Wednesday, April 7, 2021

Recent Questions - Server Fault

Recent Questions - Server Fault


How to route IPv6 across ports in Cisco ISR

Posted: 07 Apr 2021 10:01 PM PDT

I have a Cisco ISR router with 4 ports. We own our IPv4 addresses and handle them via BGP, but my datacenter provider assigned us a IPv6 network. I've successfully added the IPv6 network to GigibitEthernet0/0/0 and an able to ping the upstream gateway. I'm trying to connect a computer directly to GigabitEthernet0/0/3 and assign it a IPv6 address in the range (2001:550:xx:xx::249.3/112), but that computer can't ping the gateway at all.

I'm looking for some advice on how best to setup that 2nd port so that the IPv6 traffic can be routed over to Gi0/0/0 and ultimately to the upstream gateway.

I suspect I just need to setup a route between gi0/0/3 and gi0/0/0 but I'm not sure how to do that

My configuration:

interface GigabitEthernet0/0/0   ip address xx.xx.xx.114 255.255.255.248   media-type sfp   negotiation auto   ipv6 address 2001:550:xx:xx::249:0/112 eui-64  !  interface GigabitEthernet0/0/1   no ip address   media-type sfp   negotiation auto  !  interface GigabitEthernet0/0/3   no ip address   negotiation auto  !  
sh int GigabitEthernet0/0/3  GigabitEthernet0/0/3 is up, line protocol is up     Hardware is ISR4431-X-4x1GE, address is 00xx.xxx.d423 (bia xxx.428a.d423)    MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,        reliability 255/255, txload 1/255, rxload 1/255    Encapsulation ARPA, loopback not set    Keepalive not supported     Full Duplex, 1000Mbps, link type is auto, media type is RJ45    output flow-control is on, input flow-control is on    ARP type: ARPA, ARP Timeout 04:00:00  
ping 2001:550:xx:xx::249:1  Type escape sequence to abort.  Sending 5, 100-byte ICMP Echos to 2001:550:xx:xx::249:1, timeout is 2 seconds:  !!!!!  

Apache 2.4.46 launched from working AWS EC2 AMI runs but will not respond

Posted: 07 Apr 2021 10:07 PM PDT

I launched a new instance of an Amazon Linux 2 server (from a daily backup snapshot). Everything looks normal and Apache starts but it will not respond to requests. I have ssh access and I can see that HTTP requests are coming in from the internet. Server has been running fine for months.

[ec2-user@ip-172-31-XXXXXX ~]$ httpd -v  Server version: Apache/2.4.46 ()  Server built:   Aug 24 2020 18:54:20  [ec2-user@ip-172-31-90-216 ~]$ wget localhost  --2021-04-08 04:29:35--  http://localhost/  Resolving localhost (localhost)... 127.0.0.1  Connecting to localhost (localhost)|127.0.0.1|:80... connected.  HTTP request sent, awaiting response... 504 Gateway Timeout  2021-04-08 04:30:36 ERROR 504: Gateway Timeout.  

Normally I should receive a 404 response, not a timeout! I can't get my server back online. All the configs look correct. Nothing in the error log that I see.

What am I missing? I can see incoming requests timing out.

I have been trying to get this back online for three hours...

I restarted and rebooted, even reinstalled apache with no luck. Service is running.

[ec2-user@ip-172-31-xxxx ~]$ sudo systemctl status httpd  ● httpd.service - The Apache HTTP Server     Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)    Drop-In: /usr/lib/systemd/system/httpd.service.d             └─php-fpm.conf     Active: active (running) since Thu 2021-04-08 05:04:26 UTC; 57s ago       Docs: man:httpd.service(8)   Main PID: 2996 (httpd)     Status: "Total requests: 0; Idle/Busy workers 83/16;Requests/sec: 0; Bytes served/sec:   0 B/sec"     CGroup: /system.slice/httpd.service             ├─2996 /usr/sbin/httpd -DFOREGROUND             ├─2997 /usr/sbin/httpd -DFOREGROUND             ├─2999 /usr/sbin/httpd -DFOREGROUND             ├─3004 /usr/sbin/httpd -DFOREGROUND             ├─3006 /usr/sbin/httpd -DFOREGROUND             ├─3011 /usr/sbin/httpd -DFOREGROUND             └─3057 /usr/sbin/httpd -DFOREGROUND    Apr 08 05:04:26 ip-172-31-xxxx.ec2.internal systemd[1]: Starting The Apache HTTP Server...  Apr 08 05:04:26 ip-172-31-xxxx.ec2.internal systemd[1]: Started The Apache HTTP Server.  

