Life Pattern » it

TLS SNI – almost there… or not?

zimage — Fri, 14 Aug 2009 20:14:48 +0000

As e-commerce is gaining momentum all over the world, so is the need of e-commerce platforms and infrastructure. For 2008 US eCommerce and Online Retail sales alone projected to reach $204 billion, an increase of 17 percent over 2007. And that’s not only the big players – more and more smaller brick and mortar shops open their on-line versions and many individuals are also selling their products or services on-line.

One very important aspect is the need for secure connection between sellers and prospective buyers. That’s were SSL/TLS come into play. The TLS protocol allows applications to communicate across Internet in a way designed to prevent eavesdropping, tampering, and message forgery. TLS provides endpoint authentication and communications confidentiality by using cryptography. If we talk about web that’s the https protocol.

With virtual web hosting, which is the most common type of shared hosting, one web server provides many domains through the same IP address and port. The server examines each request to determine which domain is being served by looking at HTTP request headers. Unfortunately, when the appropriate headers are received the server has already established the secure connection and cannot change to another SSL certificate.

So, SSL enabled virtual hosting isn’t exactly possible. Every SSL site need it’s own dedicated IP address. And there are quite a lot SSL sites out there lately, so quite a lot IP addresses are wasted.

An extension to TLS called Server Name Indication (SNI) addresses this issue. By sending the name of the virtual domain as part of the TLS negotiation it enables the server to “switch” to the correct virtual domain early and present the browser with correct SSL certificate.

The most popular web server software on the Internet, the apache web server, has had support for TLS SNI as external patch for some time (in combination with OpenSSL). It’s integrated since version 2.12 and recently even entered the Debian testing repository.

All major browsers have TLS SNI support as well, so we are almost there. Current versions of Firefox, Internet Explorer, Opera, Google Chrome, Safari do support TLS SNI. Or… wait… Internet Explorer for Windows XP doesn’t support it? Yeah, that’s right. Seems we are out of luck, because despite Microsoft releasing Vista and Windows 7, the now eight years old Windows XP is still the most popular desktop operating system on the planet.

Virtual Private Servers

IO performance monitoring

zimage — Sat, 11 Apr 2009 12:08:21 +0000

If you can measure it, you can manage it. I’m a measurement, monitoring, analysis and statistics addict

That’s why I’ve always wanted to be able to monitor the IO load of the Linux systems I’ve worked with. While there are well established monitoring and accounting tools for the CPU usage – both system wide and per process – there were virtually none for the IO system until very recently.

Two of the more important reasons why I’d like to see better IO load monitoring are:

The mechanical drives have big latency. In general the CPU feels much better than the disks when overloaded. For example if load average 10 is caused by CPU bound processes the system feels much more responsive than the same load but caused by IO bond processes. CPU load average 10 on a server system with two processors isn’t very noticeable. At the same time IO load average of 10 on the same system with 2x 7200 rpm disk drives in RAID1 feels very sluggish.
The hard disk drives failed to keep up with the performance improvements in microprocessor technologies. Disk capacity has grown quite well, but the speed and especially access times are far behind. The IO performance is the most common bottleneck and most precious resource in today’s systems. Or at least the systems I work with

At the beginning of my Linux career, ten years ago, there was only one metric – blocks read/written. And that’s it. How busy the disk is you can guess only by looking at load average and checking how many processes are stuck in D state. I wish there are separate load average readings for CPU and IO…

At some point (linux 2.5 times?) extended statistics were added and things like queue size, utilization in % etc. became available. Much better. Still it was hard to tell who exactly is causing the load. If we speak of multi user system all you can see is multiple processes in D state. It’s unclear whether these are the ones causing the IO havoc or just victims of the already overloaded IO subsystem waiting.

In Linux 2.6.20 another step was made by adding per process IO accounting. I was very excited when I heard about this feature and eager to try it. It turned out that this per process IO accounting counts only the bytes read/written by a process. Not that better. A modern 7200 rpm SATA drive is only capable of about 90 IOPS so it could be choked with the pathetic 90 bytes per second…

Then there are the atop patches. These add per process IO occupation percentage. That sounds great but… when you have a lot of small random writes they go to the page cache first and only then are periodically flushed to the physical device. This is performance feature and is generally a (very) good thing as it allows the elevators to group writes together etc. Unfortunately, atop ends up accounting all these writes and IO utilization to pdflush and kjournald.

