ARGGH!

IDIOTS!

everywhere! on the internet!

puppet iptables module

i now have a working copy of iptables puppet module.


I used the following recipe :

http://reductivelabs.com/trac/puppet/wiki/Recipes/ModuleIptables

however, it did require a little tweaking, so probably worth documenting here.

Firstly, we use SVN to add or edit our puppet config, so i needed to add the above files:

/puppet/modules/iptables/files/fragments/default.pp
/puppet/modules/iptables/files/rebuild-iptables
/puppet/modules/iptables/manifests/init.pp

and edit the file
/puppet/manifests/nodes.pp

( i didnt add a seperate class for this, due to the way out environment is structured)

So firstly, default.pp i want to contain the iptables i want to install on a specific punch of servers.

for example:

-A INPUT -j SUL
-A FORWARD -j SUL
-A SUL -i lo -j ACCEPT
-A SUL -i eth0 -j ACCEPT
-A SUL -p icmp --icmp-type any -j ACCEPT
-A SUL -p 50 -j ACCEPT
-A SUL -p 51 -j ACCEPT

I should note that i dont include the SVN headers in this file, because it can intefere with the iptables rebuild script.

So ive checked this into svn, so all good there.

Next, i need to check in rebuild_iptables. Also if you reference your rules in a different way ( eg - A-REDHAT-FIREWALL, or similar ) you will need to edit the script before you check it in.

Thirdly, here is my nodes.pp, which for each server i want to load these rules, i reference the fragment i want to apply to that server:

node 'foo.example.com' inherits foonode {
include iptables
ipt_fragment {"default" : ensure => present }
}

As iptables is a module, you just need to include it. Then you need to reference the fragment.

Lastly, a bit of a gotcha. You need to set the mode of rebuild_iptables in the iptables init.pp otherwise it is not executeable.

file {
"/etc/iptables.d":
ensure => directory,
purge => true,
notify => Exec["rebuild_iptables"];
"/usr/sbin/rebuild-iptables":
mode => "755",
source => "puppet://puppet/iptables/rebuild-iptables";
}


check into svn, run svn-puppet on the server so it has the latest config.

Then on the client, run puppetd --test , or in debug if you prefer.

Please let me know if you find this helpful, or have any other comments.

appreciation

Happy Sysadmin day to me and any other sysadmins who read this.

http://www.sysadminday.com/

Today was spent driving to west sussex in the early hours to deal with something distinctly non-technical and definitely more hairy, which i put in a big metal box and sent to Europe.

Then i went to work, popped into the DC and installed PFsense to play with, then went and wrote a bash script and cronjob.

Go me.

Ugh

Writing puppet modules is probably not the best thing to be doing when one is suffering a bout of flu.

ugh. ugh. ugh.

but its not windows!!!

I dont get people sometimes. Recently, on LQ theres been a spate of newbie Linux users posting large and unnecessary rants about how they cant get their computer to work. Invariably, this is always a PEBKAC error, but the $lusers dont want to hear it , they just want to know why it doesnt work like windows!

Clue: Its not Windows.

Change is difficult for some people. I get that. And i think its brill generally that more people are trying out Linux. But Linux isnt windows, it doesnt run the same as windows, and theres some good reasons WHY it doesnt.

For example:

"There has not yet been a single widespread Linux malware threat of the type that Microsoft Windows software currently faces; this is commonly attributed to the malware's lack of root access and fast updates to most Linux vulnerabilities.^"

I hope this snippet of common sense helps the next $luser who wants to log and and run as root because its 'easier'.


==

ION i am approaching the vinegar strokes in terms of getting this bloody server fixed. Everything but the plastic case has been replaced, and i narrowed the problem down to both disk and CPU. Kickstarted the 0S, and spent yesterday rebuilding the application.( cannot wait to get this into SVN and puppet )

Only one more problem to figure out and im home free.

sweet tool

Been using this as a sweet little tool which places stress on linux systems. hats sweet about is that you can stress IO, memory, CPU cycles, and/or disk.

its also good for testing monitoring/alert software such as cacti/munin/etc and of course testing scalability.

http://freshmeat.net/projects/stress

ive been using it overnight to test the machine that went over on me last week. It seems my fears were not unfounded as its now had SATA disk,ram replacement and a new kickstarted OS and its still crashing, but thanks to stress we've managed to narrow it down t to disk. Surprisingly the machine ran quite sweetly all night with quite a high load avg.

Today ive been playing with puppet, which $bossman and i have installed quite recently. Today im chuffed to get puppet to deploy my heartbeat configuration and postfix for my MTA's in our dev environment. But i still have to figure out how to change the iptables to let heartbeat through ( this has been configured manually, just need puppet to do it ) and then ill be (re)deploying the configuration into production. The MTA's will be our first 2 machines running off puppet. Im actually quite excited about this prospect!

Tomorrow i am offically $oldfart. And ill be spending the day cutting cables (literally) in the datacentre, which were put up by 2 very sleep-depped sysadmins and are therefore a bit useless.

going Chrome

$bossman and I must be living under a rock. We only heard about Google's new OS last night

Pretty exctiting stuff though, ive got real high hopes for Chrome OS as a direct rival to MS, despite only being available on netbooks and the like in the first instance. Hopefully, it will do more to put Open Source on the map to the wider public.