Author: Michael Lucas

Writer. Sysadmin. Owns this site.
Posted on

Truth versus Art

There’s been a slow-burning furor over dishonesty in “creative nonfiction,” most recently in this Fact vs. Artistic License in Creative Nonfiction post. Now and then someone accuses me of making stuff up in my books. For the record, here’s the truth.

I lie. I make stuff up all the time. But not technical stuff.

One technique I use in each tech book is to create a narrator. The narrator is not me. I don’t actually blackmail coworkers, as the narrator of Network Flow Analysis recommends. The narrator’s role is to bring life to the material, point out possibilities that are difficult to expose in pure technical text, and try to jolt the reader into paying attention.

I don’t create the narrators beforehand. They evolve from the material. The narrator of AO2e is worryingly like forensic blood spatter analyst Dexter Morgan. I’m trying to change that, but he’s fighting back.

Of course, some things are true. The afterword for Absolute OpenBSD 2nd ed. is the true story of a really bad night. But I don’t have enough of those stories to color a book.

This technique works. It helps the reader pay attention. Some people even find reading my books enjoyable (for example, there’s this review that made me giggle madly). There are readers who hate my books for exactly this reason. But I’m not going to change my writing style to chase a readership.

If I’m giving instructions on how to fdisk and disklabel a hard drive, the information is as correct as I can make it. Facts are inviolate.

If it’s more personal, it might be true. It might be fictional. I am a writer, and am not to be trusted.

So don’t try to call me out on this. I know. I don’t care.

Posted on

Death of a Web Server

My first day at BSDCan, my Web sites died. Hard drive failure. The latest backups are defective. I think I’ve recovered the blog, but some links have changed, dang it. I’ll have to learn more about mod_rewrite to fix them. Web site is next. RSS readers will see some repeats, sorry.

Other than that, BSDCan was awesome. As usual. In fact, it was just awesome as expected. So it was kind of routine. But still awesome.

Posted on

50% off sale on my No Starch ebooks through O’Reilly, 4th May only

Yep, Cisco Routers for the Desperate and Absolute FreeBSD are 50% off when you buy through No Starch Press’s O’Reilly distributor.

And other books. By other authors. Most of whom are more awesome than I am, so I’m not going to mention any names. Like Peter Hansteen. Or Joe Kong. Or Tom Limoncelli. Or Chris Sanders. Because they sure don’t need the press.

This is part of the EFF’s Day Against DRM. Use the code DRMFREE to get 50% off ebooks via O’Reilly.

Go to the O’Reilly site for all the details.

For the record, my tech books are all DRM-free. (I have one short story with DRM on Amazon. It was the first story I put up. Amazon doesn’t allow you to change your DRM choice without removing and republishing the title. And I have two good reviews on that story, which I would lose if I did so. So I’m stuck. But you can get that story DRM-free on other sites.)

And how do I feel about doing this as part of a “GNU promotion”? Despite what a lot of people think, I have no objections to the GPL. I think it’s morally inferior to the BSD license. Sharing with the condition that people share back is generous. A pure gift is even better, however.

Posted on

Debugging RANCID

I’m a big fan of RANCID for managing configurations for embedded devices, such as most routers and switches. While you can go buy CiscoWorks, OpenView, or any number of proprietary products, RANCID is good enough for the overwhelming majority of us. (Those products do have other advantages, but simple configuration revision control isn’t one of them.)

For those who haven’t used RANCID: it logs into your devices every hour, gets the device configuration, and compares it to the stored configuration. If the configuration has changed, RANCID checks the new version into CVS. Combined with CVSWeb, RANCID really simplifies embedded device management.

Every now and then it breaks, however. Last week, I started getting an email every hour, whining that RANCID couldn’t get the configuration of one of my Mikrotik border routers. I hadn’t changed the router configuration in several days. My cow-orkers claimed they hadn’t touched the router.

So, let’s see what RANCID is having trouble with.

Log into the RANCID server, and su – to your RANCID account. Use clogin(1) to log into the device.

%clogin edge-1
edge-1
spawn ssh -c 3des -x -l admin+ct edge-1
admin+ct@edge-1.lodden.com's password:
...

[admin@edge-1] >

So, I can log in.

The main command to get a Mikrotik configuration is export. I run the command. It completes, but takes a few minutes. Not really a shock — this device has several full BGP feeds on IPv4 and IPv6, packet filtering, traffic shaping, and folds my socks in its spare time.

So, it’s not the obvious problem; the router can export its config, and RANCID can log into the router.

So, run RANCID for the group that includes the trouble router.

%rancid-run mikrotik

%

No error messages, but let’s check the log. It’s full of messages like this:

...
Trying to get all of the configs.
edge-1: End of run not found
Error: TIMEOUT reached
=====================================
...

