January 2020 - Heroes - openSUSE Mailing Lists

[heroes] Weekends makes me wish I was using a different distro
by Felix Miata 18 Jan '20

18 Jan '20

I just waited 13.5 minutes for http://download.opensuse.org/distribution/leap/15.2/repo/oss/x86_64/ to completely load in SeaMonkey, 11.5 minutes before it even started to paint anything, 75,987,605 bytes of html. This is just after it took 45 minutes between submitting a new bug, and succeeding to add 3 additional attachments (in 4 parts: 3 15.2 initrds, one too large for acceptance which had to be split) to B.O.O.: http://bugzilla.opensuse.org/show_bug.cgi?id=1161238 http://ftp5.gwdg.de/pub/opensuse/distribution/leap/15.2/repo/oss/x86_64/ took 5 seconds to load html, 2,890,366 bytes. Something is very wrong that opensuse.org is setup to require such gargantuan HTML and 16000% longer load times. -- Evolution as taught in public schools is religion, not science. Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

6 13

[heroes] Re: [#59920] New DNS infrastructure for openSUSE domains
by Michael Ströder 18 Jan '20

18 Jan '20

Lars, thanks for driving this. On 1/13/20 11:56 PM, admin(a)opensuse.org wrote: > [openSUSE Tracker] > Issue #59920 has been updated by lrupp. > > % Done changed from 20 to 60 > > ns1.opensuse.org and ns2.opensuse.org are online and answer queries for the opensuse.org domain. > > left TODO: > * define a machine outside the Nuremberg network as DNS > * saltify the setup Do you still want some help? IIRC you've installed bind. At heroes meeting there was a tendency to go for PowerDNS. Backend was still to be decided. I have some preference for launch=ldap to have authc/authz integration to another LDAP server [1] and use native LDAP replication for HA. But maintaining DNSSEC RRs with pdns_control is probably not yet supported by PowerDNS' LDAP backend. I've tried to login to nue-ns1.infra.opensuse.org to have a look at the current setup but are probably not allowed to do so. Ciao, Michael. [1] https://www.ae-dir.com/apps.html#slapd-ldap -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

3 5

[heroes] Password Expiry in FreeIPA
by Michael Ströder 16 Jan '20

16 Jan '20

HI! from the last IRC meeting: ------------------- snip ------------------ [20:52:11] <cboltz> ("password expired" only means someone didn't login in FreeIPA for months - but you can still use the VPN and sudo with an expired password) [20:52:29] <kl_eisbaer> sure? (mean: did you try?) [20:52:48] <cboltz> yes, more than once [20:52:54] <kl_eisbaer> as in that case, I have the feeling that FreeIPA has a security problem :-( ------------------- snip ------------------ Known problem since many years. Password expiry is only enforced when authentication with Kerberos, not LDAP: https://bugzilla.redhat.com/show_bug.cgi?id=782917 They claim they have to keep it that way for resetting expired passwords. :-/ In opposite to that password expiry just works for LDAP simple bind in OpenLDAP and Æ-DIR provides a decent password reset web application which also works for expired passwords: https://www.ae-dir.com/pwd.html#reset-procedure This procedure is also used for setting the initial password (because both use-cases share the same security requirements and have the same goal). Ciao, Michael. -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Leaving SUSE, staying with openSUSE & more changes
by Karol Babioch 14 Jan '20

14 Jan '20

Hi all, there have been quite a few changes within SUSE related to the Engineering Infrastructure team that I would like to share with you for reasons of transparency: - Kurt Garloff has left SUSE some weeks ago. We had a meeting discussing some of our current challenges & issues along with future options with him a few months ago. Notes have been taken [1]. We will try to stay on track with what has been discussed / agreed upon as much as possible. Feel free to remind us of anything we might have missed and/or fail to deliver! - The Engineering Infrastructure team, who is responsible for the openSUSE infrastructure within SUSE has finally a new team lead since late last year. Her name is Evženie Šujskaja (CC). - Obviously she is still trying to get a good understanding of the team and its responsibilities, but she is perfectly aware of the existence and necessity of the openSUSE infrastructure, the heroes and its responsibilities. - Feel free to contact her for any organization topics and whenever something related to the openSUSE infrastructure needs coordination with a representative from SUSE. - I will shortly be leaving SUSE. While I will try to stay as much around and connected within the openSUSE (heroes) community, I will definitely not have as much time and privileges to work on openSUSE as I've used to - also because I have quite a few challenges ahead in my personal life that will require a lot of time and attention ;-). - Please contact Ricardo Klein, Bernhard M. Wiedemann and/or Jens Daniel Schmidt (all of them CC'ed) for any technical questions/concerns that need attention from SUSE's side. At least one of them will try to be around in the monthly heroes meeting. - It is still a good idea to organize a yearly heroes meeting in person (in Nuremberg). Someone else will have to be the organizer / host next time(s), but please do not forget to think about it (e.g. in October / November / December). I'm still hoping to see and meet many of you by interacting in this and other Open Source communities, conferences, etc. In case someone wants to stay in touch more explicitly, I would like you to use my personal mail address (karol(a)babioch.de [also CC'ed]) from this point onward. Thank you so much for the good time and never forget to have a lot of fun keeping the systems up and running ;-). Best regards, Karol Babioch [1]: https://etherpad.opensuse.org/p/openSUSE_Infra

