XFS check

I wanted to check the consistency of the data partition on one of my servers. It is 6.5TB and formatted with XFS, so I ran :

#xfs_check /dev/sdb1

And I got :

xfs_check: out of memory

After some searching, it turns out that a lot of memory is needed to perform the xfs_check on a large file system : >6GB and you need to run it on 64bit, to able to address that memory.

My system is a 32-bit with only 4GB, so I would probably not be able to run xfs_check on my system, but there is another way :

#xfs_repair -n /dev/sdb1

This tools tries to repair a XFS filesystem, but with the -n switch no changes are written to the file system, so the effect is quite the same. It still uses a lot of memory if you have a lot of files/inodes on the file system, but 3GB on a 32-bit system should be sufficient.

Of course, if xfs_repair finds a problem, you can still run it without the -n switch, to repair the filesystem.

All time favorites : games

I've recently rediscovered the wonderful pass time of gaming. And I was thinking of a few great games I played in the past, in alphabetical order :

• Assassin's Creed II
• Exile (Myst III)
• Grim Fandango
• Riven, the sequel to Myst

They earned a position in this list because of the mere of beauty of the game, which was usually a combination of graphics, music, scenery, atmosphere and gameplay.

Happy 2011!

Happy New Year!

May 2011 be a year of friendship, love, joy and happiness, good health and prosperity!

2010

A lot of things happened in 2010. I'm not going to write an exhaustive list, but will just mention things that spring to mind.
On a technological level : I got my new server and installed linux on it, I learned to use vim and git, and started contributing to the Open Source community by joining the phpMyAdmin development team. I visited FOSDEM for the first time and will certainly do so this year.
On a professional level : I created a new website for my department using Drupal, and installed a new backup server.

One of my resolutions for 2010 was to read more, and I achieved this. If possible I read a chapter every evening, and I hope to continue doing this in the new year.
I also spent quite some time playing games, watching films and series and (re)discovered some music. Some of the highlights of the year : Assissin's Creed II, the best game I played in years; Isbells and Mumford & Sons, the latter doing some great gigs; and 1984, classic by George Orwell. :)

And I met a lot of interesting people, made new friends and got to know some people better.

Resolutions 2011

Bit a more of the same of last year. I made some progress, but there is always room for improvement :

• Smile (even) more!
• Enjoy more and worry less
• Continue reading
• Be more confident
• Look for a new place to live

Cleanup apt cache

Over time, the cache of apt, the Debian package installation application, keeps growing. Every time a package is installed or updated, the original packages is stored in the cache. After a few months of updates, the cache grows quite big, because nothing is deleted from it automatically.
Keeping the original packages from all software you have installed is certainly a good idea, but the packages that are replaced by newer ones are kept as well.

The cache can be cleaned. using this command :

apt-get autoclean

This removes all unneeded (old) package files from the apt cache.

If you want to clear the cache completely, and thus removing all packages, use this command :

apt-get clean

Both commands are quite safe to use, because they only remove the downloaded packages from the apt cache. The installed files naturally remain untouched.
This way you can sometimes free a few hundred megabytes after a few months.

Ubuntu is based on the Debian packaging system, so this applies to every flavor of Ubuntu as well.

Firefox plugin : HTTPS Everywhere

Yet another Firefox plugin to be added to the list of useful plugins : HTTPS Everywhere.

Essentialy, this plugin forces your browser to use the secure (encrypted) https protocol when visiting certain websites (like Facebook, Google, ...). This way, no data is sent in cleartext over the internet. When visiting these websites, everything is encrypted by your browser before it leaves your computer, and is then decrypted by the server (and vice versa, when the server sends the webpage back to your PC).

Why would you want this?

If you login over a normal http connection, your username and password are sent over the internet, for everybody who can intercept that package to read. The same with sensitive data that might be visible on websites your are visiting.

