Tuesday, April 6, 2021

Recent Questions - Server Fault

Recent Questions - Server Fault

Good architecture for redis cluster in HA scenario with low writes and high reads?

Posted: 06 Apr 2021 10:12 PM PDT

I was going through different clustering docs of redis available online and came across two types of clustering.

1) 3 nodes running on 6 machines, with slots divided between nodes, each node has one master one      slave.  2) one master and two slave running on 3 machines with sentinel running on all three.

How are the two different given in the first also the slave becomes master if the master goes down? It also has a sentinel service running.

I am confused between which deployment strategy should we use, our application is written in java and jedis is used as a connector.

Details of requirement.

Txns

100-500 million hits in 24 hrs,  max in one minute 10 millions      read txn > write txn *.1 million      each write entry size < 4 Kb

Expected perfomrance

 very fast reads   fast enough writes    torelable write loss   less tolerable read loss    (read might return null, that is data loss occured but cluster should be active)   (read from cluster should not fail Less than 0.0001%)

We can flush the entries after 24 hrs or lesser time cycle.

Tolerable data loss The data we are maintaining is stale tokens so we can tolerate fine amount of ocassional data loss

Hardware we are felxible to any harware configution.

Enabling Journaling in Exchange Online

Posted: 06 Apr 2021 09:46 PM PDT

I'm trying to migrate a small company from an ancient, on-premise Linux mail server over to Exchange Online. One of their core requirements is that they need copies of all inbound and outbound e-mail to be saved in a separate mailbox called "group", where none of the messages can be deleted.

My understanding was that journaling could do this, but as I'm preparing to enable it, the documentation seems to say that you can't journal to another Exchange Online mailbox, so I'm a little puzzled as to how this works with Exchange Online.

Can someone explain how this could be done with or without journaling?

Apache2: Disable web services and only use mod_proxy

Posted: 06 Apr 2021 09:23 PM PDT

Is there a way to disable the webserver functionality of the Apache2 webserver and only use mod_proxy?

Routing IP packets coming to SoC A over to SoC B

Posted: 06 Apr 2021 09:18 PM PDT

I have an evaluation board that has two embedded SoCs running Linux with one of them being IMX8 (SoCB) while the other being a custom one (let's call it SoCA).

Both the SoCs are connected over USB, and there's a USB interface coming up in SoCB.

  • SoCA has rmnet_data0 interface, which is configured to talk to the ISP to set up data calling on Terminal Equipment (whichever device is connected to it over USB).

  • What I am looking to do is be able to receive/send IP packets in SoCB through SoCA; basically routing the packets coming from ISP to SoCA over to SoCB.

ISP <-> SoCA <-> SoCB

rmnet interface on SoCA (sorry couldn't copy right now)

// USB interface on SoCB  usb0      Link encap:Ethernet  HWaddr 1E:C8:CD:E5:74:76            inet6 addr: fe80::1cc8:cdff:fee5:7476/64 Scope:Link            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1            RX packets:15 errors:0 dropped:0 overruns:0 frame:0            TX packets:24 errors:0 dropped:0 overruns:0 carrier:0            collisions:0 txqueuelen:1000            RX bytes:880 (880.0 B)  TX bytes:1902 (1.8 KiB)

The interface on SoCB doesn't have an IPv4. Would the initial step be to statically assign an IP to it (which perhaps sets the subnet itself?)

I have seen some articles/threads like this that use IP tables but they seem to be using ports which I'm uncertain of.

Though after reading up a bit, would the following suffice?

iptables -t nat -A PREROUTING -d <SoCA-IP> -j DNAT --to-destination <SoCB-IP>

AWS code commit how to block put, push, pull access to branch

Posted: 06 Apr 2021 07:30 PM PDT

I am trying to create an IAM policy to block a user from making any write changes to a branch on code commit. It would be great to block read access as well, but I don't know if that is happen. I need them to have access to other branches, but one in particular, read only.

{      "Version": "2012-10-17",      "Statement": [          {              "Sid": "VisualEditor0",              "Effect": "Allow",              "Action": "codecommit:GitPull",              "Resource": "arn:aws:codecommit:us-east-1:9192919:mybranch"          },          {              "Sid": "VisualEditor1",              "Effect": "Deny",              "Action": [                  "codecommit:MergePullRequestByFastForward",                  "codecommit:PutFile",                  "codecommit:GitPush",                  "codecommit:DeleteBranch"              ],              "Resource": "arn:aws:codecommit:us-east-1:9192919:mybranch",              "Condition": {                  "Null": {                      "codecommit:References": "false"                  },                  "StringEqualsIfExists": {                      "codecommit:References": "refs/heads/prod1"                  }              }          }      ]  }

Server Fans Never Slow Down After Speeding Up

Posted: 06 Apr 2021 05:54 PM PDT

I have a server motherboard in a large tower case with several hard disks installed. It's basically a media server that serves over CIFS.

