backup script (NO, not data-backups, small configuration file backups)

Hello again,

after some time finally something usefull for more of you: a small bash script that came out of configuration work. The scenario is, you want to test a new configuration file, but want to backup the old or standard one. Sometimes it's a hole directory you want to exchange. And ofter some testing one has a couple of backup files, all with different names and naming conventions, somtimes maybe a date, sometimes a tag...
So I wrote the following script. Probably most admins do something like this and probably there are already a quadrillion tools out there, that do this or can do this. But I like to have a simple command that does exactly what I want without the need to supply the same options everytime, that I can't remember. So if you have a tool already, just make an alias. But here's the script, for everyone who wants to use it:



#!/bin/bash
# put it here for example: /usr/local/bin/bak.sh
# don't forget to chmod 755 it
if [[ (($# -ne 1) && ($# -ne 2)) || ($1 == "-h") ]]; then
        echo "usage: bak.sh <file or dir> <optional tag>"
        echo "files will just be copied"
        echo "directories will be archieved as .tgz"
        exit
fi
APPEND="bak-`date +'%Y-%M-%d_%H%M%S'`"
if [ $# -eq 2 ]; then
        APPEND="${APPEND}-${2}"
fi
if [ -d $1 ]; then
        APPEND="${APPEND}.tgz"
        echo "backing up ${1} to ${1}.${APPEND}"
        tar czf $1.$APPEND $1
else
        echo "backing up $1 to ${1}.${APPEND}"
        cp -p $1 $1.$APPEND
fi

SSL Rant

GAAAAAAAAHHHH I HATE SSL

Well, I mean, I cannot live without ssl. Well I mean, I cannot live without encryption. And SSL is the de-facto standard encryption on the internet.
Since I moved to a new server because the old ones uptime rarely gets beyond 24 hours these days, i had to reconfigure some services. Apache was easy, copy the config, everybody's happy.
Mail wasn't that easy, I wanted to have virtual domains. So I had to bake myself a new little setup from ground up. postfix + courier-imap was working before, so I decided to base it on that.
But when I was testing connectivity I noticed SSL warnings. these typical "your certificate is BROKEN" in your face warnings, that would make everybody besides myself check for new viruses on their pc while making sure the abort button is not some evil "sell your soul here" button.
I don't reaaaaaally need to get rid of the warning but I wanted to do it right. It seems I used cacert certificates before. They are really nice, but aren't really compatible with anyone who doesn't go to keysigning parties or at least knows what that is. So I took my already working StartCom SSL certificate, that I use for apache and mumble, pointed the config file to it and then screamed and shed tears of blood for the next couple of hours.
Because supplying your own certificate isn't enough. No, you have get the right combination of internmediate certificates, root certificates, your own public one and your private key. And just as a side note: EVERY program does is differently! So went to the internets and looked, which files I had to cat together four courier-imap, but instead of the gaping abyss of result-less google searches I got about 10 different possiblilites, which certificates to cat together. Also, there is the ascii-style .pem format and the .crt format. Or .crt formats. Because some .crts look exactly like .pems and some are binary garbage. And people are just throwing them together in files and one never knows, if the time they did this, a .crt had a .pem format or not.
Oh, did I mention? The order in which you pack these little freaky buggers together make a difference. Sometimes.

So.
What I want to say. To every body who writes config parsers and ssl apis. PLEASE make this easier. make one option for every kind of file. Try to look up intermediate certificates your self, so we don't have to supply them. To the SSL providers: provide these intermediate certificates!

