- WLUG - wlug.mailman3.com

Re: [Wlug] PGP Key Signing Party

by Walt Sawyer

Here is mine. 7232 6FDF 6586 24F5 D2D7 588C B851 D6B0 0003 2D3B Thanks! Walt Sawyer Eric Martin wrote: > This upcoming meeting we are going to have a PGP Key Signing Party. > For those of you who don't know what PGP is, allow me to briefly > explain. This is all base off of the GPG Key Signing HOWTO > (http://www.rubin.ch/pgp/kspa/gpg-party.en.html) which I suggest for > further reading. Those who do know can feel free to skip down to the > next paragraph. PGP stands for Pretty Good Privacy, and is a Public > Key Infrastructure that allows us to communicate securely and deal with > data in a secure fashion. There is a public key that one would > typically upload to a server and a private key that you hold on to. > With the private key you can decrypt / sign, and with the public key you > can encrypt / verify emails and documents. Key signatures come into > play when you validate that a specific key belongs to a specific person > and extend the web of trust. > > Here's what needs to be done BEFORE the meeting on your computer, > or on > a secure terminal (e.g. not in a computer lab on your campus). I'll > post directions both for GPG (Gnu Privacy Guard) and Kgpg (the KDE front > -end to gpg for all of those who like GUIs). > > 1. Generate a Key Pair / Verify your key won't expire soon > gpg --gen-key > (Default values of DSA/Elgamal is fine and the default of 2048 is > good.) > I recommend 3 - 5 years for a key lifespan (how long the key will be > good for) > > 1a) for those of you wishing to use Kgpg, goto Keys -> Generate Key > Pair and fill in the dialog box > Once you create the New key pair, check the Save As box under > _Revocation Certificate_ to save a Revocation Certificate (see 2) > > 1c) For those of you who already have a key, make sure yours isn't > about > to expire (like mine did). If it has expired, you can extend the life by > $ gpg --edit-key <key-id> > and typing expire at the command prompt > > next, generate a new key-pair and sign your new key with your old key > so anyone who trusted your old one will trust the new one. > > 2) Generate a revocation certificate > Revocation certificates are for situations where you forget your > passphrase, the key becomes comprised, etc you can revoke your key. > $ gpg --output revoke.asc --gen-revoke <key-id> > Save this in multiple places, print a copy etc in case you need > it. > 2GUI) If you didn't create a revocation cert in Kgpg, just right click > on your new key and select Revoke Key. when the box pops up only check > Save As > > 3) Upload your key to the Designated server for this party (pgp.mit.edu) > > $ gpg --send-key --keyserver=pgp.mit.edu <key-id> > 3GUI) Right Click on the Key, select Export Public Keys, select Default > Key Server (make sure it's pgp.mit.edu under Settings) > > 4) Email me your key's fingerprint so I can add it to the list > > $ gpg --fingerprint <key-id> > Copy and Paste that into an email to the coordinator (me, Eric > Martin). > > 5) print out a copy of that same output and bring it to the meeting. > > I'll make up a check list and bring them to the meeting for everyone > to use. > > Example output from Step 4: > > pub 1024D/A9413B9F 2007-04-09 [expires: 2010-04-08] > Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > uid Eric J. Martin <eric.joshua.martin(a)gmail.com> > uid Eric J. Martin <freak4uxxx(a)gmail.com> > sub 2048g/01F81B8E 2007-04-09 [expires: 2010-04-08] > > my <key-id> is A9413B9F (which is always the same as my last 8 hex > digits of my fingerprint). If like me you don't always remember your > key-id you can use your email address and it will still work. > > My full key information is: > > Key ID: A9413B9F > Key Type: DSA > Hex Fingerprint: D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F > Key Size: 1024 > > (The DSA key is always 1024 bits. The ElGamal Encryption key is 2048 > bits in my case, but isn't needed for the keysigning party.) > > What you should bring to this party > > 1. Yourself, no exceptions > 2. Two forms of positive photo ID - driver's license and passport are good > 3. Key Id, Key Type, Hex Fingerprint and Key size info > > ***Please print out your own copy of your info to compare against mine > when you arrive *** > > 4. Pen / Pencil > > What you Should Not Bring > > 1. Computer > > I want to thank Chuck Anderson for helping me out. If you have any > questions please let me know. > > Eric _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 29, 2007

Re: [Wlug] I'd like to see Windows do this....

by John Stoffel

Tal> It was just the OS, not the data disk (the data disk is a 3 disk Tal> Raid 5 array). Again, If you've bothered to use RAID on your data, why not on the OS as well? It's not like the OS is all that big space wise, so it's cheap to mirror. And not always will the system (unix or otherwise) fail so nicely. You were lucky in my book. :] John

April 28, 2007

Re: [Wlug] I'd like to see Windows do this....

by Tal Cohen

It was just the OS, not the data disk (the data disk is a 3 disk Raid 5 array). :) Tal -----Original Message----- From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On Behalf Of John Stoffel Sent: Saturday, April 28, 2007 9:32 AM To: Worcester Linux Users Group Subject: Re: [Wlug] I'd like to see Windows do this.... Tal> Sure enough, he was unable to log in. It turns out that the hard Tal> drive that holds the OS (Crux Linux) failed. You don't have your disks mirrored? I'm surprised! John _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 28, 2007

