SUDO or Not SUDO

I recommend 'sudo' for root access.
As a rule, I do not login to "root" directly, and I encourage others to do the same.

It's pronounced "soo-doo" because you're DOing something as the superuser.  So the subject of this post should conjure a Shakespearean theme.  Do you 'sudo'?  That is the question.

This topic came up in IRC conversation with Russ at pmman today.  He ended with "you need to blog".  So let it be written.

When fronting via 'sudo', access to root is better controlled, logged, audited.
Non-root credentials are doled out to individuals.  They sign on each with their own ID.  (No sharing!)  Users with 'sudo' rights can then perform any needed activity, with records pointing to the correct "who dunnit" when things go awry.  (If nothing goes awry, then there's nothing to worry about.)  People, this is a very good way to run your systems.  This is so painless that I do it even on systems where I'm the only admin.  Like Nike sez, "just do it".

Computing is personal.
Even administration and maintenance is personal.
So one should connect to the target system with one's own ID.
Once connected, one has rights.  (One also has responsibilities. That's part of the deal.)

Using 'sudo' gives us at least three ways to escalate into UID 0 privileges: console or other password based sign-on, SSH sign-on (for which keys are a better authentication method), and 'sudo' (having authenticated as an individual before becoming root).  I recommend dispensing with passwords altogether.  Like Nancy sez, "just say no!".  Root access on the console ... there are so many ways to do that.  (And some won't like what I recommend, but I press on.)

Using SSH (with keys) to go directly to root is not recommended.  Never the less, it's better than password access.  (Discussion of direct SSH sign-on as root is beyond the scope of this post.)

About root's password: get rid of it.  Render it unusable.  "But what if I need console root access?"  There are many ways to get root access from the console (physical or virtual).  Short answer: skip them all and throw a root shell on the console at startup.  When you think about the physical (or virtual) security of the machine, and the many ways of recovering root access, this makes perfect sense.  A password merely delays the inevitable: console access means root access.  "But a password slows down the bad guys."  Time is relative and "slows down" hurts the good guys too.  Do not be deceived.

'sudo' expands your options. 
With careful configuration, you can be selective about what a "sudoer" can do.  In English: 'sudo' access does not equal root shell access.  True, the non-shell programs which one might authorize via 'sudo' should have no shell back door.  This is an ongoing requirement.  Duh!  So 'sudo' not only gives full root shell authority to the inner circle, it also allows selective privileged operation by the somewhat less trusted.  (Lowering the phone call rate is a Good Thing.)

All this being said is in context of no target password.  See the "NOPASSWD:" tag in the examples shipped with your system.  Using a password (of the originating ID rather than of the target) may fit your policy.  Other challenge/response schemes may be warranted.  That's fine, but beyond scope like those SSH details.  Again, consider the actual security provided by your policies and consider the scalability of your procedures.

Summary: install 'sudo' (if it is not already, which is rare), then ...

• authorize yourself (where "yourself" means the admins reading this) 
• stop signing on to "root" ... don't do it anywhere anymore
• sign on as yourself, then 'sudo' as needed
• put a root shell on the console (eg: by way of /etc/inittab)
• render the root password unusable 
• consider non-shell operations for less trusted users who need them

-- R; <><

Partitionless for Performance

Geeky Gadget Gifts

I got a new disk for Christmas.

The disk in my primary workstation (a nice Lenovo ThinkPad) had begun to fail.  So my wife gave me a shiny new Seagate "Momentus" to replace the stock Hitachi.  I had fun copying the filesystems ... two dozen of them.  (Tedious, but nice to start fresh.)  "On a clear disk, you can seek forever."  (voice of Barbara Streisand)

I decided to go partitionless.
The old disk had four partitions:  two Windows partitions (came with the machine), a Linux boot partition, and the largest given over to LVM (logical volume manager) as a PV (physical volume, the backing store for Linux LVM).  That large partition was the sole PV in a VG (volume group) containing more than twenty filesystems.  The new disk is just one grand PV; no partition table.  Works.

