Is This The Beginning of the End of Social Media?

Posted on 24. December 2018 by David Lane

As we approach the end of 2018, only people that have not been around the Internet for more than a microsecond are not wondering what will become of social media. In case you have not been paying attention, we are down to two social media players. Failbook (and their associated properties) and Twitter. So that, ladies and gentlemen, is it. On December 17, the exodus from Tumblr, the last pseudo-independent platform began as Verizon ordered all adult content remove. Now Verizon owns three failed platforms - the remains of AOL, the bad parts of Yahoo, and Tumblr. Zuckerbergland is composed of Failbook, Instasomething, and Whywoudyouuseitapp. Twitter is hanging on by a thread, but it is skating on thin ice. Snapchat is circling the drain, and other companies like MeWe and Diaspora are trying, unsuccessfully to fill the gap. G+? Well, Google is shutting it down, and it was a ghost town anyway (at least according to the technical press) and with a second data leak, Google has announced that it is closing G+ by April, instead of later in the year as they had originally announced. Not that it matters, most of the G+ communities have already shuttered their circles and moved on to Plusporia and similar nodes.

So why the end of social media? Well, you probably were asleep when Australia announced it is demanding the ability to crack encrypted streams. They claim, at the moment, that they are not asking for backdoors, but as a member of Five Eyes, it is only a matter of time before the US asks for a similar ability. Then do you think any encryption is valid? Meaning that anything you post online, you might as well post on a postcard and send it to your nearest newspaper. Many have already been doing this of course, but if you are not a fan of walled gardens, then does it matter?

I am not, nor have I ever been a fan of walled gardens. So as we go into 2019, and my options are reduced to Zuckerbergland or ... well, this site, I am choosing this site. My G+ ID will remain for a bit. I am debating closing that account, but I have begun the process of closing all my other online profiles, Twitter, and email accounts. I do not need them, and they do not offer any value beyond taking up bandwidth, so why maintain them.

A return to the real Internet may be just what the doctor ordered. What about you?

New Year, New Keys

Posted on 22. December 2018 by David Lane

When I first created my PGP keys, all those years ago, I created them with PGP. And for some reason, that I am not sure of, they were created as only 1024 bit keys. So as part of my new year clean up, I have revoked my keys and issued new ones at 4096 bit.

The revoked fingerprints are as follows:

For the ARRL account:

5C44 E28D 49FE 24D6 A9DA 1545 CD57 C291 0A53 3C19

For my Gmail account:

2428 CE82 2E0C E6B7 E1E3 8D84 85BD BF93 B6CF CE1B

The new fingerprints are:

For the ARRL account:

7AB2 2840 5C8F 7427 78E3 9105 9DCE F014 AE06 230B

and for my Gmail account:

1E01 F6F2 E5C7 9405 336C 4E89 4128 6E0B 102B 8367

As usual, the keys are at your neighborhood public key server or you can download them below. These keys were generated with GPG, but they will be usable in any PGP/GPG program.

ARRL:

gmail:

Apple’s TOCK upgrade

Posted on 13. September 2018 by David Lane

Yesterday, Apple announced the biggest iPhone ever, with stunning new displays. They also introduced a new watch that will read your EKG better, stronger, faster. Yawn. Sorry, what?

If this morning's mullet wrappers (as an old boss used to call the tech press) are any indication, they are less thrilled then I am about the new Apple hardware. Lead on Computerworld this morning? A review of five digital whiteboards. Apple's releases were the fifth bullet down behind Slack adds enterprise key management and How you can train for your MCSA and MCSE certifications (a house ad).

A couple of days ago, one of the luminaries in the Apple world asked Has Apple lost its shine? A valid question, especially related to the release yesterday. Sure, there are those that will go gaga over the new hardware, but those of us that have been in IT for more than a couple of months don't pay attention to new processors unless we need a feature in that new processor. And when it is only a tock (speed, security) upgrade, we really do not get excited.

Apple will continue to promote its new devices. The iDevice market is a considerable part of their revenue stream so they really cannot do anything else. But when the most exciting thing is the camera (and I can buy better glass for my DSLR for less money then they will ever be able to stuff in a phone case), perhaps Apple really has lost its way.

One minor thing of note. In iOS 12, there will now be almost complete support for the reading of NFC tags. I say this is a slight note because the NFC people have been asking for this for more than a decade when it first appeared in Android devices. Thanks for joining the planet Apple.

Auto-start Auto-stop Engines

Posted on 4. September 2018 by David Lane

I recently had the opportunity to drive a car with these new auto-start/auto-stop engines. You know the type. You are standing next to an idling car, and suddenly the engine stops. In the old days, we called it a stall, but new engines are doing it for fuel savings and saving the environment. I am all for protecting the environment, but I am not a huge fan of these engines. Let me explain.

These were first seen in high-end Mercedes and BMW cars. Today, they are everywhere that is not a hybrid. The idea, as I said, is to reduce carbon emissions while at idle, something most cars do a lot of in urban environments. Idling creates a lot of carbon because the gas does not fully combust, unlike when the vehicle is in motion (not entirely sure why) and it also creates a pocket of concentrated CO2 gas, along with some other not so healthy gases. So anything that makes idling cleaner is a good thing.

