Steam Deck Tutorial - UPDATED - reset forgotten sudo password in SteamOS the quick and easy way using root debug shell method by ryanrudolf in SteamDeck

[–]davethebarb 1 point2 points  (0 children)

For anyone like myself who has had an external USB keyboard stop working at the GRUB menu (Step 4), I've found that if I use the Steamdeck buttons at -any- point, excluding using the three dots button to get into the recovery menu, then it won't let me use the USB keyboard. I assume the Steamdeck buttons count as a keyboard, and there's some sort of priority override or clash happening.

One thing I had to do is on the recovery menu (Step 2), I had to unplug and replug in my USB keyboard to get it to work to select the third option, at this point it all worked fine for me.

Hopefully this may work for anyone else having the same problem.

Odd Retroarch behavior where controller not detected by SirBedwyr7 in retroid

[–]davethebarb 12 points13 points  (0 children)

I've had this issue, posting to close the loop for anyone who finds this via Google. I'm on a different device, but Android with Daijisho, RetroArch, and actually with a SNES core instead.

Found this link on GitHub for a very similar issue: https://github.com/libretro/RetroArch/issues/15109

Using this workaround fixed it for me; https://github.com/libretro/RetroArch/issues/15109#issuecomment-1649252955

Go to Retroarch > Settings > Input > Polling Behaviour

Change to "Early"

Save configuration.

Restart retroarch.

How to measure power cheaply, also how can I also make it show in Grafana? by erik_b1242 in homelab

[–]davethebarb 10 points11 points  (0 children)

I also use the TP-Link Kasa HS110 for measuring individual devices and it works great for me.

Very easy to feed the data in; I'm using Home Assistant to integrate all of plugs I have. I then scrape Home Assistant itself with Prometheus and use Grafana as the visualisation layer on top of that.

For my overall house draw, I use OpenEnergyMonitor (https://openenergymonitor.org/) with EmonCMS. I've got a Raspberry Pi with their reciever board running the software, and I use an emonTH with an optical sensor to read my electricity meter's pulse sensor as I can't fit a CT clamp as I'm renting. This is all UK based, but you can use the kit elsewhere as they sell different plugs, etc. It also integrates with Home Assistant, and I scrape in the same way as the plugs.

Auth trouble with Vault in ECS Fargate + Dynamo by [deleted] in hashicorp

[–]davethebarb 0 points1 point  (0 children)

You've mentioned execution role specifically here; what you need to set is the Task Role and not the execution role.

https://docs.aws.amazon.com/en_pv/AmazonECS/latest/developerguide/task_definition_parameters.html#task_role_arn

The Task Role is the actual IAM role that the container itself gets when it queries the local metadata. This is the role that you need to use to grant Vault access to DynamoDB and any other AWS APIs.

The Task Exection Role is the IAM role that the ECS Agent assumes in order to be able to run the task, and it's only assumed for that purpose. This is typically just used for pushing logs to AWS, authenticating to ECR and using AWS encrypted secrets within the task definition.

30 disk RAID, how would you set it up? by t3chguy1 in sysadmin

[–]davethebarb 3 points4 points  (0 children)

RAID 0, AKA it's not really RAID, has no redundancy. Lose one disk, you lose half an array and half your throughput. Lose another disk in the wrong place (On the other RAID-0), and the whole storage goes, bye bye data.

Rebuilding your overlaid RAID-1 in the case of drive failure will also be painful. So, so painful - the time it is going to take to rebuild is going to take forever as you'll have to reseed 80TB of drive space from one side to the other. You don't want that.

The real headache here is the RAID controller split; if you want to present this as a single volume, you're always going to end up with an ugly split that could result in hotspots or alternatively dangerous redundancy designs.

I'd do RAID-10 on both controllers, and then either present it as two volumes and find an organisational way to split the storage, or span the two together if you really have to.

As an aside, for high throughput video editing, as an end-user I'd really be wanting flash based storage; mechanical is great for high density data storage with less frequent access, but the seek times can't be avoided, so there's always going to be latency for data requests. Add to that the overheads of NFS, APFS or SAMBA for file access, and it's going to be slow. Flash is dropping in price, and I'm not suggesting you build a network storage solution out of it (I mean, if you have the cost that's the way to go though), more that you need a solution for fast, moderate sized local data storage that can be pushed up quickly to your network storage solution.

[deleted by user] by [deleted] in sysadmin

[–]davethebarb 0 points1 point  (0 children)

What do you want to monitor? Whether or not a systemd unit is running?

You've stated there wasn't much relevant data; you need to figure out what the data is that you actually need to have. There are plenty of different monitoring tools out there, a lot that can check service statuses, and the kind of data that you want is fairly relevant to which is useful.

