The Life of an Admin in the IT World
July 18, 2013 4:58 AM Subscribe
Oh I forgot the other exception, which was the forensics. I'll follow a problem back until I either reach a root cause I can fix or I can blame the terrible sysadmins (e.g. "it's an NFS problem") or a terrible tool (e.g. "ugh, this closed source, GUI-oriented backup/restore tool is broken").
posted by DU at 5:16 AM on July 18, 2013
posted by DU at 5:16 AM on July 18, 2013
Though we may not run Windows on our personal machines or appear to care a whit about Windows servers, we're generally quite capable at diagnosing and fixing Windows problems.
Not to hog the post here, but the reason for this is that most Windows problems can be solved by assuming Microsoft heard of the spec, then did the opposite.
posted by DU at 5:19 AM on July 18, 2013 [13 favorites]
Not to hog the post here, but the reason for this is that most Windows problems can be solved by assuming Microsoft heard of the spec, then did the opposite.
posted by DU at 5:19 AM on July 18, 2013 [13 favorites]
Agree on both counts DU, on the command line and on following back problems to their source.
I used to have a tiny consultancy, and did basic system and network admin work for small businesses with straightforward needs. And in doing that I did a decent amount of work supporting Windows and Mac clients on Linux based networks (when the client wasn't already heavily invested in Windows Sever), dealing with Samba and LDAP on the back end, and often simultaneously transitioning people from old proprietary PBXs to VOIP.
Still, I always felt like a bit of an impostor, because I can't really script from scratch, create regex from scratch, or use sed or awk, etc, without an exemplar to adapt. And I really, really don't like emacs or vim, and maybe enjoy ncurses based utilities and diagnostics a little too much.
Not to hog the post here, but the reason for this is that most Windows problems can be solved by assuming Microsoft heard of the spec, then did the opposite.
Most Windows problems can be solved by formatting the partition containing Windows.
Sorry. Couldn't resist.
posted by snuffleupagus at 5:25 AM on July 18, 2013
I used to have a tiny consultancy, and did basic system and network admin work for small businesses with straightforward needs. And in doing that I did a decent amount of work supporting Windows and Mac clients on Linux based networks (when the client wasn't already heavily invested in Windows Sever), dealing with Samba and LDAP on the back end, and often simultaneously transitioning people from old proprietary PBXs to VOIP.
Still, I always felt like a bit of an impostor, because I can't really script from scratch, create regex from scratch, or use sed or awk, etc, without an exemplar to adapt. And I really, really don't like emacs or vim, and maybe enjoy ncurses based utilities and diagnostics a little too much.
Not to hog the post here, but the reason for this is that most Windows problems can be solved by assuming Microsoft heard of the spec, then did the opposite.
Most Windows problems can be solved by formatting the partition containing Windows.
Sorry. Couldn't resist.
posted by snuffleupagus at 5:25 AM on July 18, 2013
Oh, so much bullshit.
"Vi -- and explicitly vim -- is the true tool for veteran Unix geeks who need to get things done and not muck about with the extraneous nonsense that comes with emacs."
No. We know vi because it's guaranteed to be installed on every *nix-alike, and we're too lazy/busy to learn another editor. vim can go hang, no admin I know knows or cares about the difference between it and bog standard vi, unless they're also wearing a programmer hat, or they're a text editor hobbyist.
"Veteran network admin trait No. 6: We calculate subnet masks and CIDR as easily as breathing"
Bwa-hah-hah! We all have cheatsheets pinned in our cube. We learned to do it for one cert or other and then forgot.
"Veteran Unix admin trait No. 6: We generally assume the problem is with whomever is asking the question"
This is baloney. A user's problem is your problem, regardless of how it was caused and who or what by. Your job is to help them resolve it - by fixing the system or educating the user. Sneering sysadmins are a thing. They are never at the top of their profession.
I could go on, but now I'm depressed. This sort of stereotype about what made for a seasoned sysadmin probably goes back to the early '90s when I got into the game, and probably back much further than that.
posted by Slap*Happy at 5:29 AM on July 18, 2013 [29 favorites]
"Vi -- and explicitly vim -- is the true tool for veteran Unix geeks who need to get things done and not muck about with the extraneous nonsense that comes with emacs."
No. We know vi because it's guaranteed to be installed on every *nix-alike, and we're too lazy/busy to learn another editor. vim can go hang, no admin I know knows or cares about the difference between it and bog standard vi, unless they're also wearing a programmer hat, or they're a text editor hobbyist.
"Veteran network admin trait No. 6: We calculate subnet masks and CIDR as easily as breathing"
Bwa-hah-hah! We all have cheatsheets pinned in our cube. We learned to do it for one cert or other and then forgot.
"Veteran Unix admin trait No. 6: We generally assume the problem is with whomever is asking the question"
This is baloney. A user's problem is your problem, regardless of how it was caused and who or what by. Your job is to help them resolve it - by fixing the system or educating the user. Sneering sysadmins are a thing. They are never at the top of their profession.
I could go on, but now I'm depressed. This sort of stereotype about what made for a seasoned sysadmin probably goes back to the early '90s when I got into the game, and probably back much further than that.
posted by Slap*Happy at 5:29 AM on July 18, 2013 [29 favorites]
Speaking as an admin, I despise working with people who exhibit his trait #1. I have 20+ years experience doing what I do, and one of the things that has taught me is I make mistakes sometimes. I flub a keystroke, have a brainfart, whatever. I would rather not be in a uid=0 shell when that happens. There are a couple of guys I work with who leave a shell logged in as root wherever they go because it's "convenient", and "easier than setting up sudo properly". Get bent, you idiots.
Using sudo exclusively is like bowling with only the inflatable bumpers in the gutters -- it's safer, but also causes you to not think through your actions fully.
No, you're wrong. It means that I have to accurately model in my mind which actions I perform require elevated privileges and which don't, and that means I have a better understanding of how my systems are managed than "I'll just log in as root and then everything will work".