The problem comes about when you need to actually get going again. Because the engine actually stops, there is a brief delay before it gets started again. This is a bad thing in certain situations.

For example, if you are anything but number one in line, the delay in getting the engine started, and the gears engaged (all of which is automatic) is not a big deal. The three or four-tenths of a second it takes is manageable and usually is accounted for by the car in the number one slot getting his vehicle moving. Not a big deal.

However, if you are in the number one slot, and the car behind you is not suffering from waiting for his engine to start, you are going to get honked at, at the very least. I had a couple of near collisions simply because it took that much longer to get the car moving off the line when the light turned green.

The second issue is safety. I was taught, when I learned to drive a stick shift, that you never ride the clutch. The engine should be engaged at all times. The problem is that the sensor that puts the engine to sleep when you are idling at a traffic light does not know the difference between idling at a traffic light and waiting to make a left-hand turn. I had the engine cut out just as I had an opening to make a turn and missed the opportunity because the engine was off and had to restart. Fortunately, there was no one behind me trying to make the light as well. This is not safe. The same is true with stop and go driving. I had the engine shut off just as I went to touch the accelerator.

Finally, a minor note. The engine shutting off also shuts off the air conditioner. It will kick back on, but I can see where hot climates will result in higher in-cabin temperatures, especially in stop and go driving, where the engine shutting off actually makes it more uncomfortable inside for the passengers. Again, I cannot see this as a win.

I am sure someone has done the math, and everyone is perfectly happy with the reduced emissions, while the safety issues are perceived as minor. As a driver, I do not find that these sorts of engines are good, or safe. Time will tell.

Life flight takes off

Posted on 30. September 2017 by David Lane

Life flight takes off from Prince William County. It is amazing how the video makes the blades appear to not be spinning fast enough to lift the helicopter off the ground.

https://youtu.be/LXKgCKZyJeY

I Need A Specific Browser?

Posted on 29. November 2016 by David Lane

The only browser that the system supports is IE , Mozilla Firefox and Google Chrome. We recommend the most (sic) IE browser.

Excuse me while I check the calendar. Yup, it does say it is December, 2016. And yes, that is a message I received from a web site that I was having trouble entering data on. Data that is mission critical. Data, that is consumed by a python application on the back end where the servers that are serving the data are Linux based and the processing is done in an AWS environment. And yet, the code the browser is using is specifically written to run best on Microsoft Internet Explorer. And I wish I could say this is an anomoly. I am still encountering websites that require Flash, or versions of IE that are so old that their security risks have security risks. And yet that is the state of the art in a day when most people are making transations via the mobile devices, which are either on i-devices (which primarily run Safari) or Android devices, that primarily run Chrome. Sure you can load Chrome on to i-devices, or other browsers, but 99% of users do not, and for a good reason. Why would you?

I abandoned Windows completely about a year ago for Mac. Yes, I still have one laying around somewhere, but I have not turned it on in several months, and it would take hours to come up to speed with the 10,000 patches that probably need to be applied. But even I do not use my Mac that much anymore. For example this post is being written on my iPad. Yesterday I was doing a number of things in my AWS envrionment from this same iPad. And if I had a monitor handy, I could do it from my iPhone. Why do I need to carry a laptop anymore? Why do I need to have a specific operating system any more. I do not need a specific a browser to create this post, so why do I need a specific browser to type in data to a form on a web site! This is not 1999. If you are still restricting your broswers, it is time to upgrade your application development. Or you will lose customers. Or at least annoy them to the point that they will not be giving you good reviews on-line.

Fountain for Scriptwriting

Posted on 21. April 2016 by David Lane

I recently discovered fountain, a markdown syntax specifically designed for script writing. i have done a couple of experiments with it, both quite successful. The real test though is how well it imports into Celtx, my script writing software of choice. And I must say it works pretty well. i had to make a couple of minor corrections with parentheticals. I made a couple of errors when I composed the base document, but that was easily remedied and when I corrected the base document, it imported cleanly.

I have been an avid user of Celtx for years. The product is solid and has a robust user community. Their updates are well thought out and their Studio application/eco-system that supports more than just writing scrips is great for those on a budget. The only negative is that it is web based (with some features available for iOS). In most cases this is not a big show stopper, unless, like me, you are disconnected when you do your primary writing. The iOS apps do allow for off-line editing, but what about when I am using my Linux desktop?

Celtx no longer supports their desktop client (and I never could get it to run on Linux properly), so for these situations, the fountain format is a great find. It has a robust ecosystem around it and is also good for those who are just starting out and looking for an entry into script writing.

Experienced script writers will like a number of power features that allow you to go from treatment to script in the same document, depending on how you post-process it. And because it is an open standard, it allows you to store and reprocess scripts over time. A major plus as the software landscape is always changing.

Another nice feature is the ability to embed script segments into a blog with a nice WordPress plug in. As you can see, it is quite a nice little feature, and no additional work on my part than wrapping the text.