Well, that’s not good. Let’s try running a single command on the router, setting the timeout to the usual 90 seconds.

%clogin -t 90 -c "export;quit" edge-1
edge-1
spawn ssh -c 3des -x -l admin+ct edge-1
admin+ct@edge-1.lodden.com's password:
...
/ipv6 nd prefix default
set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d

Error: TIMEOUT reached
%

So, the export takes longer to run than RANCID’s default timeout. How long does it need? Run RANCID under time(1) to find out. Add -t 1000 to set the timeout to 1000 seconds.

% time clogin -t 1000 -c “export;quit” edge-1

Walk away. Eventually, come back to look at it.

...
set accounting=yes default-group=read exclude-groups="" interim-update=0s \
use-radius=no
[admin@edge-1] > quit
interrupted
Connection to edge-1.lodden.com closed.

Error: EOF received
0.102u 0.094s 2:57.84 0.1% 87+948k 0+0io 0pf+0w

This export took almost three minutes, or 180 seconds. Twice the default timeout. Ick.

Now we have to tell RANCID to use a different timeout. I didn’t find anything in the manual pages, so I asked on the rancid-discuss mailing list. John Heasley quickly answered. It seems that the timeout option in .cloginrc should cover this, but that the feature is missing from the Mikrotik login script. He included a patch. I applied the patch and added

add password edge-1 blahblah
add user edge-1 admin+ct
add method edge-1 ssh
add noenable edge-1 {1}
add timeout edge-1 500

I then re-run RANCID. It completes silently. I can’t be sure that the change actually works until I see RANCID check in a change. I logged into the router, corrected a typo in the login message, and tried again. This time, changes appeared in CVS and I received my email. So I can conclude the patch works.

The most important thing to do in all of this, though? Close the loop with John Heasley. Verify the patch works, so others can benefit from my annoyance.

On a related note, RANCID is one of those tools that gets less attention than it deserves. I’m pondering writing a short book about it, rather like SSH Mastery. Would anyone actually be interested, however?

Posted on

And now for something completely different…

Last August a friend of mine, Colin Harvey, died of a sudden unexpected stroke. He was in my fiction critique group, and we spend several years bashing each other’s efforts. He made it as a novelist, with two books to his credit. I haven’t reached that. Yet.

Today, I learned that one of his stories had been filmed.

The funny thing is, this film is based on a challenge he set in the critique group, based on random overheard phrases provided by group members. Every story had to incorporate all of the phrases, intact and unedited. My phrase was about truth. It’s changed in the film, but the new line is also about truth. So, this film has my shadow in it, in a vague and indirect way.

Posted on

Absolute OpenBSD reviewers

Lots of people have offered to tech review the second edition of Absolute OpenBSD before it goes to print. Peter Hansteen is doing the final tech edit, but I still need a reality check before it goes to him.

Henning Brauer has offered to do this for me. He’s reviewed a few chapters already, and he’s caught a vast array of my inadequacies. I’ve decided to rely on Henning for fact-checking, rather than my usual volunteer community review process.

This will probably disappoint those of you who really wanted to volunteer. I appreciate you more than words can say. But the community review process is the single biggest time consumer of my time in book production outside of actual testing. Henning certainly knows OpenBSD, is more than capable of catching my errors, and is highly motivated to have the book be accurate. (Or, if you prefer, he’d rather not have some doofus author misrepresent his hard work. I’m good either way.)

I’m highly confident in their ability to point out every single mistake I make. If I make an error and both Henning and Peter miss it, well, then, apparently it was meant to be that way.

Posted on

Configuring OpenBSD to use RADIUS auth

I have a love-hate relationship with RADIUS. RADIUS is the cheap white glue of authentication. Just about everything speaks it, so you can use it as cheap glue to unify passwords across your gear. But it’s a finicky protocol, with lots of edge cases, and those edges can be SHARP.

Okay, perhaps it’s more of a tolerate-hate relationship. But still.

OpenBSD supports using RADIUS to authenticate user accounts. Why would you possibly want to do this? For one thing, if you’re using authpf, it gives you a way to easily synchronize firewall passwords with your Windows domain through the Microsoft Internet Authentication Service. It’s not ideal — ideal would be making all of your users use public key auth — but it’s better than nothing, reduces your support workload, and helps convince management that your firewall is a real solution.

I’m assuming you already have a RADIUS server. Mine is freeRADIUS-2.1.12, but any basic RADIUS server will work.

OpenBSD uses BSD authentication, a competitor to PAM. The RADIUS auth process is documented in login_radius(8), but I’ll walk through the basics.

Configure your RADIUS server to allow access from your OpenBSD box, and assign it a shared secret. My RADIUS server is 192.0.2.2, and my secret is the string Insubordinate. (It’s a lousy secret, but it’s just an example, and I’m tired.)

Create a directory for the server list, and set the permissions as per the man page.