And for all the lost courier-imap - configurating people out there:
TLS_CERTFILE -> make this point to a file that includes your public and private certificate (.pem)
TLS_TRUSTCERTS -> make this point to a file that includes first the intermediate certificate, then the root certificate (if that order make a differnce - I don't know, I don't care anymore)

ping tool / debugging a server from afar

hello readers,

sometimes my server is unreachable for no apparent reason. The logs don't really give a clue and my only way of reaching it again is to restart it by sending it an automatic hardware reset.
Since I have no idea whether it is locked up, just unreable *from* the network or completly disconnected from the network I wrote a little script to log pings. This way I can see in the log if it tries to ping at all and if it tries, if it can reach the network from its side or not.
Now all I have to do is to wait for it to crash. Well, I mean, to hope for the script to be a useless effort since it will never crash again ... of course ... ;)

Here's the script:


#!/bin/bash
# filename: pinglog.sh
# set logging dir here
MYDIR=/var/log/ping
# here you can choose a different format, i.e. "$1.log"
# where $1 always is the hostname given to the script
MYFILENAME="$1"
echo `date +'%Y-%m-%d %H:%M: '` `ping -c1 $1 | head -n2 | tail -n1` >>\ $MYDIR/$MYFILENAME

and here's a line for you to enter in in the crontab, if you want it to ping&log every 5minutes:

*/5 * * * * /some/directory/pinglog.sh some.server.com


I know it's not something big or difficult, but sometimes big problems need low-tech solutions. Also small scripts like these can be a good alternative to installing big software packages like nagios, if you don't really need them.

Android time conversion

Good morning dear readers,

some hours ago I was shocked to noticee there was no good time (zone) conversion app on the android market. At least no good free one. I thought this was easy, but time conversion has some evil caveats, but I think I got it working fine for now. Since I'm not yet ready to invest 25$ so I can distribute an app for free I will just publish it right here. Feedback is of course welcome :)

BTW: For now the easiest way to install the little bugger is to enable installation from unkown sources and get it on the device somehow. I just moved it to dropbox, tapped it, there you go :)

Download toLocalTime.apk

Mumble (mumurd) nagios plugin

Today I wrote a little nagios plugin to check the state of murmurd (popular mumble server) because the ones out there don't seem to do the job (at least I couldn't make them).
requirements:
-dbus
-murmurd running with dbus interface
-python-dbus bindings
-nagios ;)

define a new command in /etc/nagios/objects/commands.cfg (at least under gentoo that's where to do it):

# murmur (Mumble)
define command{
        command_name check_murmur
        command_line $USER1$/check_murmur.py $ARG1$ $ARG2$ $ARG3$ $ARG4$ $ARG5$ $ARG6$ $ARG7$ 2>/dev/null
}


define the service in i.e. /etc/nagios/objects/localhost.cfg:

define service{
        use                 local-service
        host_name           example.org
        service_description Mumble murmurd
        check_command       check_murmur!servernum!minusers!maxusers!minchannels!maxchannels!minbans!maxbans
}


where servernum starts with 1
all minumums are disabled when <= 0
all maximums except bans are disabled when <= 0
maxbans is disabled when <= -1


now paste the script below in /usr/lib/nagios/plugins/check_murmur.py (you may have to put it in a different directory, but the filename should be the same).
Good luck and have fun :)

#!/usr/bin/python
import sys
import dbus


servernum = '1'
minusers = 0
maxusers = 0
minchannels = 0
maxchannels = 0
minbans = 0
maxbans = -1
warning = False
reportstr = ""
warningstr = ""


if(len(sys.argv) == 1 or sys.argv[1] == '-h' or sys.argv[1] == '--help'):
        print 'usage: ' + sys.argv[0] + ' <server number> <minusers> <maxusers> <minchannels> <maxchannels> <minbans> <maxbans>'
        print 'minimus: <= 0: disabled (except maxbans, only disabled for <= -1); maximums: <= 0 disabled; server numbers start with 1!'
        sys.exit()


servernum = sys.argv[1]
if(int(sys.argv[2]) > 0):
        minusers = int(sys.argv[2])
if(int(sys.argv[3]) > 0):
        maxusers = int(sys.argv[3])
if(int(sys.argv[4]) > 0):
        minchannels = int(sys.argv[4])
if(int(sys.argv[5]) > 0):
        maxchannels = int(sys.argv[5])
if(int(sys.argv[6]) > 0):
        minbans = int(sys.argv[6])
if(int(sys.argv[7]) > -1):
        maxbans = int(sys.argv[7])