I'm using the 'sensors' command on linux to monitor the system temperatures. It typically runs around 70c, but if it gets a tough load (downloading several things, hashing the downloaded content) it can cause the fans to spin up to max. An first this would happen briefly, then the fans would spin down after the system cooled. Now, however, the fans never spin down and just howl at full speed forever until the system is shut down for a moment then booted again. Rebooting vs hard cycling the system, curiously, often results in the fans never leaving the "bad state" and they stay on full power.

Troubleshooting steps I've tried:

  • Alter bios temp control settings
  • clean and reapply thermal paste
  • double-check fan header connections
  • clean dust off internal components

I'm using:

  • CentOs 6.8
  • Tyan S8230 motherboard
  • (2) 12-core opteron CPUs
  • (2) Small Noctua case fans
  • (2) Generic, medium case fans that came with the case.
  • (2) std cpu coolers that came with the CPUs

How to calculate the optimal number of replicas for AKS

Posted: 06 Apr 2021 05:39 PM PDT

I'm a beginner on AKS and there are a lot of notions that I don't really understand. For example, I tried to deploy a node of 3 (agent_count_value) agents of type Standard_B2s and 2 replicas (num_replicas) but I had an error:

Deployment request failed due to insufficient compute resource. For the specified compute target, 2 replicas cannot be created per specified CPU/Memory configuration(0.1 CPU Cores, 0.5GB Memory). You can address this problem by adjusting number of replicas, using a different CPU/memory configuration, or using a different compute target. InnerException None ErrorResponse

Knowing that a VM of type Standard_B2s has 4 GB of RAM and 2 cores I don't understand how assigning 2 replicas for 3 VMs of type Standard_B2s can return this error.

Can someone tell me how to calculate the optimal number of replicas for a given VMs node?

Thank you in advance for your help

Amazon Linux 2 - EC2 PostgreSQL

Posted: 06 Apr 2021 05:39 PM PDT

I've the following:

  • Amazon Linux 2
  • Postgres 12 installed a user created

I'm using ssh to connect to my instance.

The issue is that it doesn't let me to connect to my postgres database. I've created a user using something like:

create user myuser with encrypted password 'strongpassword';

and postgres server is running ok, but when i try to connect to my db it throws:

$: psql -h localhost --port 5432 --password -U myuser -d mydb        psql: error: FATAL:  Ident authentication failed for user "myuser"

I don't know why it doesn't recognize my user.

Thanks in advance

SSH tunnel attempt. Unable to establish SSH connection without actual shell. (Arch Linux)

Posted: 06 Apr 2021 08:28 PM PDT

So I'm trying to figure out how to establish a tunnel, but nothing else. I don't want the user to have shell access.

I found this ssh tunneling only access

Is this information outdated or something? Everytime I try to login through ssh where I've set the shell of the user to /usr/(s)bin/nologin, or /bin/false, bin/true, etc.,

instead of saying:

This account is currently not available.

it says:

Permission denied, please try again.

Password is correct. I know this with absolute certainty because I typed it out and then pasted it into the console to make sure there were no mistakes. Changing the user's shell back to nologin and trying to reconnect with the same password that worked with an actual shell still in the clipboard it said Permission denied.

I've tried putting ForcedCommand internal-sftp in the config file, but that didn't do anything either.

I've tried using one those scripts I found from searching to make a fakesh and set the user's shell to that, but ssh doesn't accept that either. The only way to make it work is to set the user to an actual shell. What is going on here?

Can you implement token based authentication/authorization without a 3rd party?

Posted: 06 Apr 2021 04:39 PM PDT

fyi I'm a total newbie to server stuff (I'm an app developer, trying to implement a simple but secure api back end)

It sounds simple enough, user sends his username/password, if it authenticates, you give them a token, and they include that token in all future requests.

But every example I find online to use a 3rd party auth provider (like auth0 or Facebook) for the log-in part of this process.

Is there a reason why I cant just send an encrypted username and password in a regular api request to my own server, check it against a table that contains a hashed password, and generate a token on my own server? If not why isn't there any examples of this, if there are please point me to it.

I'm developing with ktor (kotlin), but any java style language such as node will do.

