I discovered yesterday that my Pidgin client is refusing to connect to GMail/GoogleTalk with the error:
"SSL peer presented an invalid certificate"
After half an hour of digging, I finally found this Pidgin bug with a work-around:
https://developer.pidgin.im/ticket/17118
I have no idea what's going wrong here, and I can only assume Gmail has some new cert that's not playing nice with something on my system. But seeing as it took me so long to figure out, I thought I'd help make this easier to find for anyone else who runs into the same problem find it.
UPDATED:
After a few days, this stopped working. I can only guess that gmail is rotate SSL certs faster than I can keep up.
But I found this Gentoo forums post:
https://forums.gentoo.org/viewtopic-t-1057862.html
Which pointed the problem at gnutls, and sure enough, emerging pidgin without the gnutls use-flag solved the problem.
20170111
20151129
Piwigo Thumbnails
I've been trying to find a nice way to host images on my Piwigo server... The problem I've had is that I don't have enough disk space on my server to host all of my full-size photographs, so until recently I'd been sshfs-mounting them off of an AWS instance that was connected to my Dropbox. Then my year of free AWS ran out, and I was back to searching for a solution.
I eventually ran across this post at Odd One Out who had figured out how to generate the thumbnails Piwigo needs offline. So I hacked his script up, and now I'm sshfs-mounting my photos off a much slower (and cheaper!) network connection, and pushing the thumbnail images there separately. (I figure it's very rare for someone to actually download my full images, so I can live with that being a little slower.)
I eventually ran across this post at Odd One Out who had figured out how to generate the thumbnails Piwigo needs offline. So I hacked his script up, and now I'm sshfs-mounting my photos off a much slower (and cheaper!) network connection, and pushing the thumbnail images there separately. (I figure it's very rare for someone to actually download my full images, so I can live with that being a little slower.)
20130720
Gentoo, ReadyNAS, and iSCSI
I recently bought a Netgear ReadyNAS 104 while trying to recover from a failure of my old RAID-5 enclosure. Now that it's all put together, it looks like I can pull a maximum of 50 MB/s, with typical speeds of 30-40 MB/s. I'm not sure what the limiting factor is at this point, since it doesn't seem to be network bandwidth, or CPU on either end. I think something in the system is latency bound, since it seems to pull a little faster when my desktop CPU is completely idle.
At first I was going to set it up using sshfs, but the little ARM CPU in that thing can only push about 3-4 MB/s when it has to do the encryption itself. So what I finally settled on was exporting it as iSCSI, and having my desktop do the encryption with cryptfs (LUKS).
I get the feeling that iSCSI doesn't get a lot of love on Gentoo, so I figured I'd post my troubles and what I finally got to work. This post from the Gentoo Wiki Archives was the most helpful, though I skipped all his interface setup, which I'm assuming was designed for a dedicated storage network.
iSCSI Basics:
A target is a server which is offering up a drive for clients to use.
An initiator is the client which consumes a drive to read or write it.
Init Script:
The init script for open-iscsi was kind of primitive... I had to install the unstable version (sys-block/open-iscsi-2.0.872-r2) since it hadn't been updated since modprobe stopped supporting "-l" (which still makes me sad...). At that point, I had to go redo all my kernel setup since I compiled the iSCSI stuff into my kernel, and the init script assumes that it can manually load and unload the modules. I eventually commented out all the do_modules calls to work around that.
I also installed net-libs/libiscsi although I never figured out if it was required or not.
I never did figure out how to get it to automatically connect to my drive, but I got the init script to stop complaining at me by setting AUTOSTARTTARGETS="no" in /etc/conf.d/iscsid. At this point (plus commenting out the modprobes) I could start and stop the daemon cleanly.
To manually mount a drive:
You can add "-d 8" (with a number 1-8) for increased debug messages if things are going wrong, but I can't say I found it very helpful myself.
The drive letter it shows up at will increment as you keep connecting/disconnecting. Which was enough to convince me I wanted to manually mount the thing so I've given up trying to get the init script to autostart it anyway.
CHAP:
CHAP is the iSCSI authentication protocol, and was the biggest pain point of the whole experience. I couldn't get my NAS or open-iscsi to give me any kind of useful error message other than "it didn't work" (or more precisely "iscsiadm: discovery login to 192.168.1.100 rejected: initiator error (02/01), non-retryable, giving up" ).
