There are a fair number of guides out on the Internet for how toset up a Yubikey that holds a SSH key for you, like this one . Forme, the drawback of these is that they're all focused on doing thisthrough GPG, a full set of PGP keys, and gpg-agent . I don't wantany of that. I have no interest in PGP, I'd rather not switch awayfrom ssh-agent to gpg-agent , and I definitely don't

Now that I have a smartphone , intheory I could start using two-factor authentication to improve mysecurity. In practice I have yet to set up my phone for this foranything (although I did download an app for it). There turn out tobe several reasons for this.

First, the whole area is fairly confusing and partly populated bypeople that I don't really trust ( hi, Google ).Perhaps I am looking in the wrong places, but when I went lookingat least the

I wrote recently about the relatively new -w option for iptables and how it will make things blow up . Unfortunatelyfor Linux sysadmins everywhere, exactly how the iptables peopleintroduced this option is a case study in how not to make changeslike this; it is essentially backwards from what you want to do.They could probably have made the situation worse than it is now,but it would take some ingenuity.

Perhaps it is not obvious why iptables -w is so terrible (I mean,clearly it wasn't

Our local support site used to be not all that attractive and alsonot entirely well organized. Ultimately these descended from thesame root cause; that iteration of the site started out life as awiki (with a default wiki skin), then was converted to plain HTMLvia brute force when the wiki blew up in our faces .Recently we replaced it with a much nicer version that has a much more streamlinedmodern design.

As part of that more modern design, it has a menubar along the topwith drop-

If I'm going to consider building a new home PC ( as I sort of am ), one of the big questions is what sort of CPUI should build it around. There are a dizzying array of tradeoffshere, and you have to make some of them since features like ECCare only available in some models .In other words, you need to decide what you care about. ECC? Manycores? Advanced virtualization support? Overclocking capabilities?Thermal profile? And so on.

After thinking about it

I've used Unix for long enough that I'm completely at home with thebasic octal file modes, and in fact I generally think about filepermissions in octal; mode 755 (or 0755) is a standard executableor script, and so on. These octal modes are what I reflexively usewith chmod , find , and so on when I need to deal with permissions.I know vaguely in the back of my mind that the chmod commandsupports using symbolic modes, but I

As I sort of mentioned yesterday and have noted in passing in various other entries, we don't upgrade our OmniOS fileservers . Unlike our iSCSIbackends, this is not a situation where there is almost no benefitsto upgrading; even within a single OmniOS release there are often reasonably attractive updates and bugfixes that might matter to us. Instead the blocker is pretty simple;upgrading a fileserver is a risky thing where there would be majordisruption if something went wrong and the system crashed, becamebalky, or simply slowed

I mentioned yesterday that wehadn't applied any updates to the iSCSI backends for our fileservers since we installed them. This is probablynot an ideal situation for various reasons, missing security updatesbeing one of them, and maybe we should work on changing it. The twoproblems with any real updates is that we don't want to disturb ourfileservice (it's in use all the time) and we don't want to destabilizeit. In theory updates shouldn't destabilize things because they should

We don't think about our iSCSI backends all that often. Really, we don't think about them at all. They'rejust kind of there, sitting quietly in racks and quietly workingaway. They haven't even sent in any SMART complaints about theirdata disks yet (although I'm sure that'll start happening in anotheryear or two, unless we got really lucky or unlucky with these HDs).

Recently, though, we got email from the IPMI monitoring on one and