Re: [Wlug] MySQL Server Hardware

by Frank Sweetser

On Sat, Apr 28, 2007 at 09:31:24AM -0400, John Stoffel wrote: > Well, the nice thing I like about Sun hardware is that you have remote > serial console access all the way down to the BIOS. This, to me, is a > key issue in supporting any critical system. This way I don't have to > drive into the data center to fix things if at all possible. Actually, a lot of the higher end x86 boxes have stolen this idea, including at least Dell and HP. It's a little mini system with it's own CPU, memory, NIC, etc that can give you access to the power switch, a virtual KVM, and a virtual floppy and CD for recovery purposes. -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that WPI Network Engineer | is simple, elegant, and wrong. - HL Mencken GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

April 28, 2007

Re: [Wlug] I'd like to see Windows do this....

by John Stoffel

Tal> Sure enough, he was unable to log in. It turns out that the hard Tal> drive that holds the OS (Crux Linux) failed. You don't have your disks mirrored? I'm surprised! John

April 28, 2007

Re: [Wlug] MySQL Server Hardware

by John Stoffel

>>>>> "IV" == IV John Westcott <John.Westcott(a)tufts.edu> writes: IV> I work in a place that has traditionally used Sun Sparc hardware IV> running Solaris to host a production MySQL environment. IV> We are going to be replacing our database servers this year and I am IV> trying to determine if I want to maintain the norm or if I want to try IV> to change. IV> I am interested to see what other people use for hardware/OS for IV> a production MySQL installation that requires a high amount of IV> uptime. Well, the nice thing I like about Sun hardware is that you have remote serial console access all the way down to the BIOS. This, to me, is a key issue in supporting any critical system. This way I don't have to drive into the data center to fix things if at all possible. Second, in your case you might want to think about a MySQL cluster if you have lots of stringent uptime requirements, but it's not clear what kind of downtime you can handle. You might want to look at the new Sun Opteron X4x000 boxes, they're cheaper and faster than Sparc, but come with the nice remote management features that I find indispensable. Another vendor would be Rackable Computing, they have BIOS access over serial and it works well. Again, not knowing your system loads, I'd say that any AMD Opteron box with plenty of memory would be just fine for you. In this case, the more memory the better, and of course having fast local disks in a RAID setup is also key. Mirroring the OS and data disks is key here to long life. Oh yeah, moving to Solaris in X86 might also help in this transition, in that you get more bang for the buck, but don't have a complete issue with re-training and finding new tools to do what you want. Solaris 10 on x86 is pretty neat. John

April 28, 2007

MySQL Server Hardware

by joel d

I'll take a stab at this one. At work our MySQL database contains product info and indexing data. The reasoning for designing and taking this outside of the business application is the business app. doesn't do web communication well (limited functionality and at times spotty app reliability). The business app doesn't matter (and I bet no one has heard of it anyway). Our design spec was hearty at a HP DL 385 with dual AMD CPUs (dual core I think) 5GB of RAM and around 7 internal 15k drives in RAID 5. Every bit of hardware is HP/Compaq. Without starting a distro thread we picked Red Hat AS V4. This combo has served us well and I am sure *many* other distros would do this at least as well. For us our biggest corporate reason for R.H. was most of our application vendors suported R.H in one way or another (a vote for getting good at only one skillset/distro). During application & DB development we considered uptime and ordered a second identical box mainly for a total server failure of any sort. They run very well as MySQL master and slave. In the year it has been up we are very happy with this combination. Feel free to forward any specific questions (direct or via the group). Hope this helps, Joel ============================= Date: Tue, 24 Apr 2007 14:59:55 -0400 From: "John Westcott, IV" <John.Westcott(a)tufts.edu> Subject: [Wlug] MySQL Server Hardware To: wlug(a)mail.wlug.org Message-ID: <20070424145955.3hftuclhdwg0ck4s(a)webmail.tufts.edu> Content-Type: text/plain; charset=ISO-8859-1; format="flowed" Howdy All, I work in a place that has traditionally used Sun Sparc hardware running Solaris to host a production MySQL environment. We are going to be replacing our database servers this year and I am trying to determine if I want to maintain the norm or if I want to try to change. I am interested to see what other people use for hardware/OS for a production MySQL installation that requires a high amount of uptime. Thanks in advance for any replies. -John Westcott

April 27, 2007

Re: [Wlug] MySQL Server Hardware

by Tal Cohen

We use the Crux Linux distribution with MySQL. Our production systems handle high volumes of traffic and database transactions...without incident (unless the hardware fails as I mentioned in a previous post). Tal -----Original Message----- From: wlug-bounces(a)mail.wlug.org [mailto:wlug-bounces@mail.wlug.org] On Behalf Of John Westcott, IV Sent: Tuesday, April 24, 2007 3:00 PM To: wlug(a)mail.wlug.org Subject: [Wlug] MySQL Server Hardware Howdy All, I work in a place that has traditionally used Sun Sparc hardware running Solaris to host a production MySQL environment. We are going to be replacing our database servers this year and I am trying to determine if I want to maintain the norm or if I want to try to change. I am interested to see what other people use for hardware/OS for a production MySQL installation that requires a high amount of uptime. Thanks in advance for any replies. -John Westcott _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 26, 2007