To us, it's easy to stop the bleeding by ... changing permissions on a file or directory to 777, but that's not the half of it.
But you want to live in a root shell because that makes you feel like you're living on the edge or something. Once again, get bent.
posted by russm at 5:29 AM on July 18, 2013 [29 favorites]
Using sudo exclusively is like bowling with only the inflatable bumpers in the gutters -- it's safer, but also causes you to not think through your actions fully.
No, you're wrong. It means that I have to accurately model in my mind which actions I perform require elevated privileges and which don't, and that means I have a better understanding of how my systems are managed than "I'll just log in as root and then everything will work".
To us, it's easy to stop the bleeding by ... changing permissions on a file or directory to 777, but that's not the half of it.
But you want to live in a root shell because that makes you feel like you're living on the edge or something. Once again, get bent.
posted by russm at 5:29 AM on July 18, 2013 [29 favorites]
"Veteran network admin trait No. 6: We calculate subnet masks and CIDR as easily as breathing"
Bwa-hah-hah! We all have cheatsheets pinned in our cube. We learned to do it for one cert or other and then forgot.
I was always terrible at this and just used a little calculator app.
posted by snuffleupagus at 5:31 AM on July 18, 2013 [1 favorite]
Bwa-hah-hah! We all have cheatsheets pinned in our cube. We learned to do it for one cert or other and then forgot.
I was always terrible at this and just used a little calculator app.
posted by snuffleupagus at 5:31 AM on July 18, 2013 [1 favorite]
I'm a software engineer, not an admin, but most of the first list applies to me
Yeah, I think the first list applies to people of a technical bent and it's just that another trait we share is to assume everything is about us and we're unique snowflakes, which is why we tend to rewrite stuff from scratch rather than deign to use someone else's code. I'd say the list is about 2/3 spot-on and then there's chest-thumping crap like the vi v. emacs debate (confession: I like IDEs for the same reason I don't hammer nails with a gatling gun and I set nano as the default editor for my profile on all my web servers because I'm just there to edit a cron task or something similar, not write the Magna Carta).
We prefer elegant solutions
This is definitely true, but the theme of the list seems to be inherently good traits. This one falls on both sides of the line. Everyone loves an elegant solution from a smart coder, but there are a lot of idiots out there blowing deadlines they'll never make because they've abstracted the shit out of something that just needed a quick hack.
posted by yerfatma at 5:34 AM on July 18, 2013 [2 favorites]
Yeah, I think the first list applies to people of a technical bent and it's just that another trait we share is to assume everything is about us and we're unique snowflakes, which is why we tend to rewrite stuff from scratch rather than deign to use someone else's code. I'd say the list is about 2/3 spot-on and then there's chest-thumping crap like the vi v. emacs debate (confession: I like IDEs for the same reason I don't hammer nails with a gatling gun and I set nano as the default editor for my profile on all my web servers because I'm just there to edit a cron task or something similar, not write the Magna Carta).
We prefer elegant solutions
This is definitely true, but the theme of the list seems to be inherently good traits. This one falls on both sides of the line. Everyone loves an elegant solution from a smart coder, but there are a lot of idiots out there blowing deadlines they'll never make because they've abstracted the shit out of something that just needed a quick hack.
posted by yerfatma at 5:34 AM on July 18, 2013 [2 favorites]
Using sudo exclusively is like bowling with only the inflatable bumpers in the gutters -- it's safer, but also causes you to not think through your actions fully.
Well, that certainly showed up the ignorance of the writer.
posted by Blazecock Pileon at 5:36 AM on July 18, 2013 [5 favorites]
Well, that certainly showed up the ignorance of the writer.
posted by Blazecock Pileon at 5:36 AM on July 18, 2013 [5 favorites]
Claiming one approach over another is just silly link bait, vi vs emacs, su vs sudo, just silly. All are excellent tools and should be used appropriately.
posted by sammyo at 5:37 AM on July 18, 2013 [1 favorite]
posted by sammyo at 5:37 AM on July 18, 2013 [1 favorite]
Veteran network admin trait No. 9: We take big risks all the time
Also, this entire entry is baloney. A veteran network admin has set up OOB access, peer review and scheduled change windows, and an incident management process that involves everyone dependent on the equipment. What a crummy network he must run.
posted by Slap*Happy at 5:38 AM on July 18, 2013 [5 favorites]
Also, this entire entry is baloney. A veteran network admin has set up OOB access, peer review and scheduled change windows, and an incident management process that involves everyone dependent on the equipment. What a crummy network he must run.
posted by Slap*Happy at 5:38 AM on July 18, 2013 [5 favorites]
But truly, underneath that carefully cultivated gruff exterior lies a heart of coal.
posted by seanmpuckett at 5:38 AM on July 18, 2013 [2 favorites]
posted by seanmpuckett at 5:38 AM on July 18, 2013 [2 favorites]
Also, this entire entry is baloney. A veteran network admin has set up OOB access, peer review and scheduled change windows, and an incident management process that involves everyone dependent on the equipment. What a crummy network he must run.
Yeah. I was a little surprised by this. Anything that mission critical should have some kind of OOB access, a serial server or maybe even a blast-from-the-past modem for some applications. Or at the very least some kind of pray-it-works failsafe monitoring mechanism that tries to revert to a safely accessible (if non-productive) configuration if something goes wrong and the box loses connectivity.
posted by snuffleupagus at 5:48 AM on July 18, 2013
Yeah. I was a little surprised by this. Anything that mission critical should have some kind of OOB access, a serial server or maybe even a blast-from-the-past modem for some applications. Or at the very least some kind of pray-it-works failsafe monitoring mechanism that tries to revert to a safely accessible (if non-productive) configuration if something goes wrong and the box loses connectivity.
posted by snuffleupagus at 5:48 AM on July 18, 2013
As for vi vs. emacs, the simple answer is to use ed. It is, after all, the standard text editor. Says so right in the manpage. First sentence of the first paragraph of the description.
posted by russm at 5:53 AM on July 18, 2013 [12 favorites]
DESCRIPTION
The ed utility is the standard text editor.posted by russm at 5:53 AM on July 18, 2013 [12 favorites]
Oh, God, do I hate vim. I hate how it saves state across editing sessions. I hate that it gives me syntax highlighting. I hate that vim has multiple buffers. I hate that :q closes the buffer instead of quits the program. I hate that someone looked at vi and thought that the problem was that it wasn't more superficially emacs-like.