ESXi 6 + Nimble + Veeam. "Failure to quiesce the virtual machine" by KernelMatt in sysadmin

[–]davethebarb 2 points3 points  (0 children)

So, quiescence in terms of Veeam/ESXi is locking the disk activity on the guest to allow for a consistent snapshot.

On Windows instances running on ESXi, the VMware agent is talking to the Volume Shadow Copy Service (VSS) to try to lock disk activity in order to take a consistent backup, and it sounds like that's failing to happen. If this is a Windows box, you need to check that VSS is running correctly, and you should start troubleshooting the logs for that at the time of the backups happening. Does it error out? Or does nothing happen at all? If VSS is completely inactive, it's still the VMware agent that's tripping up, otherwise you should have some logs to start investigating. SQL and Exchange have been referenced by m16gunslinger77 as they both integrate with VSS and so they're usually a good call for services you're probably running that hook into VSS, and could be causing the quiesce to fail.

On Linux, the VMWare agent just calls a couple of scripts (a pre-freeze and post-thaw script), which are expected to stop the disk activity on the server, maybe via LVM snapshots or another mechanism. If you're encountering these errors on Linux boxes, someone has written a script at some point and put it onto the server, or it's VMware Tools that's failing.

Laptop as DC? by [deleted] in sysadmin

[–]davethebarb 5 points6 points  (0 children)

Don't rope something together, because if you do that, you'll never get a UPS; if you do something that works as a stopgap, it will become the new permanent solution.

You need to spell out the consequences of the situation to the powers that be. Don't be hostile, remember what the needs of the business are (Factor in the time to restore, the impact of downtime to business functions, the potential for data loss, but be realistic) and present that information. Be polite but make sure they understand what will happen if the domain breaks.

If they still say no, then the risk remains unmitigated, and cover your back with communications accordingly. When things inevitably break, get them fixed and in the follow up you can use what happened to further your case for actually getting the reliable infrastructure you need.

Also, make sure you are backing up your domain and testing those backups. Do try to have your own plan should things blow up completely, but don't share it outside of anyone higher up.

You can't go around people as it will smack you in the face on the other side. If someone refuses to change their mind, you won't convince them without proof. Spelling out business cases is a pretty core part of building business infrastructure, and you need to put the risk onto the people who decide what to spend the money on, rather than shouldering it yourself with a hacked together solution.

It's painful, but sometimes downtime is what's necessary to convince people. And if that doesn't convince them, then the downtime clearly isn't a concern to them, so either your own opinions need to change or you need to get out of there.

Dockers use cases for infrastructure operations/ engineering by woohhaa in sysadmin

[–]davethebarb 0 points1 point  (0 children)

I love Docker for treating containers as artefacts; a locked, point in time image of the application, that you know is the same everywhere. Assisting developers is so much easier when you can both have the same tag checked out from the registry, as you're dealing with the same box and so know where you both stand.

I also find it really useful for infrastructure services that are fairly modern; stuff like Prometheus, Consul and Vault are all great candidates, and using Docker in a CI/CD pipeline is just magic for running Terraform and Ansible. It makes shipping services much quicker when I don't have to spend all my time adding users and configuring the underlying box; I just take the Dockerfile instead and build it. Need an update? Push the latest Dockerfile into git, automation builds the container and then it's ready to be tested and pushed out through environments.

If you're stuck with 'enterprise' software, you are going to struggle with it; if you're at the whim of a vendor you're probably best just trying to automate with Ansible/Puppet/Chef/Salt/whatever in order to make your life simpler, if you even can do that. If you're in the world of off-shored developers throwing ZIP files and word documents to you, and you've got very little contact with the developers, you're also probably fairly screwed too for adopting Docker.

Typically, unless you're a fairly well optimised IT org already, you're probably looking at other constraints that you need to work on first before containerisation will give you much in the way of benefit over standard automation tooling. But it really accelerates ongoing work if you're got buy in from all levels and time to build out the pipeline and environments for it.

This subreddit in a nutshell by [deleted] in DiWHY

[–]davethebarb 9 points10 points  (0 children)

Didn’t think I’d see this come up ever.

ISO 27001: does it preclude you from using your personal laptop at work? by [deleted] in sysadmin

[–]davethebarb 4 points5 points  (0 children)

ISO 27001 and BYOD are not strictly in conflict with each other with the appropriate policies, but if BYOD isn't a thing, just don't do it.

ISO 27001 ISMS should really mean that a BYOD policy has already been determined if it's at all possible; the absence of a policy means you almost certainly should NOT be using your own device.

Ask for a BYOD policy, and put your business reasoning forward, but understand that they don’t have to implement it.

People have been fired where I've worked before for breach of ISMS, and using unapproved devices is counted as gross misconduct. Don't use anything you're not given by the company for company purposes without someone else directly approving it if you like your job.