bus = dbus.SystemBus()
server = bus.get_object('net.sourceforge.mumble.murmur', '/'+str(servernum))
try:
        players = server.getPlayers()
except dbus.exceptions.DBusException:
        print "Critical: No connection via dbus. If dbus is up this service is probably down."
        sys.exit(2) #Crit
channels = server.getChannels()
bans = server.getBans()




reportstr += "users: " + str(len(players)) + ", channels: " + str(len(channels)) + ", bans: " + str(len(bans))


if(minusers > 0):
        if(minusers > len(players)):
                warning = True
                warningstr += " <less than " + str(minusers) + " users>"
if(maxusers > 0):
        if(maxusers < len(players)):
                warning = True
                warningstr += " <more than " + str(maxusers) + " users>"
if(minchannels > 0):
        if(minchannels > len(channels)):
                warning = True
                warningstr += " <less than " + str(minchannels) + " channels>"
if(maxchannels > 0):
        if(maxchannels < len(channels)):
                warning = True
                warningstr += " <more than " + str(maxchannels) + " channels>"
if(minbans > 0):
        if(minbans > len(bans)):
                warning = True
                warningstr += " <less than " + str(minbans) + " bans>"
if(maxbans > -1):
        if(maxbans < len(bans)):
                warning = True
                warningstr +=" <more than " + str(maxbans) + " bans>"


if(warning):
        reportstr = "WARNING: " + reportstr + ", warnings:" + warningstr
else:
        reportstr = "OK: " + reportstr
print reportstr
if(warning):
        sys.exit(1)
else:
        sys.exit()


UPDATE: The plugin got accepted at nagios exchange.

Prime numbers in Haskell

Hello again,
last night I couldn't sleep very well, so I tried a new method to calculate prime numbers(from 2 to n), this time in haskell.
I'm not exactly sure on the runtime, i guess O(n^2), maybe lower, but it's hard for me to say, because I believe it depends on the distribution of the prime numbers themselves. But I'm thankfull if anyone wants to analyze this and tell me :)


calcprimes :: Int -> [Int]
calcprimes n = primeh [2..n] []
 where primeh :: [Int] -> [Int] -> [Int]
primeh [] primes = reverse primes
primeh (x:xs) primes = primeh (primeh2 x xs [] ) (x:primes)
where primeh2 :: Int -> [Int] -> [Int] -> [Int]
primeh2 _ [] ys = reverse ys
primeh2 d (x:xs) ys = if mod x d == 0
                                      then primeh2 d xs ys
                                      else primeh2 d xs (x:ys)


UPDATE 1: Woops, it seems I accidentally reinvented (or remembered and just didn't know I saw this this before) the wheel, erm I mean the "Sieve of Eratosthenes" and also that there are shorter implementations of this, which can also handle infinite data structures and stuff - "much more to learn to I have..."


UPDATE 2: With a little lambda magic and "filter" I wrote a little shorter and even faster version of this:



calcprimes :: Int -> [Int]
calcprimes n = primeh [2..n] []
 where  primeh :: [Int] -> [Int] -> [Int]
        primeh [] primes = reverse primes
        primeh (x:xs) primes = primeh (filter (\y -> mod y x /= 0) xs) (x:primes)

Mumble Server and SSL

Here we are again,

my friendly gentoo server and me, playing "wouldn't be fun without trouble" ;)
Goal:
- murmur as a Mumble server
- startcom / startssl class 1 certificate
Problem:

sslCert=/etc/ssl/startssl/server.pem
sslKey=/etc/ssl/startssl/server_key.pem
did not do the trick. Though it only throws error when you try to connect.
Then I tried different variants of cat-ing together cert and key, cert and intermediate authority, with ca itself, all of it, no luck at all.
Thanks to: http://www.mumb1e.de/de/gemeinde/forum/7-murmur/1151-ssl-zertifikat I tried the right thing:
sslCa=/etc/ssl/startssl/chain.pem
Where chain.pem just contains the ca and the intermediate cert of startcom. sslCert is only my cert and sslKey is only my key.
Hope I saved someone an hour with google ;)