Licensing Windows Server 2016 for limited RDP use on a single workgroup server

Posted: 06 Apr 2021 05:50 PM PDT

I have a Windows Server 2016 Standard in a Workgroup and a Windows Server 2019 Standard (which should never need anything other than the allowed Admin users) that is going to be an Active Directory/Domain Controller in the very near future. Due to some unexpected circumstances I have discovered that an application that was just migrated to the 2016 server needs to allow 3-5 RDP based users directly on the server with the application for the foreseable future.

I was never planning on joining the 2016 server to the new domain and was always planning for it to be isolated in a Workgroup, but I am horribly confused over RDP licensing as well as the whole workgroup/active directory business. What happens if I turn on RDP licensing service on the 2016 server? Can even do RDP licensing on the 2016 server without it being in a domain?

I've already read this doc and honestly I'm still super confused: https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license

Thanks.

Why is my server using a well known port as source port

Posted: 06 Apr 2021 03:42 PM PDT

Is it normal that my server is requesting 8.8.8.8 dns with 22/udp as source port? How can i get it to use unregistered ports only

.htaccess redirect based on the visitors host name, not IP address

Posted: 06 Apr 2021 06:02 PM PDT

I have done several attempts to figure out how to redirect visitors from the visitors hostname to some other place.

I know with IP this works:

RewriteCond %{REMOTE_ADDR} ^185\.93\.180\.* [OR]  RewriteCond %{REMOTE_ADDR} ^188\.143\.232\.31  RewriteRule ^(.*)$ attacker_reroute.php

But in this case, I need to do it by domain, any suggestions?

Something like

RewriteCond %{REMOTE_HOST} *\.badguys\.com

Check if someones connected to PC through Windows RDP

Posted: 06 Apr 2021 03:01 PM PDT

Is there any way to tell whether someone is already connected to a computer through Windows' "Remote Desktop Connection"? Me and a co-worker need to remotely connect to a PC in our remote office, and we keep kicking each other out of the session when trying to connect (if the other one is connected). Could you perhaps check if the RDP port 3389 is in use?

GCP: How can I view all services / resources in an organization

Posted: 06 Apr 2021 03:37 PM PDT

How can I view, or list, all services / resources in a Google Cloud organization?

Basically I want to take audit of what services are active / inactive, prior to deleting the organization.

Automatically add certain AD users to local admintrator

Posted: 06 Apr 2021 04:58 PM PDT

I am trying to setup an AD domain and I have certain users that need some "power" privileges for installing software on their own machine and on their own machine only.

Which is the correct and the best way to achive this? I am thinking on creating a users group called Power Users, add the users I want to be eligible, but I am missing how to apply this only on their own computers. I don't want that their are local admin while they trying loggin on other users computers.

Nginx error 403 on file upload - passing multipart/form-data to the proxy/server

Posted: 06 Apr 2021 04:01 PM PDT

I have a very simple Nginx server that forwards traffic from subdomain to my http server on port 8000 like so :

server {      listen       80;      server_name *.localhost;        location / {          proxy_pass http://localhost:8000;          proxy_set_header Host            $host;          proxy_set_header X-Forwarded-For $remote_addr;      }  }

My http server then takes care of everything by reading the hostame etc and it's working fine for any basic api/json requests.

Now i'm trying to send a file to my server but get a 403 error from nginx on sending the file / multipart form data.

From reading the doc i'm a bit confused as " upload_pass_args " seems to require a dedicated route configured in the conf file and that's not something i want at all. I just need the multipart / form data passed to my server's router to be handled ( the http server on :8000 )

I've also try to include sendfile on; in both my server{} or inside location{} but to no success.

Is this an IIS issue or a Database Issue? Non Concurrent collections must have exclusive access

Posted: 06 Apr 2021 07:04 PM PDT

I am using asp.net core api with EF core and today I got this error message and it confuses me as of why it could have happened.

Operations that change non-concurrent collections must have exclusive access. A concurrent update was performed on this collection and corrupted its state. The collection's state is no longer correct.     at System.Collections.Generic.Dictionary`2.FindEntry(TKey key)     at System.Collections.Generic.Dictionary`2.TryGetValue(TKey key, TValue& value)     at Mapster.TypeAdapterConfig.Remove(TypeTuple key)     at Mapster.TypeAdapterConfig.NewConfig[TSource,TDestination]()     at InventoryService.GetCategories(Int32 inventoryCenterId)     at Controllers.InventoriesController.GetCategories(Int32 centerId)

this is the code it is referring to.

