When a UPS runs out of battery, every node in an HA cluster should go down in a controlled order. Getting that right on Proxmox with NUT (Network UPS Tools) is harder than it looks.
If every node in an HA cluster is connected to upsmon, every node receives the shutdown signal at the same time. Each one then tries to migrate its HA guests to the other nodes before powering off. Those migrations never finish, and the shutdown stalls.
[Read More]Good news: for the second time, meissner.IT is listed in the Gold tier of the BSI Hall of Fame as part of the German Federal Office for Information Security’s E-Mail Security Year.
The BSI awards Gold status to companies that implement DNSSEC. This is not an end in itself: without signed zones there is no DANE, and without DANE, transport encryption between mail servers remains vulnerable. DNSSEC is therefore the foundation for secure e-mail transport according to TR-03108.
[Read More]A customer wanted to retrieve information from their Cisco Access Points to be available in Zabbix. After some research, one implementation approach is:
Cisco Access Point → Telegraf → Zabbix
Telegraf supports Cisco Model-Driven Telemetry via the Cisco Model-Driven Telemetry (MDT) Input Plugin and Zabbix via the Zabbix Output Plugin.
But there was one little piece missing: Cisco MDT outputs extensive data, but not all messages include the hostname required for our Zabbix setup. A small tool was needed to bridge this gap. It searches incoming Cisco messages for entries containing both the MAC address and the hostname, stores this mapping, and enriches messages destined for Zabbix with the missing hostname information.
[Read More]Every server configured by us is monitored via Zabbix. If a server is not monitored, for us it does not exist. More often than not, we first add the to-be-created server in Zabbix and set it up afterward.
If possible, we always use our beloved FreeBSD as a base. FreeBSD offers jails, and we use them a lot. A jail can be one service in a minimal environment or a full-fledged host used by multiple users. Often the host gets its own IP (VNET jail), SSH access, and its own Zabbix agent. But what about monitoring a minimalistic jail running a simple service?
[Read More]The management overview of why we use FreeBSD:
A bit more detail:
Working with FreeBSD and ZFS is a joy. You can tell when using it that the kernel and the base system are developed together; everything feels consistent, integrated and very well designed.
[Read More]I am often asked why we like to use FreeBSD so much. Sometimes I catch myself giving very detailed and theoretical answers. Since that isn’t always the clearest way, here is a practical example.
A Single Sign-On (SSO) solution was to be created for various applications. The components used are:
Five different services. In our setup, each service runs in its own jail. The jails are managed with BastilleBSD, a very lightweight jail manager. We use so-called thin jails: they share a common base system, so a typical installation only consumes storage for the installed packages (keycloak, postgres, etc.):
[Read More]