Ok, lets see what’s the state of the affairs in some other operating system. Everybody talks about dtrace so it’s time to check it out. Linux doesn’t have dtrace. At least yet. There is work in progress by Paul Fox. On the other hand Linux has system tap but it doesn’t look very mature to me. Anyway, there are number of operating systems that support dtrace: as it is create by Sun engineers first come Solaris and OpenSolaris. Then there is the FreeBSD port and Apple OS X. I’m familiar with FreeBSD but I wanted to check the current state of OpenSolaris kernel. On the other hand I wanted to keep the learning curve less sloppy, so I opted for Nexenta core 2 rc1. Nexenta is GNU userspace (Debian/Ubuntu) and OpenSolaris kernel.

Download, install – everything was smooth. The install defaulted to root fs on ZFS. Good! I was thinking about playing with ZFS these days anyway.

And the moment of truth:

I started dbench -S 1, run dtrace -s iotop.d and here’s the output:

  UID    PID   PPID CMD              DEVICE  MAJ MIN D   %I/O
    0      0      0 sched            cmdk0   102   0 W     17

Hm, that looks somewhat familiar. I see a pattern there. Isn’t sched the ZFS cousin of pdflush/kjournald? Oh, well it is: http://opensolaris.org/jive/thread.jspa?threadID=39545&tstart=285

No luck… dtrace’s iotop works with UFS but has problem with ZFS.

Turns out the proper IO monitoring is a very tricky business.

MySQL Usage Accounting

The Internet Tablet Revolution

zimage — Wed, 31 Dec 2008 16:55:00 +0000

Since the introduction of the first Palm devices back in 1997 I was tracking the evolution of pocket computers with great interest. However, for a very long time I couldn’t find the combination of factors that would make me buy one. The first device I seriously considered was N770 from Nokia. It was breakthrough in many ways but still quite limited in it’s memory and processing speed. I kept an eye on its development and when Nokia released it’s successor N800 I was sold. I bought one and used it for about 9 months when N810 was released. I immediately upgraded. I wear my N810 wherever I go for more than a year now and I’m very satisfied.

Some of the reasons I didn’t like any of the previous generations of PDA were their small screens, the use of closed operating systems or their high price tag. So the main advantages of N810 over it’s rivals at least for me are:

Superior display than most of the PDAs. 4.1″ is very good and balanced size. Any bigger and it won’t fit in your pocket. Superb 800×480 screen resolution – you can’t go better for a display of this size. And due to the fact this display is transflective it’s readable even in bright daylight.

N810 is more mobile than the netbooks, which are gaining popularity recently. It’s smaller and lighter and it fits in your pocket or in a lather sleeve like this one. Better mobility is also aided by the very good battery life. I use mine to read while commuting, some internet browsing and I might turn on the gps once in a while. That’s about 1.5 hrs daily and I keep it in off-line suspended mode (but instant on – less than a second) for the rest of the time. Its battery lasts about 5 days between recharges with this usage pattern.

N810 runs an open source, linux based OS and application stack designed for use with touchscreens. Openness, flexibility, best of breed package management (debian’s apt). Want maemo mapper + openstreetmap, xterm + openssh, Doom or other popular application? No problem – check out http://maemo.org/downloads/OS2008/. Not strictly related but it’s browser is gecko based (that’s mozilla & firefox engine) and has flash support. Some of the greatest apps for N810 are written by the community.

N810 has built-in gps and comes with Wayfinder pre-installed. If you want turn by turn navigation you’ll have to pay a modest subscription fee to use this option. maemo mapper is a free mapping and navigation alternative. maemo mapper’s routing capabilities are not as extensive and route recalculation needs an Internet connection but it’s very good app nevertheless. Go try it. There’s also navit – a very promising navigation app in the making. This gps led us trough most of the southern Spain few months ago.

As expected for an Internet Tablet N810 has bluetooth and wifi. No device is useful without good connectivity options in this day and age. Hook it to the nearest WiFi hotspot or your 3g enabled bluetooth phone. And it’s WiFi is among the best I’ve used – very good range and compatibility with hot spots around the world.

One of the great surprises was the quality of the built-in qwerty keyboard. I didn’t expected nearly as comfortable typing. Sometimes I have this feeling that I didn’t hit the right key but when I look at the screen it’s all correct. Very good job, Nokia.

Another surprise was the amazing sound for a device this small. It actually sounds better than my ThinkPad X41. It’s last.fm player, vagalume, is killer app. Use it like a portable personalized radio.