Vim did give us :wn, so there's that.
posted by 1970s Antihero at 5:57 AM on July 18, 2013
Vim did give us :wn, so there's that.
posted by 1970s Antihero at 5:57 AM on July 18, 2013
...another trait we share is to assume everything is about us and we're unique snowflakes, which is why we tend to rewrite stuff from scratch rather than deign to use someone else's code...
The reason I tend to rewrite from scratch is that the algorithm is rarely the time-consuming part. The time-consuming part is hooking the algorithm up to the surrounding program (this goes 100x if "the surrounding program" requires a GUI). Taking someone else's code will save me about 1 hour of re-coding it and cost me a day of hooking it up the way their code needs vs the hookups I already have in place.
Also, when you actually start wading in to rewrite it, I almost invariably find that 90% of their code is unneeded, so the 1 hour of rewrite is really just a few minutes reproducing an understandable 10 lines.
posted by DU at 5:58 AM on July 18, 2013 [1 favorite]
The reason I tend to rewrite from scratch is that the algorithm is rarely the time-consuming part. The time-consuming part is hooking the algorithm up to the surrounding program (this goes 100x if "the surrounding program" requires a GUI). Taking someone else's code will save me about 1 hour of re-coding it and cost me a day of hooking it up the way their code needs vs the hookups I already have in place.
Also, when you actually start wading in to rewrite it, I almost invariably find that 90% of their code is unneeded, so the 1 hour of rewrite is really just a few minutes reproducing an understandable 10 lines.
posted by DU at 5:58 AM on July 18, 2013 [1 favorite]
I like IDEs for the same reason I don't hammer nails with a gatling gun ...
I feel like I should like IDEs since they do all kinds of nice context helper stuff with code but I've never found one that doesn't send me screaming back to vi[m] after about a week.
posted by octothorpe at 6:05 AM on July 18, 2013 [3 favorites]
I feel like I should like IDEs since they do all kinds of nice context helper stuff with code but I've never found one that doesn't send me screaming back to vi[m] after about a week.
posted by octothorpe at 6:05 AM on July 18, 2013 [3 favorites]
IPCALC(1) General Commands Manual IPCALC(1)posted by mikelieman at 6:11 AM on July 18, 2013 [2 favorites]
NAME
ipcalc - perform simple manipulation of IP addresses
SYNOPSIS
ipcalc [OPTION]...[/prefix] [netmask]
DESCRIPTION
ipcalc provides a simple way to calculate IP information for a host. The various options specify what information ipcalc should display on standard out. Multiple options may be specified. An IP address to operate on must always be specified. Most operations also require a netmask or a CIDR prefix as well.
OPTIONS...
These articles are the same kind of clickbait trolling that triggered endless discussions of the same old pointless things on /. and are the reason I stopped reading that site.
Asserting that vi is better than emacs? I mean, come on!
posted by Joe Chip at 6:13 AM on July 18, 2013 [6 favorites]
Asserting that vi is better than emacs? I mean, come on!
posted by Joe Chip at 6:13 AM on July 18, 2013 [6 favorites]
Any "traits of a unix admin" that doesn't mention screen is written by a poseur.
posted by jenkinsEar at 6:16 AM on July 18, 2013 [15 favorites]
posted by jenkinsEar at 6:16 AM on July 18, 2013 [15 favorites]
Huh. Doesn't mention the eye twitch.
posted by Tell Me No Lies at 6:26 AM on July 18, 2013 [6 favorites]
posted by Tell Me No Lies at 6:26 AM on July 18, 2013 [6 favorites]
I feel like I should like IDEs
I shouldn't have made it sound so much like I was saying they're the right tool for everyone. I meant I have a talent for shooting my own foot off with any editor like vi or emacs.
posted by yerfatma at 6:29 AM on July 18, 2013
I shouldn't have made it sound so much like I was saying they're the right tool for everyone. I meant I have a talent for shooting my own foot off with any editor like vi or emacs.
posted by yerfatma at 6:29 AM on July 18, 2013
I love screen, especially the newest versions with the mult-window tiling support.
posted by octothorpe at 6:31 AM on July 18, 2013
posted by octothorpe at 6:31 AM on July 18, 2013
I gave up screen for the universe of Jedi power that is tmux
and then you can get crazy and nest them...
posted by snuffleupagus at 6:31 AM on July 18, 2013 [2 favorites]
and then you can get crazy and nest them...
posted by snuffleupagus at 6:31 AM on July 18, 2013 [2 favorites]
As long as you don't use screen for talking to serial devices. That is entirely counter to the Unix Way™.
posted by russm at 6:36 AM on July 18, 2013 [1 favorite]
posted by russm at 6:36 AM on July 18, 2013 [1 favorite]
Vim did give us :wn, so there's that.
And here I had a macro in my .exrc to do the equivalent!
posted by Obscure Reference at 6:39 AM on July 18, 2013
And here I had a macro in my .exrc to do the equivalent!
posted by Obscure Reference at 6:39 AM on July 18, 2013
I've messed around with tmux but haven't found a good .config file for it yet. Is it really that much better than screen?
posted by octothorpe at 6:39 AM on July 18, 2013
posted by octothorpe at 6:39 AM on July 18, 2013
The uninitiated can't quite grok the way a network admin's mind works, but a parallel might be to imagine an intangible maze, then try to solve it.