2 1

[heroes] static.o.o etc. outage - workaround
by Christian Boltz 09 Jan '20

09 Jan '20

Hello, (if you hear about this the first time, see status.o.o and the ticket system for some details.) I applied a workaround to get at least static.o.o back in a reliable way: since pages running via login2.o.o work without problems, I switched static.o.o over to use the login proxy. Changes done: - added vhost config for static.o.o on daffy1 - added haproxy config for static.o.o via login proxy on anna - changed DNS entry for static.o.o from "A 195.135.221.143" and "AAAA 2620:113:80c0:8::18" to "CNAME login2.o.o" Note that this only "fixes" static.o.o which causes the most visible problems (loosing all styling on several pages). Other services routed via anna/elsa (everything with CNAME proxy.o.o) are still affected by the network problems. (We could apply the same workaround for them, but I'd prefer to get the network issue fixed instead ;-) Regards, Christian Boltz -- [GUI vs. Command-Line] Einen ähnlichen Streit wird es in 20 Jahren auch geben, wenn die "2D-Screenfanatiker" auf die "VR Fans" losgehen und wieder ein Streit vom Zaun bricht der an Sinnfreiheit kaum zu überbieten ist. [Phillip Richdale in suse-linux] -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 1

[heroes] Status: Monitoring
by Lars Vogdt 08 Jan '20

08 Jan '20

Hi TL;DR: - all Apache Webservers report some statistics now - general monitoring cleanup done - monitor more Long version: One of the first jobs for me was to check the monitoring for changes or broken stuff. Meanwhile I'm happy that only the monitoring of remote logs from our machines is persistent enough to show up nearly all the time in monitoring. All other 1347 service checks from the 49 monitored hosts are either green (99.4% green services) or been acknowledged or worked on. I added more checks especially for gitlab and elasticsearch - and adjusted (or patched and upstreamed) some others. If you think I missed something, please let me know. Just one thing: I *love* monitoring and try to always keep an eye on it. If you miss a check or have an idea, please let me know. These points are open: * deploy monitoring config via Salt With kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 1

[heroes] Status: Provo
by Lars Vogdt 08 Jan '20

08 Jan '20

Hi TL;DR: - Provo machines can reach NUE machines via provo-gate.infra.opensuse.org - new provo-ns.infra.opensuse.org machine for DNS - all machines have external IPv6 now - updated/upgraded all machines to Leap 15.1 Long version: We have currently the following machines running in Provo: 192.168.67.1 provo-proxy (IP is on mufasa) 192.168.67.2 mufasa 192.168.67.3 provo-proxy2 (IP is on mufasa) 192.168.67.4 provo-ns (planned for external DNS) 192.168.67.5 narwal4 (static.o.o in Provo) 192.168.67.6 nala (mirrordb for download.o.o in Provo) 192.168.67.7 provo-mirror #192.168.67.8 old keyserver2 (shut down) #192.168.67.9 water2 (wiki - shut down) #192.168.67.10 riesling2 (wiki - shut down) 192.168.67.11 login3 (login service in Provo) 192.168.67.20 provo-gate (new machine, acting as gateway to NUE) 130.57.72.11 status2 (external status.o.o fallback) I setup provo-gate as gateway now (running VPN tunnel to Nuremberg via scar), which allows all Provo machines to reach machines in Nuremberg. Sadly, I did not find the time to establish the route back as well. This needs some adaptions on scar's firewall - and I need to read more about this (or better: find someone who volunteers to help) before this can go live. While I was on it, I setup an additional machine named "provo-ns", which is currently empty (Leap 15.1 admin image only) and is waiting to get an external DNS server for the opensuse.org domain. The two status.opensuse.org machines sync the database and Cachet installation files now once each day, which should allow us a smooth failover and/or fallback in case of trouble. This is documented in the Heroes-Wiki. These points are open: * roll-out DNS on provo-ns * establish the route back from Nuremberg to Provo machines ** add all nodes to Salt ** add all nodes into Monitoring ** add all nodes into Backup With kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 2

