infrastructure August 2011

infrastructure@lists.fedoraproject.org

28 participants
39 discussions

Freeze break: add cname for existing tier0 mirror
by Kevin Fenzi 22 Aug '11

22 Aug '11

Turns out this mirror in our rsync acls has 2 names and if dns picks up the other one they get denied. I'd like to add their other name in so they can sync more reliably. odysseus.fi.muni.cz odysseus.linux.cz diff --git a/modules/rsync/files/rsyncd.conf.download-phx b/modules/rsync/files/rsyncd.conf.download-phx index 5ba9e05..c9f3fd5 100644 --- a/modules/rsync/files/rsyncd.conf.download-phx +++ b/modules/rsync/files/rsyncd.conf.download-phx @@ -63,7 +63,7 @@ refuse options = checksum list = no uid = 263 gid = 263 - hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-che mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 + hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-che mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz odysseus.linux.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 [fedora-epel0] comment = Fedora EPEL for Tier0|1 Mirrors @@ -71,7 +71,7 @@ refuse options = checksum list = no uid = 263 gid = 263 - hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-chemnitz.de mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 + hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-chemnitz.de mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz odysseus.linux.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 # For distributing applications [log] diff --git a/modules/rsync/files/rsyncd.conf.download-rdu b/modules/rsync/files/rsyncd.conf.download-rdu index 027b90e..171b22e 100644 --- a/modules/rsync/files/rsyncd.conf.download-rdu +++ b/modules/rsync/files/rsyncd.conf.download-rdu @@ -63,7 +63,7 @@ refuse options = checksum list = no uid = 263 gid = 263 - hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-che mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 + hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-che mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz odysseus.linux.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 [fedora-epel0] comment = Fedora EPEL for Tier0|1 Mirrors @@ -71,7 +71,7 @@ refuse options = checksum list = no uid = 263 gid = 263 - hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-chemnitz.de mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 + hosts allow = 152.46.7.122 200.17.202.1/28 zeus1.kernel.org zeus2.kernel.org zeus3.kernel.org zeus4.kernel.org 149.20.20.132 204.152.191.36 199.6.1.170 130.239.17.3 sinclair.wpi.edu bonaparte.hrz.tu-chemnitz.de josephine.hrz.tu-chemnitz.de mirror.speedpartner.de rsyncer.ftp.heanet.ie archive.linux.duke.edu lists.us.dell.com auslistsprd01.us.dell.com auslistsdr01.us.dell.com 65.18.175.19 198.129.224.34 mirror.hiwaay.net sagres.c3sl.ufpr.br mail.fedoraunity.org scrye.com odysseus.fi.muni.cz odysseus.linux.cz rhlx01.hs-esslingen.de ftp.nrc.ca zaphod.gtlib.gatech.edu 128.171.104.148 # For distributing applications [log]

3 2

Moving Ask Fedora to Staging
by Rahul Sundaram 22 Aug '11

22 Aug '11

Hi We have been running Ask Fedora in the devel instance for a while now and updated several times as upstream fixed bugs and responded to feature requests http://ask01.dev.fedoraproject.org/questions/ We have a custom CSS file thanks to Suchakra and with the help of PJP (co-sysadmin, cc'ed), we have configured it to run with Apache. I haven't setup Postfix or memcached yet on the devel instance but atleast Postfix has been tested locally. We will have to think about whether we should be running our own instances or hook into the existing infrastructure. A SOP has been written as well https://fedoraproject.org/wiki/Ask_Fedora_SOP We will add more details we go forward. As a side note, while I was looking at memcached, ran into a alternative python binding (pylibmc) for memcached which apparently performs much faster and is being used by reddit. This has been packaged as well as the Django (django-pylibmc) module for that. Details at http://amix.dk/blog/post/19471 Let me know what I need to do to move Ask Fedora to Staging Rahul