There are two kinds of CHAP, one used to authenticate initiators (clients), and one used to authenticate the targets (servers). Since I was already encrypting my data on my desktop, I didn't bother setting up the server authentication, but I think it works basically the same way. Here's what finally worked:
First I had to generate an InitiatorName and tell my NAS to restrict access to only that initiator. My NAS only had a field for one "Initiator (IQN)" entry, while the Linux settings had 3 different values. I don't really know what the difference is supposed to be, but I had problems until I set them all to the same thing.
Uncomment the following lines in /etc/iscsi/iscsid.conf, and set them accordingly.
For whatever reason, CHAP passwords have to be between 12 and 16 characters. I spent a while failing to get it to work with an 8-character password before I figured this out.
It probably goes without saying, but make sure you type the same password into your NAS. (And set it for your initiator, instead of what my NAS called the "bidirectional authentication" for letting clients know they're talking to the right server.)
There are also settings in iscsid.conf for using CHAP during discovery. You might have to set those too, but my NAS didn't seem to support it, so I left them alone.
After some trial and error, I finally figured out that my NAS was picking up password changes immediately, but my client was saving some kind of a session that was making things difficult. Eventually I determined that to actually get my new settings to take effect I had to stop my daemon, rm -rf the session folder it had created in /etc/iscsi/nodes/, start the daemon again, and then start over from the discovery phase.
And there you go! Good luck.
At first I was going to set it up using sshfs, but the little ARM CPU in that thing can only push about 3-4 MB/s when it has to do the encryption itself. So what I finally settled on was exporting it as iSCSI, and having my desktop do the encryption with cryptfs (LUKS).
I get the feeling that iSCSI doesn't get a lot of love on Gentoo, so I figured I'd post my troubles and what I finally got to work. This post from the Gentoo Wiki Archives was the most helpful, though I skipped all his interface setup, which I'm assuming was designed for a dedicated storage network.
iSCSI Basics:
A target is a server which is offering up a drive for clients to use.
An initiator is the client which consumes a drive to read or write it.
Init Script:
The init script for open-iscsi was kind of primitive... I had to install the unstable version (sys-block/open-iscsi-2.0.872-r2) since it hadn't been updated since modprobe stopped supporting "-l" (which still makes me sad...). At that point, I had to go redo all my kernel setup since I compiled the iSCSI stuff into my kernel, and the init script assumes that it can manually load and unload the modules. I eventually commented out all the do_modules calls to work around that.
I also installed net-libs/libiscsi although I never figured out if it was required or not.
I never did figure out how to get it to automatically connect to my drive, but I got the init script to stop complaining at me by setting AUTOSTARTTARGETS="no" in /etc/conf.d/iscsid. At this point (plus commenting out the modprobes) I could start and stop the daemon cleanly.
To manually mount a drive:
#Start a session to a target iscsiadm -m discovery -t st -p 192.168.1.100 #Open a drive named "group1" # on the target "iqn.1994-11.com.netgear:host:a1b2c3d4f" # (as generated by my NAS) at IP 192.168.1.100 iscsiadm -m node --targetname iqn.1994-11.com.netgear:host:a1b2c3d4f:group1 --portal 192.168.1.100 --login #At this point /dev/sde should appear and you can mount/format it. #Disconnect from the target to make the drive disappear iscsiadm -m node --targetname iqn.1994-11.com.netgear:host:a1b2c3d4f:group1 --portal 192.168.1.100 --logout
You can add "-d 8" (with a number 1-8) for increased debug messages if things are going wrong, but I can't say I found it very helpful myself.
The drive letter it shows up at will increment as you keep connecting/disconnecting. Which was enough to convince me I wanted to manually mount the thing so I've given up trying to get the init script to autostart it anyway.
CHAP:
CHAP is the iSCSI authentication protocol, and was the biggest pain point of the whole experience. I couldn't get my NAS or open-iscsi to give me any kind of useful error message other than "it didn't work" (or more precisely "iscsiadm: discovery login to 192.168.1.100 rejected: initiator error (02/01), non-retryable, giving up" ).
There are two kinds of CHAP, one used to authenticate initiators (clients), and one used to authenticate the targets (servers). Since I was already encrypting my data on my desktop, I didn't bother setting up the server authentication, but I think it works basically the same way. Here's what finally worked:
First I had to generate an InitiatorName and tell my NAS to restrict access to only that initiator. My NAS only had a field for one "Initiator (IQN)" entry, while the Linux settings had 3 different values. I don't really know what the difference is supposed to be, but I had problems until I set them all to the same thing.