INT. LIVING ROOM - DAY

The door crashes open and BILL TURNER crashes into the room, blood pouring from two gun shot wounds. He is holding his abdomen as he staggers and falls to his knees. ALICE GEORGE is sitting on the couch.

ALICE

(screams)

Who are you! What are you doing here?

BILL

Currently bleeding. Call 9-1-1!

Bill falls to the floor.

If you are not already familiar with it, I encourage you to look into it and see if it fits your needs. I am more than happy with what it provides.

Windows 10 Security Issues are not Overblown

Posted on 5. February 2016 by David Lane

As a technology professional, I have been reading ComputerWorld for most of my career. Most of the time, the information in it is useful and occasionally biased. But the bias is easy to pick out and people will generally roll their eyes and move on. However, today, while reading a different article, I came across an August 25, 2015 article by Preston Gralla on 4 overblown Windows 10 worries that made my jaw hit the floor and actually question if Preston is working directly for Microsoft, because I cannot imaging an objective journalist writing some of the things he says, at least a journalist with any technical skill whatsoever.

Now, I am going to start by saying that Windows 8, as an operating system had a number of problems that really made me wonder what Microsoft was thinking, but the more I hear about Windows 10, the more I am convinced that Microsoft knows exactly what I am thinking, and what they are thinking runs diametrically against what most technicians and other IT professionals (especially security professionals) feel and operating system should be doing. The article tackles four key features of Windows 10 that have security people (and others concerned about digital privacy and security) pretty much wrapped around the axel.

First: Wi-Fi Sense will share all your passwords

Preston say this is not true, then goes on to explain why it is. He also says it is a good and necessary thing.

The concept behind Wi-Fi Sense is a solid one: To make it easier for visitors to find and connect to Wi-Fi networks. Wi-Fi Sense lets you share your network with others without seeing the actual network passwords – the passwords are encrypted and stored on Microsoft’s servers so they aren’t visible to outside users.

Let me explain. Wi-fi Sense shares your passwords with other users and they are stored on Microsoft’s servers. Oh, sure, they are encrypted, but are they encrypted with your keys? Do you control the revocation of the passwords? If you answered yes, please box up your PC and return it to where you bought it. The fact that this feature is enabled by default is a massive security hole. He tries to bloviate by saying it was invented by a similar idea invented by the Open Wireless Movement, but you can be sure the OWM had much less specific user information in mind for its implementation than what Microsoft has implemented. He goes on to say you have to take another step to actually share the key. Again, that it is enabled by default is a bad idea. The second step is merely a feel-good panacea. And since most home users do not have good network security, the myth that users on your network will not be able to get to other resources is just that a myth. This feature should not be part of any implementation of any operating system. If I want someone to have access to my Wi-Fi, I will provide them that access in a way that does not jeopardize my network, nor provides critical infrastructure information to an unknown third-party system.

Second: Windows 10 updates are automatically installed on your system, and that is a bad thing.

Says Preston:

The concern here is that, unlike previous versions of Windows, Windows 10 doesn’t give you a choice about when (or which) Windows updates will be installed on your computer. What Microsoft sends to you will be installed, whether you like it or not, and as a result, an update could break something on your PC – for example, a driver for a peripheral like a printer.

The truth is much more sinister.

It’s true that if you have the Windows 10 Home edition, you don’t have a choice about installing Windows 10 updates – Microsoft sends them and your system installs them.

And the fact is that most people have will be running Windows 10 Home. And you really should have a choice about what you will install because while most of Microsoft’s core patches are necessary, I have spend hours helping my less technologically savvy friends recover from a bad patch, or roll back a peripheral patch that caused a once working device to fail. And it happens more than anyone would like to admit.

I am all for installing patches and keeping your systems as current as possible, but not all patches should be blindly installed and certainly not on the day they are released. Let other people be the Guinea pigs. This is especially true with some of the less than successful browser updates in Microsoft’s past.

Third: Microsoft’s use of peer-to-peer networking for Windows updates will slow down your network connection.

Says Preston:

With Windows 10, Microsoft uses a trick borrowed from peer-to-peer networking apps like BitTorrent in order to distribute updates more efficiently. Rather than have everyone get updates from a central server, the updates are also delivered from PC to PC.

Microsoft “BITS” service has been around for a long time. Systems Management Server and the updated Systems Center Configuration Manager have used BITS for distributing files across low-bandwidth links. Preston likens the model to the way Bit Torrent works. But unless you have a slow bandwidth (and some do), this is actually not an effective way to deliver packets for an update. Further, there is a risk that the Peer-to-Peer network can be infiltrated. I fully expect that there will be a viable penetration before year-end if there is not one already. Again, you can turn it off, but it should not be enabled by default to begin with.

Fourth: Windows 10 is a privacy nightmare.

Well, honestly, it is. Preston even admits it by saying:

Most of the fears have to do with Windows 10’s default privacy settings, created during the installation if you use the express install option. With those default options, Windows 10 will send your calendar and contact details to Microsoft; assign you an advertising ID that can track you on the Internet and, when using Windows apps, track your location; and send your keystrokes and voice input to Microsoft.