PGP Key Signing Party

by Eric Martin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This upcoming meeting we are going to have a PGP Key Signing Party. For those of you who don't know what PGP is, allow me to briefly explain. This is all base off of the GPG Key Signing HOWTO (http://www.rubin.ch/pgp/kspa/gpg-party.en.html) which I suggest for further reading. Those who do know can feel free to skip down to the next paragraph. PGP stands for Pretty Good Privacy, and is a Public Key Infrastructure that allows us to communicate securely and deal with data in a secure fashion. There is a public key that one would typically upload to a server and a private key that you hold on to. With the private key you can decrypt / sign, and with the public key you can encrypt / verify emails and documents. Key signatures come into play when you validate that a specific key belongs to a specific person and extend the web of trust. Here's what needs to be done BEFORE the meeting on your computer, or on a secure terminal (e.g. not in a computer lab on your campus). I'll post directions both for GPG (Gnu Privacy Guard) and Kgpg (the KDE front - -end to gpg for all of those who like GUIs). 1. Generate a Key Pair / Verify your key won't expire soon gpg --gen-key (Default values of DSA/Elgamal is fine and the default of 2048 is good.) I recommend 3 - 5 years for a key lifespan (how long the key will be good for) 1a) for those of you wishing to use Kgpg, goto Keys -> Generate Key Pair and fill in the dialog box Once you create the New key pair, check the Save As box under _Revocation Certificate_ to save a Revocation Certificate (see 2) 1c) For those of you who already have a key, make sure yours isn't about to expire (like mine did). If it has expired, you can extend the life by $ gpg --edit-key <key-id> and typing expire at the command prompt next, generate a new key-pair and sign your new key with your old key so anyone who trusted your old one will trust the new one. 2) Generate a revocation certificate Revocation certificates are for situations where you forget your passphrase, the key becomes comprised, etc you can revoke your key. $ gpg --output revoke.asc --gen-revoke <key-id> Save this in multiple places, print a copy etc in case you need it. 2GUI) If you didn't create a revocation cert in Kgpg, just right click on your new key and select Revoke Key. when the box pops up only check Save As 3) Upload your key to the Designated server for this party (pgp.mit.edu) $ gpg --send-key --keyserver=pgp.mit.edu <key-id> 3GUI) Right Click on the Key, select Export Public Keys, select Default Key Server (make sure it's pgp.mit.edu under Settings) 4) Email me your key's fingerprint so I can add it to the list $ gpg --fingerprint <key-id> Copy and Paste that into an email to the coordinator (me, Eric Martin). 5) print out a copy of that same output and bring it to the meeting. I'll make up a check list and bring them to the meeting for everyone to use. Example output from Step 4: pub 1024D/A9413B9F 2007-04-09 [expires: 2010-04-08] Key fingerprint = D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F uid Eric J. Martin <eric.joshua.martin(a)gmail.com> uid Eric J. Martin <freak4uxxx(a)gmail.com> sub 2048g/01F81B8E 2007-04-09 [expires: 2010-04-08] my <key-id> is A9413B9F (which is always the same as my last 8 hex digits of my fingerprint). If like me you don't always remember your key-id you can use your email address and it will still work. My full key information is: Key ID: A9413B9F Key Type: DSA Hex Fingerprint: D1C4 086E DBB5 C18E 6FDA B215 6A25 7174 A941 3B9F Key Size: 1024 (The DSA key is always 1024 bits. The ElGamal Encryption key is 2048 bits in my case, but isn't needed for the keysigning party.) What you should bring to this party 1. Yourself, no exceptions 2. Two forms of positive photo ID - driver's license and passport are good 3. Key Id, Key Type, Hex Fingerprint and Key size info ***Please print out your own copy of your info to compare against mine when you arrive *** 4. Pen / Pencil What you Should Not Bring 1. Computer I want to thank Chuck Anderson for helping me out. If you have any questions please let me know. Eric -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGMBvKaiVxdKlBO58RAsCVAJ9cA488l+SybdxD+rgqNWGi/U9tUQCeMvH8 UAhMTFVRG5SbVVn5jqbVwqg= =BSzn -----END PGP SIGNATURE-----

April 26, 2007

I'd like to see Windows do this....

by Tal Cohen

Hi Folks, I recently ran across an interesting situation that I wanted to share this group. A customer of ours called us, letting us know that our server in their data center was beeping. We tried to ssh into the box, but kept getting connection refused. I asked the customer to hook up a monitor and keyboard to the box, and try a simple TTY. Sure enough, he was unable to log in. It turns out that the hard drive that holds the OS (Crux Linux) failed. Now, that in and of itself is not very interesting. What is interesting is that our software kept running even without the OS drive functioning. Our software resides on a separate drive. Since it was already loaded into memory and almost never needs to touch the OS drive, it just kept going.and going..and going.. Tal

April 25, 2007