Monday, February 1, 2016

February 1st - History (Bash), GMVault, Google Takeout & Let's encrypt games :)

For the last few days I didn't had a chance to write about the things I've done.
Today, I'll summary some of the things I was working on for the last couple of days.

History (Bash internal command):
I've underestimated the History tool abilities.
I was using a lot the History tool to check sequence of my previous commands, at some machines I've even configured the History tool to remember more queries than configured by default.


I've also used the "history -c" sometimes when typed sensitive data as input by mistake.
In the last few days I've learned that the history output has lots of power inside of it.
I remember that in the past I've even searched about a way that will make History output data of the last commands only, without the sequence number to the left of the commands.
But now I want to tell you about the power of those numbers.



The above screenshot is a simple output from my history output command.
Did you knew that if you type "!{number}" Bash will run the command related to this {number} in Bash output?
It means that if I had type "!488" Bash would have run the command "svn up .", cool uh?!

Another tip I learned is that if I type in Bash "!$" the value of "!$" means that last parameter entered in the previous command.
Means that if the last command I entered in Bash was "rm -rf /etc/puppet/modules/apache"
The value in Bash of "!$" == "/etc/puppet/modules/apache", Cool!!
Once you get used to work with it, it can be really helpful.



GMvault:
I was remember GMvault has a very good application in my past, but it seems that the upgrades of Inbox & Gmail didn't make well to GMvault which might its developer don't have time anymore to keep it updated.
For the last two weeks I was struggling with it to export\import 65K of emails from x-employee to a new one.
Because those two employees were working together for ~2weeks approx. for overlap I ad to merge the two accounts together later on.
The Import process was seems to be fine at first, and was finished after 20hrs or so.
But while running the export phase I've had lots of issues, some were related to the import phase.
- GMvault didn't import well drafts that didn't had extra text in the body besides signature - even if those were with some email addresses configured in the "To" & "Cc" sections.
I've had to login into the old account, check each drafts and delete it if it was empty.
- The x-employee used Outlook as her email client, using Google Apps sync for Outlook, Outlook created a "directory" called "Outbox", which GMvault fail to import as a new label, due to "Reserved naming" of Google.
- There were lots of issues about corrupted email ID's, though after restart the import action the issue didn't came up for the same email ID; I've experience this issue for ~15 times during the process.

- Last issue was, it seems like GMvault didn't knew to count correctly which emails have been imported and which not.
Every time it finished I ran the restore command to make sure I didn't missed any emails during the import process, and GMvault told me that there are still ~65K of emails to restore
(?!)

Google Takeout:
Due to the issues I've experienced with GMvault the team decided to take another kind of backup of the x-employee account data, although it is eligible to get Google Vault license (we used Postini services in the past...).
As writing this emails, Google Takeout run a backup action to backup all emails, contacts, Google+, Youtube, etc. data to .Zip file which we will upload eventually to the new employee Google Drive.

Let's Encrypt:
Let's encrypt sounds to be a deal breaker!
The guys from ISRG raised an amazing project - SSL certificates to everybody for FREE.
But, it has some restrictions, at-least for now, such as no wildcard SSL certificate is allowed, SSL certificate renewal is a process that should be run once a day at-least.


I'll must to admin though, until now I did succeed to require any SSL certificate using the Let's Encrypt.
I've tried challenge via the Standalone method, also using WwwRoot...
I've also tried challenge via DNS using the 3rd party tool of LE (Github)..
I've tried my own domain (devorkin.net) and a test domain - tests.net - nothing for now.
I'll work and investigate it more deeply later this week and will dedicated a whole Blog post for it later this week.

Good night :)

Thursday, January 14, 2016

Puppet, Apache 2.2 and Apache 2.4 installation module.

A few days ago I've decided to grab a new task on my workplace - to create a local CA server for our internal utils.

This means that each device with Web service (Web sites, Firewall management, WiFi management, and more) that using self-signed SSL certificate will be validated using our local CA.

before start working on the CA end, I've decided to bring up lab env. that contain 1 node with functional Zabbix server, Based on:
- OS: CentOS 6\ or 7
- Web server app: Apache 2.2 or 2.4 & PHP
- Database: MySQL community server (Latest stable release for centOS)

The other node, for the CA, will use CentOS 7 OS.
Both systems will be set as Virtual machines (guests of VMware Fusion) and will be implanted by Puppet.

Current Objectives:
- Configuring Apache 2.2 templates:
  • httpd.conf
  • ssl.conf
  • Disable Welcome virtual server
- Configuring Apache 2.4 templates:
  • httpd.conf
  • ssl.conf
  • Disable Welcome Virtual Host



Main issue:
- Detect Apache version and use template files for Apache 2.2 or 2.4
Solution:
CentOS 6 comes with Apache 2.2.x while CentOS 7 comes with Apache 2.4.x
So checking the OS against major release and adding an IF conditional solved the issue.
<code>
if $::operatingsystemmajrelease == 6 {
... }

if $::operatingsystemmajrelease == 7 {
... }
</code>

Accomplished tasks:
- Create Puppet module to install basic setup of MySQL community server.

Also, during the run of Puppet I've noticed that the MySQL module is running each time Puppet agent runs - and it attempts to change the temporary Root password (appear in MySQL log files) with other one set as variable.
Solution:
I'm using a Bash script in the end of the module (via Exec['...']) ref. to grep, mysql query and change the Root password.
I've added this script an option to check if there's a directory called /etc/puppet/locks - if not it should create it.
Also, Once the Bash finish, it will touch an .lck file into this directory (/etc/puppet/locks) - in the client end - and next time the script will run, there's an IF statement that checks if this .lck file found - so it will not run the whole script repeatedly.

Welcome - 1st post

Welcome to my first post in this blog

My name is Yehonatan Devorkin,
I'm 31years old.
live in Petah Tiqwa, Israel.
I've got 1 brother, 1 sister, 3 dogs, lots of hobbies and one major of them is my love to technologies.

I'm starting to write this blog in order to bring my learning skills on "paper" from IT skills to DevOp.

So let's start working on becoming a REAL DevOp :)