He goes on to say that you can turn them all off. Two things wrong with this. First, opt-in, not opt-out should be the default setting for anything being sent anywhere. Period, end of sentence. Secondly, there are still a number of things that security professional are finding being sent to Microsoft even if you turn them off. Compound that by even more errors when you actively block the transmission of data to Microsoft. This is not a secure operating system. This is an information sieve.

What really upsets me is this:

Let’s face it – every time you use a computer, you’re living with tradeoffs between your privacy and getting things done more easily.

No. Privacy should never be a trade-off. Deciding what and when I send information to unknown third-parties should always be my decision, not the decision of an organization that knows better than me. Most home users do not know any better, which means that Microsoft should actively be helping them better protect themselves than exposing them to harm.

He concludes his article with this statement:

But other concerns have been overblown – in many cases you can change the defaults to make the operating system work more to your liking. And other concerns – for example, that Wi-Fi Sense automatically shares your Wi-Fi passwords with your friends and friends of friends – are myths.

No, they are not myths. They are facts, enabled by default, and while some of them can be turned off, the average user needs a much larger skill set than in past versions of Windows. Microsoft is not interested in their customer’s privacy, or security, or these, and other features would not be enabled by default, and that is not a myth.

Using A New Tool

Posted on 25. December 2015 by David Lane

Every now and then, I find a new tool to make my life easier, at least that is the theory. My first new tool was to ditch Microsoft Windows for the MacOS. At least as my primary day-to-day OS. Yes, I spend a large portion of my work day in Linux. At the moment the distribution is Ubuntu, but I spend most of my day staring at a terminal emulator. When I am not doing that, the OS should be something I do not have to think about, and Windows, especially Windows 8, was causing me too much thought. Then with the release of Windows 10 and all the things that are talking back to Microsoft, I decided it was time to try something else. So Mac won, despite the costs.

As many of you know, I have a certain loathing for the Mac. My primary arguement has (and still is) cost. It is just too bloody expensive. It has the advantage of being Unix like under the covers though, and it has a couple of other advantages in terms of photo work that Windows, even with all the RAM I could throw at it, just could not measure up to. So, I bit the bullet and went Mac.

With the conversion, came a couple of new tools, of which this is one - it is a piece of blogging software call Byword, and is a combination text editor, markdown support. It seamlessly connects with my blogging platform (which is good) and supports markdown which is good because more and more of my documents are being written in markdown than they are in anything else. It is more portable and just a better way of doing things. This is the first post with the Byword, and I am doing it more to test out the software than anything else. So here we go.

Hello world!

Test Kitchen to support Amazon Web Service (AWS) AMIs

Posted on 11. December 2015 by David Lane

I will keep this document updated as I move along.

Security Considerations

Under the instructions the Amazon Security Blog you need to do a few things to get started.

First, you need to create a new file called credentials in ~/.aws and set the rights to 600.

The credentials file needs to look like this:

[default]
aws_access_key_idx = "value here" <-- "This is the Access Key ID from IAM for the core user"
aws_secret_access_key = "value here" <-- "This is the secret ID from the CSV file that matches the access key"

Some things also need to be variables it seems. This is the default .bash_profile:

export AWS_ACCESS_KEY_ID="value here"
export AWS_SECRET_ACCESS_KEY="vale here"
export AWS_SSH_KEY_ID="PEM key name without the .pem"
export AWS_SSH_KEY="$HOME/.ssh/pem key with the .pem"

This is a bit of belt and suspenders, but it works and doesn’t throw irrational errors that keep you chasing your tail. Ideally you should not need the AWS_ACCESS_KEY and ID in your .bash_profile file, but some functions seem to need it.

You may want to set up a config file in ~/.ssh similar to:

# contents of $HOME/.ssh/config
Host chef
    User ubuntu
    HostName 52.91.89.20  <-- public IP address of instance
    IdentityFile ~/.ssh/awskey.pem <-- aws key

Drivers

You will need the EC2 Drivers from GitHub You will also need to install the AWS SDK for Ruby v2 gem.

To install the gems:

 $ gem install aws-sdk
 $ gem install ec2

Instantiate the kitchen:

$ kitchen init --driver=kitchen-ec2 --create-gemfile
  create  .kitchen.yml
  create  test/integration/default
  create  Gemfile
  append  Gemfile
  append  Gemfile
You must run `bundle install' to fetch any new gems.

