Using this post to keep some notes on a few things I did to my XenServer instance,  most of this is just common sense.

Disable root login via SSH

First things first, make sure you add a user on the Xenserver box.  This is the user you will allow to login via SSH (if you have SSH running at all).

Edit the sshd_config, and find the text #PermitRootLogin yes and change it to:

PermitRootLogin no

Right below that add a new line, and replace USERNAME with the username you created.

AllowUsers USERNAME

If you have more then one user that you want to add just put a space between them and add them in succession.  Example:

AllowUsers john harry bob

Then go ahead and restart sshd:

/etc/init.d/sshd restart

Open up a new terminal session and make sure you can login to the server under your new user, and you should be good to go!

Edit the web page that XenServer shows or limit access completely

Xenserver by default serves up a web page that gives your links to download the Xen Center admin console… The web server also servers up the XAPI that is needed for the admin console to access the server remotely. So you have a few options, edit the index.html page to remove the data on there and serve up a blank page.  Or the better option is to restrict access completely to the XAPI via the hosts file.  And the best option is to toss the Xenserver behind a firewall (hardware or software).  Perhaps I’ll go into detail on how to do that in a future post, but in short, firewall the entire server and tunnel in via SSH, which would be the most secure avenue. The only downside to restricting access via a firewall or restricting access via the hosts file is that if you are not at home / work / at a PC where you have access to the restrictions in place your, out of luck on getting access to your server.   Now keep in mind, there are alternatives for access (port knocking, ssh via another server or VM, etc)  I could go on forever, but everyones situation is different. With that said, lets go over the first two options.

To prevent XenServer from showing the default index.html page, you can either edit the actual file and change it to your liking. The file is located here:

/opt/xensource/www/index.html

For the second option, you can reference the Citrix support document here for detailed information on modifying the hosts file http://support.citrix.com/article/CTX118504, however below is essentially what you need to do.

First edit the hosts.deny file located here: /etc/hosts.deny and enter in: xapi:ALL – What this does is restrict every IP from accessing the XAPI.  Second, you’ll need to edit the hosts.allow file, which takes precedence over the hosts.deny and specify the ip adresses or range of ip addresses that you would like to allow access to the XAPI.  The hosts.allow file is located /etc/hosts.allow

Allow access to a specific ip in the hosts.allow you would put in the following replacing IPADDRESS with the ip you would like to grant access:

xapi:IPADDRESS

Example:

xapi:24.22.12.222

To allow access to a group of ip addresses, for our example, lets use 24.22. – this would allow any ip address that begins with 24.22. to access the XAPI.

Example:

xapi: 24.22.

If you happen to come across this page, what do you do to lock down your XenServer installs?  I’ll be writing a few more articles as I dive deeper into Xen and XenServer, so be sure to check back often.

Figured I’d share a few of my notes from firing up a XenServer instance…  I went through lot of research before deciding to go with XenServer versus just firing up Xen on Debian, but thats for another post. The main reason I setup this server was to move off of Linode because I was at the point where it just made sense cost wise, essentially I have a more powerful server for way less money.  Granted, you do loose some of the conveniences of Linode  (simple management/upgrade/backup).  Anyways, onto XenServer…

When using the free edition of XenServer 6.0, you’ll want to do a few things such as enabling Auto Start / Auto Boot / Auto Power On.  For some reason this feature was removed from the “Free” version in 6.0, so lets go ahead and set this up.

First your going to want to get the UUID of the VM’s you wish to enable auto start on as well as the UUID of the pool these VM’s reside in.

To get the list of the pool’s on your XenServer type:

xe pool-list

Copy the UUID of the pool, in my case there ist just one pool. Then issue the following command, and replace the UUID with your pools UUID.

xe pool-param-set uuid=UUID other-config:auto_poweron=true

Then, at the command prompt of your XenServer type:

xe vm-list

You should get a full list of the VM’s on the server, along with their name and UUID. Copy the UUID of the VM you wish to enable autostart then issue the command below, again replacing the UUID with the UUID of the VM you wish to auto start.

xe vm-param-set uuid=UUID other-config:auto_poweron=true

And thats it, the next time you ever need to power cycle your main server, the Xen instances should power up automatically.

I’ll be adding a few more articles over the next few weeks of some other notes and tips.  Next up is adding some monitoring to your main XenServer to see whats going on with your different instances.

I finished up the main detailing to get rid of all the oxidation.  I started to work on some of the corroded wiring and other problems. I had a really hard time getting off some of the body screws because they were so rusted.

All cleaned up:

Bus connector fix (common problem on 2005 and 2006 Kawasaki Brute Force 750′s)

Took the wires out of this plug, stripped then soldered.