# mkdir /etc/raddb
# chgrp _radius /etc/raddb/
# chmod 755 /etc/raddb/

Create the file /etc/raddb/servers. List each server, and its secret, on its own line.

192.0.2.2 Insubordinate

Now switch your default authentication scheme in login.conf.

#auth-defaults:auth=passwd,skey:
auth-defaults:\
        :auth=radius:\
        :radius-port=1812:\
        :radius-server=192.0.2.2:

The change should take effect immediately. Be sure you have a window logged in as root beforehand, so you can switch back if necessary. If you have trouble, check your RADIUS server’s debugging log, or use a packet sniffer to examine the actual RADIUS dialog.

Your host will now check every password against the RADIUS server. That includes root. You probably want to set up an auth-su class, or only have the authpf class use RADIUS, or some combination thereof. I really recommend requiring anyone who can get an actual shell to log in with public key authentication.

And for those who care, you now know exactly what part of Absolute OpenBSD I’m writing.

Posted on

The Purpose of Tech Books

I just got asked one too many times, “What’s in this book that’s not in the man pages?” And I’ve snapped.

I’m blogging my answer, so I can point here and save myself from typing the answer again.

I’m best known for writing about BSD technologies, a field where the developers are notoriously detailed in their documentation. If you look at the man pages for any open-source BSD, you’ll see that everything is included. If something is missing, it’s a bug. In addition there are extensive, lovingly-maintained FAQs and community-supported handbooks. How could I possibly add anything to than knowledge?

The short answer is: integration and context.

The man pages almost certainly contain everything you want to know. But man pages are not examples. Man pages do not provide context for the use of that knowledge. The ability to read disparate manuals and assemble that knowledge into a working, cohesive whole is a very specific skill. Programmers, in particular programmers who learn new technologies, have that skill. Many systems administrators develop that skill, after years of practice.

Some people can take a whole pile of man pages, assimilate their contents, integrate that knowledge together, and create a holistic understanding of the field they cover. They can extrapolate from documents into use cases, and reverse-extrapolate from actual uses into configuration. If you are one of these people, I have two things to say to you:

1) You do not need my books.
2) You are smarter than me.
3) By attempting to convince me of things I already know, you are wasting your own time.

I also concede that many technology books are nothing more than recitals of man pages. Others are nothing more than collections of screenshots, saying “click the Next box” four hundred times. These books are a waste of electrons and wood pulp. I blame them for dragging down the reputation of technology writing. (I also writhe in envy because these books sell far, far better than mine. But that’s a separate issue)

Good technology writing provides context for the information, and guides the reader to create a holistic understanding. Yes, some people can do that purely by reading man pages. Others need help.

Why should I write a book that competes directly with, say, the FreeBSD Handbook or the OpenBSD FAQ? Not everybody learns in the same way. Discussing the same facts in different language, with a different organization, makes the knowledge take a different path through the reader’s mind. The reader’s job is to use new information to make new connections in their brain, and seeing the same information presented very differently can help.

On a personal level, I do my best to make the job of getting that information easy, and present the reader with a whole bunch of ready-made connections.

If you want me to listen to your proclamation of superiority, I have to say: put your money where your mouth is. Donate the list price of one of my books to an open-source project that I write about. If you feel the uncontrollable need to advertise your superiority, write “That Moron Lucas Is Wasting His Time” in the note field. Copy me on the emailed receipt. At that time I will pay attention to you, in direct proportion to the size of the donation. I won’t change what I do, mind you — I probably won’t even answer the email — but I’ll pay attention to you. And I promise you, the recipient project won’t mind.

Update 5/2/2013: With the OpenBSD book coming out, I’m getting more of these. What really amuses me is that people think it’s important that I know the book is not useful.

Posted on

February “SSH Mastery” sales numbers and expenses

I promised several authors results of my private label publishing experiment. I now have sales numbers from February from Amazon, B&N, Smashwords, and CreateSpace. Just like the January post, this comes with some caveats:

  • This includes only SSH Mastery. I have removed my fiction from the totals. Again, fiction sales are considerably lower, but growing.
  • This excludes the 200 copies bought at cost by the OpenBSD/OpenSSH team for fundraising, and the 40 review copies I ordered.
  • I’m not going to regularly report sales numbers to the general public. I will say when I break even.

    Without further ado, here’s the numbers:

  • Amazon Kindle: 163 ebooks sold (135 US, 14 UK, 10 DE, 2 FR, 1 IT, 1 ES), for a total of ~$1100.83. (Amazon reports European royalties in euros or pounds, so the exact total will vary with the day they compute the check).
  • Barnes & Noble: 8 ebooks sold, for $51.92
  • Smashwords: 109 ebooks sold, for $869.80
  • CreateSpace: 4 physical books sold, for $41.27
  • Total: 280 ebooks, 4 physical books, for a total of ~$2063.