As an ignorant article/discussion about IT grows longer, the probability that the author/speaker uses grok as a word approaches 1.
posted by RonButNotStupid at 6:42 AM on July 18, 2013 [6 favorites]
As an ignorant article/discussion about IT grows longer, the probability that the author/speaker uses grok as a word approaches 1.
posted by RonButNotStupid at 6:42 AM on July 18, 2013 [6 favorites]
I've messed around with tmux but haven't found a good .config file for it yet. Is it really that much better than screen?
I find it worthy for running a customized set of terminal panes on a side monitor rotated to portrait mode, watching various parts of an automated workflow do their things, top over there, iptraf over here, iostat wedged into a corner, and so forth.
Maybe I just like it that my linux terminal looks like some kind of Wargames SCADA interface.
posted by snuffleupagus at 6:44 AM on July 18, 2013 [5 favorites]
I find it worthy for running a customized set of terminal panes on a side monitor rotated to portrait mode, watching various parts of an automated workflow do their things, top over there, iptraf over here, iostat wedged into a corner, and so forth.
Maybe I just like it that my linux terminal looks like some kind of Wargames SCADA interface.
posted by snuffleupagus at 6:44 AM on July 18, 2013 [5 favorites]
As an ignorant article/discussion about IT grows longer, the probability that the author/speaker uses grok as a word approaches 1
posted by snuffleupagus at 6:46 AM on July 18, 2013
grok should have a man page.posted by snuffleupagus at 6:46 AM on July 18, 2013
I suppose #9 is true if you're a hired gun - the network was designed poorly, the management who hired you is giving you no internal support beyond "Just fix the damn thing", you have no hope of getting any on-site resources in place, and you're doing your best to tap-dance around all of that.
A lot of my current gig involves stuff like this... eventually, we'll get them on a network we design and manage, but until then, we sold them a firewall to tide them over which they racked up in Outer Mongolia where the routers are administrated by a team of coke-fiend circus clowns in between acts, and it's now broken internet for all of Manhattan. "Just fix the problem your firewall caused, we don't care."
posted by Slap*Happy at 7:02 AM on July 18, 2013
A lot of my current gig involves stuff like this... eventually, we'll get them on a network we design and manage, but until then, we sold them a firewall to tide them over which they racked up in Outer Mongolia where the routers are administrated by a team of coke-fiend circus clowns in between acts, and it's now broken internet for all of Manhattan. "Just fix the problem your firewall caused, we don't care."
posted by Slap*Happy at 7:02 AM on July 18, 2013
That's like something from the DailyWTF odinstream. One does what one must, but goddamn. I would require many memos to the effect of YES REALLY DO THIS ITS OUR ASS NOT YOURS.
posted by snuffleupagus at 7:03 AM on July 18, 2013
posted by snuffleupagus at 7:03 AM on July 18, 2013
Oh god, I worked with a guy like the Veteran Unix Admin writer and every day was an exercise in mindful not-punching.
posted by murphy slaw at 7:04 AM on July 18, 2013
posted by murphy slaw at 7:04 AM on July 18, 2013
Nine Traits of the Veteran...Network Admin
It's somewhat gratifying to see that "No Macs on my network" no longer rates a mention, even though, to this day, those guys still exist in the wild.
posted by Thorzdad at 7:07 AM on July 18, 2013 [1 favorite]
It's somewhat gratifying to see that "No Macs on my network" no longer rates a mention, even though, to this day, those guys still exist in the wild.
posted by Thorzdad at 7:07 AM on July 18, 2013 [1 favorite]
to this day, those guys still exist in the wild
So unevolved, it's like they've never heard of Darwin
posted by snuffleupagus at 7:12 AM on July 18, 2013 [7 favorites]
So unevolved, it's like they've never heard of Darwin
posted by snuffleupagus at 7:12 AM on July 18, 2013 [7 favorites]
When I hear about admins who go to lengths to avoid using sudo, I sort of assume they're prone to fuckups and don't want an audit trail.
posted by rmd1023 at 7:17 AM on July 18, 2013 [12 favorites]
posted by rmd1023 at 7:17 AM on July 18, 2013 [12 favorites]
BTW, namewithoutworlds kindly provided his screen and tmux configs in a previous thread.
posted by snuffleupagus at 7:22 AM on July 18, 2013 [3 favorites]
posted by snuffleupagus at 7:22 AM on July 18, 2013 [3 favorites]
Veteran Unix admin trait No. 1: We don't use sudo
Oh whatever.
posted by jquinby at 7:33 AM on July 18, 2013 [1 favorite]
Oh whatever.
posted by jquinby at 7:33 AM on July 18, 2013 [1 favorite]
One trait of network admins that I've noticed is an inability to get a set of new firewall rules implemented quickly and correctly.
posted by wotsac at 7:35 AM on July 18, 2013
posted by wotsac at 7:35 AM on July 18, 2013
These should be called eighteen traits of the egotistical admin. I've worked with so many of these guys before and they end up causing as many problems as they solve.
posted by cmfletcher at 7:44 AM on July 18, 2013
posted by cmfletcher at 7:44 AM on July 18, 2013
I'm finding that screen(1) is being partly supplanted by having a number of terminals with mosh sessions to the server open in them.
posted by acb at 7:46 AM on July 18, 2013 [2 favorites]
posted by acb at 7:46 AM on July 18, 2013 [2 favorites]
Didn't see neckbeards on that list.
posted by backseatpilot at 7:47 AM on July 18, 2013 [1 favorite]
posted by backseatpilot at 7:47 AM on July 18, 2013 [1 favorite]
Yeah the vi vs. emacs thing gives the Unix author away as a pretender, a brownbeard. ed(1) is the standard text editor. vi and emacs are useful on a fancy terminal, but if you have a real terminal with a roll of paper you're going to need ed. (Related: Ctrl-P means "previous line" in any modern Unix environment with emacs keybindings. But on a VAX 11/785 console Ctrl-P means "halt the whole multiuser machine immediately". Ask me how I know!)
posted by Nelson at 7:47 AM on July 18, 2013 [9 favorites]
posted by Nelson at 7:47 AM on July 18, 2013 [9 favorites]
P for.....Pause? Panic? Pain?
posted by snuffleupagus at 7:51 AM on July 18, 2013 [1 favorite]
posted by snuffleupagus at 7:51 AM on July 18, 2013 [1 favorite]
I know a fairly successful freelance Windows admin who is as clueless as it is possible for an alleged sysadmin to be.