4 9

Unplanned Proxy Outage: - 2011-08-19 16:30 UTC
by Toshio Kuratomi 22 Aug '11

22 Aug '11

Summary of Event ================ Tonight there was an unplanned outage of two proxy servers (proxy01 and proxy02). The proxies were unresponsive and needed to be rebooted in order to come back online. Proxy01 being down caused a cascade of other issues that should have had very little end-user impact. As far as we know, the applications on admin.fp.o would have been up but appeared very slow and the wiki would have been up for reading but logging in would have failed. Explanation to follow. Proxy01 is the only proxy server that is used for app servers (web apps, cronjobs, etc) in phx2 that need to talk to our web applications in phx2. This was setup because the router that handles traffic into and out of phx2 does not allow us to "hairpin", send a request for data from phx2 to an external ip address that then resolves back to a server in phx2. As currently implemented, we have an /etc/hosts entry that points admin.fedoraproject.org at the internal ip address of phx2. When proxy01 went down, things in PHX2 that needed to talk to admin.fedoraproject.org were no longer able to get the data they needed. For the wiki, this meant that attempting to login during the outage would be unable to verify the password in fas. For the TurboGears apps on admin.fedoraproject.org the situation was worse. TG1 apps' identity management depends on visit tracking to work. Visit tracking hits fas for every request. This means that no page could be served for the TG1 apps from the phx2 app servers. We have two app servers that reside outside of phx2. Because of network latency between these servers and the database server in phx2, these servers are configured to be backups for the servers in phx2, not handling requests unless phx2 is unable to. The remaining proxy servers detected that the app servers within phx2 were down and properly switched over to app servers outside of phx2 so there was no apparent outage for people trying to use admin.fedoraproject.org, although response time would have been drastically less. Looking at the haproxy status page for proxy03 during the outage we noticed that only one of the two app servers outside of phx2 (app05 at ibiblio) was handling traffic. app06 (at telia) was not. We are not sure why this is. One possibility is that telia's network latency is just too high so haproxy decided that app06 was also down and did not pass traffic to it. Action Items ============ There are some open questions to try to resolve: * Why did proxy01 and proxy02 die? A brief look at the logs has not revealed a cause for this. * Why didn't app06 take up any of the slack when haproxy started passing traffic to the backups? We have identified one means of mitigating this in the future: If we ran internal DNS for phx2 then we could have admin.fedoraproject.org resolve to different proxy servers (using internal ip addresses for the proxies inside of PHX2). This should remove the SPOF on proxy01. We have not yet determined whether we'd need to run more proxy servers inside of PHX2 or if hairpinning would not be an issue if we used proxy servers outside of phx2. -Toshio

2 1

[PATCH] modify all the TG apps (except for bodhi since its logging config is different) to not dump the world to stdout.
by Seth Vidal 19 Aug '11

19 Aug '11

From: Seth Vidal <skvidal(a)fedoraproject.org> --- modules/fas/files/fas-log.cfg | 2 +- modules/fas/templates/fas.cfg.erb | 2 +- .../fedora-packagedb/templates/pkgdb-prod.cfg.erb | 2 +- .../templates/mirrormanager-prod.cfg.erb | 2 +- modules/smolt/templates/prod.cfg.erb | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/fas/files/fas-log.cfg b/modules/fas/files/fas-log.cfg index 3f7843d..a1ed30c 100644 --- a/modules/fas/files/fas-log.cfg +++ b/modules/fas/files/fas-log.cfg @@ -19,7 +19,7 @@ formatter='full_content' [[[access_out]]] class='StreamHandler' -level='INFO' +level='WARN' args='(sys.stdout,)' formatter='message_only' diff --git a/modules/fas/templates/fas.cfg.erb b/modules/fas/templates/fas.cfg.erb index 5908fc4..48ab522 100644 --- a/modules/fas/templates/fas.cfg.erb +++ b/modules/fas/templates/fas.cfg.erb @@ -206,7 +206,7 @@ handlers=['debug_out'] #propagate=0 [[[identity]]] -level='INFO' +level='WARN' qualname='turbogears.identity' handlers=['access_out'] propagate=0 diff --git a/modules/fedora-packagedb/templates/pkgdb-prod.cfg.erb b/modules/fedora-packagedb/templates/pkgdb-prod.cfg.erb index 4f28dce..ce4990a 100644 --- a/modules/fedora-packagedb/templates/pkgdb-prod.cfg.erb +++ b/modules/fedora-packagedb/templates/pkgdb-prod.cfg.erb @@ -133,7 +133,7 @@ formatter='full_content' [[[access_out]]] class='StreamHandler' -level='INFO' +level='WARN' args='(sys.stdout,)' formatter='message_only' diff --git a/modules/mirrormanager/templates/mirrormanager-prod.cfg.erb b/modules/mirrormanager/templates/mirrormanager-prod.cfg.erb index b4d18b9..39345fa 100644 --- a/modules/mirrormanager/templates/mirrormanager-prod.cfg.erb +++ b/modules/mirrormanager/templates/mirrormanager-prod.cfg.erb @@ -121,7 +121,7 @@ level='INFO' handlers=['debug_out'] [[[access]]] -level='INFO' +level='WARN' qualname='turbogears.access' handlers=['access_out'] propagate=0 diff --git a/modules/smolt/templates/prod.cfg.erb b/modules/smolt/templates/prod.cfg.erb index cc22b5a..0e10dbd 100644 --- a/modules/smolt/templates/prod.cfg.erb +++ b/modules/smolt/templates/prod.cfg.erb @@ -78,7 +78,7 @@ level='INFO' handlers=['debug_out'] [[[access]]] -level='INFO' +level='WARN' qualname='turbogears.access' handlers=['access_out'] propagate=0 -- 1.7.2.1

