Blog

Update on CentOS 7, Kerberos, and Active Directory.

Update on CentOS 7, Kerberos, and Active Directory.

After my initial configurations had time to bake in for a while, I discovered a lingering little problem. If the system was left to allow all a user’s Kerberos tickets to expire, using PuTTY to SSH into the machine would permit login but not pass 

CentOS 7, Active Directory, and Kerberos, oh my!

CentOS 7, Active Directory, and Kerberos, oh my!

For the longest time, I have utilized ldap authentication and nfs shares to loosely bind my Linux servers to my Active Directory domain. I did stretch one aspect of my ldap authentication to use a load balanced URL so that should one or the other 

Home Assistant in a box — Docker-style

Home Assistant in a box — Docker-style

After running Home Assistant on my Raspberry Pi 3b for some time, I have run into a few concerns over the long term maintenance of the system.

  • Database maintenance is a must. Using SQLLite, the database is limited to 2 GB in size, and no automatic trimming is performed by the Home Assistant software. Data collection in excess of this limit results in Home Assistant becoming inoperable.
  • Point-to-point upgrades of the Home Assistant software introduce interesting complications with dependencies. At least one I ran into was caused by a failure to process a setup properly, complaining about a utf-8 encoding problem.

As I like to expand my understanding of current trends in technology, one thing I have been investigating is use of the Docker platform. I like the concept from a number of angles. A common security trick of old was to use a ‘chroot jail’ to isolate processes at risk from the base system. Once locked in a different root folder, a compromised process could not access locations that would grant access to install kernel modules or other malicious software. Docker takes this to another level. Another alluring feature of Docker containers is their isolation of data from software, and software from hosting Operating System. This enables easier upgrades, as well as a removal of dependency-hell. It also opens up the software to be run in a form of a cluster called a Docker Swarm.

I have since attempted to relocate some of my older websites from their original homes directly on a hosting Linux device to a Docker container. I have had some mixed successes using pre-built images from official repositories. However, as I reassessed my difficulties with Home Assistant, I figured I’d give it a go to compartmentalize it and see if I could gain the benefits above. So far, that walk has been most interesting, and not the least bit because of the conversion required in the configurations to use a container instead of a python virtual environment.

Setting up the environment

I began this effort by having to select an image to use for Home Assistant. There is an official Home Assistant repository, but as I was soon to find out when installing this on my Raspberry Pi 3b, this is an image built for amd64 or x86 systems and not the armv71 architecture that the Pi runs. There is an unofficial repository by user lroguet on the Docker Hub built for the Pi and fairly well rated, for what images are available. This is the image I selected to use.

I went through a great big trial of attempting to manage the docker containers, build the environment, and work it all out and while I had some success for a brief time, I ran into similar problems of upgrade management. So after that fizzled out, I went ahead and gave Home Assistant’s Hass.io, and their newest variation, HassOS images a try. This too is built on Docker as I discovered, but it has a supervisor that does a lot more to help manage the system as a whole.

Is it stable and perfect? Absolutely not. While running the Hass.io image, I had to enable the debugging ssh port in order to correct faults with the supervisor. This ssh access should not be confused with the SSH Add-ons that does not permit access to the underlying host. There are ways to pull later images and that worked for a time until something became corrupt within my Homeassistant container. Once I wiped it out to let the supervisor redownload everything, it failed to attempt it and I decided backup and reflashing was less hassle.

Assessing the experience

Using HassOS, so far so good. One thing I like very much is the on-web upgrade and management tools. Once the updater sensor in Home Assistant detects a new version is available, I can go to the Hass.io panel and upgrade Home Assistant right there. Configuration can be checked and some components reloaded, or Home Assistant’s container as a whole restarted. I have even managed to work in a custom panel called Floorplan for Home Assistant after finding a very helpful Youtube video by member Dr Zzs. While his style is on the more silly side, the documentation for Floorplan was less than clear and his instructions clarified aspects of it. More details on that setup can be had later.

I would definately enable the SSH addon, as it may be the only way to get access to the system if Home Assistant has problems. I don’t know yet whether Home Assistant’s new custom HassOS is more stable or more robust than the earlier resin.io-based Hass.io image. I can say after the Hass.io image had issues, copying all the files off (or a snapshot if you make one after your last change), reflash, and reload your data, I was back up and running in less than 20 minutes. Remembering the addon options is necessary if you don’t use snapshots, something I learned the hard way.

Either way, it seems like the best way to deal with Home Assistant for now may be their custom OS image for ease of management, upgradability, and addon features. No love yet for my sense hat on Hass.io or HassOS, but I have more on other options to create a sensor net about my home I am exploring.

VyOS and Redundancy – Part 2

VyOS and Redundancy – Part 2

In Part 1 of my exploration of router redundancy, I mentioned several issues that I discovered with setting up VRRP with VyOS. My impetus to walk down the path of redundant routers started because I wanted to standardize the configurations. One router had individual interfaces (one 

VyOS and Redundancy

VyOS and Redundancy

Some time ago, perhaps three years at this point, I had to swallow my pride and switch from AT&T DSL back to Comcast Cable internet. When I did so, and got a sizable boost in bandwidth to go along with it, I opted to change