play Doom with Vista Business edition.

I will load my home laptop with latest version of Ubuntu which comes in two days and see what happens.

My MythTV system : Two days after, HotBird works

2007-10-14T22:19:00.000+02:00

Hardware for my new HTPC system arrived on Friday:

Dual core AMD X64 X2 4800+
ASUS M2N SLI Deluxe motherboard
Kingston 1 GB (2x512 MB) DDR 800 MHz
3x 500 GB WD SATAII drives
and BigTower case from Chieftec (this case is superb, one of the best I've ever owned, very good inside design. I don't need screw driver when need to open the case or even add/remove drive - cool)

At the same day I got hardware for DVB-S:

Technisat SkyStar2 PCI DVB-S card
WaveFrontier T55 toroidal antena (I would never bought a satellite rotor after I read what WaveFrontier can do with simple Diseqc switch. This antena can in theory hold up 16 LNB blocks so you can watch programmes from up to 16 satellites. But in practise I would say that 6 will be the optimal number of LNBs. )

Building the T55 antena is easy for average trained "Ikea furniture" builder. Its time consuming though. It has many parts and took me few hours to find out how to build it. I would save some time when I read manual first (RTFM).

Loading 64-bit CentOS to new hardware was a piece of cake. No issues. Just install and load. I spent some time with finding the good configuration for my disks. I finally set up software RAID5 without LVM. It was new to me to find out that from latest kernel releases you can enlarge RAID5 filesystem. Its very easy and Google has lot of info. I made my swap partition and boot partition RAID1. Why not.

[root@golem Video]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/md2 899G 14G 876G 2% /
/dev/md0 54M 9.8M 41M 20% /boot
tmpfs 502M 0 502M 0% /dev/shm

After I plugged in SkyStar2 DVB-S I found that kernel is missing driver for this card. Weird. Then I found out that I need to install CentOS plus kernel from CentOS plus repository. I like that separation. No need to have such drivers on central company server running CentOS.

Now the tricky part comes. How to place LNBs on WaveFrontier. I had to do lot of reading about parabola skew, azimuth, elevation angle etc. Then I found a great calculator for WaveFrontier antenas.
This calculator should be part of manual of every WaveFrontier owner. You tell the calcultor your position, whats your most eastern satellite and most western satellite and it tells you how you should put the LNBs on your WaveFrontier, together with antena skew, azimuth, elevation etc.

I started my DVB-S game with Hotbird 13E, this will be my most western satellite. I screw the LNB according the what calculator said. After few minutes of fiddling with antena position I got valid signal from Hotbird! How?

scan -a 0 -d 0 /usr/share/dvb/dvb-s/HotBird-13E > channels.conf (this tool comes with dvb-apps tool)

Then I took my laptop out, ssh to my new server and run:

szap -a 0 "Russia Today" (this tool will tune your SkyStar to channel given in parameter according the channels.conf )

szap will tell you actual signal strength. I used that info for finding the best position for WaveFrontier. After I got the best signal I made this position final with some screws. ;-)

Currently I'm able to watch free channels from Hotbird 13E. I will add more LNBs this week.

To be continued....

My MythTV system - time for change? Nono, just upgrading.

2007-10-12T14:25:00.001+02:00

I'm running MythTV system for last two years and my family loves it. My
MythTV currently holds one DVB-T card, about 150 GB of multimedia files
(movies, music and photos). Its funny to sit in the living room and play with
a remote. I can watch my movies, TV recordings, listen music or see
family photos. This system also doing some routing, firewalling and acts
as a home PBX switch (Asterisk, yeah) for DECT phones.

I've come into a decision of moving this system to the next level. This
is my list of goals:

- (MUST) DVB-S (digital satelite) with Diseqc support. I bought a
toroidal multifocus antena with 4 LNB receivers which I want to connect
to Technisat Skystar2 DVB-S PCI card.

- (MUST) DVB-T (terrestrial). I already owns Hauppage Nova DVB-T card in
my current system. I want to reuse this.