He cannot conceive of fixing anything which is not presented to him in a Windows dialog box. Will call out Dell or whoever rather than delve into documentation. Gets 3rd parties to configure servers for him and looks almost scared when PowerShell is mentioned. Yet he seems to have loads of clients. I wish I had his sales and (golf-course) networking skills.
posted by epo at 7:53 AM on July 18, 2013
He cannot conceive of fixing anything which is not presented to him in a Windows dialog box. Will call out Dell or whoever rather than delve into documentation. Gets 3rd parties to configure servers for him and looks almost scared when PowerShell is mentioned. Yet he seems to have loads of clients. I wish I had his sales and (golf-course) networking skills.
posted by epo at 7:53 AM on July 18, 2013
This person is a variety of contractor, aka 'systems integrator', not an administrator in any real sense of the term. And he doesn't have any in-house administrators either (or so it sounds).
I see companies like this in the legal tech sector with some regularity. Sometimes they're set up that way. Some times they're the leftovers of a consultancy that's slowly bled out all of its technical people, leaving the business people to farm everything out and resell whoever's stuff will give them a good margin as a VAR.
posted by snuffleupagus at 8:05 AM on July 18, 2013 [1 favorite]
I see companies like this in the legal tech sector with some regularity. Sometimes they're set up that way. Some times they're the leftovers of a consultancy that's slowly bled out all of its technical people, leaving the business people to farm everything out and resell whoever's stuff will give them a good margin as a VAR.
posted by snuffleupagus at 8:05 AM on July 18, 2013 [1 favorite]
As for vi vs. emacs, the simple answer is to use ed. It is, after all, the standard text editor. Says so right in the manpage.
I just looked at the ed manpage actually, and on my system that's sadly not true:
"DESCRIPTION
GNU Ed - The GNU line editor."
posted by Dysk at 8:08 AM on July 18, 2013
I just looked at the ed manpage actually, and on my system that's sadly not true:
"DESCRIPTION
GNU Ed - The GNU line editor."
posted by Dysk at 8:08 AM on July 18, 2013
One trait of network admins that I've noticed is an inability to get a set of new firewall rules implemented quickly and correctly.
It's not just firewall rules these days - network admins are screwing up a wide variety of UTM features on next-generation security appliances. (Says the security engineer...)
posted by Slap*Happy at 8:12 AM on July 18, 2013
It's not just firewall rules these days - network admins are screwing up a wide variety of UTM features on next-generation security appliances. (Says the security engineer...)
posted by Slap*Happy at 8:12 AM on July 18, 2013
I just looked at the ed manpage actually, and on my system that's sadly not true
that's what you get for using a system that ships GNU ed, those damn dirty hippies. you need proprietary Unix where the manpages have been encased in amber. Solaris ought to do it.
posted by russm at 8:23 AM on July 18, 2013 [3 favorites]
that's what you get for using a system that ships GNU ed, those damn dirty hippies. you need proprietary Unix where the manpages have been encased in amber. Solaris ought to do it.
posted by russm at 8:23 AM on July 18, 2013 [3 favorites]
network admins are screwing up a wide variety of UTM features
Annoying when these things drop legitimate traffic and the security team gets blamed, but let's be honest: any attacker worth their salt is going to evade a UTM device trivially.
posted by bfranklin at 8:23 AM on July 18, 2013
Annoying when these things drop legitimate traffic and the security team gets blamed, but let's be honest: any attacker worth their salt is going to evade a UTM device trivially.
posted by bfranklin at 8:23 AM on July 18, 2013
In fact, for Unix-like operating systems that force sudo upon all users, the first thing we do is sudo su - and change the root password so that we can comfortably su - forever more.
And then what? Pass around root passwords to all your administrators on sticky notes or email? And when you change them every 30/60/90 days?
posted by ish__ at 8:24 AM on July 18, 2013 [1 favorite]
And then what? Pass around root passwords to all your administrators on sticky notes or email? And when you change them every 30/60/90 days?
posted by ish__ at 8:24 AM on July 18, 2013 [1 favorite]
Team Pico here - it's intuitive, easy to use, and most importantly drives real admins into fits of apoplectic rage whenever they see me using it.
posted by Blue Meanie at 8:36 AM on July 18, 2013 [5 favorites]
posted by Blue Meanie at 8:36 AM on July 18, 2013 [5 favorites]
Annoying when these things drop legitimate traffic and the security team gets blamed, but let's be honest: any attacker worth their salt is going to evade a UTM device trivially.
Umm - no. Maybe a team put together by The Fin and Armitage, sure, but most threats are of the automated variety. Black hats have a workflow, and they're not super-geniuses: they all crib off each other, most of their automated attacks work the same way and are usually based off the same code. Disrupt the workflow, and they move on to other targets.
If you get the 7B3PLA or the RBN on your ass, you're in trouble, but that's a long way from "Trivial."
posted by Slap*Happy at 8:42 AM on July 18, 2013 [1 favorite]
Umm - no. Maybe a team put together by The Fin and Armitage, sure, but most threats are of the automated variety. Black hats have a workflow, and they're not super-geniuses: they all crib off each other, most of their automated attacks work the same way and are usually based off the same code. Disrupt the workflow, and they move on to other targets.