Then taped them up nice and secure…

After 10 months of looking I finally found the ATV deal I was looking for.  A 2005 Kawasaki Brute Force 750.  It has 33 hours on the clock ~170 miles, its basically brand new.  I spend about 8 hours today detailing the quad, it was pretty oxidated from sitting outside. I used a oxidation remover and then wax on the whole ATV.  Its coming out pretty good. I took off the racks and starting spray painting some of the rusted bolts and parts with Rustoleum.  The plow needs to be reconditioned as well, I’ll probably strip that down to bear metal with the wizzer next week.  Here are some pics:

My “spray booth”

Here are some pics from a few weeks ago when she was all cleaned up.   The stang looks a lot better via photos then in person, but hey… What do you expect for 23+ year old paint?!?! Other pics are for the new switch console I added to the ashtray.  These switches control my Fan, Shift Light, and gauges.   Heading to Englishtown,NJ this weekend for the big Muscle Mustang & Fast Fords Event.  More info on the event here: http://www.etownraceway.com/schedule/fords.aspx It should be fun!

Some pics of the control panel installed in the ashtray, sorry crappy pics, took it with my iPhone.

Just a frustrated consumer…  Avoid http://broadvoice.com at all costs.  I was a customer of theirs for over 4 years, pretty much from when they launched.   I think their service as a VoIP company (Not their customer service) was average.  I had a few issues along the way with their sip servers going down but it was really minimal.   The voice quality was OK, their web interface is is complete, their phone support is moderate at best.   Soo….  4 years later, time to move on to my triple play with Cablevision.  I have a $99.00 a month deal for Cable, Internet, and Phone service.  I think great! Save cash, move the phone number over, done deal.

Ahhh, but wait.  “Broadvoice” is not a phone company (this is the crap they fed to me) .  They will NOT release their number to you if you try to port it OUT.   Yet, they’d gladly port your number in.   While I did NOT agree or sign to these “TERMS” when I first became a customer, yet they magically apply to me.

So now I am stuck moving my home phone to a new number, dumping Broadvoice because they will not transfer my number which will end up in a class action lawsuit sooner or later.  Maybe its me, but I just think that’s shady business practice. They are trying to retain customers by holding your number hostage. This is one time where I think the government needs to step in….

If you provide phone service, 911 service, etc, your a damn phone company in my book.

I hope if you have learned anything from this, its stay away from Broadvoice.  I cain’t even imagine if you have your business lines ported over. Imagine not being able to keep your business number because they would not release it to you?  Seriously think twice before signing up for Broadvoice or any phone company before getting a SIGNED contract that states that you can port your number out when you leave.  Thank god that my business number is not with Broadvoice (I just use their service for outgoing sip on that line, as well as my customers accounts).  I’ll be moving them away from them as well as 4 of my family members as result of this.

Have a good Holiday all!

2008 Live Election Results Map – Mouse over and or click the state…

Obama won, hope he does the right thing.

Here are some before, during and after shots of the landscaping. We did a simple design for the front, and are planning on adding another layer or two of the brick to finish it off. We just did one layer so we could put the initial mulch down and that is all that would fit in my truck.

Everything seems to be growing pretty good, the grass has some bare spots and I’ll address those in the spring. Hopefully some of those weeds will go away with the next weed and feed session. Next up is to do a fence along the side and back (behind the new arborvitaes we planted). Waiting for that tax refund!

Front Before

Front After

Another Shot of the front – An in progress photo

Another two shots of the front – All done – And sidewalk / walkway is power washed now!

The Backyard

Before:

In Progress (All cleaned up and seeded)

After – John Power washed neighbors fence too

Two more backyard shots

Well,  this isn’t a normal “house update”.  The house was updated, but with a few thousand pound branch that crushed my truck, scratched Chrissy’s car, and took off my brand new gutters.  Below are some pictures, it happened at about 10:45pm (about an hour and 1/2 ago) on 3/8/2008.  I reported 3 claims (yes three) to Allstate.  They made me do one claim per car, then one for the house.  I’ve herd some horror stories in the past with claims of this nature with Allstate, lets just hope they handle everything correctly.

I do have a question for everyone, this was a branch from my neighbors tree.  What do I do? Who’s responsible for the tree cleanup and all of the other expenses?

Sideshow here:  http://www.flickr.com/photos/burmjohn/sets/72157604073525656/show/

All pictures here: http://www.flickr.com/photos/burmjohn/sets/72157604073525656/ 

Yes, the tree is IN my car!

Roof is crushed in, windows smashed, quarter panel is smashed….

Wifes car has a lot of scratches and missing a side mirror now…

Thats one big branch!

I had to post this, especially for all the techies…

“see the thing is, uptime is only as good a downtime. you NEED downtime to get uptime.  Uptime wouldnt mean anything without downtime. Appreciate the downtime, its priceless.

 – John