3 2

[PATCH] change access_out to WARN from INFO - testing to quiet down apache error_log
by Seth Vidal 19 Aug '11

19 Aug '11

From: Seth Vidal <skvidal(a)fedoraproject.org> --- modules/elections/templates/elections-prod.cfg.erb | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/elections/templates/elections-prod.cfg.erb b/modules/elections/templates/elections-prod.cfg.erb index e0f4ab9..6f92258 100644 --- a/modules/elections/templates/elections-prod.cfg.erb +++ b/modules/elections/templates/elections-prod.cfg.erb @@ -80,7 +80,7 @@ level='INFO' handlers=['debug_out'] [[[access]]] -level='INFO' +level='WARN' qualname='turbogears.access' handlers=['access_out'] propagate=0 -- 1.7.2.1

3 2

Meeting Agenda Item: Introduction Mahrud
by Mahrud S 19 Aug '11

19 Aug '11

Hi I'm Mahrud. irc username: mahrud. *Skills: * I've learned working with these things while working on different projects or digging my linux laptop: LinuxPAM, SELinux, chroot, squid, LDAP, git, Wireless Cryptography & OpenSSL, Linux network/security administration, monitoring and troubleshooting, embedded linux (OpenWRT on a WRT54GL), etc. programming: native c/cpp and adv. bash, familiar with ruby, python, php, javascript, a bit assembly, understand perl, hate Visual Studio and specially VB. Algorithmic programing and data structure (intended school classes). *Projects:* HelliJudge <http://hellicode.allamehelli.ir/git/> (an online judge system; details<http://users.allamehelli.ir/%7Em_sayrafi/blog/2011/08/project-hellijudge/>), OpenSchoolNetwork (a local system for Allamehelli HS (my previous high school), it's goal is to find and train future admin of server<http://allamehelli.ir/>of Allamehelli from students by giving them a jailed ssh account on server. It uses a central authentication system using LDAP for squid on the same server and sshd on another server using the same ldap server) *Hobbies: * Digging Linux! hack (but not crack)! Remote administrating Allamehelli's network and server. *Weaknesses:* If there isn't any problem to solve, then I'll be so lazy and waste my time on google reader! Back in Iran I were working on Allamehelli's server, but now in US due to loss of physical access I'm unable to work with that server (because in case of problem in ssh or auth, I'll have to wait about a day for my friends to take is up again), and that's why I want to join you in administrating the fedora infrastructure. Still in high school (12th grade). Hope you are not bored :) I'm interested in working on this<https://fedorahosted.org/fedora-infrastructure/ticket/230>or this <https://fedorahosted.org/fedora-infrastructure/ticket/833>, but I'll be glad to work on anything related to Linux (even if there is a requirement, I'll learn it through the project, just like all of the above) **-- Best wishes Mahrud <http://users.allamehelli.ir/%7Em_sayrafi/>

2 1

Plan for tomorrow's Fedora Infrastructure meeting (2011-08-18 at 19UTC)
by Kevin Fenzi 18 Aug '11

18 Aug '11

The infrastructure team will be having it's weekly meeting tomorrow 2011-08-18 at 1900 UTC in #fedora-meeting on the freenode network. Suggested topics (suggested by whom): * New folks introductions and Apprentice tasks. * F16 Alpha Freeze reminder and tickets. * Fedora hosted plans * Upcoming Tasks/Items (nirik) 2011-08-02 - 23: Alpha change freeze 2011-08-05 figure replacements for xen 03/05/09/15 (EOL 09-25 ish) 2011-08-17 send infra meeting agenda 2011-08-18 infra meeting 2011-08-23: Fedora 16 alpha 2011-09-01 mail fi-apprentice folks. 2011-09-13 - 27: Beta change freeze 2011-09-09 Remove inactive fi-apprentice people. 2011-09-27: Fedora 16 Beta * Meeting tagged tickets: https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assi… Submit your agenda items, as tickets in the trac instance and send a note replying to this thread. More info here: https://fedoraproject.org/wiki/Infrastructure/Meetings#Meetings Thanks kevin

