SLES 10 SP1 –> SP2 for both x86 and x64

How-to: http://www.novell.com/support/viewContent.do?externalId=7000387

Local update: http://www.novell.com/support/documentLink.do?externalID=3065146

Release notes: http://www.novell.com/documentation/sles10/release-notes_sp2/release-notes_sp2.html

Why Linux will not displace Windows

Here’s the incredible response:

You are kidding arent you ?

 

Are you saying that this linux can run on a computer without windows underneath it, at all ? As in, without a boot disk, without any drivers, and without any services ?

That sounds preposterous to me.

If it were true (and I doubt it), then companies would be selling computers without a windows. This clearly is not happening, so there must be some error in your calculations. I hope you realise that windows is more than just Office ? Its a whole system that runs the computer from start to finish, and that is a very difficult thing to acheive. A lot of people dont realise this.

Microsoft just spent $9 billion and many years to create Vista, so it does not sound reasonable that some new alternative could just snap into existence overnight like that. It would take billions of dollars and a massive effort to achieve. IBM tried, and spent a huge amount of money developing OS/2 but could never keep up with Windows. Apple tried to create their own system for years, but finally gave up recently and moved to Intel and Microsoft.

Its just not possible that a freeware like the Linux could be extended to the point where it runs the entire computer fron start to finish, without using some of the more critical parts of windows. Not possible.

I think you need to re-examine your assumptions.

 

Posted by: jerryleecooper Posted on: 03/14/07

Everything has been working really well – great uptime, better performance, another box moved to SLES 10..

Except for one little thing. Grania has been commenting that some of her email is missing.

Well – it’s not been in the inbound SpamAssassin kill files; it’s not stuck on the mail server; there are no errors with connectivity; no problems with DNS or MX records. The mail has been from all over – so it’s not someone like Yahoo being picky. Also normal mail has been coming in fine – so we’ve not been blackholed.

Tonight I decided to hunt down the problem.

It was me. I missed one step for the migration of mail; to use Netmail rules and forwarding the AutoReply agent needs creating and configuring.

The AutoReply Agent also enables users to forward their messages to another e-mail address. Users can specify if they want to retain a copy of the message in their NetMail mailbox or forward the message to the designated address.

Ooops. I missed that one. Three mouse clicks later and everything is back to normal.

I just trawled the aliases and there were over 400 mails to forward to the real mailboxes.

I use IPcop and Copfilter as my firewall/spam/email filtering gateway. Free and easy. Scales well.

I’ve had problems with Copfilter running the Bayesian learning for spam assassin; in short copfilter runs a wrapper script to call into sa-learn.pl.

I found that the IMAP->message_to_file was just sitting waiting for input from the NetMail server I run. Simple fix; add a timeout to IMAP reads and increase the IMAP buffer size. This should let me get all of the body text for learning, and timeout on massive inline images.

I logged a bug and posted a fix to the DMZS-sa-learn.pl script

my $imap = Mail::IMAPClient->new(
Server => ‘foo.com:143′,
User => ‘spamtrainer’,
Password => ‘longpassword’,
Debug => ’1′,
#ezs edits
Timeout => ’5′,
Buffer => ’65536′,
);

Spam training is working perfectly now – Copfilter is eating its way through 3600 spam and about 6000 ham (non spam) messages.

The Collanos Workplace seems to fill several of my needs for working with my team:

- document sharing and management
- team task lists
- discussions
- cross platform

Most importantly – the model is peer-to-peer. That means that none of my ‘corporate data’ ever lives on someone elses server. That was one of the major downsides to using something like Backpack or Basecamp. (Cool – but kinda interesting from a risk and security angle).

By having this ‘built’ and in the web it also means I don’t have to build an internal server, manage it, keep it safe, back it up – and also use VPN to get data in and out of it.

Feedback soon. I’ve sent the team the data – we should be running in a couple of days.

I’m writing a wiki article on installing WordPress on openSUSE.

The aim is to have this done this week in time for WordCamp.

Novell’s PR agency are using del.icio.us to track press for the release of SUSE Linux Enterprise 10.

The link is here http://del.icio.us/SHIFT.Communications.Novell.SUSELinuxEnterprise10

Things have improved since the internal alpha and beta releases – no problems so far – and very good hardware detection.

I’m writing a document on installing WordPress on SLES 10 – I’ll have that out soon.

[Edit - SLES 10 and WordPress 2.0.3 are running nicely together in my tests. I'll update the Evil ZEN Scientist blog server tonight and see where that gets me.]

This blog is now running on SLES 10 – woo!

# tail /etc/SuSE-release
SUSE Linux Enterprise Server 10 (i586)
VERSION = 10


Usual delays – see posts below – but should be up and posted in mid-February.

Topics for discussion: ZENworks 7, ZENworks Asset Management, Patching and BrainShare 2006.

