Cheap process mon­i­tor­ing (no addi­tion­al soft­ware required)

I have an old sys­tem (only the hard­ware, it runs ‑cur­rent) which reboots itself from time to time (most­ly dur­ing the dai­ly periodic(8) run, but also dur­ing a lot of com­pil­ing (por­tup­grade)). There is no obvi­ous rea­son (no pan­ic) why it is doing this. It could be that there is some hard­ware defect, or some­thing else. It is not impor­tant enough to get a high enough pri­or­i­ty that I try hard to ana­lyze the prob­lem with this machine. The annoy­ing part is, that some­times after a restart apache does not start. So if this hap­pens, the solu­tion is to login and start the web­serv­er. If the web­serv­er would start each time, near­ly nobody would detect the reboot (root gets an EMail on each reboot via an @reboot crontab entry).

My prag­mat­ic solu­tion (for ser­vices start­ed via a good rc.d script which has a work­ing sta­tus com­mand) is a crontab entry which checks peri­od­i­cal­ly if it is run­ning and which restarts the ser­vice if not. As an exam­ple for apache and an inter­val of 10 minutes:

*/10 * * * *    /usr/local/etc/rc.d/apache22 status >/dev/null 2>&1 || /usr/local/etc/rc.d/apache22 restart

For the use case of this service/machine, this is enough. In case of a prob­lem with the ser­vice, a mail with the restart out­put would arrive each time it runs, else only after a reboot for which the ser­vice did not restart.

One-Time-Passwords for Horde/IMP?

I search a way to use one-time-passwords for Horde/IMP on FreeB­SD. I do not want to use PAM (local users on the machine). Cur­rent­ly I use the authen­ti­ca­tion via IMAP4 (link between the IMAP4-server and post­fix via MySQL, to have the same PW for send­ing and receiv­ing), and I expect that not all users of Horde/IMP will use OTP if avail­able, so the prob­lem case is not that easy. I can imag­ine a solu­tion which tries to authen­ti­cate via OTP first, and if it suc­ceeds gets a pass­word for the login to the IMAP4 serv­er. If the OTP-auth fails, it could try the entered pass­word for the login to the IMAP4 serv­er. Migrat­ing exist­ing users to a new solu­tion can be done by telling them to enter the pass­word from the machine of the per­son doing the migra­tion. The solu­tion needs to auto­mat­i­cal­ly login to the IMAP4 serv­er, enter­ing a pass­word for the IMAP4 serv­er after the OTP-login to Horde is not an option.

Oh, yes, send­ing the pass­words over SSL is not an option (that is already the only way to login there). The goals are to have

  • an easy to remem­ber pass­word for an OTP app on the mobile to gen­er­ate the real password
  • the pass­word expire fast, so that a stolen pass­word does not cause much harm
  • not the same login-password for dif­fer­ent ser­vices (mail-pw != jabber-pw != user-pw)

One-Time-Passwords for XMPP/Jabber?

I search a way to use one-time-passwords for jabber/XMPP (ejab­berd) on FreeB­SD. I do not want to use PAM (local users on the machine). Cur­rent­ly I use the inter­nal authen­ti­ca­tion, and I expect that not all users of the jab­ber serv­er will use OTP if avail­able, so the prob­lem case is not that easy (migrat­ing exist­ing users to a new solu­tion can be done by chang­ing the pass­word myself and then telling them to change their pass­word, but there needs to be a way to let them change the non-OTP password).

I assume that OTP is not fore­seen in the XMPP pro­to­col, so where could I ask to have some­thing like that con­sid­ered as an exten­sion (if such a place exists at all)?

Oh, yes, send­ing the pass­words over SSL is not an option (that is already the only way to login there). The goals are to have

  • an easy to remem­ber pass­word for an OTP app on the mobile to gen­er­ate the real password
  • the pass­word expire fast, so that a stolen pass­word does not cause much harm
  • not the same login-password for dif­fer­ent ser­vices (mail-pw != jabber-pw != user-pw)

Pho­to­volta­ic from the bank (no real ben­e­fit for me)

A while ago I got a mail from my bank. They offer to fund a pho­to­volta­ic sys­tem on my house with a spe­cial offer. They give a cred­it upto a spe­cif­ic amount if I use it to install a pho­to­volta­ic sys­tem, and to pay it back I just have to give them the com­plete amount of mon­ey which I get from the pow­er com­pa­ny when the pho­to­volta­ic sys­tem is pro­duc­ing pow­er (the state requires the pow­er com­pa­ny to pay a spe­cif­ic amount of mon­ey – fixed dur­ing 20 years – for each kW/h). They also offer that a spe­cial­ist vis­its me to explain the pho­to­volta­ic stuff and cal­cu­late if all the phys­i­cal con­straints for such an instal­la­tion are OK.

At first this sounds nice, but I do not trust the words of some ran­dom per­son which wants to get mon­ey from me. So I had a deep­er look at it.