      TypeAdapterConfig<Category, CategoryDto>             .NewConfig()             .IgnoreIf((src, dest) => string.IsNullOrEmpty(src.MetaTitle), dest => dest.MetaTitle)            .IgnoreIf((src, dest) => string.IsNullOrEmpty(src.MetaDescription), dest => dest.MetaDescription);            var categories = dbContext.Centers.Where(x => x.Id == CenterId).SelectMany(x => x.Categories).OrderBy(x => x.Name).ToList();          return categories.Adapt<List<CategoryDto>>();

It seemed like anyone who tried to access that method go the same error. I did an IIS reset and all was good but I am trying to figure out what happened.

Not sure what else to add.

How do I remove a user's home directory without deleting the user?

Posted: 06 Apr 2021 10:08 PM PDT

[root@Acheron ~]# systemctl status shadow  ● shadow.service - Verify integrity of password and group files     Loaded: loaded (/usr/lib/systemd/system/shadow.service; static; vendor preset: disabled)     Active: failed (Result: exit-code) since Tue 2019-05-14 13:59:34 EDT; 1s ago    Process: 25502 ExecStart=/bin/sh -c /usr/bin/pwck -r || r=1; /usr/bin/grpck -r && exit $r (code=exited, status=1/FAILURE)   Main PID: 25502 (code=exited, status=1/FAILURE)    May 14 13:59:34 Acheron systemd[1]: Started Verify integrity of password and group files.  May 14 13:59:34 Acheron sh[25502]: user 'netdata': directory '/home/netdata' does not exist  May 14 13:59:34 Acheron sh[25502]: pwck: no changes  May 14 13:59:34 Acheron systemd[1]: shadow.service: Main process exited, code=exited, status=1/FAILURE  May 14 13:59:34 Acheron systemd[1]: shadow.service: Failed with result 'exit-code'.

This user should not have a home directory. I'd like to update its entry in /etc/passwd to remove the home directory. I could edit this file directly, but that seems unsafe. Is there a better way?

MySQL 8 on CentOS 7 - after update to 8.0.16-1, service won't start

Posted: 06 Apr 2021 05:01 PM PDT

This morning, I updated MySQL as there was an update available, but since then, the service won't start.

Below is a screen grab from the output from systemctl status mysqld.service - the error seems to be "no such file or directory", but I can see the data...

