automount sshfs with passphrase enabled key

There are many articles to mount sshfs using autofs, but most of them use "empty" passphrase. I come up with a way to enable passphrase. Here is a memo for myself in the future.

When zpool create command fails

When try to create pool on whole disk but a partition, zpool command automatically creates partition.
But sometimes the command fails and emits the following error message.

the kernel failed to rescan the partition table: 16
cannot label 'sdc': try using parted(8) and then provide a specific slice: -1

As described in ArchWiki, that is because udev fails to create the device file within 1 second.

The ArchWiki proposes to slow down the disk by parallel read.
I found another way which is much stable.


strace command traps syscalls and dump the parameters of syscalls to stderr.
cstream command lets you limit throughput.
So limit the stderr by cstream slows down the zpool.

strace zpool create /dev/sda /dev/sdb tank |& cstream -b 64 -t 2048

If the command is too slow, then increase the throughput to 8K or 16K.

SoftEther VPN on Gentoo

SoftEther VPN is an opensource VPN client/server software, which supports multiple vpn protocols like their own protocol, L2TP/IPsec, OpenVPN, and MS-SSTP. Its client and server software runs on multiple platform including Window, Linux and BSD. Simply saying it's awesome.

Maybe because the software is originally developed on Windows, some part of its behavior is not unix-style.

• logs are saved in the same directory as the binary locates
• config file is saved in the same directory as the binary locates

And no ebuild in the gentoo portage exists. That's why I make my portage overlay.
It is available at my github repository.

The ebuild includes several patches that I think not appropriate to merged in mainline.

1. pid file and log file are saved in /var/run and /var/log/softeher respectively.
2. disable override /proc/sys/kernel/threads-max setting
3. activate all features including X.509 authentication that are disabled on original source

How to use my overlay: 

• emerge layman
• enable the line of "overlay_defs" in /etc/layman/layman.cfg
• wget https://raw.githubusercontent.com/yTakatsukasa/misc/master/layman/yutetsu.xml -O /etc/layman/overlays/yutetsu.xml
• layman -a yutetsu

How to install softether-vpn

After my overlay is enabled,
# emerge softether-vpn
# rc-update add vpnserver
# /etc/init.d/vpnserver start
Then configure the vpnserver. I recommend to use Server Management program on windows to configure the server.

Changing the permission of /dev/nvidia* on Gentoo Linux

To use CUDA on Gentoo, just emerge nvvidia-cuda-sdk is sufficient.
After installing the driver and sdk, /dev/nvidia* will be found.

These device files has 660 permission and belong to video group.
So if users are a member of video group, no problem.

If you want to use the device file from other groups, you have to change the permission.
Here is what I did.


1) edit /etc/modprobe.d/nvidia.conf
  change the line starts with "options nvidia NVreg_DeviceFileMode=", from NVreg_DeviceFileMode=432 to NVreg_DeviceFileMode=0666

2) chmod +x /opt/bin/nvidia-modprobe

3) reboot

Then you will find /dev/nvidia* have permissioin 666.

Installing Munin on gentoo and CentOS

Munin, which is a software to monitor the servers requires less effort to setup than MRTG.
I setup Munin server on gentoo box and munin-node on centos boxes.
Munin server collects status from munin-nodes and generates charts.

Setup Munin server on gentoo

Article in gentoo wiki is helpful.
Before installing munin, it is better to serup httpd like apache, lighttpd.
If you have already installed httpd, simple emerge it, but you cannot use -minimal flag.

# emerge -v munin

# emerge --config net-analyzer/munin

If you also want to monitor this box, it should also be munin-node.

# rc-update add munin-node default

# /etc/init.d/munin-node

Then edit the /etc/munin/munin.conf and add following entry if not exists.

[yourserver.example.com]
        address 127.0.0.1
        use_node_name yes

emerge --config commands installs crontab, so you will find newly generated charts within 5 minutes at /var/www/localhost/htdocs/munin/.

Setup Munin-node on centos

Enable EPEL

Because munin is not hosted in the default repository, you have to enable EPEL (Extra Packages for Enterprise Linux).
On CentOS 5.x x86_64 

# rpm -ivh http://ftp-srv2.kddilabs.jp/Linux/distributions/fedora/epel/5/x86_64/epel-release-5-4.noarch.rpm

 On CentOS 6.x x86_64

# rpn -ivh http://ftp-srv2.kddilabs.jp/Linux/distributions/fedora/epel/6/x86_64/epel-release-6-5.noarch.rpm

Then edit/etc/yum.repos.d/epel-testing.repo and set enable of [epel-testing].

enabled=1

Install munin-node

Just yum it.

# yum install munin-node

Edit /etc/munin/munin-node.conf and  add allow entry for Munin server. Note that the IP address must be described as a regular expression.

allow ^192\.168\.0\.\d+$

Then boot munin-node and make it executed automatically.

# /etc/init.d/munin-node start

# chkconfig --add munin-node

# chkconfig munin-node on

Add munin-node to be monitored

Edit /etc/munin/munin.conf on gentoo box and add an entry of centos box.

 [centos.example.com]
        address 192.168.0.2
        use_node_name yes

Now you can check the status at http://gentoobox.example.com/munin/.

802.1X PEAP-md5 authentification with freeradius

A few wireless access point supports WPA2-EAP, each user can have different password to connect wifi with it.
Some model of corega supports WPA2-EAP, you have to check the datasheet before you buy.

RADIUS server, which manages accounts is necessary for EAP auth.
I realized WPA2-EAP wifi access point with freeradius on gentoo linux.
Following is the procedure of it.

Install freeradius

Simply emerge it.

# emerge freeradius -v

Setup the config files

Edit /etc/raddb/clients.conf to allow clients(access point) to query the account.
Add an entry like following.

client 192.168.0.0/24 {
        secret = secretphrase
        shortname = yourservername
}

Make account

Edit /etc/raddb/users to add accounts.
The following 3 lines are required for each account.

account_name Cleartext-Password := "password"
        Service-Type = Framed-User,
        Framed-Protocol = PPP

Setup access point 

Setup the access point to use WPA2-EAP auth.
You have to specify at least 2 information below.

1. IP address or hostname of radius server
2. secret key specified in clients.conf

Start daemon with debug mode

# radiusd -X

If you try to connect the access point, access point queries the radius server and radiusd will show the debug messages.
You will have to enter the account name and password as in /etc/radvd/users.

I tested with 4 clients, windows8 pro, android 2.3, android 4.0 and android 4.2. Only android 2.3 failed to connect. I am not sure the reason.

Let radiusd starts at boot time

# rc-update add radiusd default