## -*- mode: Conf-space;-*- ##/etc/iscsi/initiatorname.iscsi ## For examples, see /etc/iscsi/initiatorname.iscsi.example InitiatorName=iqn.2008-10.com.example.mybox:openiscsi-a1b2c3f InitiatorAlias=iqn.2008-10.com.example.mybox:openiscsi-a1b2c3f
Uncomment the following lines in /etc/iscsi/iscsid.conf, and set them accordingly.
##/etc/iscsi/iscsid.conf node.session.auth.authmethod = CHAP node.session.auth.username = iqn.2008-10.com.example.mybox:openiscsi-a1b2c3f node.session.auth.password = ThisIsAPassword
For whatever reason, CHAP passwords have to be between 12 and 16 characters. I spent a while failing to get it to work with an 8-character password before I figured this out.
It probably goes without saying, but make sure you type the same password into your NAS. (And set it for your initiator, instead of what my NAS called the "bidirectional authentication" for letting clients know they're talking to the right server.)
There are also settings in iscsid.conf for using CHAP during discovery. You might have to set those too, but my NAS didn't seem to support it, so I left them alone.
After some trial and error, I finally figured out that my NAS was picking up password changes immediately, but my client was saving some kind of a session that was making things difficult. Eventually I determined that to actually get my new settings to take effect I had to stop my daemon, rm -rf the session folder it had created in /etc/iscsi/nodes/, start the daemon again, and then start over from the discovery phase.
And there you go! Good luck.
20121223
Alarm clock
In a sudden stroke of genius (the kind that can only occur at 1:30 in the morning), I have just invented the most annoying alarm clock ever.
(Where random is a script I wrote that does the obvious.)
Not only is it incredibly annoying, but you can't control-c it, since the beeps are running so fast. I also had the luck (misfortune?) of running it while sudoed as root, so it ended up with some kind of weird reparenting and so it didn't even stop when I closed my terminal... I finally had to rmmod pcspkr to get it to quit while I hunted down the offending process.
I don't yet know how I will fully use this newfound power, but if nothing else I can guarantee I will be waking up tomorrow morning.
while true; do beep -f `random 100 2000` -l `random 5 300`; done;
(Where random is a script I wrote that does the obvious.)
Not only is it incredibly annoying, but you can't control-c it, since the beeps are running so fast. I also had the luck (misfortune?) of running it while sudoed as root, so it ended up with some kind of weird reparenting and so it didn't even stop when I closed my terminal... I finally had to rmmod pcspkr to get it to quit while I hunted down the offending process.
I don't yet know how I will fully use this newfound power, but if nothing else I can guarantee I will be waking up tomorrow morning.
20121214
Book Reviews 2012: Martha Wells
I discovered a new fantasy author while touring a used bookstore, Martha Wells. I've since bought everything of hers I can get my hands on.
The Books of Raksura, Martha Wells
The Cloud Roads (The Books of the Raksura)
The Serpent Sea (The Books of the Raksura)
The Siren Depths (The Books of the Raksura)
I rate them as 5/5 all the way across. The series chronicles the adventures of a clan of "Raksura", sentient fantasy creatures (people?) in a realm of other sentient fantasy creatures. There was some magic here, but it was fairly subdued, and mostly taken for granted. The series was mostly about the cultural differences of the various peoples, and one misfit's attempt to assimilate, with some villains and adventure thrown in for fun.
The Books of Ile-Rien, Martha Wells
The Wizard Hunters (The Fall of Ile-Rein: Book 1)
The Ships of Air (The Fall of Ile-Rein: Book 2)
The Gate of Gods (The Fall of Ile-Rein: Book 3)
The Death of the Necromancer
The Element of Fire
Also 5/5 all the way across. The first three books are trilogy, set in a fantasy world that has 1900's era technology (ie simple cars and air ships, electric lights, but not much else) and well-established schools of magic and sorcery. The country of Ile-Rien finds itself fighting a war, and the characters set off in search of a powerful magic to defeat their enemies. The world that she creates here has enough depth to it that I found even the back stories enthralling.
The last two books are stand-alone novels set in the same world but during earlier time periods. They have some familiar characters, but were essentially distant back-stories for the events in the trilogy.