It seems a little silly to have a partition table for just one partition.  Never the less, the concept of partitioning disks is so entrenched that we go that route by default.  Most uses do not require partitioning.

Using LVM in place of a partition table is really a whole different story.  If I had done things purely for the sake of this little blog post, I would have made one huge 750G filesystem (probably EXT4).  Been there; done that.  It works too.

Cheating ... a little

The title of this post is "Partitionless for Performance".  I'm stretching the story a bit.  The performance boost from discarding the partition table alone is negligible.  However, if your team gets used to the idea, then you may save on the human aspect of "performance": there would be one less thing to have to manage.  Put an arrow here.  This is the point.

Well ... there's also the point that we purists like getting rid of unused layers.

Running partitionless is kind of a big deal for me.  I do a lot of virtualization.  For virtual servers, unpartitioned "disks" make a lot of sense.  For example, servicing a filesystem from the "host" side is a whole lot easier when the (virtual) has no partition table to interfere.  If the virtual disk is represented by a file or a logical volume, you can mount it directly.  Voi-la!

So this is really more about manageability than about run-time performance.

The advantage seems obvious, but many people don't know it can be done. 

Disclosing Performance

The laptop is not virtual.
Going partitionless on the new disk was more to prove the point.  It works.
And when running partitionless, you could avoid LVM too.  (Except that PVs are identified by their UUID, so there may be less confusion w/r/t content.)

When it comes to operational performance, LVM can actually make things worse ... or better.  LVM is way more sophisticated than plain partitioning.  It naturally brings more internal complexity with it.  I'm looking for hard numbers, and I confess that I don't have them yet.  (And ultimately, if you can't measure it, ... you know how that goes.)

The wisdom of the community says that LVM adds little to the burden of disk I/O.  So until we get factual measurement, that's a smart place to start.

But then there is a case for a win, and it's a biggie.
LVM can add striping and/or redundancy.  Striping, if not offered by the physical backing storage, does improve performance.  (And redundancy helps a lot for recovery.)  There are measurements of the performance gains from striping.  (The value varies a lot based on your workload.)

The Road So Far

There is a bootstrapping issue.
Most bootstraps do not grok LVM.  They cannot pierce the LVM veil like they can pierce the partitioning veil.  I chose not to resolve this.  My solution is to boot from USB media.  (There were other reasons that removable boot media seemed like a good idea.  Maybe will talk about it in another post.)  It's been less than a week, and things are working very very well.

So the conclusion is this:
If you're running virtual, consider unpartitioned filesystems at offset zero.
When you're not running virtual, consider using LVM instead of a partition table.
(Perhaps not for your boot disk, but you get the idea.)

Performance Matters

Performance Matters ... and why

Driving to the office this morning, I was thinking about an up-coming game changer.  I won't divulge just now what game changer I was thinking of.  But I am concerned that it will lack vital instrumentation.  This thing is going to be hot, and it will ride a wave of investment.  Some might say,  "Performance? It's good enough! Measurement? Why bother?".

I did not previously care all that much about performance.  It's not sexy.  Performance measurement is statistics.  Ewww.  In fact, the sexier stuff, graphical interfaces and cloud-capable applets, tend to be horrible in terms of resource consumption.  If you shine the glare of the performance spotlight on them, they don't look quite as flashy as they did when surrounded by smoke and mirrors.  Up to now, it did not matter.

But performance (more accurately, our delay in attending to it) will come back to bite us.  This is especially true when we have to run a task over and over.  (Isn't that how we got into computers to begin with?  We want the machine to carry the tedium.)  It helps when the machine actually works.  It helps when it's quick about the task we give it.  The advent of smart phones and other embedded computing shows us that performance matters a lot;  it becomes a part of basic reliability.

I came to respect the performance experts and to value the performance question.  As a multi-platform guy, I always valued the different platforms for their unique strengths.  But I found myself defensive of my favorite platform.  It's expensive.  (It's also not flashy ... at least not as flashy as a Mac or even most PCs.)  The justification for this beast is in performance.  And if you can't measure it ... well ... that's a whole nutha story.  But we can measure it.  And we did.  And we demonstrated the value.