The .kitchen.yml file

Modify/tweak your .kitchen.yml file to look like either of these or use the baseline sample:

Ubuntu Sample

---
driver:
  name: ec2 <-- Driver name
  security_group_ids: ["security group"]
  require_chef_omnibus: true
  region: us-east-1 <-- Verify
  availability_zone: d <-- Verify
  subnet_id: "subnet-x"
  associate_public_ip: true <-- If you want to connect from outside.
  interface: private <-- To connect from in AWS

transport:
  ssh_key: "/home/ubuntu/.ssh/AWSKEY.pem" <-- set to your key name
  username: ["ubuntu"] <-- Connect user name (needs quotes and brackets)

provisioner:
  name: chef_solo

platforms:
  - name: ubuntu-14.04 <-- Descriptive name
  driver:
    image_id: ami-d05e75b8 <-- Verify
    instance_type: t2.micro <-- Verify
    block_device_mappings: <-- Optional
      - ebs_device_name: /dev/sdb
        ebs_volume_type: gp2
        ebs_virtual_name: test
        ebs_volume_size: 8
        ebs_delete_on_termination: true

  suites:
    - name: default
    run_list:
    attributes:

CentOS/RHEL Sample

---
driver:
  name: ec2
  security_group_ids: ["security group"]
  require_chef_omnibus: true
  region: us-east-1 <-- zone may need verification
  availability_zone: e <-- may need verification
  subnet_id: "subnet-yoursubnet"
  associate_public_ip: true
  interface: private <-- when building from inside AWS

transport:
  ssh_key: ~/.ssh/AWS.pem <-- set to your key name
  username: ["ec2-user"] <-- may need to be root for CentOS, ubuntu for ubuntu

provisioner:
  name: chef_solo

platforms:
  - name: centos-6.4
driver:
  image_id: ami-26cc934e <-- Verify
  instance_type: t1.micro <-- Verify
  block_device_mappings:
    - ebs_device_name: /dev/sdb
      ebs_volume_type: gp2
      ebs_virtual_name: test
      ebs_volume_size: 8
      ebs_delete_on_termination: true  

suites:
  - name: default
    run_list:
    attributes:

Baseline file sample for both Ubuntu and CentOS/RHEL

---
driver: 
  name: ec2
  require_chef_omnibus: true
  aws_ssh_key_id: AWSKEY <-- AWS Key name (no .pem)
  security_group_ids: ["sg-...f"] <-- security group
  region: us-east-1 <-- verify your region
  associate_public_ip: true <-- if you need to access the node outside AWS
  interface: private <-- set to _private_ if you are inside AWS

provisioner:
   name: chef_solo
transport:
   ssh_key: "/location/.ssh/key.pem" <-- don't know why, but this has to be here and not in the individual sections. 

platforms:
   - name: rhel-7.1 <-- RHEL is not officially supported but will work
     driver:
       image_id: ami-12663b7a <-- verify the image 
       instance_type: t2.micro <-- verify the instance type and size
       availability_zone: e <-- verify the zone it can run in
       transport.username: ["ec2-user"] <-- user will vary _ec2-user_ is the default for RHEL, but may need _root_
       subnet_id: "subnet-...2" <-- verify the subnet with the zone
       block_device_mappings:
         - ebs_device_name: /dev/sdb
           ebs_volume_type: gp2
           ebs_virtual_name: test
           ebs_volume_size: 8
           ebs_delete_on_termination: true

- name: ubuntu-14.04
     driver:
     image_id: ami-d05e75b8 <-- verify the image
     instance_type: t2.micro <-- verify the instance type and size
     availability_zone: d <-- verify the zone it can run in
     subnet_id: subnet-...c <-- verify the subnet with the zone
     transport.username: ["ubuntu"] <-- default name for Ubuntu
     block_device_mappings:
       - ebs_device_name: /dev/sdb
         ebs_volume_type: gp2
         ebs_virtual_name: test
         ebs_volume_size: 8
         ebs_delete_on_termination: true

suites:
  - name: default
    run_list:
    attributes:

If you want to assign a static address to the host, you have to do it at kitchen create stage. In the platforms section add:

network:
   - ["private_network", {ip: "172.31.47.69"}]

Using Kitchen

Kitchen List: Check your Instances and Actions

$ kitchen list
Instance             Driver  Provisioner  Verifier  Transport   Last Action
default-rhel-71      Ec2     ChefSolo     Busser    Ssh         <Not Created>
default-ubuntu-1404  Ec2     ChefSolo     Busser    Ssh         <Not Created>

Kitchen Create: Create an instance

$ kitchen create default-ubuntu-1404
-----> Starting Kitchen (v1.4.2)
-----> Creating <default-ubuntu-1404>...
    If you are not using an account that qualifies under the AWS free-tier, you may be charged to run these suites. 
    The charge should be minimal, but neither Test Kitchen nor its maintainers are responsible for your incurred costs.

   Instance <i-d4f71865> requested.
   EC2 instance <i-d4f71865> created.
   Waited 0/300s for instance <i-d4f71865> to become ready.
   Waited 5/300s for instance <i-d4f71865> to become ready.
   Waited 10/300s for instance <i-d4f71865> to become ready.
   Waited 15/300s for instance <i-d4f71865> to become ready.
   Waited 20/300s for instance <i-d4f71865> to become ready.
   Waited 25/300s for instance <i-d4f71865> to become ready.
   Waited 30/300s for instance <i-d4f71865> to become ready.
   Waited 35/300s for instance <i-d4f71865> to become ready.
   EC2 instance <i-d4f71865> ready.
   Waiting for SSH service on 172.31.63.224:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.63.224:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.63.224:22, retrying in 3 seconds
       [SSH] Established
       Finished creating <default-ubuntu-1404> (1m9.39s).
-----> Kitchen is finished. (1m9.46s)