Wheel of the Infinite, Martha Wells
Also 5/5. At a high level, this book follows the main characters as the restore balance to the "Deep Magics" that govern the world (my term, not hers). Magic is assumed everywhere, but not actually exhibited much by the characters. I thought this one was a little more adventure driven, with a little bit of deeper issues thrown in, and much less cultural focused than most of Wells' other works.
City of Bones, Martha Wells
I rate this at 4/5. City of Bones was a set in a post-apocalyptic world with survivors struggling to survive. The male lead (named Khat) carried this book in my opinion. He was another cultural misfit trying to survive in a foreign city, honest enough to be endearing and with enough character flaws to get himself into trouble. The world was interesting and all, but I found him fascinating.
Khat kind of reminded me of a more interesting version of the male-lead from the Ile-Rien trilogy. And the overall crisis the characters solve felt a lot like the one in Wheel of the Infinite by the end. So that's mainly why I rate this as only a 4/5. But the book might stand better on it's own if you hadn't have just read her other books. :-D
And that's all the motivation I have for the evening, so I'll stick to one author for now.
The Books of Raksura, Martha Wells
The Cloud Roads (The Books of the Raksura)
The Serpent Sea (The Books of the Raksura)
The Siren Depths (The Books of the Raksura)
I rate them as 5/5 all the way across. The series chronicles the adventures of a clan of "Raksura", sentient fantasy creatures (people?) in a realm of other sentient fantasy creatures. There was some magic here, but it was fairly subdued, and mostly taken for granted. The series was mostly about the cultural differences of the various peoples, and one misfit's attempt to assimilate, with some villains and adventure thrown in for fun.
The Books of Ile-Rien, Martha Wells
The Wizard Hunters (The Fall of Ile-Rein: Book 1)
The Ships of Air (The Fall of Ile-Rein: Book 2)
The Gate of Gods (The Fall of Ile-Rein: Book 3)
The Death of the Necromancer
The Element of Fire
Also 5/5 all the way across. The first three books are trilogy, set in a fantasy world that has 1900's era technology (ie simple cars and air ships, electric lights, but not much else) and well-established schools of magic and sorcery. The country of Ile-Rien finds itself fighting a war, and the characters set off in search of a powerful magic to defeat their enemies. The world that she creates here has enough depth to it that I found even the back stories enthralling.
The last two books are stand-alone novels set in the same world but during earlier time periods. They have some familiar characters, but were essentially distant back-stories for the events in the trilogy.
Wheel of the Infinite, Martha Wells
Also 5/5. At a high level, this book follows the main characters as the restore balance to the "Deep Magics" that govern the world (my term, not hers). Magic is assumed everywhere, but not actually exhibited much by the characters. I thought this one was a little more adventure driven, with a little bit of deeper issues thrown in, and much less cultural focused than most of Wells' other works.
City of Bones, Martha Wells
I rate this at 4/5. City of Bones was a set in a post-apocalyptic world with survivors struggling to survive. The male lead (named Khat) carried this book in my opinion. He was another cultural misfit trying to survive in a foreign city, honest enough to be endearing and with enough character flaws to get himself into trouble. The world was interesting and all, but I found him fascinating.
Khat kind of reminded me of a more interesting version of the male-lead from the Ile-Rien trilogy. And the overall crisis the characters solve felt a lot like the one in Wheel of the Infinite by the end. So that's mainly why I rate this as only a 4/5. But the book might stand better on it's own if you hadn't have just read her other books. :-D
And that's all the motivation I have for the evening, so I'll stick to one author for now.
New Computer
I recently upgraded my main system from a Phenom II to an Ivy Bridge (Xeon E3-1270), and this may be stating the obvious, but dang is it faster...
I have a little benchmark program I wrote to test a simple C-library of data structures, that normally took 10 seconds on my old machine, that now completes in just under 4. If I launch eight of them at once (two per real core), the hyper-threading lets them complete in just under 6 seconds a piece. Wow!
With my spare cycles, I normally run GIMPS work units, which is a distributed prime number search that consists of heavy floating point operations. The new machine processes work units about 6 times faster than the old one. I'm assuming the new AVX instructions are mostly responsible.
Which brings me to an awkward problem... I normally run 4-threads of GIMPS at a niceness of 19, which usually translates into very little CPU usage, and I just let it run without typically noticing any performance hit. But with hyper-threaded cores, the Linux scheduler notices that I've got spare CPU's, and happily schedules them with GIMPS tasks. So what ends up happening, is I get my interactive workload on a core, and a GIMPS thread on it's hyper-peer, and they split CPU roughly 50% (modulo the hyper-threading boost). That kind of hurts, but I also hate to turn off hyper-threading since it was a 30% throughput boost when I do have real multi-threaded workloads.
