Recent content on madboa.com
When AWS reports errors that are due to violating a Service Control Policy (SCP), the SCP is typically mentioned by ARN or ID. The problem is that SCP catalog — accessed by AWS Organizations > Policies > Service control policies — identifies the policies by name, not ID or ARN. Here’s how to avoid clicking through each policy to see if the name matches the correct ID.
Beginning with release 19.2.0 (codenamed “Squid”), the Ceph Object Gateway, Ceph’s S3-workalike feature, supports user accounts “as an optional feature to enable the self-service management of Users, Groups and Roles similar to those in AWS Identity and Access Management (IAM).”
Beginning with version v0.153.0 , the Hugo developers starting shipping the MacOS release of Hugo as a Mac-native pkg file rather than in the traditional compressed tar format. 
 Since I use Hugo to build this site, I had long maintained a shell script that automated the installation of the old tar.gz distribution files, so I needed to rework my script to deal with the pkg file. The reworked…
We were in for a surprise when we upgraded our backup server from Ubuntu 20.04 LTS to 24.04 LTS: our backups started failing over the weekends. Here’s the story…
On June 26, 2024, under the title “The Center Must
Hold,” 
Yair Zivan gave voice to the centrism that over the past couple
decades I have increasingly come to call my political stance. As I
read it, I realized I’d been seeking this sort of clear exposition
for quite a while.
At work, our ceph cluster is managed by the cephadm utility, which
means that all ceph operations are launched within containers managed
by podman. Our original batch of storage servers was running CentOS
7, which as of late 2023 is only a few months from reaching its
official end-of-life date. The hardware is still good, so I just
wanted to update operating systems while…
We recently expanded our Ceph cluster at work with six new RHEL 8 storage servers. All the Ceph services run in containers managed by cephadm. I ran into an interesting problem the first time I had to patch and reboot those servers after we had integrated them into the cluster.
When you launch a virtual machine on an OpenStack-managed network, the VM generally receives a random address in the active subnet. A researcher at work, however, needed a system for launching instances that have static addresses so he could preconfigure the local /etc/hosts file with all his machines.
One of our duties at work is monitoring and renewing SSL certificates for customer services. Now that certificate issuers regularly expire certificates after only one year, renewals are a regular occurance. Plus, we like to verify what protocols and alternative hostnames are supported by a specific service. This script helps.
Delay times for various beats-per-minute values.
I can’t say that I’m exactly addicted to Wordle , but I really like the game and try to play it most days. Since I regularly clean out my browser cache, I don’t have any statistical history to show for it, but I seem to guess most words on my fourth try, with fifth, third, and sixth tries next most common. Like any self-respecting geek, I have a strategy.
There has, evidently, been some shakeup in how to use Ansible to manage
a Red Hat Satellite server.
In a 2020 technical meeting, someone asked about some SSH ProxyJump
documentation I’d posted. I
promised to follow up with a full configuration for using ProxyJump
with a remote network, so here goes nothing.
I don’t have a strong economic ideology, though I’d say that my
bias is to try first a market-based approach to most economic issues,
turning to public-sector solutions only when the private sector is
sorely wanting.
I put real work into using IPv6 in FreeBSD on a CenturyLink connection.
People scream “Fake news!” today with annoying consistency. Originally
an attempt to identify published stories that ignored or wildly
stretched the truth, the phrase has become a cynical way to dismiss
stories we dislike.
Red Hat Enterprise Linux (RHEL) 8 and its open-source derivative CentOS 8 include a facility for setting system-wide cryptographic policies.
I needed to create for a client several AWS S3 buckets that would be used for system backups.
bash and rsync don’t necessarily work and play well together
when rsync’s --exclude option is set as a variable.
Hacking a bash script to search for Amazon Machine Images.
I often use the AWS Command Line Interface to create or modify AWS assets, typically in the context of a bash shell script. I’ve found that I frequently need to extract information from one aws operation in order to complete another one. 
 What follows are some of what I’ve learned in that filtering operation.
Configuring a VPC at AWS isn’t particularly intuitive. A short how-to.
It’s somewhat common to have what’s known as a “jump host” serve
as an SSH gateway to a remote network. You use ssh to log into the
jump host (or “jump server”) and from there use ssh to log into an
internal host that’s not directly accessible from the Internet. 
 With the release of ssh version 7.3, the OpenSSH folks made it
easier to…
A brief conversation with John Tierney about educational superiority complexes.
Ubuntu 16.04 has native support for ZFS, which means that VMs may
start to use ZFS for non-root filesystems. Here’s a cookbook for
expanding those filesystems. In OpenStack, the ZFS filesystem must
be exported before this can be done, but at AWS it can be done
without downtime.
I’m in the process of learning about and porting some rules to
Puppet 4.9. One task that had eluded me was integrating custom Hiera
data into modules.
Given a directory (e.g., ~/src ) with a bunch of git and/or
subversion repositories, refreshing them all is a script away.
Creating PXE-friendly hexadecimal file names.
A quick summary of Glacier operations using the aws command-line tool.
Access control on Amazon S3 is subtle
and complex. Here’s a high-level overview of the access controls
that can be placed on S3 buckets and objects.
How to use SCL to install non-standard versions of Red Hat-packaged software.
Understanding the time/date formatting routines Hugo inherits from Go.
An OpenStack Swift object-storage container is usually available
only to users in the project in which the container was created,
but Swift has an access-control mechanism that allows subtle
permission sets to be constructed.
If you’re an OpenStack administrator or power user, there’s a good chance
you need to use the OpenStack command-line tools within multiple projects.
Here’s a bash script to help you move between projects.
I was perusing the instructions to setup Heat , the OpenStack orchestration service, and found myself unable to use the openstack domain command.
Congratulations! You’ve setup OpenStack and you can get to its web interface. 
 Now what?
The growth of big-box computer retailers does not fully explain the demise of small shops.
Spotlight searches on my Macbook Pro running OS X 10.10.5 (Yosemite) were failing. Worse, the smart mailboxes in Apple Mail weren’t working. Without smart folders, it takes me a lot longer to navigate my inbox every morning. 
 The solution was to force OS X to re-index my hard drive.
The end of a quirky era.
Why a dog makes a great narrator for detective fiction.
A script to avoid Adium timeouts in MacOS.
The problem, briefly: Apache configured to authenticate via LDAP
and authorize access only to members of a certain group, would not
authorize a new user account that was clearly a member of that
group. 
 The solution, briefly: The new user account had its primary group
identifier (GID) set to the authorized group, while all other users
were auxiliary members. The new user…
I’ve been playing with OpenStack at work, getting ready for a pilot
project that, if approved, will launch in a couple weeks. I hope to
have more entries on OpenStack installation, configuration, and
usage later. Today, however, I began experimenting with cloud-init
scripting and customizing a stock OpenStack VM image.
The Mozilla SSL Configuration Generator is a very nice tool for anyone who’s responsible for configuring a web server for SSL operations.
Someone at work encountered an interesting obstacle today. The
problem was how to change ownership of files in transit to an NFS
filesytem that squashed activity by user root. Solving it required
a quirky shell one-liner that you may find interesting.
I have a great commute!
I’ve maintained this site since 2002, and it had essentially the
same layout from 2004 until recently (November 2015). It was time
to redo it.
In the vein of my post about an SSH login function I’ve added to my bash profile, here’s another profile function, this one for invoking ipmitool .
A bash function for lazy ssh users.
Red Hat and CentOS kickstart are difficult with unpredictable interface names. A workaround.