The output from systemctl status mysqld.service

From mysqld.log

2019-04-29T07:52:12.107195Z 0 [Warning] [MY-010915] [Server] 'NO_ZERO_DATE', 'NO_ZERO_IN_DATE' and 'ERROR_FOR_DIVISION_BY_ZERO' sql modes should be used with strict mode. They will be merged with strict mo$  2019-04-29T07:52:12.110473Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.16) starting as process 7100  2019-04-29T07:52:12.113297Z 0 [Warning] [MY-013242] [Server] --character-set-server: 'utf8' is currently an alias for the character set UTF8MB3, but will be an alias for UTF8MB4 in a future release. Please$  2019-04-29T07:52:12.113317Z 0 [Warning] [MY-013244] [Server] --collation-server: 'utf8_general_ci' is a collation of the deprecated character set UTF8MB3. Please consider using UTF8MB4 with an appropriate $  2019-04-29T07:52:19.927908Z 4 [System] [MY-013381] [Server] Server upgrade from '80015' to '80016' started.  2019-04-29T07:52:31.456525Z 4 [System] [MY-013381] [Server] Server upgrade from '80015' to '80016' completed.  2019-04-29T07:52:45.173350Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.  2019-04-29T07:52:45.195659Z 0 [ERROR] [MY-010270] [Server] Can't start server : Bind on unix socket: Address already in use  2019-04-29T07:52:45.195686Z 0 [ERROR] [MY-010258] [Server] Do you already have another mysqld server running on socket: /var/lib/mysql/mysql.sock ?  2019-04-29T07:52:45.196385Z 0 [ERROR] [MY-010119] [Server] Aborting  2019-04-29T07:52:47.560115Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.16)  MySQL Community Server - GPL.  2019-04-29T07:55:48.983870Z 0 [Warning] [MY-010915] [Server] 'NO_ZERO_DATE', 'NO_ZERO_IN_DATE' and 'ERROR_FOR_DIVISION_BY_ZERO' sql modes should be used with strict mode. They will be merged with strict mo$  2019-04-29T07:55:48.986909Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.16) starting as process 3667  2019-04-29T07:55:49.229362Z 0 [Warning] [MY-013242] [Server] --character-set-server: 'utf8' is currently an alias for the character set UTF8MB3, but will be an alias for UTF8MB4 in a future release. Please$  2019-04-29T07:55:49.229394Z 0 [Warning] [MY-013244] [Server] --collation-server: 'utf8_general_ci' is a collation of the deprecated character set UTF8MB3. Please consider using UTF8MB4 with an appropriate $  2019-04-29T07:58:43.922205Z 0 [Warning] [MY-010915] [Server] 'NO_ZERO_DATE', 'NO_ZERO_IN_DATE' and 'ERROR_FOR_DIVISION_BY_ZERO' sql modes should be used with strict mode. They will be merged with strict mo$  2019-04-29T07:58:43.924734Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.16) starting as process 4362  2019-04-29T07:58:43.927787Z 0 [Warning] [MY-013242] [Server] --character-set-server: 'utf8' is currently an alias for the character set UTF8MB3, but will be an alias for UTF8MB4 in a future release. Please$  2019-04-29T07:58:43.927807Z 0 [Warning] [MY-013244] [Server] --collation-server: 'utf8_general_ci' is a collation of the deprecated character set UTF8MB3. Please consider using UTF8MB4 with an appropriate $  2019-04-29T07:58:45.734055Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.  2019-04-29T07:58:45.739086Z 0 [ERROR] [MY-010270] [Server] Can't start server : Bind on unix socket: Address already in use  2019-04-29T07:58:45.739110Z 0 [ERROR] [MY-010258] [Server] Do you already have another mysqld server running on socket: /var/lib/mysql/mysql.sock ?  2019-04-29T07:58:45.739676Z 0 [ERROR] [MY-010119] [Server] Aborting  2019-04-29T07:58:47.828539Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.16)  MySQL Community Server - GPL.  2019-04-29T08:21:45.104646Z 0 [Warning] [MY-010915] [Server] 'NO_ZERO_DATE', 'NO_ZERO_IN_DATE' and 'ERROR_FOR_DIVISION_BY_ZERO' sql modes should be used with strict mode. They will be merged with strict mo$  2019-04-29T08:21:45.108410Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.16) starting as process 4826  2019-04-29T08:21:45.111420Z 0 [Warning] [MY-013242] [Server] --character-set-server: 'utf8' is currently an alias for the character set UTF8MB3, but will be an alias for UTF8MB4 in a future release. Please$  2019-04-29T08:21:45.111440Z 0 [Warning] [MY-013244] [Server] --collation-server: 'utf8_general_ci' is a collation of the deprecated character set UTF8MB3. Please consider using UTF8MB4 with an appropriate $  2019-04-29T08:21:49.874453Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.  2019-04-29T08:21:49.891328Z 0 [ERROR] [MY-010270] [Server] Can't start server : Bind on unix socket: Address already in use  2019-04-29T08:21:49.891353Z 0 [ERROR] [MY-010258] [Server] Do you already have another mysqld server running on socket: /var/lib/mysql/mysql.sock ?  2019-04-29T08:21:49.892014Z 0 [ERROR] [MY-010119] [Server] Aborting  2019-04-29T08:21:52.722060Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.16)  MySQL Community Server - GPL.

I've tried un-installing the update (but found a line in the mysqld.log that says 'downgrade not avialable'. I've tried deleting ib_logfile0 & ib_logfile1 as suggested in another forum.

Please help...

EDIT:

I've tried the solution from MySQL PID file missing (as I couldn't see a pid file), so did:

chmod 0777 /var/lib/mysql/ib_logfile0  chmod 0777 /var/lib/mysql/ib_logfile1  chown -R mysql:root /var/lib/mysql

The error has changed - below is the updated output from systemctl status mysqld.service

[root@360loa5 mysql]# systemctl status mysqld.service  ● mysqld.service - MySQL Server     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)     Active: failed (Result: exit-code) since Mon 2019-04-29 09:21:52 BST; 7min ago       Docs: man:mysqld(8)             http://dev.mysql.com/doc/refman/en/using-systemd.html    Process: 4826 ExecStart=/usr/sbin/mysqld $MYSQLD_OPTS (code=exited, status=1/FAILURE)    Process: 4807 ExecStartPre=/usr/bin/mysqld_pre_systemd (code=exited, status=0/SUCCESS)   Main PID: 4826 (code=exited, status=1/FAILURE)     Status: "SERVER_BOOTING"      Error: 98 (Address already in use)    Apr 29 09:21:44 360loa5.360ss.com systemd[1]: Starting MySQL Server...  Apr 29 09:21:52 360loa5.360ss.com systemd[1]: mysqld.service: main process exited, code=exited, status=1/FAILURE  Apr 29 09:21:52 360loa5.360ss.com systemd[1]: Failed to start MySQL Server.  Apr 29 09:21:52 360loa5.360ss.com systemd[1]: Unit mysqld.service entered failed state.  Apr 29 09:21:52 360loa5.360ss.com systemd[1]: mysqld.service failed.