    I said last month that February sales were lower than January’s. One a per-day basis, they were much lower. But the book only went live on Amazon on 20 January. The excellent January numbers were due to my hard-core fans buying it. (And I thank you all, sincerely.)

    Similarly, the print version was available on 27 February, if you bought it directly from my CreateSpace store. It went live on Amazon on 29 February. One copy sold on the 27th, and three on the 29th. The March average per-day sales per venue will be lower, but the greater number of days will create higher totals.

    A couple sales per day per channel adds up. The B&N sales don’t look impressive, but hey, it’s $52 that I wouldn’t otherwise get, and eight readers I wouldn’t otherwise have.

    I expect sales to go down from this point on. Reviews drive sales. Reviews this far have all been from people who follow my work. There’s nothing wrong with that — indeed, I appreciate every review. But I think I’ve basically worked through all the reviewers in my hard-core fan base. In the future, I must attract disinterested reviews. I have saved the contact information for everyone who has ever reviewed my work, and am working my way through the list offering review copies. I’m going slowly; I’d rather have 3 reviews a month for 6 months than 18 reviews in one month.

    So, what about the expenses? Publishing this cost:

  • $2,581 for the publishing workshop I attended. Mind you, I took two workshops in a row, I flew to Oregon, I rented a car, I ate at a couple really good restaurants.
  • $227 for artwork. My graphic skills are appalling, so I hired a graphic artist. This includes getting all the line drawings for the book done professionally, some touch-up on screenshots, and the Tilted Windmill Press corporate logo in high-res in six different sizes.
  • $226.50 for page layout. I don’t feel like learning to use InDesign right now.
  • $150.00 for copyediting the manuscript.
  • $214.57 for CreateSpace print fees. This includes several rounds of proofs and 40 review copies, as well as the fees to get the book into the Ingram’s catalog for bookstores.

    So, how much more do I need to sell to break even?

    Total expenditures: $3,399.86.
    Total Jan-Feb royalties: $3506.88

    I have made $107.02 in about forty days of sales (assuming my time is free). So, I’d like to give a sincere “thank you!” to the 482 people who bought SSH Mastery in January and February, as well as those who bought it since then.

    Again, this assumes that my time to write, design, lay out, test, corral reviews, and so on, is free. Also, I don’t have that cash in hand yet. Ebook retailers delay payment for 30-60 days after the close of the month or quarter. I’ll get my first check at the beginning of April.

    Clearly, the self-publishing route is viable, if you have good content. (I’ll babble about tech book content, and the distressing quality thereof, some other time.)

    If you want to do this yourself, I strongly recommend you to get into Dean Wesley Smith’s Think like a Publisher workshop. No, I don’t encourage you to go. I command you to go. DWS is a fiction writer, and his other workshops are for fiction writers, but TlAP is suitable for all sorts of writers. I spent weeks pounding my head against the desk trying to figure out how all the different ebookstores work, and this workshop not only solved all those problems, it let me get this book into print as well.

    I’m also going to cut off the Big Question that I get asked any time self-publishing comes up: “What about Absolute OpenBSD, 2nd Edition?”

    Even if self-publishing SSH Mastery turns into an absolute freaking gold mine and self-publishing showers me with riches, I will finish AO2e. I will send it to NSP. I’ve promised that I would do this book, and I know many people are eagerly waiting for it. Breaking my agreement with my publisher and, more importantly, my readers, would be blatant asshole behavior. And I’m just not going to behave that way. AO2e will be the next big book I publish.

    • Posted on

    SSH course at BSDCan 2012

    I will be at BSDCan 2012. In addition to poking my nose where it doesn’t belong, spouting insouciance and irrelevance, and derailing important technical discussions with tediously pointless anecdotes about my pet rats, I am teaching a course on SSH.

    If you don’t have time to work your way through the SSH book, take a couple hours and and get dragged through it. The course will include material not included in the book, unless it goes too long, in which case I’ll spout off about extra material upon request.

    The new FreeBSD Device Drivers book should be out by then, and the author will be there. (Pity poor Joe Kong. He came to BSDCan in 2007, just after his Designing BSD Rootkits came out. I spent the rest of the conference badgering him into writing the FreeBSD Device Drivers book. He spent five years on this project, and is done at long last. I’m sure he’s ready to shout “Ha! Lucas, I’m rid of your stupid project! I’m a free man!” Sadly for Joe, I have another three books he needs to write. Preferably immediately. If he resists my persuasive powers, I’m prepared to use brainwashing techniques.)

    If you’re a reader of my blog, you need to go to BSDCan. We received so many excellent paper proposals this year that cutting the list down was physically painful. If you don’t yet have IPv6 up and running, attend the IPv6 tutorial. Or learn about PF. Not to mention two days of really interesting papers. And beer.