$ kitchen list
Instance             Driver  Provisioner  Verifier  Transport   Last Action
default-rhel-71      Ec2     ChefSolo     Busser    Ssh         <Not Created>
default-ubuntu-1404  Ec2     ChefSolo     Busser    Ssh         Created

Kitchen Destroy: Destroy an Instance

$ kitchen destroy default-ubuntu-1404
-----> Starting Kitchen (v1.4.2)
-----> Destroying <default-ubuntu-1404>...
       EC2 instance <i-d4f71865> destroyed.
       Finished destroying <default-ubuntu-1404> (0m0.82s).
-----> Kitchen is finished. (0m0.87s)

Kitchen Setup: Install Chef on a node

$ kitchen setup default-rhel-71
-----> Starting Kitchen (v1.4.2)
-----> Creating <default-rhel-71>...
If you are not using an account that qualifies under the AWS free-tier, you may be charged to run these suites. 
The charge should be minimal, but neither Test Kitchen nor its maintainers are responsible for your incurred costs.

   Instance <i-387a1fc1> requested.
   EC2 instance <i-387a1fc1> created.
   Waited 0/300s for instance <i-387a1fc1> to become ready.
   Waited 5/300s for instance <i-387a1fc1> to become ready.
   Waited 10/300s for instance <i-387a1fc1> to become ready.
   Waited 15/300s for instance <i-387a1fc1> to become ready.
   Waited 20/300s for instance <i-387a1fc1> to become ready.
   Waited 25/300s for instance <i-387a1fc1> to become ready.
   Waited 30/300s for instance <i-387a1fc1> to become ready.
   Waited 35/300s for instance <i-387a1fc1> to become ready.
   EC2 instance <i-387a1fc1> ready.
   Waiting for SSH service on 172.31.41.13:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.41.13:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.41.13:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.41.13:22, retrying in 3 seconds
   Please login as the user "ec2-user" rather than the user "root".

   Please login as the user "ec2-user" rather than the user "root".

   Finished creating <default-rhel-71> (1m47.75s).
-----> Converging <default-rhel-71>...
   Preparing files for transfer
   Preparing dna.json
   Preparing current project directory as a cookbook
   Removing non-cookbook files before transfer
   Preparing solo.rb
   Please login as the user "ec2-user" rather than the user "root".

   Please login as the user "ec2-user" rather than the user "root".

-----> Starting Kitchen (v1.4.2)
-----> Converging <default-rhel-71>...
   Preparing files for transfer
   Preparing dna.json
   Preparing current project directory as a cookbook
   Removing non-cookbook files before transfer
   Preparing solo.rb
-----> Installing Chef Omnibus (install only if missing)
   Downloading https://www.chef.io/chef/install.sh to file /tmp/install.sh
   Trying curl...
   Download complete.
   Downloading Chef  for el...
   downloading https://www.chef.io/chef/metadata?v=&prerelease=false&nightlies=false&p=el&pv=7&m=x86_64
     to file /tmp/install.sh.10715/metadata.txt
   trying curl...
   url  https://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chef-12.5.1-1.el7.x86_64.rpm
   md5  9333136ba8a11bd6cad6d28fcd26a2c7
   sha256   7a937d8c0ab68a1f342aba4ad33417fc4ba8cb1a71f46e4a18b5e76c363e4075
   downloaded metadata file looks valid...
   downloading https://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chef-12.5.1-1.el7.x86_64.rpm
     to file /tmp/install.sh.10715/chef-12.5.1-1.el7.x86_64.rpm
   trying curl...
   Comparing checksum with sha256sum...

   WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

   You are installing an omnibus package without a version pin.  If you are installing
   on production servers via an automated process this is DANGEROUS and you will
   be upgraded without warning on new releases, even to new major releases.
   Letting the version float is only appropriate in desktop, test, development or
   CI/CD environments.

   WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

   Installing Chef 
   installing with rpm...
   warning: /tmp/install.sh.10715/chef-12.5.1-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
   Preparing...             ################################# [100%]
   Updating / installing... ################################# [100%]
   Thank you for installing Chef!
   Transferring files to <default-rhel-71>
   Starting Chef Client, version 12.5.1
   Compiling Cookbooks...
   Converging 0 resources

   Running handlers:
   Running handlers complete
   Chef Client finished, 0/0 resources updated in 00 seconds
   Finished converging <default-rhel-71> (0m39.27s).
-----> Setting up <default-rhel-71>...
   Finished setting up <default-rhel-71> (0m0.00s).
-----> Kitchen is finished. (0m39.32s)

$ kitchen list
Instance             Driver  Provisioner  Verifier  Transport   Last Action
default-rhel-71      Ec2     ChefSolo     Busser    Ssh         Set Up
default-ubuntu-1404  Ec2     ChefSolo     Busser    Ssh         <Not Created>

Kitchen Converge: Deploying a file to a node

Modify your .kitchen.yml file, and update the suites section with the recipe:

suites:
  - name: default
    run_list:
      - recipe[motd::default]
    attributes:

Then run the kitchen converge command:

$ kitchen converge default-rhel-71
-----> Starting Kitchen (v1.4.2)
-----> Creating <default-rhel-71>...
   If you are not using an account that qualifies under the AWS free-tier, you may be charged to run these suites. 
   The charge should be minimal, but neither Test Kitchen nor its maintainers are responsible for your incurred costs.