At the moment I'm just living with it, and turning off GIMPS if I run into a situation where I care, but that kind of sucks. I tried playing with cgroups, but from all I can tell, they're not really designed for this. You can use them to limit things to a percentage of the CPU when you're under load, but when there are spare cores they optimize for throughput, and schedule things anyway.
After digging through the Internet, I finally found a utility called cpulimit that is almost what I want. It'll let me limit the total CPU of a process tree to X% of a core, so I can limit GIMPS to 3 cores, and leave one completely spare, but I still have to manually pay adjust to it if I want to give it my whole CPU while I'm gone.
What I really want, is for it to check my load average, and automatically scale up/down the limit it's applying to GIMPS based on how busy my system is. After pulling the source for it, I think I know how to make it do that, so sometime when I get really motivated I'm going to give it a try.
Among the other fun things I've learned while setting up this machine is what happens when you don't have your static /dev setup right (the kernel can't launch init...), when you don't have a /run folder (your hostname never sets, and you can't successfully halt or reboot among other things), and Gentoo live cd's haven't setup the net.eth0 symlink by default since at least January. Oh, and don't dd your disk while you have it mounted... It doesn't end well.
I have also now become well-acquainted with NewEgg's return policies, having sent them back a bad motherboard, and a set of four 8-GB RAM chips (which I mistakenly ordered despite the fact that registered memory wasn't compatible with my motherboard).Props to NewEgg for painlessly taking it all back. (Update: NewEgg has since refused to accept my motherboard back... :-( )
I'd like to think this experience has made me wiser, but if nothing else, at least I now have a faster computer. :-D
I have a little benchmark program I wrote to test a simple C-library of data structures, that normally took 10 seconds on my old machine, that now completes in just under 4. If I launch eight of them at once (two per real core), the hyper-threading lets them complete in just under 6 seconds a piece. Wow!
With my spare cycles, I normally run GIMPS work units, which is a distributed prime number search that consists of heavy floating point operations. The new machine processes work units about 6 times faster than the old one. I'm assuming the new AVX instructions are mostly responsible.
Which brings me to an awkward problem... I normally run 4-threads of GIMPS at a niceness of 19, which usually translates into very little CPU usage, and I just let it run without typically noticing any performance hit. But with hyper-threaded cores, the Linux scheduler notices that I've got spare CPU's, and happily schedules them with GIMPS tasks. So what ends up happening, is I get my interactive workload on a core, and a GIMPS thread on it's hyper-peer, and they split CPU roughly 50% (modulo the hyper-threading boost). That kind of hurts, but I also hate to turn off hyper-threading since it was a 30% throughput boost when I do have real multi-threaded workloads.
At the moment I'm just living with it, and turning off GIMPS if I run into a situation where I care, but that kind of sucks. I tried playing with cgroups, but from all I can tell, they're not really designed for this. You can use them to limit things to a percentage of the CPU when you're under load, but when there are spare cores they optimize for throughput, and schedule things anyway.
After digging through the Internet, I finally found a utility called cpulimit that is almost what I want. It'll let me limit the total CPU of a process tree to X% of a core, so I can limit GIMPS to 3 cores, and leave one completely spare, but I still have to manually pay adjust to it if I want to give it my whole CPU while I'm gone.
What I really want, is for it to check my load average, and automatically scale up/down the limit it's applying to GIMPS based on how busy my system is. After pulling the source for it, I think I know how to make it do that, so sometime when I get really motivated I'm going to give it a try.
Among the other fun things I've learned while setting up this machine is what happens when you don't have your static /dev setup right (the kernel can't launch init...), when you don't have a /run folder (your hostname never sets, and you can't successfully halt or reboot among other things), and Gentoo live cd's haven't setup the net.eth0 symlink by default since at least January. Oh, and don't dd your disk while you have it mounted... It doesn't end well.
I have also now become well-acquainted with NewEgg's return policies, having sent them back a bad motherboard, and a set of four 8-GB RAM chips (which I mistakenly ordered despite the fact that registered memory wasn't compatible with my motherboard).
I'd like to think this experience has made me wiser, but if nothing else, at least I now have a faster computer. :-D
20120807
Subscribe to:
Posts (Atom)