You are probably wondering who can catch your packets? To do that you must most certainly be an internet wizard? Not true. Recently a Firefox plugin was published, called Firesheep, that allows a computer to look around on your local (wireless) network, and hijack Facebook and other sessions on social networking websites and actually see what they are seeing.
For instance, when you are using a free wireless accesspoint, someone with the firesheep plugin, can easily watch what you are doing. (With more sophisticated software this is also - and was already - possible, but this requires more skill)

So, to protect yourself from these kind of attacks, it's better to use the https protocol as much as possible. And a nice tool to help you do this is, is a plugin like HTTPS Everywhere, or Force TLS. The Force TLS plugin does about the same as HTTPS Everywhere, but is more difficult to setup, because you have to tell the plugin for which website you want to use https. Downside of the HTTPS Everywhere plugin, is that it only works for the preprogrammed websites.

Microcode

This morning, one of my servers (Dell Poweredge R510, with a quad-core Intel Xeon E5520 CPU running Debian 5.0.4) had crashed. It didn't respond to anything : ping, ssh, smb. Not even when physically attaching a screen and a USB keyboard to it, did it respond.
After a reboot, the system started without a problem and everything seemed to work again.

Skimming through the logs I found some things occuring :

kernel: BUG: soft lockup - CPU#7 stuck for 61s!

and

kernel: __ratelimit: 35 messages suppressed
kernel: nf_conntrack: table full, dropping packet.

After Googling, I didn't really find a sound explanation, but some of the things that was mentioned was a bug in the Intel CPU, which could be solved by updating the CPU Microcode.

I'm not sure this will solve my problem, which only happened once since I started using the server about half a year ago, but as was mentioned, it does little risk, doesn't slow down your machine and might solve a few  problems.

So I installed two packages (you need contrib and non-free repositories):

apt-get install intel-microcode microcode.ctl

Package intel-microcode contains the updated microcode for Intel CPU's, while microcode.ctl does the update. Because the update is done in memory, the update is lost after a reboot, so you will have to do it again, but this package takes care of that.

Update 06Dec2010 : The microcode is automatically updated after a reboot. :)

Open Source Social Networking

For quite some time now, I've been thinking about a social networking website alternative, where you, as a user, can keep control of what you submit : who can see it, what can be seen, and most important, if you delete it, that it is really gone (at least from the website you originally put it on, as one can not be sure that something that is published on the internet can be completely removed from it). But I got an insight on how it could be done. It's only a rough idea, with a lot of conceptual and practical things still to be sorted out :

A way to reach this goal is to use encryption. When encrypting a message for instance with OpenPGP, you use the public keys of the ones that should be able to decrypt the message. To do so, they use their own - private - key, which is of course private, and can only be used by the one who owns it. So this way, only the ones you intend to be able to read your message will be able to read it.
So, in case of this conceptual open source social networking website, every user has a PGP-key. If you want to submit something to this website, for instance your place of birth, you encrypt it, using the public keys of a selection of your friends and submit that encrypted chunk of data to the website, where it is stored in the database.
If one of your friends accesses your page on this social networking website, all the data, in encrypted form, is requested from the website and decrypted using the private key of that friend. The data that was encrypted with that persons public key, will be decrypted, while the rest will remain unreadable, thus showing only the data that you intended for that person.
If on a later moment, you decide you want to change the list of people that will be able to consult your place of birth, you simple encrypt the same data with different keys and replace it in the database.

The kind of data you can encrypt is of course not limited to short texts, but can also be a picture, a piece of video, a link to a website, a piece of you DNA, ...
The upside of storing an encrypted version of the data you share, makes it unreadable to anyone who doesn't have the right decryption key. So even if your data remains in the database of the website, it will only be readable for the persons it was originally intended for. It will even not be readable by the maintainers of the website, unless you include their public key when encrypting.

So, the bottom line is that YOU should be able to keep control over your data. Encrypting the data is one thing, somewhat trusting the software that makes it happen and of course also the ones hosting it all, is as important.
And here the Open Source model comes in. The software is freely available, so the way it works can be checked and improved by the Open Source community.
And because the software is freely available, anyone can set up a social networking website. So as a user, you can choose who to trust when you join a group.


Of course, this is all just an idea and a very general concept.

One final remark : in order for this to work, the whole encryption mechanism should be invisible for the end user. And the encryption should be handled client side, for obvious reasons, otherwise the data you intend to be limited available, might end up unencrypted on some kind of server.