   Instance <i-af402556> requested.
   EC2 instance <i-af402556> created.
   Waited 0/300s for instance <i-af402556> to become ready.
   Waited 5/300s for instance <i-af402556> to become ready.
   Waited 10/300s for instance <i-af402556> to become ready.
   Waited 15/300s for instance <i-af402556> to become ready.
   Waited 20/300s for instance <i-af402556> to become ready.
   Waited 25/300s for instance <i-af402556> to become ready.
   EC2 instance <i-af402556> ready.
   Waiting for SSH service on 172.31.45.65:22, retrying in 3 seconds
   Waiting for SSH service on 172.31.45.65:22, retrying in 3 seconds
   [SSH] Established
   Finished creating <default-rhel-71> (1m4.66s).
-----> Converging <default-rhel-71>...
   Preparing files for transfer
   Preparing dna.json
   Preparing current project directory as a cookbook
   Removing non-cookbook files before transfer
   Preparing solo.rb
-----> Installing Chef Omnibus (install only if missing)
   Downloading https://www.chef.io/chef/install.sh to file /tmp/install.sh
   Trying curl...
   Download complete.
   Downloading Chef  for el...
   downloading https://www.chef.io/chef/metadata?v=&prerelease=false&nightlies=false&p=el&pv=7&m=x86_64
     to file /tmp/install.sh.5483/metadata.txt
   trying curl...
   url  https://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chef-12.5.1-1.el7.x86_64.rpm
   md5  9333136ba8a11bd6cad6d28fcd26a2c7
   sha256   7a937d8c0ab68a1f342aba4ad33417fc4ba8cb1a71f46e4a18b5e76c363e4075
   downloaded metadata file looks valid...
   downloading https://opscode-omnibus-packages.s3.amazonaws.com/el/7/x86_64/chef-12.5.1-1.el7.x86_64.rpm
     to file /tmp/install.sh.5483/chef-12.5.1-1.el7.x86_64.rpm
   trying curl...
   Comparing checksum with sha256sum...

   WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

   You are installing an omnibus package without a version pin.  If you are installing
    on production servers via an automated process this is DANGEROUS and you will be upgraded without warning on new releases, even to new major releases.
   Letting the version float is only appropriate in desktop, test, development or CI/CD environments.

   WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING

   Installing Chef 
   installing with rpm...
   warning: /tmp/install.sh.5483/chef-12.5.1-1.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 83ef826a: NOKEY
   Preparing...             ################################# [100%]
   Updating / installing... ################################# [100%]
   Thank you for installing Chef!
   Transferring files to <default-rhel-71>
   Starting Chef Client, version 12.5.1
   Compiling Cookbooks...
   Converging 1 resources
   Recipe: motd::default
     * cookbook_file[/etc/motd] action create
       - update content in file /etc/motd from e3b0c4 to 295b84
       --- /etc/motd    2013-06-07 10:31:32.000000000 -0400
       +++ /etc/.motd20151210-10819-18peqj2 2015-12-10 14:02:01.757471882 -0500
       @@ -1 +1,10 @@
       + __________________________________
       +/ You are on a simulated Chef node \
       +\ environment                      /
       + ----------------------------------
       +        \   ^__^
       +         \  (oo)\_______
       +            (__)\       )\/\
       +                ||----w |

       - restore selinux security context

   Running handlers:
   Running handlers complete
   Chef Client finished, 1/1 resources updated in 00 seconds
   Finished converging <default-rhel-71> (0m32.21s).
-----> Kitchen is finished. (1m36.95s)

$ kitchen list
Instance             Driver  Provisioner  Verifier  Transport   Last Action
default-rhel-71      Ec2     ChefSolo     Busser    Ssh         Converged
default-ubuntu-1404  Ec2     ChefSolo     Busser    Ssh         <Not Created>

$ ssh -i ~/.ssh/awskey.pem ec2-user@52.91.126.45
Last login: Thu Dec 10 14:02:00 2015 from ip-172-31-60-114.ec2.internal
 __________________________________
/ You are on a simulated Chef node \
\ environment                      /
----------------------------------
        \       ^__^
         \      (oo)\_______
                (__)\       )\/\
                    ||----w |
                    ||     ||
[ec2-user@ip-172-31-45-65 ~]$ exit
logout
Connection to 52.91.126.45 closed.

Metadata.rb modifications

When you are creating a new recipe, you need to edit the metadata.rb file. For example, in the apache cookbook example, the file will look like:

name             'apache'
maintainer       'David A. Lane'
maintainer_email 'david.lane@gmx.com'
license          'All rights reserved'
description      'Installs/Configures apache'
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version          '0.1.0'

Writing a recipe: Modifying recipe/default.rb

When you want to install a package, you will need to modify the default.rb file in the recipe subdirectory. An example, for installing apache is as follows:

#
# Cookbook Name:: apache
# Recipe:: default
#
# Copyright 2015, YOUR_COMPANY_NAME
#
# All rights reserved - Do Not Redistribute
#

package "httpd" do
  action :install
end

Once you make that modificaiton run a kitchen converge [node] and it will install apache.

