All posts by Sciri

Configuring a TFTP server on Ubuntu for switch upgrades and maintenance

Note: Community TFTP documentation is on the Ubuntu Wiki but this short guide adds extra steps to help secure and safeguard your TFTP server.

Every Data Centre Engineer should have a TFTP server somewhere on their network whether it be running on a production host or running on their own notebook for disaster recovery. And since TFTP is lightweight without any user authentication care should be taken to prevent access to or overwriting of critical files.

The following example is similar to the configuration I run on my personal Ubuntu notebook and home Ubuntu servers. This allows me to do switch firmware upgrades and backup configuration files regardless of environment since my notebook is always with me.

Step 1: Install TFTP and TFTP server

$ sudo apt update; sudo apt install tftp-hpa tftpd-hpa

Step 2: Configure TFTP server

The default configuration below allows switches and other devices to download files but, if you have predictable filenames, then anyone can download those files if you configure TFTP Server on your notebook. This can lead to dissemination of copyrighted firmware images or config files that may contain passwords and other sensitive information.

# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/lib/tftpboot"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure"

Instead of keeping any files directly in the /var/lib/tftpboot base directory I’ll use mktemp to create incoming and outgoing directories with hard-to-guess names. This prevents guessing common filenames.

First create an outgoing directory owned by root mode 755. Files in this directory should be owned by root to prevent unauthorized or accidental overwriting. You wouldn’t want your expensive Cisco IOS firmware image accidentally or maliciously overwritten.

$ cd /var/lib/tftpboot
$ sudo chmod 755 $(sudo mktemp -d XXXXXXXXXX --suffix=-outgoing)

Next create incoming directory owned by tftp mode 700 . This allows tftpd-hpa to create files in this directory if configured to do so.

$ sudo chown tftp:tftp $(sudo mktemp -d XXXXXXXXXX --suffix=-incoming)
$ ls -1
ocSZiwPCkH-outgoing
UHiI443eTG-incoming

Configure tftpd-hpa to allow creation of new files. Simply add –create to TFTP_OPTIONS in /etc/default/tftpd-hpa.

# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/lib/tftpboot"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure --create"

And lastly restart tftpd-hpa.

$ sudo /etc/init.d/tftpd-hpa restart
[ ok ] Restarting tftpd-hpa (via systemctl): tftpd-hpa.service.

Step 3: Firewall rules

If you have a software firewall enabled you’ll need to allow access to port 69/udp. Either add this rule to your firewall scripts if you manually configure iptables or run the following UFW command:

$ sudo ufw allow tftp

Step 4: Transfer files

Before doing a firmware upgrade or other possibly destructive maintenance I always backup my switch config and firmware.

cisco-switch#copy running-config tftp://192.168.0.1/UHiI443eTG-incoming/config-cisco-switch
Address or name of remote host [192.168.0.1]? 
Destination filename [UHiI443eTG-incoming/config-cisco-switch]? 
 
 !!
3554 bytes copied in 0.388 secs (9160 bytes/sec)
cisco-switch#copy flash:?
flash:c1900-universalk9-mz.SPA.156-3.M2.bin flash:ccpexp flash:cpconfig-19xx.cfg flash:home.shtml
flash:vlan.dat

cisco-switch#copy flash:c1900-universalk9-mz.SPA.156-3.M2.bin tftp://192.168.0.1/UHiI443eTG-incoming/c1900-universalk9-mz.SPA.156-3.M2.bin 
Address or name of remote host [192.168.0.1]? 
Destination filename [UHiI443eTG-incoming/c1900-universalk9-mz.SPA.156-3.M2.bin]? 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
85258084 bytes copied in 172.692 secs (493700 bytes/sec)

Files in incoming will be owned by tftp mode 666 (world writable) by default. Remember to move those files to your outgoing directory and change ownership to root mode 644 for safe keeping.

Once you’re sure your switch config and firmware is safely backed up it’s safe to copy new firmware to flash or do any other required destructive maintenance.