In the output from

sudo netstat -lntup

there isn't anything listed for port 3306...

openssl verify error 2 at 1 depth lookup:unable to get issuer certificate

Posted: 06 Apr 2021 05:01 PM PDT

Openssl is telling me it can't verify my concatenated cert. I downloaded the intermediate cert from the issuer (AlphaSSL) and concatenated that with my domain cert I purchased (domain cert first, then the AlphaSSL intermediate cert) as instructed by google app engine. I then followed their instructions for verifying:

openssl verify -verbose -CAfile mycert_cat.crt mycert_cat.crt

I tried to verify using the above and received this error message:

mycert_cat.crt: /C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2  error 2 at 1 depth lookup:unable to get issuer certificate

I googled it, but the results said I forgot to append the cert to the file. I did not.

What else can cause this issue?

SQL Server Kerberos Configuration Manager error "The LDAP server is unavailable"

Posted: 06 Apr 2021 10:08 PM PDT

Running v3.1 of the SQL Server Kerberos Configuration Manager (KerberosConfigMgr) on Windows Server 2012 against a SQL Server Developer 2016 instance on same server.

Running tool as admin (logged in to server as domain admin account).

Default blank details specified in the Kerberos tool. I have also tried entering details of another server running same version of SQL along with my domain admin user account details, with same result.

The application thinks for about 10 seconds then responds with error message "Unable to access User Principal information from the System"

Log has the following:

10/31/2017 2:41:09 AM Error: Access of User Principal information failed System.DirectoryServices.AccountManagement.PrincipalServerDownException: The server could not be contacted. ---> System.DirectoryServices.Protocols.LdapException: The LDAP server is unavailable.     at System.DirectoryServices.Protocols.LdapConnection.Connect()     at System.DirectoryServices.Protocols.LdapConnection.SendRequestHelper(DirectoryRequest request, Int32& messageID)     at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)     at System.DirectoryServices.AccountManagement.PrincipalContext.ReadServerConfig(String serverName, ServerProperties& properties)     --- End of inner exception stack trace ---     at System.DirectoryServices.AccountManagement.PrincipalContext.ReadServerConfig(String serverName, ServerProperties& properties)     at System.DirectoryServices.AccountManagement.PrincipalContext.DoServerVerifyAndPropRetrieval()     at System.DirectoryServices.AccountManagement.PrincipalContext..ctor(ContextType contextType, String name, String container, ContextOptions options, String userName, String password)     at System.DirectoryServices.AccountManagement.PrincipalContext..ctor(ContextType contextType, String name)     at KerberosCM.WMIHelper.TryGetUser(SystemInfo mi, UserPrincipal& user)

As a test, I have successfully run ADFind to get a listing of admin users from the default DC.

I have tried all solutions from this post to no avail (no orphaned GUID users in local administrators group, run tool as a different user account) Kerberos Configuration Manager for SQL Server error "unable to access user principal information from the system"

Any ideas what else I can do here?

Bacula storage daemon won't write to labeled volume

Posted: 06 Apr 2021 08:03 PM PDT

My Bacula configuration won't write to any labeled volume, as long as it's outside of /tmp. When the SD is configured to write to /tmp however, everything works flawlessly.

[herpderp@neuromediator2 home]$ ls -lah  total 8.0K  drwxr-xr-x.  4 root     root       34 Feb 22 15:01 .  dr-xr-xr-x. 17 root     root     4.0K Feb 22 15:27 ..  drwxr-xr-x.  3 bacula   tape       20 Feb 22 15:03 bacula  drwx------. 14 herpderp herpderp 4.0K Feb 22 17:02 herpderp

I set the proper permissions to let Bacula write to a specific directory, yet without success. The error message I get is below:

Jobs waiting to reserve a drive:  ====    Terminated Jobs:  JobId  Level    Files      Bytes   Status   Finished        Name   ===================================================================   2  Full          0         0   Cancel   22-Feb-16 16:16 BackupClient1   7  Full          0         0   Cancel   23-Feb-16 10:19 BackupClient1   1  Full        639    55.76 M  OK       23-Feb-16 10:20 Full_backup   2  Full        697    60.58 M  OK       23-Feb-16 10:21 Full_backup   3  Full          0         0   Cancel   23-Feb-16 11:48 Full_backup    ====    Device status:    Device "Storage" (/home/bacula/storage/) is not open.   Device is BLOCKED waiting to create a volume for:     Pool:        File     Media type:  File    ==    ====     Used Volume status:   ====     ====

How to install a default ssl cert for apache on debian

Posted: 06 Apr 2021 06:06 PM PDT

Learning linux skills...please be patient!