1 1

Activity
by Jesse N. Richardson 18 Aug '11

18 Aug '11

I've finally gotten my computer fixed everyone. Can someone please add me back to the team? Sent from my iPod On Aug 14, 2011, at 8:00 AM, infrastructure-request(a)lists.fedoraproject.org wrote: > Send infrastructure mailing list submissions to > infrastructure(a)lists.fedoraproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://admin.fedoraproject.org/mailman/listinfo/infrastructure > or, via email, send a message with subject or body 'help' to > infrastructure-request(a)lists.fedoraproject.org > > You can reach the person managing the list at > infrastructure-owner(a)lists.fedoraproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of infrastructure digest..." > > > Today's Topics: > > 1. Re: infrastructure Digest, Vol 63, Issue 17 (F?bio Falc?o) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 13 Aug 2011 23:06:33 +0100 > From: F?bio Falc?o <fawcao(a)gmail.com> > Subject: Re: infrastructure Digest, Vol 63, Issue 17 > To: infrastructure(a)lists.fedoraproject.org > Message-ID: > <CAM4+sV0MPs77tWq_fcKsj6Dsjv5d+e9LZszHPhee0=qAHrHR4Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, i'm new here too. > > i working with systems development today, but always worked with > infrastructure, specifically in clusters and grids. Currently I master's > degree in computer engineering in Coimbra and my area of ??research is in > the area of ??secure protocols. > > 2011/8/13 <infrastructure-request(a)lists.fedoraproject.org> > >> Send infrastructure mailing list submissions to >> infrastructure(a)lists.fedoraproject.org >> >> To subscribe or unsubscribe via the World Wide Web, visit >> https://admin.fedoraproject.org/mailman/listinfo/infrastructure >> or, via email, send a message with subject or body 'help' to >> infrastructure-request(a)lists.fedoraproject.org >> >> You can reach the person managing the list at >> infrastructure-owner(a)lists.fedoraproject.org >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of infrastructure digest..." >> >> >> Today's Topics: >> >> 1. joining with the Fedora Infra team - Hello (Buddhika Kurera) >> 2. Re: joining with the Fedora Infra team - Hello >> (Stephen John Smoogen) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Sat, 13 Aug 2011 07:28:25 +0530 >> From: Buddhika Kurera <bckurera(a)fedoraproject.org> >> Subject: joining with the Fedora Infra team - Hello >> To: Infrastructure Ffedora Project >> <infrastructure(a)lists.fedoraproject.org> >> Message-ID: >> <CAMkiuStsQxX4790swwTajS6vwGX5jMC9oa3jKg4PNKrsmvwpSQ(a)mail.gmail.com >>> >> Content-Type: text/plain; charset="utf-8" >> >> Hello Infra team, >> >> I am Buddhika Kurera[1] and working with Fedora Ambassadors and Design >> teams >> plus free media teams currently. >> >> I am interested in joining with the infrastructure team too. Therefore I ll >> be keep in touch though the ML. >> Further as I am new to this team please help me to understand the workings >> with the teams. >> >> If any tickets, requests please share, I can give my helping hand. >> >> I am a good at PHP development and web related technologies. That is my >> tech >> background. See you soon. >> >> [1] fedoraproject.org/wiki/User:bckurera >> >> -- >> Regards, >> *Buddhike Chandradeepa Kurera* >> Fedora Ambassador Sri Lanka >> Event Liaison - Design Team >>

4 4

Questions before requesting new mailing list
by James Laska 17 Aug '11

17 Aug '11

Greetings, I'm about to submit a ticket requesting a new mailing list on lists.fedoraproject.org. Before submitting, I'd like to ask a few questions. The new list is really an existing list that will be migrating to lists.fedoraproject.org. Because of this, the list has existing members, and archives. What is the procedure for migrating the existing subscriber list? I gather that's something I'd setup after the list is created, but thought I'd ask here first. Also, is it at all possible to migrate the existing list archives to the new lists.fedoraproject.org location? I suspect this would be fairly painful, but again, can't hurt to ask. :) Thanks, James

3 4

[PATCH 1/2] since we're running all of fasClients from cron now - comment out this run of fasClients from puppet.
by Seth Vidal 15 Aug '11

15 Aug '11

From: Seth Vidal <skvidal(a)fedoraproject.org> I think but am not positive that it is causing this log error: restorecond: set context /var/db/shadow.db->system_u:object_r:shadow_t:s0 failed:'Permission denied' due to fasClient running from cron at the same time as from puppet. --- modules/fas/manifests/init.pp | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) diff --git a/modules/fas/manifests/init.pp b/modules/fas/manifests/init.pp index f1eb7ac..64676bb 100644 --- a/modules/fas/manifests/init.pp +++ b/modules/fas/manifests/init.pp @@ -66,15 +66,6 @@ class fas::client { type => "user_home_dir_t", } - exec { "make-accounts": - command => "/usr/bin/fasClient -e; /usr/bin/fasClient -i", - timeout => 90, - creates => "/var/db/shadow.db", - require => [ - File["/etc/fas.conf"], - Package["fas-clients"], - ], - } } # May want to merge this into fas::client in the future if we want yubikey -- 1.7.2.1

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure August 2011