That said, I installed Duplicity on a test-server and started experimenting with it. As I’m fairly familiar with GnuPG and PGP encryption, I reckoned that the ideal setup would be the standard public/private key structure and only have the public key installed on the server. The private key would be stored elsewhere. So far so good, Duplicity asked for the public key in its configure, but it still asked for the passphrase when running. Surely, you could store the passphrase in plain text and parse it to Duplicity, but that’s kind of pointless, as it defeats the purpose of a passphrase.

Now you may say ‘Hey! you probably already store the backups without encryption anyways, so what’s the point?’ The point is that there could be backups from other servers stored in the S3 bucket. If you save the passphrase (and somehow gets your hand on the private key), these are all compromised too. If you were instead able to encrypt the backup just using the public key, without the passphrase, these backups would be a lot more secure.

As it turns out, that is possible with GnuPG — just not with Duplicity (AFAIK). The key is to encrypt the backups with the public key as the ‘recipient.’ I’m not going to tell you how to get up and running with GnuPG (see this page instead).

Assuming you’ve installed the public key (gpg –import your-public-key), all you need to for encrypting a file without entering the passphrase is as follows:

gpg –encrypt –recipient ‘the-email-in@your-key.net’ filename

Pretty easy, right?

If we want to pull that into a script, we just need s3cmd to the mix, and we’re pretty much all set. You will also need to configure s3cmd (s3cmd –configure) with your AWS information.

Here’s the script I ended up with. Please note that the path I backup only includes achieves generated from another backup script. Also, the archive only includes files with the extension tbz, bz2 and tar. I’m sure you could play with s3cmd’s ‘rexclude’ feature to write a pretty RegEx, but it wasn’t worth the time for me.

#!/bin/sh

# Path to backup
BACKUP=/path/to/backup/archive

for i in `find $BACKUP -type f | grep -v .gpg`
do gpg –batch –encrypt –recipient ‘the-email-in@your-key.net’ $i
done

s3cmd sync -r $BACKUP –exclude=’.tbz’ –exclude=’.bz2′ –exclude=’.gz’ s3://your-bucket/`hostname -s`/

Enjoy. If you have any comments, please let me know.

So what is Chronicle.IM? The slogan for the product is ‘Write the story of your life.’ That sums it up pretty well. It is an online journaling/diary app that allows you to keep track of your life in with ease and style. While I don’t want to reveal all the details now, let’s just say that we’ve focused on simplicity and usability. You won’t be disappointed.

Nginx

(/etc/monit/conf.d/nginx.conf)

check process nginx with pidfile /var/run/nginx.pid
group www
start program = “/etc/init.d/nginx start”
stop program = “/etc/init.d/nginx stop”
if children > 250 then restart
if loadavg(5min) greater than 10 for 8 cycles then stop
if 3 restarts within 5 cycles then timeout

Download

Disk usage

(/etc/monit/conf.d/diskusage.conf)

check filesystem md3 with path /dev/md3
group server
if failed permission 660 then unmonitor
if failed uid root then unmonitor
if failed gid disk then unmonitor
if space usage > 80 % then alert
if inode usage > 80 % then alert

Download

Please note that the above script monitors ‘/dev/md3.’ You can replace this with the path to the file system you want to monitor, such as /dev/sda1 or /dev/hda1. You can also configure Monit to take actions based on certain criterions, but I left that part out as I didn’t find any need for it. You can read more about that here. If you want to monitor more file systems, simply repeat the above config with a different ‘path.’

Once you’ve added you new configs, you need to restart Monit (/etc/init.d/monit restart).

For Red iGone we use Apache as the web-server, and PostgreSQL as the database. I wanted to configure Monit to keep an eye on these processes. As it turns out, setting up Monit was really straight-forward.

I tried this on Ubuntu 9.10 and 10.04. If you try this on a different Ubuntu version (or other distribution), it is likely that you will need to make changes to apache.conf and postgresql.conf.