Cool.

I looked at all sorts of options for building the website – it needed to be easy to use, minimal maintenance, good functionality – but also secure, not resource hungry and obviously run on Apache, PHP and MySQL.

I eventually selected Drupal.  It has an active developer community; the architecture and structure was logical; the security seems good. Best of all it’s easy enough for non-IT people to use.

So far so good. The new WYSIWYG editor looks pretty sweet too

I found an addition to IPcop that added these services in a controllable manner – CopFilter – http://www.copFilter.org.

CopFilter plugs into IPcop and adds (for me) an SMTP proxy, ClamAV, SpamAssassin – as well as giving me a really simple web UI to manage things. Best of all all of the components are GPL.

I’ve trained the anti-spam – and it’s really working better so far than my own manual tweaking on a seperate server.

So far so good – I’ll keep track of the performance and post the results later.

I’ve installed on a non-live server – and things work ok right now. Some testing needed on the plugins – but fingers crossed.

I keep tweaking and tightening my anti-spam rules for my mail server – but the amount of inbound spam is getting crazy. I’m catching about 95% of bad mail – and getting all viruses – but I’m looking at switching to a dedicated inbound mail filter.

I’m probably going to run SpamAssassin and ClamAV running on SLES9.

I had forgotten the password, it was locked out, the machine wasn’t in AD – and I was stuck.

Luckily there are a wealth of tools to help in this situation – including this. Petter Nordahl-Hagen has written a stunning Linux based boot floppy that just fixes things like this in seconds. Thanks Petter.

(In a former life I use to use ERwin from Platinum Technology..)

If anyone wants a copy in PDF just give me a shout. If anyone wants to know how I did this – please also get in touch.

The focus is heavily on NT4 replacement – but there are some good notes and worked examples of Windows 200x and Active Directory migration.

One area that would be interesting (for Novell customers) is replacing the LDAP components of this Redbook with eDirectory; for more comprehensive management of this space Novell Open Enterprise Server would also be a great choice.

Nov 16 13:25:14 gc-blog sshd[6625]: Illegal user admin from ::ffff:[IPaddress]
Nov 16 13:25:16 gc-blog sshd[6628]: Illegal user test from ::ffff:[IPaddress]
Nov 16 13:25:19 gc-blog sshd[6631]: Illegal user guest from ::ffff:[IPaddress]
Nov 16 13:25:26 gc-blog sshd[6637]: Illegal user webmaster from ::ffff:[IPaddress]
Nov 16 13:25:36 gc-blog sshd[6645]: Illegal user oracle from ::ffff:[IPaddress]
Nov 16 13:25:38 gc-blog sshd[6647]: Illegal user library from ::ffff:[IPaddress]
Nov 16 13:25:41 gc-blog sshd[6650]: Illegal user info from ::ffff:[IPaddress]
Nov 16 13:25:43 gc-blog sshd[6653]: Illegal user shell from ::ffff:[IPaddress]
Nov 16 13:25:50 gc-blog sshd[6658]: Illegal user linux from ::ffff:[IPaddress]
Nov 16 13:25:53 gc-blog sshd[6661]: Illegal user unix from ::ffff:[IPaddress]
Nov 16 13:25:55 gc-blog sshd[6664]: Illegal user webadmin from ::ffff:[IPaddress]
Nov 16 13:26:05 gc-blog sshd[6672]: Illegal user test from ::ffff:[IPaddress]
Nov 16 13:26:09 gc-blog sshd[6678]: Illegal user admin from ::ffff:[IPaddress]


SANS also had a post – http://isc.sans.org/diary.php?storyid=846

I’m keeping an eye on behaviour – I think my sshd are configured reasonably well.

So far it’s working nicely.

This described using ZLM7 to mirror content from update.novell.com.

ZLM7 can also bring content from a SUSE YaST Online Update (YOU) repository. YOU can be used to update SUSE Linux Enterprise Server 9.

Read the earlier post on some tips to get your ZLM7 mirroring configured correctly.

Here is my working configuration to mirror from a YaST Online Update (YOU) mirror:


you-mirror.xml


<ZLMMirrorConf>
<Session>
<RemoteServer>
<Base>http://sdb2.suse.de/download</Base>
<Type>yast</Type>
<User>yast-user</User>
<Password>yast-password</Password>
</RemoteServer>
<LocalServer>
<Type>zlm</Type>
<User>zlmmirror-service</User>
<Password>foo</Password>
</LocalServer>
<Catalog>
<Name>sles-9-i586</Name>
<Target>sles-9-i586</Target>
<Folder>YOU</Folder>
</Catalog>
</Session>
</ZLMMirrorConf>

Most of the posts from the last few days have been a day early (if that makes any sense) – it looks like I’ve been posting a day in the future

All fixed now.