[ec2-user@ip-172-31-47-69 ~]$ rpm -qa httpd
httpd-2.4.6-40.el7.x86_64

Service Resource

You can take it a step further to install, and activate the package once it is installed by modifying the default.rb like this:

package "httpd" 

service "httpd" do
  action [ :enable, :start ]
end

Which should result in ouput like this:

$ kitchen converge default-rhel-71
-----> Starting Kitchen (v1.4.2)
-----> Converging <default-rhel-71>...
   Preparing files for transfer
   Preparing dna.json
   Preparing current project directory as a cookbook
   Removing non-cookbook files before transfer
   Preparing solo.rb
-----> Chef Omnibus installation detected (install only if missing)
   Transferring files to <default-rhel-71>
   Starting Chef Client, version 12.5.1
   Compiling Cookbooks...
   Converging 2 resources
   Recipe: apache::default
    (up to date)

       - enable service service[httpd]

       - start service service[httpd]

   Running handlers:
   Running handlers complete
   Chef Client finished, 2/3 resources updated in 03 seconds
   Finished converging <default-rhel-71> (0m5.05s).
-----> Kitchen is finished. (0m5.11s)

And on the server, you get:

[ec2-user@ip-172-31-47-69 ~]$ systemctl list-unit-files | grep httpd
httpd.service                               enabled

Template Resource

Modify the default.rb to add the template line as shown:

package "httpd"

service "httpd" do
  action [ :enable, :start ]
end

template "/var/www/html/index.html" do
  source 'index.html.erb'
  mode '0644'
end

And then you need to create the index.html.erb file. Start by running chef generate template <file>:

$ chef generate template index.html

and then change into templates/default and edit the index.html.erb file with what you want to include, such as:

This site was set up by <%= node['hostname'] %>

and run another kitchen converge.

Check the output:

$ kitchen converge default-rhel-71
-----> Starting Kitchen (v1.4.2)
-----> Converging <default-rhel-71>...
   Preparing files for transfer
   Preparing dna.json
   Preparing current project directory as a cookbook
   Removing non-cookbook files before transfer
   Preparing solo.rb
-----> Chef Omnibus installation detected (install only if missing)
   Transferring files to <default-rhel-71>
   Starting Chef Client, version 12.5.1
   Compiling Cookbooks...
   Converging 3 resources
   Recipe: apache::default
    (up to date)
    (up to date)
    (up to date)

       - create new file /var/www/html/index.html
       - update content in file /var/www/html/index.html from none to b2f6ae
       --- /var/www/html/index.html 2015-12-11 12:49:17.376524243 -0500
       +++ /var/www/html/.index.html20151211-19185-1lfz25z  2015-12-11 12:49:17.376524243 -0500
       @@ -1 +1,2 @@
       +This site was set up by 

       - restore selinux security context

   Running handlers:
   Running handlers complete
   Chef Client finished, 1/4 resources updated in 03 seconds
   Finished converging <default-rhel-71> (0m5.03s).
-----> Kitchen is finished. (0m5.09s)

And then on the host, you can verify the installation:

[ec2-user@ip-172-31-47-69 ~]$ curl localhost
This site was set up by ip-172-31-47-69

Using Knife

Creating a Knife file

$ knife cookbook create motd --cookbook-path .
WARNING: No knife configuration file found
** Creating cookbook motd in /home/ubuntu/git/motd
** Creating README for cookbook: motd
** Creating CHANGELOG for cookbook: motd
** Creating metadata for cookbook: motd

$ kitchen init --create-gemfile
conflict  .kitchen.yml
Overwrite /home/ubuntu/git/motd/.kitchen.yml? (enter "h" for help) [Ynaqdh] n
    skip  .kitchen.yml
conflict  chefignore
Overwrite /home/ubuntu/git/motd/chefignore? (enter "h" for help) [Ynaqdh] y
   force  chefignore
  create  Gemfile
  append  Gemfile
  append  Gemfile
You must run `bundle install' to fetch any new gems.

$ bundle install
Fetching gem metadata from https://rubygems.org/..........
Fetching version metadata from https://rubygems.org/...
Fetching dependency metadata from https://rubygems.org/..
Resolving dependencies...
Using mixlib-shellout 2.2.5
Using net-ssh 2.9.2
Using net-scp 1.2.1
Using safe_yaml 1.0.4
Using thor 0.19.1
Using test-kitchen 1.4.2
Using kitchen-vagrant 0.19.0
Using bundler 1.10.6
Bundle complete! 2 Gemfile dependencies, 8 gems now installed.
Use `bundle show [gemname]` to see where a bundled gem is installed.

Musings from the Back Room

Thoughts, rants and musings on all things of interest.

Category Archives: Technology