Setting Up Salt

Salt is a remote execution manager which allows a system administrator to run multiple commands across many systems in their enterprise at once. Similar to Func, I am looking at it as a configuration tool written in python that I can grok better than I am at puppet.

To start with we worked from the central home server by installing the following rpms:

1. https://github.com/downloads/thatch45/salt/salt-0.8.9-1.el5.noarch.rpm
2. https://github.com/downloads/thatch45/salt/python-zmq-2.1.7-1.el6.x86_64.rpm
3. https://github.com/downloads/thatch45/salt/zeromq-2.1.7-1.el6.x86_64.rpm

$ sudo yum localinstall salt*rpm python-zmq*rpm zeromq*rpm

Now some prep work is needed here. We need to setup the hostname for the salt server in DNS and or /etc/hosts so that our clients can find it. After that we can start the master and minion on our first box.

$ sudo /sbin/chkconfig --add salt-master
$ sudo /sbin/chkconfig --add salt-minion
$ sudo /sbin/service salt-master start
$ sudo /sbin/service salt-minion start

The next clients will only have the minion added. The master will be off as we aren't ready to deal with multi-master setups. So what can we do with salt? Well we can run cmds and such

$ sudo salt '*' cmd.run "ls -l /etc/hosts"        
xanadu.int.smoogespace.com: -rw-r--r--. 1 root root 209 Sep  7 14:59 /etc/hosts
xanadu.int.smoogespace.com: 

$ sudo salt '*' user.info smooge
{'xanadu.int.smoogespace.com': {'gid': 500,
                                'groups': ['desktop_admin_r',
                                           'mock',
                                           'wheel'],
                                'home': '/home/smooge',
                                'name': 'smooge',
                                'passwd': 'x',
                                'shell': '/bin/bash',
                                'uid': 500}}
$ sudo salt '*' status.diskusage /
{'xanadu.int.smoogespace.com': {'/': {'available': 13899972608,
                                      'fstype': 'ext4',
                                      'total': 16910295040}}}

However I then ran into some limitations. I am trying to figure out what might have caused them, but they are rather interesting:

salt '*' pkg.list_pkgs
{'xanadu.int.smoogespace.com': {}}

salt '*' file.get_sum /etc/passwd    
{'xanadu.int.smoogespace.com': 'Hash md5 not supported'}

There should be quite a bit more packages there than that, and I think md5sum is supported. I am guessing there are some packages I need to install or check in the files. Will get to that in my next blog on this.

What did you really expect?

What did you really expect?

In having dealt with multiple 'reformed' hackers, I have to reluctantly agree with Spafford on this. When I was a teenager in the early 1980's, I started into 'cracking' encryption codes on software.. not because I wanted to use the software (versus the game Choplifter and Adventures) but mainly because I wanted to see how people were trying to hide stuff and make a programmable floppy drive 'play' with bits and bites. Or trying to figure out how a telephone system works, lock tumblers, or password systems. But at some point, it became sort of an obsession, and I was more going for the amount of cracked software I had in my house compared to others. Our standards were the number of years we would spend in prison on consecutive prison terms, and how much we owed in fines. The first person who broke 200 years in prison was the coolest etc. Looking back on it.. it was plain STUPID. I think I began to be aware of its 'stupidity' when I started using GPL software, and realized that the only thing that made the GPL strong was the COPYING license. It made no logical sense to disregard other people's licenses and then say that the GPL license was better because of this that or the other... And looking at myself further, I realized that most of the arguments I had used to justify my actions were selfish lies in the same vein as why an addict says stealling money from the family is ok. What I was addicted to was the rush of doing something illicite that few other people could do... and at some point I had a "Come to Jesus" moment, and realized that doing it wasnt helping anyone and eventually hurting others. So I basically went to being a GPL-freak for a while, didn't use any closed source licenses I had not paid for, and started working on protecting other people's rights versus violating them.

And like some other people that conversions happen to.. I went through a period where I believed everyone could do it, and that when someone said they were 'clean'... they meant it. I have helped hire some former crackers, and very often found that what they said and what they did were two different things. It might be I am on the wrong side of the statistics, but looking back on 10 years in the business.. 8 out of the 9 went back to cracking at some point, and we had to let them go. There is some sort of 'rush' when you get that password off the wire, when you find that supposed closed system is wide open from some office telephone/modem, and it is addictive. And then comes the feeling of superiority that you are mightier than anyone else... and with that feeling comes the usual drive to take advantage of it because of some percieved slight. Heck it sounds like all the classic feelings and symptoms people on crack mention (but probably at a different level).

Anyway, I have come to believe that like many bad things, it takes an act of conversion to get out of Cracking. And then probably in many cases, a 10 step program to make it stick. I guess Luke 11:24-11:26 is probably a good summary to show this has gone on for a long time with people.

Goodbye SysAdmin Magazine

Got a card in the mail today saying that SysAdmin magazine was going out of print as of August 2007. The magazine covered Unix Systems Administration, and had a bevy of articles every month for Solaris, AIX, and Linux. I had been subscribing to the magazine since I had worked at Red Hat back in 1997 or so.. and had a couple of articles I was going to submit this fall for possible publication. I had noticed the magazine had gotten thinner and thinner over time.. my guess was that circulation was increasingly down as less Unix systems were around and more people get their information from the web. However the articles were surprisingly useful at times when I needed to figure out some arcane Unix issue that only occurred on version X.Y of Bubonix.
The good point, they are offering to fulfill my subscription with a CD-rom of all issues in pdf format from 1994 to 2007 so I will be able to have my back issues available for grepping about how to handle our aging AIX and Solaris boxes here at the University. The bad point will be that I will have to find out where to get up-to-date Systems Administration information these days. I should probably join LOPSA or SAGE again to see what they offer. Off to find out what magazines are good these days.. and what I can afford on a University salary.

I will try to put up my articles on puppet and computer security sometime in the future.

Thankyou to the editors and writers of the magazine over the years. You have been very helpful.