There are built-in camera and mic as well. Combined with the pre-loaded software like jabber client with voice and video support (and gtalk), gizmo and skype it’s the ultimate communicator.

It’s light sensor is very handy. Based on the current light conditions the display brightness is adjusted to save power and make work with the tablet more comfortable.

And last but not least the price: it was first released at $450 and is currently (Dec 2008) being sold for about $335 in various on-line stores.

What’s next? There are quite a lot people that prefer their internet tablet to have some built-in long range connectivity options in addition to WiFi like GPRS, 3G or WiMAX. Nokia responded to this demand with N810 WiMAX edition. I personally am completely satisfied with 3G via bluetooth phone.

But what’s more interesting is the upcoming fourth generation internet tablet (N900?). Rumours are that it will be OMAP3 based, will have built-in HSPA connectivity, high definition camera and hardware based graphics acceleration. Recently nokia released the Maemo 5 SDK which is targeted at this future device’s developers.

I’m glad someone (Nokia) finally has taken this technological way. I hope they continue evolving the internet tablet series in the same way and spirit. Can’t wait to see what N9xx will look like…

No related posts.

MySQL Usage Accounting

zimage — Fri, 05 Sep 2008 08:00:54 +0000

Those of you who use MySQL in a multi-user environment are probably disappointed by it’s lack of per user usage statistics. For example in Linux there are BSD process accounting for CPU usage and IO accounting for disk usage tracking. Most applications like apache, ftp servers and mail servers provide some sort of usage statistics as well. But MySQL is the great anonymizer.

Not anymore, thanks to the people at Percona for their microslow patch and Google for the UserTableMonitoring patch.

Latest version of the patches can be found here but at the time of this writing they are against MySQL 5.0.62 and the current MySQL version is 5.0.67. So I tweaked the patches to apply cleanly to MySQL 5.0.67 and placed them for download: microslow, userstats, microslow+userstats.

IO performance monitoring

Virtual Private Servers

zimage — Sat, 23 Aug 2008 07:59:23 +0000

A year ago I decided it’s about time to get a Virtual Private Server for my pet projects. Prior to that I had 2 sites on a shared hosting server and some other non-web network related apps spread around workstations that are always on. But at some point it all started to get messy and moreover I needed to put a few more things online. So I decided to get a VPS and consolidate all of my projects in one place. Compared to shared hosting environment the VPS gives me more freedom and fine grained control over the exact versions of applications and libraries I use among other things. It requires more work on my part though.

The fact that I have 10 years of experience working as a (unix) systems and network administrator is very handy when it comes to installing, configuring and troubleshooting the software I use on my VPS. Unfortunately it doesn’t help that much with the selections process so I had to sit down and filter the myriad of VPS providers out there.

I dug through blogs & forums, asked friends. Web Hosting Talk forums were particularly useful. Finally I have chosen Future Hosting. It turned out to be a good choice indeed. I’m with them for almost a year already and there weren’t any major issues. I asked for PTR RRs (that’s reverse resolving from IP to hostname) and their support staff quickly added these for me.

However good a hosting provider is you must keep a backup of your own. I was rather passively looking for second VPS provider for some time. One day I saw (can’t remember where) a Comfy Host’s ad. It looked suspiciously cheap at $10/mo to me and I haven’t heard anything about them before. But this was supposed to be a backup VPS so I decided to give it a try. I placed my order with Comfy Host using my PayPal account and started waiting for a welcome email. One day later I received an email saying that due to the surplus of orders my VPS setup will be delayed a little bit. Ok it happens. Few days later I had to submit a support ticket to ask what’s going on with my account. After some more back and forth support tickets I got my VPS up and running.

I used it for three months and it was pretty stable. I used it only for my automated daily backup and monitored it with nagios. Then one day suddenly the monitoring lost connection with the VPS. Since it is a backup server and I was busy with other things I let it stay this way for a week. Finally I logged into the control panel and guess what… I was paying on a monthly basis after receiving an invoice from Comfy Host. Last month I didn’t receive an invoice. And I couldn’t pay either because according to the control panel I didn’t owe money despite being late with the payment. Hm… I submitted a ticket to ask why is that. I had to wait several days for a reply that read:

“Sorry about the late reply. The ticket seems to have been overlooked without a response. We received no payment and therefore your VPS was shut off.”

Enough. I went looking for another backup VPS. I remembered that Leo from Zen Habits once said he is satisfied with his current provider – namely slicehost.com. So I’m with slicehost.com as my backup VPS for about a month now. So far so good.