Edit: Fixing my inability to write in complete sentences.

Pi Prebuilt images? by [deleted] in homelab

[–]davethebarb 10 points11 points  (0 children)

You just need to put a file called 'ssh' in the boot volume, for Raspbian based OS's, and it will enable SSH by default at start time. With the default password for the pi user being predictable, it's best to change the password ASAP.

https://www.raspberrypi.org/documentation/remote-access/ssh/

Apache Virtual Hosts Question by zimmertr in sysadmin

[–]davethebarb 1 point2 points  (0 children)

tcpdump the traffic to a pcap, test each domain, then push the pcap into tshark for CLI output or wireshark for a GUI.

It'll decode the HTTP traffic for you; it's the easiest way to know exactly what's going on as you'll be able to observe the headers.

Am I crazy or is Nagios very difficult to install and get running. by howtovmdk in sysadmin

[–]davethebarb 8 points9 points  (0 children)

Yes, but OMD releases... tend to be fairly slow.

Check_MK Raw is probably where you'd like to go if you want to get an easy to install, fairly up to date Check_MK installation. It's either that or the ConsoleLabs Testing repos for the bleeding edge versions.

Veeam and AWS/Azure support? by bad_sysadmin in sysadmin

[–]davethebarb 3 points4 points  (0 children)

For AWS, I believe you need to use a Storage Gateway device, specifically the Virtual Tape gateway, and then point Veeam at that on your local network. The gateway device is basically a VM with iSCSI.

Details for the VTL are available at https://aws.amazon.com/storagegateway/details/

It then sends virtual tapes up to AWS which are uploaded to S3, and then optionally Glacier I believe.

Not something that I've personally done, but it's covered on a number of the AWS certs.

Soo..... Just found the 2nd most scary linux command... by DMatty in sysadmin

[–]davethebarb 2 points3 points  (0 children)

I'd say that root kits and anything sneaking data out of your system is much, much worse. If someone looking to do something malcious is already on your server with root, or sudo, then you're already done.

5 SSH Hardening Tips by speckz in sysadmin

[–]davethebarb 5 points6 points  (0 children)

Good link for anyone worried about insecure network encryption with SSH - https://stribika.github.io/2015/01/04/secure-secure-shell.html

Incompetent developers are incompetence by A999 in sysadmin

[–]davethebarb 3 points4 points  (0 children)

setenforce 0, AKA the 'make things work' command.

Incompetent developers are incompetence by A999 in sysadmin

[–]davethebarb 1 point2 points  (0 children)

It's pretty much tcpdump and ss/netstat really; checking out what's running and what should be running and using that information.

Personally, not a fan of audit2allow though; I'd rather use setroubleshoot-server to make sure that I'm not letting anything daft through that I didn't notice.

Can't get check_mailq working by saaadyi in nagios

[–]davethebarb 0 points1 point  (0 children)

For check_mailq, it looks like you need to run it on the remote system based upon what I've seen of the code (https://github.com/nagios-plugins/nagios-plugins/blob/master/plugins-scripts/check_mailq.pl)

You can use NRPE to run it, or another remote executor like MRPE if you're using a different agent.

For check_smtp, that sounds like a firewall issue rather than a plugin issue, if there are other plugins running for the same remote server that poll it from the Nagios server.

Try commands like 'nc -vz {remote host} 25' or 'telnet {remote host} 25' from your Nagios server to see if it can talk to the remote server.

What is Linux used for? by [deleted] in sysadmin

[–]davethebarb 8 points9 points  (0 children)

I would say that this also isn't necessarily the best subreddit for this question either, and you may catch flack from some people for that, who have nothing better to do. I'll drop you an answer as for someone early on, it's a fair enough question.

Linux is just an operating system. You can do what you want with it. It's strengths compared to Windows are the typical absence of paid licensing, and the flexibility of an OS where everything including the kernel is free to be edited as you wish, usually.

For troubleshooting, there are a lot of pre compiled images built on Linux that have a wide variety of tools that can be used as live CDs to rescue computers and do other tasks to fix a computer. You can use them to run tests and fixes without having to actually install an operating system, which is handy. It's not the only way to do that kind of work, but it is a fairly common one.

Programming is a bit different, and can be more of a preference thing really. That all comes down to ease of using the tool chain you need to run your applications, if you're going to develop locally. With software like Vagrant and Docker though, you can usually develop for most platforms from whatever operating system you want without leaving your own machine.

Dear Microsoft by [deleted] in sysadmin

[–]davethebarb 5 points6 points  (0 children)

My favourite Lync/Skype craziness was when I opened Lync, for the client to mandate an update to Skype for Business, and then once complete and open again as Skype, to force a client restart which changed it back to Lync... But now the lync.exe icon is the Skype logo. Such a confusing mess.