Step 5: Prevent TFTP access

It’s good practice on a notebook to deny services when not actively in-use. Assuming you have a software firewall be sure to deny access to your TFTP server when on the road or when connected to hostile networks.

$ sudo ufw deny tftp
Rule updated
Rule updated (v6)
$ sudo ufw status
Status: active

To Action From
-- ------ ----
CUPS ALLOW Anywhere 
OpenSSH DENY Anywhere 
69/udp DENY Anywhere 
CUPS (v6) ALLOW Anywhere (v6) 
OpenSSH (v6) DENY Anywhere (v6) 
69/udp (v6) DENY Anywhere (v6)

Is Google Chrome running obscenely slow on your obscenely expensive Mac Pro or Retina MacBook Pro with 4K or UHD monitor? Fear not…

My shiny Mac Pro just arrived along with a pair of Dell 28 Ultra HD (P2815Q) Monitors (2160p). I anxiously plugged everything in, fired up Google Chrome, and waited…and waited…and waited…and waited. The dreaded spinning pinwheel of death greeted me and it took minutes for each page to load. Not even the chrome://settings/ or chrome://version/ pages would load. Chrome was basically unusable.

Odd, since everything was running fine when I had the Mac Pro plugged into my Sony R550A 60″ HDTV (1080p). I begrudgingly switched to Safari and started to do some digging.

Turns out the latest Chrome Stable and Chrome Beta (as of 13-Mar-2014) eat themselves right in the face when plugged into 4K or UHD displays. I’m unable to find a specific bug report but I did manage to find a single general complaint thread in the Google Product Forums from Oct/Nov 2013. Turns out I’m not the only one experiencing this problem.

Luckily the problem has been fixed in the latest Chrome Dev 35.0.1883.0 and Chrome Canary 35.0.1888.0 builds so just download either of those versions. Chrome now completely screams on the Mac Pro.

Version information: Mac Pro Late 2013 MacPro6,1 running Mac OS X 10.9.2 Mavericks.

Wi-Fi regulatory domains are a pain

Managing multiple facilities across multiple continents can be a pain especially when Wi-Fi is involved. Different regions use different frequencies depending on regulatory domain. And, depending on your hardware vendor, compliant hardware could be backordered.

In my case, the Cisco Aironet 1140 Series Access Point (AIR-AP1142N-T-K9 802.11a/g/n Standalone AP; Int Ant; Taiwan C) is backordered by 4-6 weeks. I guess our Taipei 101 office is out of luck for a while unless I can find a different piece of compliant hardware.

Here are some miscellaneous regulatory notes for when I need to revisit this in the future:

Pulling the Karakoram out of storage

Since Operation Stop Being a Fatass 2.0 is progressing rather satisfactorily (down 15 pounds this month) I’ll be pulling my trusty 1992 GT Karakoram Full Rigid out of storage so I can give it a proper tuneup and start hitting the trails again. With the exception of racing my nephews up and down the cul-de-sac I haven’t gone riding since Summer of 2004 and the Karakoram desperately needs some TLC since it was ridden hard and put away wet without any end of season maintenance. I got fat and it started rusting.

So I’ve now committed myself financially to getting back behind the bars by picking up the supplies required to finally do a complete overhaul. A Park Tool PCS-10 Home Mechanic Repair Stand and Park Tool Work Tray will keep the bike firmly planted on the workbench while I tickle its naughty bits with a Park Tool AK-37 Advanced Mechanic Tool Kit, Finish Line Speed Degreaser, and Finish Line DRY Teflon Bicycle Chain Lube. My full automotive mechanic tool kit was missing many of the critical tools to properly maintain a bike so I needed the AK-37 kit to fill in the gaps.