- (MUST) Asterisk based PBX system

- (MUST) Firewall, router, WiFi AP

- (MUST) Enough storage for multimedia. Videos, Music, Photos, TV
recordings. This storage should run on top of software RAID with the
possibility of online filesystem resize. Yes, get new disk, plug it in,
and work. I will start with 1 TB of storage in RAID5.

- (SHOULD) VMWare server with Linux image. This will be my playground
for development.

- (NICE) Home alarm system with motion detection cameras. I have this
idea in my head for a long time, but I didn't have time to explore this.

Hardware for my system should arrive today. I will load it with 64-bit
CentOS 5.

To be continued.....

Generating windows IAS PEAP & LDAPS certificates using OpenSSL

2007-10-11T15:31:00.001+02:00

Today I spent nice afternoon by finding out how to create SSL certificate
using OpenSSL for Windows 2003 Internet Authentication Service (IAS). I'm
using IAS for authentication of my WiFi clients. Generating such
certificate using OpenSSL is not that much easy, because MS requires lot
of extended atributes and I could not find out which they are. Yep, MS
wants you to use its Microsoft Certification Authority. But I'm an
openssl guy and have my CA generated already using openssl.

Here are the steps which helps me to accomplish this dirty task (Big
thanks to Stephen Pillinger):

Generating windows IAS PEAP & LDAPS certificates using OpenSSL

It is possible to generate a signed certificate for Windows Internet
Authentication Service (IAS) and LDAPS access to an Active Directory
using OpenSSL.

You need to generate a private/public key pair sign it with your chosen
CA, convert it to PKCS12 format and then import into your Windows
certificate store.

Sounds simple - it is until you find that Windows requires the PKCS12
file to contain a couple of Microsoft specific Bag Attributes. Namely
the Crypto Graphic Service Provider (oid=1.3.6.1.4.1.311.17.1) set to
'Microsoft RSA SChannel Cryptographic Provider' and LocalKeySet
(oid=1.3.6.1.4.1.311.17.2) set to an empty string.

OpenSSL currently doesn't appear to support LocalKeySet so it's
necessary to patch it yourself.

Download this patch for version 0.9.8a of OpenSSL it was based on a patch by
Daniel Carroll for version 0.9.7d and modified slightly for later versions.

Once you've got your new patched version of OpenSSL you need to generate
a CSR in the usual way and get it signed by a CA. There are a few
requirements that the certificate must comply with in order to work:

* The certificate must chain to a trusted CA.
* The X509 Extended Key Usage must contain Server Authentication
(oid=1.3.6.1.5.5.7.3.1).
* The name in the subject line of the certificate must match the
fully qualified machine name.
o For LDAPS the subject line must match the full computer
name including the Active Directory domain (eg.
hostname.ad-domain.domain) as indicted by the Computer Name tab of the
System Properties.
* The certificate must pass the CryptoAPI certificate store checks
- in order to do this the PKCS12 file must have the bag attributes
listed above.

To add the extra bag attributes use the following command:

openssl pkcs12 -name "PEAP Certificate" -export -in peap.pem -out
peap.p12 -CSP 'Microsoft RSA SChannel Cryptographic Provider' -LMK

Import the PKCS12 file into your machines personal certificate store and
it should now work with PEAP or LDAP.

In order to ensure that the certificate contains the correct
extendedKeyUsage attributes you will need to add the following to your
openssl.conf file:

[ sign_ias_csr ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth,serverAuth

HP will deliver nice toy for Norway University students

2007-10-05T16:37:00.001+02:00

Norway University students will be given a nice toy:

"HP has been hired to deliver a massive Linux-based solution based on a 60 Teraflop/s clustered HP Cluster Platform 3000BL spanning 17 racks and consuming 370 kW of operational power, with 704 2-way 2.66 GHz BL460c (Quad-core Intel Xeon X5355) nodes. The largest university in Norway will have a total of 5,632 compute cores with Infiniband interconnect, 12.1 TB of distributed memory, 128 TB available centralized storage, and 100 TB of distributed storage."

Have a look at the server room preparation picture:

http://docs.notur.no/uit/gfx-uit/the-machine-hall-august-27-2007/mhall3724.jpg

More HP Linux annoucements are available at http://www.hp.com/linux

Email from eco-friendly employee to shut off A/C units

2007-09-21T15:15:00.001+02:00

From: ----- -----------
To: IT Department
Re: A/C constantly running.