I have found lots of tutorials on installing a cert for a single site but not a default.

I have a wildcard cert for my domain. I had support install this cert installed on a server. Since I am learning linux server skills I want to install this on a Debian server with Apache. I want it to be the default ssl cert for all sites regardless of domain name unless they have their own ssl cert.

The place where I bought the cert has text that I can copy and paste for:

  • Server Certificate
  • Intermediate Certificate
  • Root Certificate

I have found the sites-enabled and sites-available folders with various files. I have also found the ssl cert folder.

I am finding different tutorials that have terms like private key, SSL cert, intermediate cert, etc. It seems that there are a few terms that are used interchangeably.

I think the process is:

  1. Create files (keys/certs) with a certain owner and permission in the certs folder.
  2. Edit default site configuration data in either the sites-available or sites-enabled folders or both.
  3. Restart Apache.

My questions:

  1. Are my steps above correct?
  2. What sections of my cert correspond to what file names in the certs folder?
  3. What do I add for a default ssl virtual host? Does this go in the sites-available or sites-enabled folder or both?

I realize that I don't know some things...What else do I need to know?

PS. ISPConfig is installed on this server but there does not seem to be a place to do what I want to do. I will eventually want to know how to create a site specific ssl cert as well.

How to use environment variable in haproxy?

Posted: 06 Apr 2021 07:04 PM PDT

I work with haproxy 1.5.2 My haproxy.cfg has this server definitions:

server  HALB_ucd1 ${UCD1_END_POINT_IP}:${UCD1_END_POINT_PORT} check port 8444

I set the UCD1_END_POINT_IP and UCD1_END_POINT_PORT in the bash and start haproxy with service haproxy restart

The haproxy restarted OK but the UCD1_END_POINT_IP and UCD1_END_POINT_PORT are not resolved. I see that as per haproxy doc it is supported:

    Any part of the address string may reference any number of environment      variables by preceding their name with a dollar sign ('$') and optionally      enclosing them with braces ('{}'),     similarly to what is done in Bourne shell.

If I change it for hard coded ip and port it works fine. What do I miss?

Thank you!

pam_mount not working when logging in from ssh or console

Posted: 06 Apr 2021 09:02 PM PDT

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines.

But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, and su to a user who needs the hmoe dir mounted pam_mount works fine and mount the home dir.

the error i get, when i ssh or log in from console is found in /var/log/messages:

Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:64): Errors from underlying mount program:  Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): mount error(13): Permission denied  Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)  Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:521): mount of tomas failed  Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:172): conv->conv(...): Conversation error  Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:476): warning: could not obtain password interactively either  Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:64): umount messages:  Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:68): umount: /home/tomas: not mounted  Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:722): unmount of tomas failed  Feb 13 14:33:59 centosy kernel: Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE  Feb 13 14:33:59 centosy kernel: CIFS VFS: Send error in SessSetup = -13  Feb 13 14:33:59 centosy kernel: CIFS VFS: cifs_mount failed w/return code = -13

my pam.d/system-auth:

#%PAM-1.0  # This file is auto-generated.  # User changes will be destroyed the next time authconfig is run.  auth        required      pam_env.so  auth        sufficient    pam_unix.so nullok try_first_pass  auth        requisite     pam_succeed_if.so uid >= 500 quiet  auth        sufficient    pam_ldap.so use_first_pass  auth        required      pam_deny.so  auth        optional      pam_mount.so    account     required      pam_unix.so broken_shadow  account     sufficient    pam_localuser.so  account     sufficient    pam_succeed_if.so uid < 500 quiet  account     [default=bad success=ok user_unknown=ignore] pam_ldap.so  account     required      pam_permit.so    password    requisite     pam_cracklib.so try_first_pass retry=3 type=  password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok  password    sufficient    pam_ldap.so use_authtok  password    required      pam_deny.so    session     optional      pam_keyinit.so revoke  session     required      pam_limits.so  session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid  session     required      pam_unix.so  session     optional      pam_ldap.so  session     optional      pam_mount.so  session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam.d/password-auth:

#%PAM-1.0  # This file is auto-generated.  # User changes will be destroyed the next time authconfig is run.  auth        required      pam_env.so  auth        sufficient    pam_unix.so nullok try_first_pass  auth        requisite     pam_succeed_if.so uid >= 500 quiet  auth        sufficient    pam_ldap.so use_first_pass  auth        required      pam_deny.so  auth        optional      pam_mount.so    account     required      pam_unix.so broken_shadow  account     sufficient    pam_localuser.so  account     sufficient    pam_succeed_if.so uid < 500 quiet  account     [default=bad success=ok user_unknown=ignore] pam_ldap.so  account     required      pam_permit.so    password    requisite     pam_cracklib.so try_first_pass retry=3 type=  password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok  password    sufficient    pam_ldap.so use_authtok  password    required      pam_deny.so    session     optional      pam_keyinit.so revoke  session     required      pam_limits.so  session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid  session     required      pam_unix.so  session     optional      pam_ldap.so  session     optional      pam_mount.so  session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam_mount.conf.xml:

?xml version="1.0" encoding="utf-8" ?>  <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">  <!--          See pam_mount.conf(5) for a description.  -->    <pam_mount>                <!-- debug should come before everything else,                  since this file is still processed in a single pass                  from top-to-bottom -->    <debug enable="0" />                    <!-- Volume definitions -->  <volume user="*" fstype="cifs" server="zentyal" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="sec=ntlmsspi,nodev,nosuid" />                    <!-- pam_mount parameters: General tunables -->    <!--  <luserconf name=".pam_mount.conf.xml" />  -->    <!-- Note that commenting out mntoptions will give you the defaults.       You will need to explicitly initialize it with the empty string       to reset the defaults to nothing. -->  <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />  <!--  <mntoptions deny="suid,dev" />  <mntoptions allow="*" />  <mntoptions deny="*" />  -->  <mntoptions require="nosuid,nodev" />    <logout wait="0" hup="0" term="0" kill="0" />                      <!-- pam_mount parameters: Volume-related -->    <mkmountpoint enable="1" remove="true" />      </pam_mount>

can anyone see the error, and knows how to fix this?

Export munin data, import it and rebuilt html and graph

Posted: 06 Apr 2021 08:03 PM PDT

I am trying to read data collected from a server to an other server.

Reading Change a Munin server and keep the data seems show a way to do this.

  • exporting rrd database using rrdtool dump
  • importing rrd dump using rrdtool restore

Next I declare in the destination server the hostname list in /etc/munin/munin.conf

[server1]     use_node_name yes     update no

Now, I would like munin recreate the html pages and the graphs corresponding to the hostname list.
How to force recreation (without new data) ?

Update Even the index.html is not updated and does not include a link to server1

Can't boot VM after P2V or ghost - Linux 2.6

Posted: 06 Apr 2021 06:06 PM PDT

I got this old machine that runs on a p2 400 and a Linux Debian 3.1 with kernel 2.6.8 and since it has modified binaries due to internal undocumented changes in the code, migrating off manually isn't an option, so I was trying to P2V this box with VMWare Converter and had no luck.

The P2V resulted in a VM that hangs on a black screen but I can get it to boot off a LiveCD like CloneZilla. I tried in this order :

  • Recreated grub config
  • tried various SCSI BUSes in the VM config
  • Ghosted the physical machine to restore it on the virtual machine, same result

Is it normal that a bootable CD can see the disks but not the virtual BIOS?

Any idea what could cause this and how to solve? could it have to do with the fact the machine is based off IDE HDDs and that the virtual machine uses scsi/sata?

Thanks

haproxy header rewrite to lower case

Posted: 06 Apr 2021 09:02 PM PDT

I have a custom app behind an haproxy server. Can haproxy rewrite the case of the header?

For example changing http://www.company.com/ABC to http://www.company.com/abc

If so, how?

Samba config and Mac OS X mounting

Posted: 06 Apr 2021 04:01 PM PDT

I'm aware that his question should maybe be posted on SuperUser. But as it probably has something to do with the Samba server, i'm posting it here.

I'm trying to mount one of my Samba shares in Mac OS X, but haven't had any luck yet. I'm able to mount the same share as a networkdrive in Windows XP.

I have tried to mount it in various ways, CMD+K in finder and the following command in terminal mount_smbfs ⁄⁄dev_domain_tld@192.168.1.54/homes /Users/philip/share

The output of that command is just the help thingy, i have tried many possible combinations

usage: mount_smbfs [-Nh] [-d mode] [-f mode]                 //[domain;][user[:password]@]server[/share] path

Samba config on FreeBSD:

[global]  workgroup = domi  hosts allow = 192.168.0.0/255.255.0.0  server string = Webserver  security = share  socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192  remote announce = 192.168.1.2  local master = no  wins server = 192.168.1.2  dns proxy = no  idmap uid = 16777216-33554431  idmap gid = 16777216-33554431  template shell = /bin/nologin  winbind use default domain = no    [homes]  comment = Home Directories  valid users = %S  writable = yes  browsable = yes    [web]  path = /home/web  read only = no  writeable = yes  browsable = no  valid users = myadminusername
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)