If you get the 7B3PLA or the RBN on your ass, you're in trouble, but that's a long way from "Trivial."
posted by Slap*Happy at 8:42 AM on July 18, 2013 [1 favorite]
Pretty simple measures like denyhosts, fail2ban etc deal with like 90% of the bullshit I see hitting my vitualized PBX over at Linode. Which is the only thing resembling an outwardly facing production server I deal with these days.
posted by snuffleupagus at 8:47 AM on July 18, 2013
posted by snuffleupagus at 8:47 AM on July 18, 2013
Man, I saw this Nine trains of a veteran UNIX admin a year ago or more, and thought it was bullshit then. Perhaps I'll make my own list.
A first draft at "Nine trains of a Modern UNIX Admin:"
1. Sudo is mandatory. Not because we make mistakes but because it's easier to audit. And because you shouldn't need to poke around as root, since you have a functioning configuration management tool.
2. Vim, emacs, Eclipse, it's all fine, because your job involves making changes to a git repository from your local workstation and pushing to configuration management.
3. Regex, XSLT, SQL, and Perl should all be given equal weight; for every problem solved correctly with a regex I can show you one with a dozen corner cases.
4.
5. For every problem, there's a solution that's elegant and wrong. Embrace that. 80 percent solutions are often good enough to start finding bugs in your problem definition, and typically provide value immediately.
6. Check the logs. If someone says they did something and it failed, you should have evidence of that.
7.
8. Have a Windows Virtualbox handy.
9. When in doubt, reformat. Servers should be cattle, not pets. They don't have special names, and when one gets sick, you take it out back and shoot it!
Obviously a work in progress, but I've got actual UNIX administration to go do.
posted by pwnguin at 8:53 AM on July 18, 2013 [17 favorites]
A first draft at "Nine trains of a Modern UNIX Admin:"
1. Sudo is mandatory. Not because we make mistakes but because it's easier to audit. And because you shouldn't need to poke around as root, since you have a functioning configuration management tool.
2. Vim, emacs, Eclipse, it's all fine, because your job involves making changes to a git repository from your local workstation and pushing to configuration management.
3. Regex, XSLT, SQL, and Perl should all be given equal weight; for every problem solved correctly with a regex I can show you one with a dozen corner cases.
4.
5. For every problem, there's a solution that's elegant and wrong. Embrace that. 80 percent solutions are often good enough to start finding bugs in your problem definition, and typically provide value immediately.
6. Check the logs. If someone says they did something and it failed, you should have evidence of that.
7.
8. Have a Windows Virtualbox handy.
9. When in doubt, reformat. Servers should be cattle, not pets. They don't have special names, and when one gets sick, you take it out back and shoot it!
Obviously a work in progress, but I've got actual UNIX administration to go do.
posted by pwnguin at 8:53 AM on July 18, 2013 [17 favorites]
Umm - no.
Red Team much? Dave Kennedy's doing a presentation at DefCon where he's showing how about 20 of these devices can be trivially defeated with some basic tunneling.
Black hats have a workflow, and they're not super-geniuses: they all crib off each other, most of their automated attacks work the same way and are usually based off the same code
If you're legitimately worried about automated attacks on your perimeter, you're doing the whole firewall thing wrong. If you're worried about some spear phishing getting someone to open up a reverse tunnel over an encrypted or covert channel... Well then I'm right there with you.
posted by bfranklin at 8:53 AM on July 18, 2013
Red Team much? Dave Kennedy's doing a presentation at DefCon where he's showing how about 20 of these devices can be trivially defeated with some basic tunneling.
Black hats have a workflow, and they're not super-geniuses: they all crib off each other, most of their automated attacks work the same way and are usually based off the same code
If you're legitimately worried about automated attacks on your perimeter, you're doing the whole firewall thing wrong. If you're worried about some spear phishing getting someone to open up a reverse tunnel over an encrypted or covert channel... Well then I'm right there with you.
posted by bfranklin at 8:53 AM on July 18, 2013
Just had a 1990s flashback: Know your System Administrator.
posted by fings at 9:01 AM on July 18, 2013 [1 favorite]
posted by fings at 9:01 AM on July 18, 2013 [1 favorite]
"Oh God, how I loathe cute server names in production. TypeOfServer+SequenceNumber please."
THANK YOU. I have made this argument so many times I can't even count them. NOBODY knows what "BACON SANDWICH" means on the network.
posted by mr_crash_davis at 9:29 AM on July 18, 2013
THANK YOU. I have made this argument so many times I can't even count them. NOBODY knows what "BACON SANDWICH" means on the network.
posted by mr_crash_davis at 9:29 AM on July 18, 2013
Righty-O. Spinning up BACONSANDWICH_0.
posted by snuffleupagus at 9:32 AM on July 18, 2013 [2 favorites]
posted by snuffleupagus at 9:32 AM on July 18, 2013 [2 favorites]
Servers should be cattle, not pets.
Virtualization, and the proliferation of single-purpose servers it encourages, makes this pretty apparent, pretty quickly.
posted by sandettie light vessel automatic at 9:35 AM on July 18, 2013 [2 favorites]
Virtualization, and the proliferation of single-purpose servers it encourages, makes this pretty apparent, pretty quickly.
posted by sandettie light vessel automatic at 9:35 AM on July 18, 2013 [2 favorites]
The sudo thing is ridiculous. I used to like to turn my prompt to bright red whenever I was running as root, just to remind myself not to be monumentally stupid.
I am, however, mostly on board with the "fundamentally lazy" part. If I can turn a task into a shell script and run it as a cron or launchd job, I'll spend *hours* getting it right, just so I don't have to worry about it.
posted by zuhl at 9:36 AM on July 18, 2013 [2 favorites]
I am, however, mostly on board with the "fundamentally lazy" part. If I can turn a task into a shell script and run it as a cron or launchd job, I'll spend *hours* getting it right, just so I don't have to worry about it.
posted by zuhl at 9:36 AM on July 18, 2013 [2 favorites]
Oh God, how I loathe cute server names in production. TypeOfServer+SequenceNumber please. If it dies replace it, you don't need a funeral.