To whom it may concern,

I came in today (Monday) to finish up a project I was working
on before our big meeting with the State ----- Commission tomorrow,
and I noticed that there were three or four large air conditioners
running the entire time I was here. Since it's a three day weekend,
no one is around, why do we need to have the A/C running 24/7?

With all the power that all those big computers in that room use, I
doubt it is really eco-friendly to run those big units at the same
time. And all computers have cooling fans anyway, so why put the A/C
for the building in that room?

I got a keycard from [the facility manager's] desk and shut off the
A/C units. I'm sure you guys can deal with it being warm for an hour
or two when you come in tomorrow morning.

In the future, let's try to be a little more conscientious of our
energy usage!

Thanks,
-----

As for the employee who sent it, he decided to take an early retirement.

Synchronize Team's Outlook calendars through Google Calendar

2007-09-20T15:17:00.001+02:00

I have been looking for a way how to synchronize Outlook calendars which
are not connected to Exchange. I find an interesting solution which can
be implemented for free - synchronize them via Google Calendar.

1/ First setup calendar sharing between team members on Google.
2/ Setup a two-way sync of your Outlook calendar and Google calendar.
Using remotecalendars tool - see below.
3/ Finally setup one-way sync of other (shared) Google Calendars to your
Outlook - use separate calendar folder.
4/ Enjoy shared calendars.

You can also keep in sync your Thunderbird calendar and Google Calendar.
That said you can share calendars between Outlooks and Thunderbirds. ;-)

This is the tool you will need:

http://remotecalendars.sourceforge.net

Here you can find more info about setup:

http://remotecalendars.sourceforge.net/help.html#services
http://www.grinn.net/blog/dev/2006/04/incorporate-google-calendar-into.html
http://johnhesch.com/2007/04/12/sync-thunderbird-with-google-calendar/

Thinking of drobo

2007-09-07T14:57:00.000+02:00

My current disk storage at home is getting full and I'm looking around
for some replacement:

http://www.drobo.com/

I have read lot of good stuff about external storage device called a
Drobo. It's marketed as a 'storage robot', but there are no robotics
involved. They use a proprietary RAID-like scheme that typically gives
you more storage than the various RAID levels. The price is reasonable
too: $499.

If you want to see Drobo in action I recommend this video at

http://www.drobo.com/products_demo.aspx

How to restore boot path for Windows on Itanium platform (EFI)

2007-09-06T12:14:00.001+02:00

The instructions below show how to restore the booth path in the boot
manager:

1. Boot the server. Make sure that nothing is in the CDROM drive.

2. From the Boot Options menu, select the EFI Shell menu item.

3. Type map ?r and locate the EFI service partition. This should be
fs0:.

4. Change to fs0 and type ls. You should see the directories of efi
and MSUtil. If you don't then try the next fs# listed by the map command
in step 3.

5. As part of the Windows install process, a backup boot path is
saved to the EFI service partition in the \efi\Microsoft\WinNT50
subdirectory. The name of the file is boot000# where # is usually a 4 or
5 but can vary between 1 and 9. Find out what your filename is by going
to the directory. Type the following:

cd \efi\microsoft\winnt50 and <ENTER> and then ls
Record the name of the Windows boot path here:

6. The nvrboot.efi file is located in the \MSUtil directory. Change
to this directory by typing cd \MSUtil and <ENTER>

7. Run the nvrboot.efi file by typing in nvrboot and <ENTER>

8. You should see boot path descriptions similar to what you see at
the Boot Options menu at startup. To restore the Microsoft Windows
Server 2003 boot path we need to import the backup one located in step
5. To do this press I and <ENTER>.

9. Type in the import file path:
\efi\microsoft\winnt50\<bootpathfile> Replace <bootpathfile> with the
filename recorded in step 5 above.

10. You now should see a Windows Server 2003, Enterprise menu option
appear at the bottom of the boot path list.

11. Type p, <ENTER>, then type the number that corresponds to the
Windows Server 2003, Enterprise boot option, and <ENTER>. This pushes
the boot option to the top of the list so Windows Server 2003 will be
automatically booted after the system starts.