The roof of my house is still OK, but in some years (maybe 3 – 5) it has to be changed (at least part­ly). The roof  is already 30 years old, so this is OK. If I would install a pho­to­volta­ic sys­tem now, it would have to be removed and rein­stalled when the roof is changed. If the sys­tem is financed by the bank, this has to be done by an offi­cial spe­cial­ist (instead of let­ting a good friend with expe­ri­ence doing it in exchange of my work­force for some ren­o­va­tion project at his house). This means it would be cheap­er if I change the roof before the pho­to­volta­ic sys­tem is installed. I do not have the mon­ey to do this com­plete­ly out of my pock­et, so the bank has to finance this.

Let­ting the cost of the roof aside (which has to be done “soon” any­way), the inter­est­ing part now is what do I get when the bank is com­plete­ly financ­ing the pho­to­volta­ic sys­tem (maybe parts of the elec­tri­cal instal­la­tion need to get updat­ed, as they are 30 years old too). I have to take into account tax­es, what needs to be paid back to the bank, what I have to pay for the pow­er, and what I have when every­thing is paid back.

If the pho­to­volta­ic sys­tem is financed com­plete­ly by the bank, the typ­i­cal cal­cu­la­tion is that it takes about 20 years to pay back every­thing. This assumes I only give to the bank the amount of mon­ey I get from the pow­er com­pa­ny for the pow­er of the pho­to­volta­ic sys­tem. So basi­cal­ly the pho­to­volta­ic sys­tem pays itself. This sounds great, the prob­lem is that a rough esti­ma­tion of the life­time of a pho­to­volta­ic sys­tem is 20 years (and after 10 years you may have to change the AC con­vert­er). The war­ran­ty on pho­to­volta­ic ele­ments here is 2 years, so far I have not seen any offer where they extend it much (some­how it is hard to find some good pages for pri­vate cus­tomers, most of the pages I see are either light on info, or tar­get com­mer­cial cus­tomers). This is not even remote­ly in the range of 20 years. So after it paid back itself to the bank, it may be bro­ken. And dur­ing those 20 years, I still have to pay my com­plete pow­er bill.

There is also a tax point of view to take into account. Luck­i­ly a friend of my sis­ter is doing some tax con­sult­ing for pri­vate tax issues. The tax stuff involved here is about com­pa­ny tax­es (you are required to open a com­pa­ny when you install a pho­to­volta­ic sys­tem here). This is not spe­cial­ly in the area where she is work­ing in, but I assumed she should know enough about the basics, that I can get at least an overview. I got even more than that. When I talked to her about it, she told me they cal­cu­lat­ed a sim­i­lar offer for their house recent­ly. She assumed a pho­to­volta­ic instal­la­tion of 20 T€ and that the bank is financ­ing it com­plete­ly. The roof of their house does not have the same char­ac­ter­is­tics than my house, but as the pho­to­volta­ic spe­cial­ists cal­cu­late with rough peak sun­shine hours any­way, it gives me a rough overview. The good part is, that you do not lose mon­ey this way, but you have to pay the tax direct­ly (even if I give all the mon­ey from the pow­er com­pa­ny to the bank), you start to earn mon­ey near the end of the 20 years.

Accord­ing to her cal­cu­la­tions you will have earned 6 T€ after 20 years, when the pho­to­volta­ic sys­tem paid itself back to the bank and you had to pay the tax­es each month/year/whatever. This assumes that the peak sun­shine hours are not get­ting worse, and that the effi­cien­cy of the pho­to­volta­ic sys­tem stays at rough­ly the same lev­el dur­ing the 20 years. Now let us cal­cu­late the amount of mon­ey per month and per year you gain when you do this:

6000/20 = 300 €/year

300/12 = 25 €/month

So for 25 €/month I have to invest my time into tak­ing care about the tax stuff, have to take care about the pho­to­volta­ic sys­tem (clean­ing, and man­age­ment stuff in case some­thing breaks because of bad weath­er or nor­mal usage), have to pay extra mon­ey when some­thing has to be done to the roof, and so on. And when every­thing is fin­ished after 20 years, the pho­to­volta­ic sys­tem may be fin­ished too (and the rate of mon­ey the pow­er com­pa­ny has to pay for each kW/h then is not known, in case the sys­tem still works good then). If it is in a state where I have to remove or replace it, I also have to pay the cost of remov­ing it. And I need to get togeth­er enough mon­ey to get a new roof now.

Now this offer does not sound so good any­more (remem­ber, I also have to pay the pow­er I con­sume dur­ing this time). To me it looks like only the bank and the com­pa­ny installing the sys­tem will ben­e­fit from it, and I have to take care about all the unpleas­ant things.

There is for sure an eco­log­i­cal aspect to think about here. It sounds great to pro­duce green ener­gy (I do not know how much CO2 is pro­duced dur­ing the pro­duc­tion of the pho­to­volta­ic sys­tem, and if it will pro­duce enough ener­gy to com­pen­sate this), and I would do it direct­ly if I would see a sane return of invest­ment, but this offer does not look sane in my cur­rent situation.