The opposite of this is also true—do not use a naming sequence that will make no sense seven years from now to a person who isn't you.
It is incredibly frustrating when you can't remember whether the service you're trying to troubleshoot is on aab-serv, acb-serv, adb-serv, afb-serv, agb-serv, ajb-serv, amb-serv, anb-serv, apb-serv, aqb-serv, atb-serv, or axb-serv, so you have to connect to server after server until you find the right one.
posted by one more dead town's last parade at 9:40 AM on July 18, 2013 [1 favorite]
The opposite of this is also true—do not use a naming sequence that will make no sense seven years from now to a person who isn't you.
It is incredibly frustrating when you can't remember whether the service you're trying to troubleshoot is on aab-serv, acb-serv, adb-serv, afb-serv, agb-serv, ajb-serv, amb-serv, anb-serv, apb-serv, aqb-serv, atb-serv, or axb-serv, so you have to connect to server after server until you find the right one.
posted by one more dead town's last parade at 9:40 AM on July 18, 2013 [1 favorite]
Nothing beats the guy I worked with who named the SharePoint server Cuyahoga.
I'd break out the CAT5 pom-poms.
GIVE ME A C
GIVE ME U....
they pay off comes when you get to the CUYAHOGACUYAHOGARAHRAHRAH part.
posted by snuffleupagus at 9:41 AM on July 18, 2013 [1 favorite]
I'd break out the CAT5 pom-poms.
GIVE ME A C
GIVE ME U....
they pay off comes when you get to the CUYAHOGACUYAHOGARAHRAHRAH part.
posted by snuffleupagus at 9:41 AM on July 18, 2013 [1 favorite]
I am, however, mostly on board with the "fundamentally lazy" part. If I can turn a task into a shell script and run it as a cron or launchd job, I'll spend *hours* getting it right, just so I don't have to worry about it.
Relevant XKCD.
I used to like vi, but anymore... it's nano for quick config edits, and textpad on windows for anything more involved.
posted by Pogo_Fuzzybutt at 9:44 AM on July 18, 2013 [1 favorite]
Meaningful but silly names are the best. Both for clarity and recall. And sequence numbers if you need them. Or, sometimes, putting the date (or month/year) you stood up the system in the hostname is more useful than a sequence number.
posted by snuffleupagus at 9:44 AM on July 18, 2013
posted by snuffleupagus at 9:44 AM on July 18, 2013
> Nothing beats the guy I worked with who named the SharePoint server Cuyahoga.
We used to have a guy who went with Japanese WWII ships. Twenty+ servers that nobody knew hot to spell the names of.
Bar a few outliers everything's virtualised now. Meaningful codes all the way.
posted by vbfg at 10:43 AM on July 18, 2013 [2 favorites]
We used to have a guy who went with Japanese WWII ships. Twenty+ servers that nobody knew hot to spell the names of.
Bar a few outliers everything's virtualised now. Meaningful codes all the way.
posted by vbfg at 10:43 AM on July 18, 2013 [2 favorites]
vi for quick jobs (and, often, things which started out as quick jobs, like “tweak this Python script/css file”), as well as anything on a remote server, though these days, SublimeText for anything bigger. (It's commercial, but a single licence covers both OSX and Linux.)
I tried Emacs, but found that its fatal flaw was that it was big enough to be an entire operating environment, and at the same time, single-threaded. So you get lulled into the convenience of using it to read mail/read newsgroups/IRC, only to have all your editing sessions freeze whenever the network isn't running optimally.
posted by acb at 10:43 AM on July 18, 2013
I tried Emacs, but found that its fatal flaw was that it was big enough to be an entire operating environment, and at the same time, single-threaded. So you get lulled into the convenience of using it to read mail/read newsgroups/IRC, only to have all your editing sessions freeze whenever the network isn't running optimally.
posted by acb at 10:43 AM on July 18, 2013
And below a certain scale, the cattle/pets distinction vanishes.
posted by acb at 11:04 AM on July 18, 2013
posted by acb at 11:04 AM on July 18, 2013
Twenty+ servers that nobody knew hot to spell the names of.
I always wondered about our IT guy's decision to name a server after George W. Bush's slip of the tongue "Subliminable". Oddly, it was a problem in reverse: for a year or two after I left I still couldn't spell the word correctly.
posted by yerfatma at 11:11 AM on July 18, 2013
I always wondered about our IT guy's decision to name a server after George W. Bush's slip of the tongue "Subliminable". Oddly, it was a problem in reverse: for a year or two after I left I still couldn't spell the word correctly.
posted by yerfatma at 11:11 AM on July 18, 2013
Also: I wonder whether the rise in drone warfare has led to a similar pets->cattle transition in air combat vehicles. I imagine that manned fighters (like B52 bombers and warships) would have names (and possibly hand-painted artwork), though suspect that unmanned drones piloted by flexible pools of console jockeys might just be given sequence numbers.
posted by acb at 11:27 AM on July 18, 2013 [1 favorite]
posted by acb at 11:27 AM on July 18, 2013 [1 favorite]
So I see y'all covered the sudo thing. I'll just add that auditors don't really like it when people log in as an administrative user with no audit trail. I'm less crazy about their insistence on not using default ports.
posted by ob1quixote at 12:29 PM on July 18, 2013
posted by ob1quixote at 12:29 PM on July 18, 2013
If your naming convention is harder to remember than the damn IP address, you've failed at DNS. (IPv4 Only)
posted by jenkinsEar at 12:56 PM on July 18, 2013 [4 favorites]
posted by jenkinsEar at 12:56 PM on July 18, 2013 [4 favorites]
If your naming convention is harder to remember than the damn IP address, you've failed at DNS. (IPv4 Only)
This a thousand times. I'm sick of people using hostnames as tiny fixed-record-length databases to store stuff in.
posted by popechunk at 3:19 PM on July 18, 2013 [4 favorites]
This a thousand times. I'm sick of people using hostnames as tiny fixed-record-length databases to store stuff in.
posted by popechunk at 3:19 PM on July 18, 2013 [4 favorites]
On sudo, I did admin one system where standard practice was to use only su and it worked very well. The reason it worked very well was that every time you created a root shell, on exit it threw you into an editor to write a mail about why you'd used root.