12. Exit out of nvrboot by typing q and <ENTER>.

13. Exit from the EFI Shell by typing in exit and <ENTER>.

14. Notice that when you return to the EFI Boot Option menu that you
do not see the Windows Server 2003, Enterprise boot option. This is
because the menu you are looking at has not been refreshed from NVRAM.
To update the display simply enter the Boot option maintenance menu and
then exit back to the Boot Option menu. You should now see the Windows
boot option at the top of the list.

15. Boot into Windows by highlighting the Windows Server 2003,
Enterprise boot option and pressing <ENTER>. Windows now boots.

Keywords: EFI, Itanium, Boot, Sector, Recover, Restore

Big players are looking for datacenter automation startups

2007-07-25T00:46:00.000+02:00

Over the last few months we can see big players are buying datacenter automation startups. Altiris has been acquired by Symantec in January, HP has just announced its intent to acquire Opsware, and we can only guess when EMC will buy BladeLogic.

I have been playing with Altiris Deployment Solution over the past few days and it works reasonably well. It has some headaches with Linux deployment which does not work without making some small patches to the Linux startup scripts.

Its also interesting that the list of supported platforms is limited to Windows, Linux and MacOS. I can't count DOS as a platform. Wonder when these systems can work with other platforms like HP-UX, AIX, Solaris and other big Unixes.

The world's most dangerous server room?

2007-07-19T14:56:00.000+02:00

Uhm, what can be wrong here?

Scripting languages - are they underestimated?

2007-07-10T21:55:00.001+02:00

Scripting languages such as Perl, Tcl, Python represent a very different
style of programming than system programming languages such as C or
JavaTM. Scripting languages are designed for "gluing" applications; they
use typeless approaches to achieve a higher level of programming and
more rapid application development than system programming languages.
Increases in computer speed and changes in the application mix are
making scripting languages more and more important for applications of
the future.

Good manual for sed

2007-07-10T20:25:00.001+02:00

I was written some tool using sed and have found good manual for sed.

http://www.grymoire.com/Unix/Sed.html

And again I'm amazed what you can do with sed - I call that rapid scripting. ;-)

Big companies always surprise me

2007-06-28T10:13:00.000+02:00

It is amazing how big companies can surprise not just the customers but
even their own employees. I needed to change signalling on EuroISDN line
from PTMP to PTP. This is rather standard procedure with other companies
but not with Slovak Telecom (TCOM). I should note that we have had two
DID numbers for each EuroISDN line before we asked for the change.

Timeline:

1/ We submitted a request for change the signalling on TCOM helpdesk.
2/ Then we have to wait for half a week and then started to call TCOM
helpdesk regulary what is the status of our request.
3/ After many calls and after 8 days we got a call from TCOM support
engineer that he is about to make a change.
4/ TCOM engineer made a change and said OK - Done. I should notice
that making this change is a 2 mins job (including testing)
5/ The day after we realized that only one DID number per ISDN is
working. Huh, whats that. Why the second number does not work?
6/ After several calls with helpdesk we were told that there is some
internal process which says that only one DID is allowed on PTP line.
7/ Customer: "What?"
8/ TCOM engineer and helpdesk were not aware about this processed when
we've started this change.
9/ We have our PTP line but customers could not call because every odd
number does not work.
10/ Customer: "How we can get to work all DID numbers?"
11/ TCOM: "You need to submit a request for adding second DID for your
PTP line."
12/ Customer: "What? Wh't the f'uk yur talking about? We already owned
that numbers before we asked for a change!"
13/ TCOM: "Thats our internal processes and our system does not allow to
make this change."
14/ Customer: Asking god for a help and submitting a request for adding
second DIDs which we already owned and were working before.
15/ TCOM: Processing.

I don't know the end of this story because customer is still waiting.

Landed

2007-06-28T02:05:00.001+02:00

Landed. I have shutdowned my old Movable Type blog and switch over to Blogger. Movable Type has been nice, but required some decent admin work to keep it fresh and updated.