It seems I have to wait until the prices go down more (and I have some spare mon­ey to invest with­out the need for a bank). Recent­ly I have read that the expec­ta­tion is that in about 3 – 5 years the tech­nol­o­gy to print pho­to­volta­ic cells can be pro­duc­tion ready, which could reduce the price to a tenth of what a pho­to­volta­ic cell costs ATM. Invest­ing 20 – 30 T€ is not some­thing I would do from one day to anoth­er, 4 – 5 T€ for a sim­i­lar instal­la­tion sounds more easy to agree to.

While I am at it: so far I only see pho­to­volta­ic info regard­ing the peak pow­er a cell can gen­er­ate. To me this does not look inter­est­ing. The peak pow­er will be gen­er­at­ed most of the time in sum­mer (direct sun­light, no clouds, long sun­light times), but in the sum­mer the con­sump­tion of pow­er is less than in win­ter (less light to use, more time spend out­side the house so less time in front of a TV, more BBQ so less cook­ing in the kitchen, …). More inter­est­ing to me would be a good pow­er gen­er­a­tion in less than opti­mal sit­u­a­tions like in win­ter when it is cloudy (but it is prob­a­bly hard to come up with an use­ful val­ue, as the aver­age for “less than opti­mal” varies from loca­tion to loca­tion). I have seen a report about water heat­ing (attached to the cen­tral heat­ing) with solar ener­gy, where a sys­tem is used which has a low­er peak pow­er, but a bet­ter pow­er out­put in less than opti­mal weath­er con­di­tions (round col­lec­tors where used instead of flat pan­els). So the­o­ret­i­cal­ly there is the pos­si­bil­i­ty to get more pow­er out in not so good con­di­tions, but so far I did not find any infor­ma­tion if it is tech­ni­cal­ly pos­si­ble ATM to opti­mize pho­to­volta­ic cells to such sit­u­a­tions, and if it is if there are some cells avail­able for a sane price.

Lin­ux­u­la­tor in ‑cur­rent ready for test­ing the 2.6.16 emulation

Today I com­mit­ted two patch­es which fix the last two pan­ics we know about in the 2.6.16 emu­la­tion. Now we need testers. Here’s the text of the mail I did send to current@ a few moments ago:

Hi,

today I com­mit­ted the last fix­es for the show­stop­per prob­lems (pan­ics) in the lin­ux 2.6.16 emu­la­tion. I intend to switch the default ver­sion to 2.6.16 on i386 “soon” (see below), so please help test­ing it.

More recent lin­ux dis­tri­b­u­tions (e.g. FC5) require a 2.6 ker­nel and don’t work with 2.4.2 any­more. And because FC4 is “abandon-ware” (no secu­ri­ty fix­es from fedo­rale­ga­cy any­more), get­ting 2.6.16 emu­la­tion up an run­ning is very important.

If you use a lin­ux pro­gram, please add compat.linux.osrelease=2.6.16 to /etc/sysctl.conf (my desk­top is run­ning with 2.6.16 emu­la­tion since some days already). After the next boot (or after run­ning “sysctl compat.linux.osrelease=2.6.16”, please make sure no lin­ux pro­gram is run­ning already) any lin­ux pro­gram will start with a lin­ux ker­nel ver­sion of 2.6.16 instead of 2.4.2. The default lin­ux base port (FC4) will then use dif­fer­ent code paths (e.g. with­in glibc). In case you want to switch back to the 2.4.2 emu­la­tion with­out a reboot, please make sure no lin­ux pro­gram is run­ning anymore.

So far we fixed all known/repeatable prob­lems with acrore­ad, realplay­er, skype and lin­ux fire­fox. If you encounter strange behav­ior with any lin­ux pro­gram, please tell us (emulation@freebsd.org) which pro­gram you used, how to repeat the prob­lem, what the prob­lem is, and if it only is vis­i­ble with 2.6.16 or with 2.4.2 too. You should also watch out for mes­sages in the dmesg (unim­ple­ment­ed sys­tem calls or oth­er stuff, this is used to deter­mine the pri­or­i­ty of miss­ing syscalls). Please also have a look at http://wiki.FreeBSD.org/linux-kernel, I intend to doc­u­ment the known prob­lems there. If you find your prob­lem there, please tell us about it if you are will­ing to test fixes.

We are spe­cial­ly inter­est­ed in reports (good or bad) on SMP sys­tems. Please beat the hell out of the linuxulator!

On amd64 sys­tems we have not the same func­tion­al­i­ty as on i386, miss­ing are futex­es and TLS. In P4 we already have the futex part cov­ered, but the TLS part is still miss­ing (any­one with a clue about the ker­nel side of TLS on amd64 is wel­come to give a hint or two to jkim@ and rdivacky@). So if you get a mes­sage about miss­ing futex­es or TLS on amd64: we know about it (testers for the futex stuff are wel­come, but first you need to use a pro­gram which uses futex­es and complains).

As long as we get prob­lem reports with 2.6.16 I will not switch the default to 2.6.16. If we don’t get a report at all, I will switch the default on i386 to 2.6.16 in two weeks. If we get some prob­lem reports, we will push back the switch a lit­tle bit depend­ing on the sever­i­ty of the problem.

Bye,
Alexander.