Install Monit

Installing Monit on Ubuntu is dead simple. Just run:

sudo apt-get install monit


Configure Monit

Now let’s configure Monit. We start with the generic config-file. Open /etc/monit/monitrc in your favorite editor and add the following line:

include /etc/monit/conf.d/*


Important: Change permission on the folder /etc/monit/conf.d as it will include your email password stored in plain text.

sudo chmod a-rwx,u=rwX -R /etc/monit/conf.d/


Next we need to edit /etc/default/monit and change “startup=0″ to “startup=1″.

Now we’re ready to really start configuring Monit. Just to keep things, organized, I’ve broken down the Monit’s settings into three files:

• basic.conf
• apache.conf
• postgresql.conf

In basic.conf I’ve put the generic Monit-configs, and then broken out Apache’s and PosgreSQL’s configs into their own files.

basic.conf

(/etc/monit/conf.d/basic.conf)

set daemon 60
set logfile syslog facility log_daemon

set mailserver smtp.gmail.com port 587
username “user@domain.com” password “password”
using tlsv1
with timeout 30 seconds

set alert admin@domain.com

set httpd port 2812 and
use address localhost
allow localhost
allow admin:monit

check system localhost
if loadavg (1min) > 4 then alert
if loadavg (5min) > 2 then alert
if memory usage > 75% then alert
if cpu usage (user) > 70% then alert
if cpu usage (system) > 30% then alert
if cpu usage (wait) > 20% then alert

Download

The above file is configured to send email using Google Apps or Gmail. Just change your username and password according to your needs. I’ve also enabled Monit’s webserver that allows you to view Monit’s status directly in your browser. Access is restricted to localhost and you need to login with the username ‘admin’ and password ‘monit.

I prefer to restrict access to just localhost, and then use a SSH-tunnel to gain access.

apache.conf

(/etc/monit/conf.d/apache.conf)

check process apache2 with pidfile /var/run/apache2.pid
group www
start program = “/etc/init.d/apache2 start”
stop program = “/etc/init.d/apache2 stop”
if children > 250 then restart
if loadavg(5min) greater than 10 for 8 cycles then stop
if 3 restarts within 5 cycles then timeout

Download

This is pretty straight forward. Assuming you use the Apache-distribution that came with Ubuntu, you shouldn’t need to modify anything.

postgresql.conf

(/etc/monit/conf.d/posgresql.conf)

check process postgresql with pidfile /var/run/postgresql/8.4-main.pid
group database
start program = “/etc/init.d/postgresql-8.4 start”
stop program = “/etc/init.d/postgresql-8.4 stop”
if failed unixsocket /var/run/postgresql/.s.PGSQL.5432 protocol pgsql then restart
if failed unixsocket /var/run/postgresql/.s.PGSQL.5432 protocol pgsql then alert
if failed host localhost port 5432 protocol pgsql then restart
if failed host localhost port 5432 protocol pgsql then alert
if 5 restarts within 5 cycles then timeout

Download

The same thing applies here. Assuming you used the PosgreSQL-version (8.4) that came with Ubuntu, you shouldn’t need to modify anything here.

Final steps

Now that you have configured all the files, all that needs to be done is to fire up Monit and make verify that it is running. To launch Monit, simply run:

sudo /etc/init.d/monit start


You can verify that Monit is running either by browsing to the webserver or checking /var/log/syslog. You should also receive an email that says that Monit is now running.

Assuming everything went well, you also want to make sure that Monit actually starts a daemon if it is failing. A simple way to do that is to run:

sudo killall apache2


That should kill Apache. Monit should be able to detect that and fire it back up shortly. Again, you should be able to monitor Monit’s process either by email, the web-interface, or in /var/log/syslog.

That’s it. Good luck!

Update: I decided to extend this guide and wrote another article on how to monitor Nginx and disk-usage with Monit.

Since I already spent the time getting it running, I thought I’d share the instructions for getting it running. It’s pretty straight forward, but there are a few minor things that took me some time to get around.

Installation

Optional: I personally prefer to install the do ‘minimal’ version of Ubuntu. You can install this mode by simply hitting F4 right at boot.