There will come a new player soon.  (There are always newcomers.)  It will slip into a niche of the industry with enough recognition to be welcomed.  But it will not be mature.  It's going to be cool, even glitzy.  Those who embrace it will give it ample resources.  It will be good enough.


Throwing money at the problem does not scale.  Whether people or processors, you can't always escalate.  Sometimes the "system" needs to be tuned.  And tuning is not cooked like frog legs in the skillet.  Tuning requires measurement.  Adding more and more power is just not good enough.

I look forward to this new thing, and others.  But like Ford's latest ride, I want it tested, measured, ... analyzed to pieces.  First, I want to know that the air bags will deploy.  But I also want to know the pinch at the pump.  It matters.

-- R; <><

Pen and Ink

Wither Pen and Ink?

Ever had a crackberry? ... er, uh ... a Blackberry?
Nice phone!

Everyone is different.  Everyone has a unique way of communicating.  And everyone has a list of preferred forms of communication. (And most people, that I run into, seem unaware of their own "list".)

About the Blackberry: They call it "crackberry" because executives got so addicted. But we're all addicts now thanks to TXTing. Well, maybe not all of us. Do you TXT or do you call? Do you IM or send email? Our are you the neighborhood luddite insisting on paper mail?

This is about email.  I prefer it to pen and ink.  I felt guilty for leaving some friends and family behind (paper and pen luddites), but even my grandmother got hip to AOL.  And now I seem to be a stick-in-the-mud of sorts.  That bothers me.

No Mo Email

In early 2011, Thierry Breton announced his move to dispense with email at Atos Origin (big outsourcing firm headquartered in France).  Many were skeptical.  I found the move offensive because an IT leader should know the terrain better.  His motive is right: we need to stem the tide of information overload.  But he's taking the easy out by changing to the "social networking" fast lane.  Mr. Breton is ignoring the fact that people interact using many modes.

Most of us are blessed with the capacity to use a half dozen or more types of communication.  We start with face-to-face, which includes verbal and non-verbal.  But we've had written language for millennia.  And there have been special forms of distance signalling (smoke and light) almost as long.  Then in the 19th century, we got telegraph and then telephone.  The 20th century brought us radio and then television.  And now we have the internet, which has subsumed even the phone and a good portion of radio and TV.

Now ... I am a touch typist.  (And thus far I have not suffered from CTS or RSI, thank the Lord.)  So for me, even a GUI is distasteful.  I would just as soon  t-y-p-e  a command as click an icon.  It's faster. Really. And that's just when instructing the machine. 

Pen and ink are fine, but I do better with a keyboard.  Mistakes are easier to correct.  Then there's that thing called "touch typing" ... I can type much faster than I can write (with pen).  But Mom would rather get a hand-written note, or at least a phone call.  (Let's not even discuss TXTing or IM.)  So we come full circle on communication forms.  Though I don't believe it's the hand-written part as much as the paper part that appeals to Mom.

Dad, bless his heart, has worked really hard to enter my world.  He got internet email on a university mainframe because he knew I did email. (That was in the days before AOL did internet.) But Dad cannot type, so I know it is difficult, and I don't push the matter.

But for me, it was never about getting rid of paper.  I remain indifferent to the "paperless office".  (And I find myself printing a lot of things sent via email.  Paper is easier to read.)

What's Old is New - What's New is Old

We had this nice truce between the old and the new.  And then came the newer.

As I was settling in to a high ground in the battle against spam, there came a replacement for email: Facebook messaging.  Seems that if I want to drop a note to certain people (eg: anyone under Breton's reign), it has to be a Facebook message instead of email.

The benefits of FB messaging are obvious.  But there are problems too.  The problems are less obvious.  The benefits are mostly on the convenience side, and people naturally trend toward convenience. (Some to their own demise.)

Even in the technical arguments, I can't help notice the ironic similarity, where my generation abandoned paper mail, a new generation abandons electronic mail.  My kids prefer Facebook.

As I write, I realize that the irony is not iron-clad and the similarity is only superficial. 