And only tangentially related, but I once cooked up an interview question nobody in the office (or any candidates) got right, though I hadn't thought it was that hard: what does "grep '^asdf$;'" match?
posted by 23 at 9:20 PM on July 18, 2013 [2 favorites]
And only tangentially related, but I once cooked up an interview question nobody in the office (or any candidates) got right, though I hadn't thought it was that hard: what does "grep '^asdf$;'" match?
posted by 23 at 9:20 PM on July 18, 2013 [2 favorites]
I managed to wrangle root out of the BoFH at one place I worked. (I needed to have it; the guy was so bad at his job, doing my own admin was my only hope). He was sure he fixed me by making me use the new-fangled sudo and its fancy audit trails. I wonder what he made of the fact that all that showed up in his logs was a single sudo bash?
posted by Nelson at 8:47 AM on July 19, 2013 [1 favorite]
posted by Nelson at 8:47 AM on July 19, 2013 [1 favorite]
"Oh God, how I loathe cute server names in production. TypeOfServer+SequenceNumber please."
I'm not an admin (so I don't have to think about hundreds/thousands of servers), but cute names make communication so much easier when you don't personally have to deal with too many of them. We're humans, we don't naturally identify things with numbers.
posted by cosmic.osmo at 10:58 AM on July 19, 2013
I'm not an admin (so I don't have to think about hundreds/thousands of servers), but cute names make communication so much easier when you don't personally have to deal with too many of them. We're humans, we don't naturally identify things with numbers.
posted by cosmic.osmo at 10:58 AM on July 19, 2013
like the company I worked with whose server naming scheme was based on deceased employees
what the hell kind of company has enough deceased employees to make a viable pool for server names? you were an IT admin for the mob or something?
"What happened to my files?"
"I ain't saying nothing!"
posted by russm at 10:50 PM on July 27, 2013 [1 favorite]
what the hell kind of company has enough deceased employees to make a viable pool for server names? you were an IT admin for the mob or something?
"What happened to my files?"
"I ain't saying nothing!"
posted by russm at 10:50 PM on July 27, 2013 [1 favorite]
what the hell kind of company has enough deceased employees to make a viable pool for server names? you were an IT admin for the mob or something?
Worse yet was the day they announced a major data center expansion....
posted by Tell Me No Lies at 8:28 AM on July 28, 2013 [1 favorite]
Worse yet was the day they announced a major data center expansion....
posted by Tell Me No Lies at 8:28 AM on July 28, 2013 [1 favorite]
23: "what does "grep '^asdf$;'" match?"
Beginning of line, followed by the left hand homerow, followed by the end of line? Is there a file or something that you think this is present in?
posted by pwnguin at 8:20 PM on July 28, 2013
Beginning of line, followed by the left hand homerow, followed by the end of line? Is there a file or something that you think this is present in?
posted by pwnguin at 8:20 PM on July 28, 2013
pwnguin: “23: "what does "grep '^asdf$;'" match?"Without a filename grep reads from STDIN. I suspect this is the trick in the trick question.
Beginning of line, followed by the left hand homerow, followed by the end of line? Is there a file or something that you think this is present in?”
posted by ob1quixote at 8:27 PM on July 28, 2013
Nope, that's not it. It's not a question about i/o or something, just about how the regex works in this case.
posted by 23 at 1:19 AM on July 29, 2013
posted by 23 at 1:19 AM on July 29, 2013
23: “Nope, that's not it. It's not a question about i/o or something, just about how the regex works in this case.”When I noticed there was no input given, I never really looked further at it. It's obvious to me now. You could feed it a file with a millions lines of 'asdf' and you'd get the same answer as feeding it nothing at all.
posted by ob1quixote at 1:57 AM on July 29, 2013
Wait a minute, I missed that semicolon. I have no idea whether that makes it multiline, or if it ignores the semicolon, or if it's impossible, but it doesn't strike me as an informative question, especially given that your coworkers can't answer it. Seems to do as much good as asking candidates what's north of the north pole.
posted by pwnguin at 11:42 PM on July 29, 2013 [1 favorite]
posted by pwnguin at 11:42 PM on July 29, 2013 [1 favorite]
In Posix Basic Regular Expressions (which grep uses by default) caret and dollar only have special meanings when at the beginning or end of a string (or, for caret, in a character set such as [^asdf]). Otherwise they are literals, so this would match lines beginning with "asdf$;".
it doesn't strike me as an informative question
It wasn't! Knowing any particular piece of unix trivia is irrelevant, though we did want to know how you reasoned about or would look up things you don't know without asking "How many manholes are in New York?" or something else completely irrelevant, as well as giving you a chance to show off if you were really well-informed about something. I shared it here because I thought it was a funny wrinkle in Unix.
posted by 23 at 1:07 AM on July 30, 2013 [2 favorites]
it doesn't strike me as an informative question
It wasn't! Knowing any particular piece of unix trivia is irrelevant, though we did want to know how you reasoned about or would look up things you don't know without asking "How many manholes are in New York?" or something else completely irrelevant, as well as giving you a chance to show off if you were really well-informed about something. I shared it here because I thought it was a funny wrinkle in Unix.
posted by 23 at 1:07 AM on July 30, 2013 [2 favorites]
« Older Pee into Power | Simply Irresistible? Newer »
This thread has been archived and is closed to new comments
What I didn't see on the list was any mention of the command line. It's almost assumed in the regex one. I see people writing programs (or worse, editing files by hand) to parse/modify them when some combination of grep, cut, sed, awk, find and xargs will almost always do what they want.
The major exception to that is XML. Holy crap do I hate XML.
posted by DU at 5:14 AM on July 18, 2013 [3 favorites]