TLS SNI – almost there… or not?

Family’s IT Consultant: The Computer Display

zimage — Tue, 17 Jun 2008 10:08:44 +0000

In today’s world of technological wonders few of us wouldn’t welcome some guidance. And since my friends and relatives know I work with computers they often ask me to help solve various issues and help them choose their new electronic devices. Actually it might have been worse… not that I’m not helpful guy (I am friendly) but I’m not the most communicative person out there so they don’t bother me as much as they might probably wanted to. On the other hand quite a lot of my friends are IT experts

Anyway, my little niece Teda will be starting school this fall. She already has a room of her own, her parents are buying her textbooks and other school aids and finally a computer. We decided to use an older computer to keep the cost down and invest instead in a good display.

The computers I work with are quite specific and I had to brush up a little bit my knowledge of general purpose desktop systems. For example my personal computer is a 3 years old IBM ThinkPad X41 (12″ screen) and I’m totally satisfied with it’s performance and features. The rest are servers with 8 or more hard drives and 8 CPU cores each.

We decided to go for a 19″ or 20″ wide screen TFT LCD display but also weren’t willing to pay more than 450 leva (~$350). First things first and I went for learning more about various types of current TFT technologies on the market. I almost instantly ruled out TN displays and focused on MVA panels since IPS wouldn’t fit in our price range. Most of the MVA panels are more pricey than we liked but finally I spotted an Asus PW201 that according to the manufacturer’s specifications was built with a P-MVA panel and also its price has recently dropped from about 700 leva to 449 leva.

This price drop seemed suspicious to me so I called the shop to make sure that this particular model and batch is P-MVA and not TN. After they assured me several times that this is a P-MVA panel (they called their warehouse) I proceeded to order but still suspicious I wrote in the order’s comment field: “If you are not sure whether this monitor is of P-MVA type please cancel the order”.

Finally the display arrived. I paid to the delivery guy and opened the box. Oh boy, this thing looks splendid. Very stylish. It has integrated stereo speakers although expectedly the sound quality is mediocre. The integrated USB hub is very convenient because you don’t need to crawl under the desk in order to plug USB devices. Audio, USB and VGA cables run together so despite using DVI for video you’ll have to use the VGA cable as well. The buttons on the front are actually small touch sensitive areas and react somewhat erratically. My overall impressions about PW201 are very good. It is definitely worth its price.

I intended to install Kubuntu 8.04 (Hardy Heron) so I hooked up monitor’s DVI port to the PC, attached the keyboard and… suddenly realised I don’t have an optical drive on this PC. Okay let’s try network install I followed the instructions listed at http://wiki.koeln.ccc.de/index.php/Ubuntu_PXE_Install but since I wanted to install Kubuntu I opted for “console only” installation in the Ubuntu installer. After the installation had finished I installed the rest of the Kubuntu with:

sudo apt-get install kubuntu-desktop

So far so good. The X server detected the Nvidia GeForce4 MX 440 graphics adapter and used nv to drive it. It properly detected the monitor’s properties and started in the panel’s native resolution of 1680×1050. Unfortunately the nv opnesource driver lacks 3D acceleration (because Nvidia refuses to provide the hardware specifications needed to add 3D support) and this is where I spent 3 hours trying to get the proprietary nvidia driver to work properly with my setup. Most of the time was spent trying to set it up to use 1680×1050 but nvidia driver kept thinking that PW201 has maximum pixel clock of 135 MHz when it’s actually 146 MHz. Finally I found this set of options working for me:

Section “Device”
Identifier “GeForce4 MX 440 with AGP8X”
Driver “nvidia”
Option “ExactModeTimingsDVI” “true”
Option “NoBandWidthTest” “true”
Option “ModeValidation” “NoDFPNativeResolutionCheck, NoEdidMaxPClkCheck, NoMaxPClkCheck”
EndSection

This did the trick but after only few minutes of playing video with mplayer and Xv (Xvideo) output driver the video window started to show only colorful noise. Tried OpenGL output driver and worked better but used 95% of the CPU vs. 55% for Xv (that’s AMD Athlon XP 1800+). Moreover after half an hour video artefacts started to appear all over the screen and I reverted to the “nv” driver.

I don’t know whether this is a software/driver problem or maybe the graphics adapter is having some issues but since it works with the nv driver (and my niece doesn’t need 3D acceleration) I’ll stick with it for now.

No related posts.