Google Gets It

Time and again I've said: I use Google, but I don't trust them.  The reason they continue to suck me in is that they "get it" on some important technical points.  Google will continue to grow as long as Google uses standardized services.  With email, for example, you can get a free mailbox from Google and there's a spiffy web interface.  But they also let you connect using other clients.  GMail speaks IMAP and SMTP.  These are standards.  Google lets you access their services with the standard tools/protocols at no penalty.

Curiously, FB IM can speak "XMPP", so you can chat with Facebook friends using other tools than just the web interface.  Why do they not support this for mail type messages?

Electronic mail is older than the internet.  Electronic mail is bigger than the internet.  (It gets relayed to/from systems that are not on the internet.)  What's needed is a relay from electronic mail to paper mail and then "correspondence" becomes all inclusive.

Conclusion?

There is no "conclusion" as long as people struggle with the various means of communcating.  But here are some of those means ...

• face to face
• written (letter, dictation, notes passed during class)
• electronic mail (can be printed; can be relayed, except for Facebook)
• IM (including FB chat)
• phone (ie: not a computer program)
• online voice (eg: Skype, but there are others)
• and social media

I think I'll write Mom a letter.

-- R; <><

Dear Earthlink, part I

This is a story about Earthlink ...
about their lack of support for Linux.
It's mostly about their poorly thought consumerist corporate direction.

Our high speed internet service died.
Turns out, we depend on it even more now than just two years ago.
The service technician cannot get to us until Thursday. (called in the problem on Tuesday; today being Wednesday)

SO ... what are we gonna do?? Maybe try dial-up?? Ick.

I was just about to give away the nice AT&T Paradyne modem we used to use. Glad I did not yet get it to Free Geek! (I'm sure they need it, but today, I need it more.)

This particular provider of "high speed" internet at one time also provided dial-up service for when we (customers) were travelling or when (not "if"!) there was an outage. They stopped that service in 2009. I guess I didn't care ... at that time. That little annoyance is irritating enough, but this post is supposed to be about Earthlink.

Since my main provider no longer offers dial-up fall-back, I looked around, checked into several ISPs who explicitly offer dial-up service. After I happened to speak with my friend Steve, who is on Earthlink for high speed, I opted to try them first. I used Earthlink years ago, but they are a bit pricey.

(Speaking of "looked around", I may be in the market for high speed real soon now.)
(But ... oh yeah ... this post is about Earthlink.)

Getting the account established was a 40+ minute call. (Could not use the web to do it ... duh.) The woman was clearly from India (presumably located there now) and reading a script. She was courteous and diligent. When she asked what op sys, I told her Linux. No red flag; no comment from her about it.
We continued.

After many other questions (accounting, postal, email, so on), she offered a couple of trial services, neither of which I was really interested in. But I again mentioned the L word by saying that the latter offer probably would not work with Linux anyway. (Its description suggested that it needed a Microsoft context.) She agreed that such was likely, then added "we don't support Linux".

Support. It's a verb. I am not surprised that Earlink does not "support Linux". Fine. I'll take my chances. (Used Earthlink on Linux years ago. Worked great! And that's another reason for trying them again.) They don't support Linux: I DON'T CARE. Not a problem. Proceed. Continue. Activate the account.

The rep said she would discuss the L word with her manager, but did then transfer me to the support team to complete my setup. From the support guy (also clearly in India), I got a local dial-up number and confirmed my username and password. I then hun up (so the modem could have the line), punched in the info, and launched good ole 'wvdial'.

Didn't work.

Not sure how many times I tried 'wvdial' before finding an old copy of 'minicom'.
Ah, there's the problem: Bad password. But wait, this is a brand new account, and both sales and tech support confirmed my password.

Hang up. Get on the land-line again. Maybe 20 minutes this time.

"The account was deactivated for dissatisfaction."

Huh?
I never said I was dissatisfied. (But I'm getting close!)
Turns out that since "Earthlink doesn't support Linux", the first rep had left the account disabled. I guess this was in hopes of preventing a backout and a refund of my $10 for the first month. She ASSumed that I could not use the service with Linux. Not true. It's just that their support people a only trained for Windoze.

