Solaris 10, Active Directory, Squid-2.7, NTLM. Eww.

I've been working on another Solaris 10 and Active Directory + Squid NTLM integration project. I think that I've finally coaxed out the niggling bits from all of this.

In summary (thus far);

The latest Solaris 10 ships with a "sun free software" Samba package with Kerberos and Active Directory already working. Good.

It -may- still have the 8 character password limit in the "net ads join" command (for "logging in" the server into the Active Directory.) Eww.

The Kerberos setup is a bit crack smoking but reasonably trivial. The trick is making sure the realm is setup right (capitalise the realm in the kerberos configs) and that the server queries the Active Directory DNS or things just don't work. (Active Directory DNS is used to discover services - eg ldap, kerberos, wins, etc.)

The default LDAP query results in Active Directory is limited to 1000 entries. So "wbinfo -u" doesn't return all the users from a large Active Directory.

Figuring out why/when to restart winbind; when to purge the winbind idmap/usermap tdb files is very Eww. I need to properly understand what is going on there.

Make sure the damned server is NTP synched to the AD servers.

I need to make certain that the Active Directory Kerberos is returning renewable tickets.

The winbind separator works best when its "+" apparently. Again, not sure why. I need to document all of this.

Having tightly controlled firewalls makes a 1 day job take a week; but it has shown me all the random communication which happens. For example, Samba uses LDAP-over-UDP on this setup to do the initial net join..

There's more to come as I finalise this installation. I'll publish the install guides on my website.

Downtime - web hosting services

There was a brief outage today on the web hosting services cluster. I've kicked the relevant service hard and things seem to be working again.

I'm looking forward to Sunday's upgrade and shuffle - I'll be able to do a lot more with what I have after that.

Current outage

I lost connectivity to the data centre a few minutes ago. It looks like all the WAIX participants down there are offline.

.. nope, its back now. I wonder what the problem was. There wasn't a power loss in the data centre so it looks like a problem with the backhaul to WAIX.

Hosting Referral Special!

G'day everyone,

I'm running a little referral campaign for May and June 2009. Existing clients who bring in three new clients get three months free.

Don't be shy!

Project Updates!

Here's a few updates concerning my current and upcoming projects at Xenion "Labs".

From the Squid consulting side of things:

• I'm putting together a proposal to implement generic Quota support in Squid-2 for an interested party. Hopefully they'll fund both the Squid-side (which will go back into Squid-2 and maybe Squid-3 in the future) and the proprietary code. This way they get their shiny features, the Squid community gets their shiny Quota support, and the company doesn't have to pay for ongoing maintenance of the Quota framework! Winners all around!
• I'm doing some installs of Squid for a company supplying internet access via Satellite. This means I'll have to tune Squid to cache a whole lot of popular stuff -and- do some tuning to optimise TCP/IP over satellite. I'll wrap up everything from this project and put it online.
• I've got an upcoming project to setup a small Squid cluster for a company providing services via a MediaWiki install. I'm going to leverage the excellent work done by the Wikimedia group and hopefully put all of that up online for others to leverage.

I've also been working on an NNRP proxy for a commercial USENET provider. Yes, people still pay for usenet services. Its quite scary actually! The first phase of that is near completion and I'll hopefully be able to leverage some of that in some open source projects. The NNRP proxy is currently handling almost a gigabit of reader traffic without any particularly scary issues; I'm quite impressed. Hopefully we can scale this software up to proxy around 5 to 10gbit of NNRP traffic and about 5000-15000 connected clients per server. This scales much, much better than the current software of choice in  the NNRP world - The diablo reader stuff, or "dreaderd".

I've been working on a few things on the hosting side - mostly relating to some content delivery ideas of mine. Nothing fantastically different there; I'll post some more details when there's something concrete and deliverable.

New Pricing Online!

I've just put the new pricing online - http://www.xenion.com.au/products/pricing.html .
This includes basic webhosting, domain services, traffic, colocation and virtual private servers.

New Customer: European-based media company CDN

I've recently acquired a small support contract to help build and troubleshoot issues for a European-based media company. They've built their own simple CDN with servers around Europe to deliver content. I've built and deployed two new Squid-2.7 servers for them which handle their current summer holiday load (20-30mbit at peak) with absolutely no trouble whatsoever.

Based on their existing servers which I'm apparently helping replace, they predict the servers will each peak above 150mbit/sec once the holiday period is over and everyone is back at work. I'm looking forward to it. I've got a few configuration tricks up my sleeve to optimise their setup to dramatically reduce the CPU consumed without any code or system changes. Stay tuned..