Assuming I actually follow through, start riding again, and hit my initial goal weight of 240ish pounds by the end of the Summer I’ll definitely upgrade to a 2012 GT Karakoram 1.0 Hardtail 29er. No way I’m going to drop the coin to go full suspension unless I get under 200 pounds and am doing some serious miles. And if the wife wants to start riding as well then a 2012 GT Palomar Hardtail will probably be in her future.

Operation Stop Being a Fatass 2.0 is well underway

It’s been seven years since I mused about weight loss on this Blog. And in that seven years I’ve embarrassingly regained almost all the weight I so elatedly lost and enthusiastically wrote about. An unfortunate combination of work, stress, and a complete lack of healthful motivation turned those seven years into a crash course of unhinged weight gain.

I saw and felt it happening as I ballooned back up to a 46″ waist and had to dig out my cache of old 2XL geek and hacker t-shirts that had been packed away for nostalgic reasons. But even as I jumped up each size I just didn’t care. And on New Year’s Day of this year I weighed in at 308.6 pounds. Not quite the 330 pounds I weighed at my all-time high in 1998 but a Hell of a lot more than the 220ish pounds I weighed at my last health-related entry in 2004.

So Operation Stop Being a Fatass 1.0 ended in failure but Operation Stop Being a Fatass 2.0 is well underway thanks to some hardy motivation from my lovely wife since we’ve both vowed to get back into shape together. Since the beginning of January I’ve dropped 12.6 pounds and I’m down to 296 pounds. That may seem like a tiny victory but it’s a victory nonetheless.

The Hacker’s Diet is still my primary motivation and going back to Blogging about my fat ass will definitely help but I’ve also added some additional tools to my aresenal:

HP Mini 1000 and 110 batteries on sale

For you mobile geeks out there HP Home currently has 3-cell batteries for the HP Mini 1000 and 110 on sale for 60% off as well as a $15-off coupon you can use (ACY93421). No idea how long this is going to last.

The 6-cell batteries are regular price but the coupon should also work.

Photo credit: http://www.flickr.com/photos/minami/ / CC BY-NC-SA 2.0

Upgrading Polycom firmware

If you have a mixed bag of Polycom kit in your office, be sure to check out the VoIP SIP Software Release Matrix to check on compatible versions. In our case, I chose SIP version 3.1.3RevC since it’s compatible with both the IP 430 and the IP 4000. I’ll probably bump up to SIP version 3.2.0 for the IP 430; just not today.

Also pay special attention to the release notes. Just because a Firmware version is on the download page for a particular model doesn’t mean it will work. We had to mix and match with Firmware version 4.1.3 for the IP 4000 and 4.2.0 for the IP 430. This is difficult (but not impossible) since pre-4.0 Firmware versions look for bootrom.ld instead of modelnumber.bootrom.ld in 4.0 and higher versions.
Continue reading Upgrading Polycom firmware

Totally unsupported Ubuntu 8.04 (Hardy Heron) installer for ServerBeach RapidRescue

The aging Red Hat Enterprise ES4 server I have colocated at ServerBeach was starting to get a bit crufty and I felt kind of dirty running RHEL instead of Ubuntu now that I’m working for Canonical. It was finally time to bring up a shiny new Dell PowerEdge 440 running Ubuntu 8.04 LTS Hardy Heron however ServerBeach does not yet officially support Ubuntu and will not do custom OS loads.

No problem. ServerBeach provides a brilliant tool called RapidRescue that allows you to reboot your server into a Linux recovery session and gives remote console access to the disks and hardware. I whipped together an awful hack to take advantage of this tool and automate the process of formatting the hard drives and debootstrapping an Ubuntu install. Not exactly elegant, but it gets the job done. 😀

Creating DOS floppies and USB thumbdrives for BIOS flashing

MS-DOS or another DOS derivative is still required for flashing the BIOS on some desktops, servers, notebooks, and mobile devices. These tools automate the creation of boot floppies and USB thumbdrives instead of fighting with tools like MKBT (Make Bootable).

Required Tools

Continue reading Creating DOS floppies and USB thumbdrives for BIOS flashing