This post describes in detail how to mirror content (updates and patches) from Novells update service – update.novell.com.

update.novell.com contains updates for Novell Linux Desktop, Open Enterprise Server and Novell Linux Small Business Suite.

I hope to publish similar articles in the coming days on how to do this for Red Hat Network (for Red Hat Enterprise Linux) and YaST Online Update (for straight SUSE Linux Enterprise Server).

There is a documentation misquote; in the documents it describes jumping through some hoops and placing ZLM6.6 mcookie and partnernet files (these are the credentials for the remote server) on your ZLM server.

No need.

This process should be a lot lot easier with this process.

From your ZLM server (the one where ZLMmirror will run)

rug service-add --type=rce https://update.novell.com/data --key=[key]


[key] is the product activation key you received with your Novell Linux product.

This will create everything needed for zlmmirror to connect to the remote update.novell.com server.

Next step – the xml for the zlmmirror configuration. I recommend creating a zlmmirror-service account for this and giving it full (read/write) access to /Bundles. You can do this from the ZENworks Control Center or from the command line (zlman).

zlman admin-create zlmmirror-service [password]
zlman admin-rights-assign --bundles --create


Hint: Create a ~/.zlmanrc file and place your ZLM username and password in there:

-U [user] -P [password]

Here’s the XML:


update-novell-com.xml

<ZLMMirrorConf>
<Session>
<RemoteServer>
<Base>https://update.novell.com/data</Base>
<Type>RCE</Type>
</RemoteServer>
<LocalServer>
<Type>zlm</Type>
<User>zlmmirror-service</User>
<Password>foo</Password>
</LocalServer>
<Catalog>
<Name>sles9</Name>
<Target>sles-9-i586</Target>
<ExcludeTarget>nld-9-x86_64</ExcludeTarget>
<Folder>update.novell.com</Folder>
</Catalog>
</Session>
</ZLMMirrorConf>

Test the structure with:

zlmmirror cv ./update-novell-com.xml -v

This should come back with a dump of the log file for a success – i.e. the xml parses correctly. Note that the tags are case sensitive.
If there are problems with the config then zlmmirror will report an error.

From the website:

Open Invention Network (OIN), a company that has and will acquire patents and offer them royalty-free to promote Linux and spur innovation globally, was launched today with financial support from IBM, Novell, Philips, Red Hat, and Sony. The company, believed to be the first of its kind, is creating a new model where patents are openly shared in a collaborative environment and used to facilitate the advancement of applications for, and components of, the Linux operating system.

There has already been coverage on Groklaw, NYT, CNN, Novell Open PR and probably others during the day.

Cool.

I keep getting other priorities. Sorry to anyone who is waiting.

I’ll post a mindmap of where I am soon – problem is that there are still a lot of questions that I need to get answered on this.

My main pain right now is getting SLES 9 support packs cleanly into ZLM7 – this is driven by a customer request. My other pain is some of the internal workings of ZLM and how to best document that.

Thanks for your continued patience.

Quoting McAfee:

The worm blindly attacks web servers by sending malicious http requests on port 80. If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed.

There are some well understood methods to minimise this risk.

Practice good security. A good robust perimeter firewall – I use IPcop; along with a good patch regime is vital. I (naturally) use ZENworks Linux Management to keep my Linux servers up to date.

One other addition is application hardening – I blogged a while ago about Novell AppArmor – I run this on my outward facing and internal Linux servers. If anything untoward happens – AppArmor is my final line of defence keeping my servers in good health.

[Edit - also to note - keep your applications themselves up to date; if they are RPM based - ZENworks Linux Management can deliver the updates. My blogging software is WordPress - they posted a note saying the updated versions are not affected.]

[Note - I really don't think this matters on a server - clean up your servers; reduce the bloat; reduce the risk - remove X and a desktop from your servers Believe me - ssh is your friend]

I’ve posted before on this – my personal opinion is that the real battle is not over KDE vs. Gnome. It’s about making a more productive, good looking, consistent desktop; one that you can “Just Use” (TM). It would be great to see components of KDE running nicely on Gnome, Gnome pieces running on KDE, common themes – can you see my paradise here?

This should not be a religious argument. There has been much work between the two communities – even as far back as the 1.0 versions (common menuing for example).

There have been some notable efforts in this space more recently. freedesktop.org tries to drive interoperability for all GUI/WM environments on X – with some success; even more recently last month the Tango Project was launched to try and deliver a common user experience.

These are all good efforts. I believe Novell has supported several of these initiatives; as well as promoting choice within (over 50% of Novell employees are using NLD as their primary production OS).

Nice solution for a standalone imaging solution if you just want a nearly-smart(*) imaging story. It’s fast, furious and does what I need.

(*) for true smartness use ZENworks 7 with the full policy enablement of imaging.