I asked the latter rep to activate me.
She then rattle off a lengthy "we cannot help you" statement (the script again) if I were to call tech support with Linux problems.

Once the account was activated, 'wvdial' connected fine.

Dear Earthlink,
Please grant some lattitude to your customers who have more experience than the average n00b consumer.

Not happy.

-- R; <><

NIH

NIH is Now Intrinsically Harmful

So you see the acronym NIH. Whadaya think?
For most in the US, it's the "National Institutes of Health".
Try again. This NIH is not a health organization.
It's a disease. NIH == "Not Invented Here". It's a syndrome.

Most of us suffer from NIH, some worse than others.
In other words, I am just as guilty as anyone else. 
Lately, NIH has been on my personal radar because I have been on the observing end.  (Sometimes even a victim of its effects; that is, "on the receiving end", so to speak.) What happens is that you, or someone you know, reject an idea or a proposal or a device because you did not think it up. If it wasn't "invented here", it must be rejected, or so it goes when you are an NIH sufferer.

I thought about perhaps cooking up a piece of satire describing NIH even more clearly as an illness. Thought about equating NIH with tobacco addition or electrolyte imbalance. But it's just not that funny to me ... at least not at the moment.

This can happen with your boss, your team mates, even your family.
You have an idea or you do something or make someone and one of the others disses it: "Why would you/we want to do that??". 
  In my niche of the software industry, NIH is a real problem because our nitchy base environment (CMS on z/VM) is so very different from other environments. NIH hits when one suggests creating new programs for CMS that follow Unix semantics. It works, but a lot of VMers don't like it. Why? "Too much like Unix." or maybe "Doesn't work like traditional CMS.". [insert expected clip from "Fiddler on the Roof" soundtrack here] (I will not enumerate my would-be contributions because it's really not about me.) A computing community that at one time (more than most!) embraced new and different ways of doing things now refuses to embrace new and different inventions. Weird. Sad!

Personally, I make a lot of non-traditional suggestions because interoperability is a form of self-preservation. To clarify, some of the ideas that come to my own mind are those which (hopefully) foster connecting with different systems than our spiffy environment. Might lead to greater control of our own destiny, and who would not want that? If we do things similar to how other systems do them (at the human interface level) then we are less foreign to the other systems. But the benefits are not always clear. [sigh] I can only hope that some of my friends will get active, start coding again, and get our little niche reconnected.

NIH reached a new peak today. Several of us have been collaborating on a big project. I instantiated a couple of collab tools (using free services from one of the big public providers). One old friend took the shared tool I had established (I did not write the supporting code) and cooked up his own. oy vey   And I had gone out of my way to make the other easy for him to use, gave him full control over it. But it wasn't enough. He just had to re-do the thing. It was "not invented here" (at his site).

-- R;

Lightning Struck and I was re-Trained

Lockergnome (Chris Pirillo) YouTubed about his spiffy new Prius V. 
I was disappointed. But more on that later.

This is for Ed who wants an American Muscle Car and does not (yet) realize that electric drive is exactly that.  The day is soon upon us when the power plant in our most muscular cars (from any country) will be comprised of steel (magnetized) and copper (wound).

This is also for Jay, but Jay's reason for dissing hybrids is that he has a 300 mile trip. (I say hybrid still fills the bill, but I back off because there is still a surcharge.)

This post is about my epiphany.

I'm a wire monkey. I've been kicking electrons down the line since I was five. Literally. (Scared the crap out of my parents.) Yet when it came to locomotion, I considered electric drive to be a revolting idea. After living through the 70s oil crises and hearing of the impending arrival of hybrid cars, I ASSumed they were glorified golf carts.

Then lightning struck.

What do YOU think of when you think of hybrids or electric cars? 
Think raw power.  Think the unstoppable torque of a diesel locomotive.
But imagine that kind of power combined with nimbleness, the responsiveness of a touch screen, the instant obedience of a light switch. Time to stop thinking wimpy, wimpy, wimpy and think hefty, hefty, hefty. Diesel locomotives are electric. They are what's called "series hybrid".