[heroes] Status report: piwik migration
by Lars Vogdt 08 Jan '20

08 Jan '20

Hi TL;DR: - beans.opensuse.org has been migrated to matomo.infra.opensuse.org - the database has been moved into the Galera cluster - the old Piwik installation is upgraded to Matomo 3.13.0 Long version: Some of the openSUSE web-pages are equipped with inline Piwik code for tracking and analysis of the visitors since years. The original setup was done under my umbrella - and not really touched much over the years. While we all might need to start a conversation about "is such tracking/analyzing still needed" (especially with all these new GDPR stuff in mind), I decided to bring the setup to a more current state, first. Reason: the used SLE11 (even with LTSS) and Piwik 3.2.0 were kind of outdated and might had security issues already. So I bumbed the machine to SLE-12-SP5 and upgraded Piwik to Matomo 3.13.0 in a first step. This took some time - and involved also some database migrations for the application. Once this worked - and I got the changes I did integrated into the matomo package in network:utilities, I decided that the best way might be to go forward... In the end, I setup a new Leap 15.1 machine inside the openSUSE Heroes private network (called matomo.infra.opensuse.org). After that, I migrated the database from an old MySQL cluster to the new Galera cluster in the openSUSE Heroes network. Using Leap allowed me to enable some additional features in Matomo (like Geo or Device tracking). At the moment, the Piwik accounts and tracked pages are still the same as before - no changes happened. But we could - in theory - use Heroes accounts from now on. This would make maintaining access to the Matomo instance easier (and reduce the amount of accounts that everybody needs to remember). We might also decide to completely shut down Matomo - or even extend it's usage to other services (like the ones listed on status.o.o). We might also need to clarify if the service - together with all others - is "GDPR clean". These points are open: * GDPR check * keep or shut down Matomo * extend it to monitor (for example) other services like: + download.o.o + build.o.o + planet.o.o + lists.o.o + etherpad.o.o + forums.o.o + ... (some more resources) * align the user accounts with FreeIPA accounts for easier management With kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 2

[heroes] Status update
by Per Jessen 06 Jan '20

06 Jan '20

== Forums migration Last year on Dec 2, Jared informed he was ready with a database dump, a couple of days later, I provided a place for him to securely upload the database dump. As of Jan 6 - no communication, no database dump. == Maxmind GeoIP As Ludwig (thanks!) informed us last year, as of 30/12 Maxmind requires an account in order to access the otherwise free GeoIP databases. I went ahead and opened an account using per(a)o.o. On both pontifex and olaf, you'll find the databases as well as userid and password (in the Makefile) in /var/lib/GeoIP. See tickets #50633, #37546 and #61749. olaf - I don't know how the GeoIP databases are used here, can anyone enlighten me? I need to check that the GeoLite2 format is accepted. == Tumbleweed on mirrors it looks like we are not correctly picking up when a mirror has Tumbleweed. Looking at mirrors.o.o, very few mirrors seem to carry Tumbleweed, but I know my own mirror (mirror.hostsuisse.com) has it, yet it is not listed. ticket #61743 == widehat ticket#61746 - only returns a 404 ? I will likely be a little late for tomorrows meeting, I need to pick up my son from orchestra practice. -- Per Jessen, Zürich (-0.2°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Happy New Year 2020!
by Lars Vogdt 06 Jan '20

06 Jan '20

Hi ho! I hope, everybody had the chance to relax, recover and enjoy her/his vacation! While most people know me, I like to give a short introduction for those which are new here: I'm Lars Vogdt, currently working at SUSE on the Open Build Service. In former times, I was also responsible for the R&D infrastructure (which included openSUSE stuff during this time) - but I stepped back from this area in September 2016. In 2017, I was first still busy with the hand-over - and finally realized that I will not have enough time for the openSUSE heroes any longer (mainly because of private reasons). At least not in 2018. So I stepped back in December 2017 - and was focussing on other areas of my life in 2018 and 2019. But - as I mentioned during the Heroes meeting in November 2019 - I like to return and offer my help and support to the openSUSE heroes in 2020. Please note that I explicitely write here with my private Email address, as this decision has nothing to do with my employer. I'm working on the openSUSE heroes "front" as everyone else: during my free time. I just have the luck to still have some good connections and still know some (bigger) parts of the running infrastructure. I took the freedom to use parts of my Christmas break to work on some openSUSE infrastructure stuff already. I will give an update about this in separate Emails (in the hope that this split makes it easier to start separate discussions). I'm looking forward to an interesting year 2020 for the openSUSE Heroes and wish everyone a good and healthy start into the new year! With kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 1