Isolating network interfaces on Linux

Consider a not entirely hypothetical situation: you have an officemachine that serves as one end of a GRE tunnel ,and, in addition to its official network interface, has a fluctuatingnumber of secondary interfaces on various internal VLANs for testing,debugging, and so on. The simple approach for such a machine is to justturn on global IP forwarding and cross your fingers that no one willdecide to make the machine their gateway (apart from the GRE link). Butthis is not ideal; if nothing else,


The sysadmin's life (again)

I made a bugfix to our mail server's configuration today.

Size of the bugfix: 25 characters added to an existing line.

Size of the comment sort of explaining why the bugfix is necessary: sixlines.

(And a complete discussion of the issue would be much longer.)

Of course, this is not unique to system administration; programmingalso has that sort of bugfixes. I think system administration may bemore prone to it, because so few of our tools, especially the ones with complicated logic


Linux's IP forwarding settings summarized

Unlike many Unixes, Linux determines whether or not it does IPforwarding on an interface by interface basis, based on interface thepacket arrived on . While Linux has a global IP forwarding sysctl, net.ipv4.ip_forward , pretty much all this really does is (re)set thevalue for all of the interfaces and make it the default; you can stillchange individual interfaces later.

The fine controls are in /proc/sys/net/ipv4/conf/ , where thingsgo like


An annoyance in Python's attribute access rules

When looking up names on objects, I really wishthat Python had a special attribute accessor for looking upattributes it was about to call, instead of only running them throughthe regular attribute lookup chain.

While this uniformity probably has little effects on mostcode, it complicates the life of things such as proxy objects thattrace and monitor access to objects, which sometimes want to behavedifferently for ' var = you.foo ' than for ' var = you.foo() '. You canfake this by returning


One reason I like Python

One reason that I like Python is that I find it what I call a very'computer science' language and I am a product of a CS environment. Bythis I mean that Python is mostly built from a small number of coreconcepts which are uniformly expanded through the language, and thosecore concepts are by and large familiar to me from my CS background.

(It also has a quite traditional Algol-style syntax, apart from thewhitespace issue.)

Since its core concepts click for me, I find


Classic crontab syntax mistakes

The crontab file format is unfortunately prone to mistakes, since itrequires you to carefully count words and, for bonus fun, requires adifferent number of words in different contexts. There are three classiccrontab syntax mistakes that I have seen (and sometimes committed):

  • adding a username when it's not necessary

    This generally results in mail from cron complaining that it cannotrun ' username '.

  • failing to specify a username when it's necessary

    This results in mail about 'no such user program ', assuming that


The funding capture problem

Here is a cynical truth:

No matter what they say, organizations eventually wind up workingfor the people who give them money.

This is a natural result of the fact that very few people everdeliberately try to put themselves out of a job. Organizations aredriven to perpetuate themselves, which requires that money keep comingin, which requires that the funding sources be kept happy, and beforeyou know it the organization's interests have become aligned with thoseof the people who give it money.

This sounds unexceptional,


A modest suggestion about test accounts

Here is a modest suggestion that has recently occurred to me:

Don't give your test accounts the same password as your regularaccount.

It's not that I'm all that worried about security issues; it's that Iwant to avoid accidentally logging in as one account when I'm tryingfor the other. With separate passwords, I have to make an absent-mindedmistake with both the username and the password, instead of just theusername, and I figure this improves my odds.


Running a 32-bit Firefox on a 64-bit Fedora or Red Hat Enterprise

It turns out that it is pretty easy to run a 32-bit Firefoxon a modern 64-bit Fedora or Red Hat Enterprise system,something that is periodically convenient. (For example,the current Sun ILOM client needs the 32-bit version ofJava. Maybe you could run things with nspluginwrapper , but I prefernot to take chances with a machine's console.)

First, you need to make sure you have the 32 bit version of Firefoxinstalled. I don't


Linux's umount -f forces IO errors

Here is something that I had to find the moderately hard way:

When used on an NFS filesystem, Linux's umount -f will force anyoutstanding IO operations to fail with an error, whether or not theunmount will succeed.

This can be both good and bad, but on the whole I think it's mostly bad.

If the NFS server has died completely and the outstanding IO can neversucceed, you do want things to abort now instead of hanging around. Inthis case umount -f '