True, a train engine isn't for the oval (not as sporty as your beamer), but no one can argue that it's serious horsepower. (More accurately, torque.) What if you had that kind of science in a street legal package?  

My attitude adjustment came one day in the late 90s. While I was busily saving the world from some software problem, my wife and one of the kids were in the other room catching the latest from the local PBS affiliate. Suddenly, I heard, "Rick! Rick!", and ran into the den expecting to help stem a flow of blood. Thankfully, there was no injury. My love, knowing my geek nature, was simply alerting me to something important. 

The program presented a high school shop teacher (Carolinas, I think) who instructed his pupils through the enlightening work of replacing an entire drive train: engine, tranny, all of it. Every season, they'd find a junker, remove the gasoline motivator, and install an electric equivalent. After a while, the teacher had a collection of these and used one on his daily commute. I wish I could remember this guy's name. (I always have some reason to thank a teacher.) 

This was really neat to see. We were all impressed! My wife asked why we don't have more things like that on the road. The scene cut to a race track. "That's why. You could never race an electric car." (Or so I thought! as do Ed and many other friends.) To my shock, the very race we were watching was all electric. They were tooling around at over 100MPH on some track where it was a regular event! 

At this point, I was in trouble. I sank into an obsession that lasted several weeks. Found out that there were hundreds of "EVers" around the country. Found out that these amp-heads were regularly burning rubber. (These ain't golf carts!) The norm was to convert something with a shot gasoline engine and everything else intact. Found out there was, even then, an electric dragster. The downside: it doesn't rumble. 

I wanted one! Things got bad: I would turn off the key in my Tempo ... at highway speed ... just to hear the silence. (Well ... except for the tire whine and wind noise.) I had to put this desire on hold. But some years later, when that Tempo finally bit the dust, the family encouraged me to look at hybrids. We got a 2005 Prius. 

Hybrid cars don't necessarily spark my interest. It's pure electric that really gets me torqued. I was skeptical of hybrids at first because of the added complexity. Also, early hybrids were not fully electric, so they could not run the A/C without cranking the ICE shaft. Stuff like that. No thanks. But the "second generation" Prius is capable of pure electric operation. It's a "full hybrid". 

To be honest, even as a full hybrid, the focus of the Prius is all environmental. Not what muscle maniacs want. But the unseen beauty is this: all of that pro-environment tech is just a matter of tuning. Slide the knob the other direction and you've got a performance machine. 

So ... I admit to not being an environmentalist. But I do like to breath. I also made a decision: I would rather fund one economy (one that produces hybrid and electric cars) than another (one that produces oil). 

"It feels good knowing that I'm not running on foreign oil." -- John Whelan 

I also weighed the costs. In 2005 the cost of gasoline was so much and the cost of batteries was another so much. I figured it was a safe bet that fuel costs would increase and battery costs would decrease. This has come true. 

The surcharge for hybrid tech has come down some. This is the part for Jay. Based on what I've heard from him, I think he needs a small SUV, something like a Toyota Highlander. So the Toy boys make a hybrid Highlander. And this is what I'm ultimately after: Electric drive that looks just like its gasoline counterpart. And though I love pure electric propulsion, that 300 mile trip to grandmother's house is where a petroleum push helps things out.

But for Chris Pirillo, dude, you are missing out! The lockergnome has fallen into the same trap we all have. That energy readout psychs you into driving more conservatively. Don't be afraid to punch it once in a while! You may get better overall mileage from being a little aggressive off the line. Worked for me. (Not sure if Toyota changed the programming between gen 2 and gen 3.) 

The thing between Jay and Ed and me started when I whined on G+ about the demise of the Rolls Royce Phantom 102EX. Seems the uber rich have range anxiety. But that makes no sense for a car whose longest usual journey is round trip to the opera. Think about it.

Summary:

Electric drive is muscle.

If all you're fueled by is gas, you're just fartin around.

-- R; <><