Other than the installing the ‘minimal’ system, the only things you would need to keep in mind are to install “LAMP” and “OpenSSH” under the Software selection. You will also need to pick a MySQL password, which will be used later.

Configuration

Upgrade the package repository:
sudo apt-get update && sudo apt-get upgrade

Install all required dependencies:
sudo apt-get install build-essential ffmpeg libmysqlclient-dev libjpeg-dev libssl-dev libdate-manip-perl wget liblwp-useragent-determined-perl libavformat-dev libphp-serialization-perl libswscale-dev joe

Get Zoneminder:
wget http://www.zoneminder.com/downloads/ZoneMinder-1.24.2.tar.gz

Extract Zoneminder and change permission:
sudo tar xvfz ZoneMinder-1.24.2.tar.gz -C /usr/local/
sudo chown -R `whoami` /usr/local/ZoneMinder-1.24.2

Configure Zoneminder:
cd /usr/local/ZoneMinder-1.24.2
./configure --with-webdir=/var/www/zm --with-cgidir=/usr/lib/cgi-bin/ --with-webuser=www-data --with-webgroup=www-data ZM_DB_USER=zm ZM_DB_NAME=zm ZM_DB_PASS=yourpassword ZM_SSL_LIB=openssl


Resolve a bug (discussed more here):
joe src/zm_utils.cpp (or your favorite editor)
Add the line ‘#include ‘ on row 22 (or somewhere in that general area). To exit and save with Joe, press ctrl+k x.

Build and install Zoneminder
make
sudo make install

Configure the database:
mysql -uroot -p < db/zm_create.sql
echo "GRANT ALL PRIVILEGES ON zm.* TO 'zm'@'localhost' IDENTIFIED BY 'yourpassword'; FLUSH PRIVILEGES;" | mysql -uroot -p

Install Cambozola:
cd
wget http://www.charliemouse.com:8080/code/cambozola/cambozola-latest.tar.gz
tar xvfz cambozola-latest.tar.gz
sudo cp cambozola-0.76/dist/cambozola.jar /var/www/zm/

Make Zoneminder the root-page in Apache:
sudo joe /etc/apache2/sites-enabled/000-default

Change "DocumentRoot /var/www" to "DocumentRoot /var/www/zm" and "Directory /var/www/" to "Directory /var/www/zm/"

Restart Apache:
sudo /etc/init.d/apache2 restart

Change some system parameters:
sudo sysctl kernel.shmall=134217728
sudo sysctl kernel.shmmax=134217728

Make the system parameters permanent:
sudo joe /etc/sysctl.conf

Add the following lines at the end:
kernel.shmall=134217728
kernel.shmmax=134217728

Install the startup-script (from the official site):
sudo wget http://viktorpetersson.com/upload/zm -O /etc/init.d/zm
sudo chmod +x /etc/init.d/zm
sudo update-rc.d zm defaults
sudo /etc/init.d/zm start

That's it. You should now have a fully working version of ZoneMinder. All you need to do now is to point your browser to the IP address of the server.

- Delete any vmdk.lck directries
- Delete any vmem.lck directories
- Delete the quicklook-cache.png file
- Edit the .vmx file and set to FALSE entries for USB, SOUND and SERIAL.

Ubuntu 10.04 LTS is a great Linux distribution, with one exception: Grub. I really mean it. Grub is probably the worst boot loader to date. Is so bad that it could equally well be replaced with the following shell script:


echo ""
sleep 10


The better alternative to Grub is obviously Lilo. While it may be obsolete, poorly updated and 20 years old, it does one thing that Grub doesn’t: it works. Personally I couldn’t care less about fancy splash screens and all the bells and whistles that Grub can put on it’s repertoire. It’ doesn’t matter when it cannot boot the system. Please Ubuntu, just ditch Grub and make Lilo the default boot loader.

Today I just released version 0.2. It is using the latest LTS version of Ubuntu (10.04) and ZoneMinder 1.24.2. I’ve also reduced the size of the VM significantly. The new version is about 1GB extracted and around 350MB compressed.

For more information about the VM and how to download it, please visit this page.