Error log

$ sudo tail /var/log/httpd/error_log  [Thu Apr 08 04:28:57.966581 2021] [suexec:notice] [pid 2309] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)  [Thu Apr 08 04:28:58.049821 2021] [lbmethod_heartbeat:notice] [pid 2309] AH02282: No slotmem from mod_heartmonitor  [Thu Apr 08 04:28:58.049925 2021] [http2:warn] [pid 2309] AH10034: The mpm module (prefork.c) is not supported by mod_http2. The mpm determines how things are processed in your server. HTTP/2 has more demands in this regard and the currently selected mpm will just not do. This is an advisory warning. Your server will continue to work, but the HTTP/2 protocol will be inactive.  [Thu Apr 08 04:28:58.056290 2021] [mpm_prefork:notice] [pid 2309] AH00163: Apache/2.4.46 () OpenSSL/1.0.2k-fips configured -- resuming normal operations  [Thu Apr 08 04:28:58.056327 2021] [core:notice] [pid 2309] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'  [Thu Apr 08 04:30:36.009806 2021] [proxy_fcgi:error] [pid 2343] (70007)The timeout specified has expired: [client 127.0.0.1:36884] AH01075: Error dispatching request to : (polling)  [Thu Apr 08 04:31:01.250830 2021] [proxy_fcgi:error] [pid 2341] (70007)The timeout specified has expired: [client 52.7.78.221:11600] AH01075: Error dispatching request to : (polling)  [Thu Apr 08 04:31:01.913877 2021] [proxy_fcgi:error] [pid 2342] (70007)The timeout specified has expired: [client 3.239.43.177:45496] AH01075: Error dispatching request to : (polling)  [Thu Apr 08 04:35:18.853149 2021] [proxy_fcgi:error] [pid 3025] (70007)The timeout specified has expired: [client 127.0.0.1:36934] AH01075: Error dispatching request to : (polling)  [Thu Apr 08 04:35:23.560609 2021] [proxy_fcgi:error] [pid 3031] (70007)The timeout specified has expired: [client 158.51.21.11:59070] AH01075: Error dispatching request to : (polling), referer: https://example.com  

rollup plugin-commonjs module is not defined

Posted: 07 Apr 2021 09:18 PM PDT

I required one commonjs module with @rollup/plugin-commonjs plugin to build, my config:

plugins: [     babel({       exclude: 'node_modules/**',       babelHelpers: 'bundled',     }),     resolve(),     commonjs({       transformMixedEsModules: true,     }),   ],  

my commonjs code like this:

!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).Aegis=t()}(this, ()=>{})  

after rollup build, the code is like this:

!function (e, t) {      "object" == (_typeof(exports)) && "undefined" != 'object' ? module.exports = t() : (e = "undefined" != typeof globalThis ? globalThis : e || self).Aegis = t();    }(undefined, function () {....  

obviously, the moudle in statement "undefined" != _typeof(module) became "undefined" != 'object', when my umd js execute in browser, this is an error, module is not defined...

Why can't I edit IIS XML configuration files with gvim on Windows 10?

Posted: 07 Apr 2021 08:27 PM PDT

When I try to open C:\Windows\system32\inetsrv\config\schema\IIS_schema.xml for example on Windows 10 Pro, build 20H2, I can always open it in notepad, but if I open it in gvim (a real editor) it pretends like the file doesn't exist.

I've even run gvim as a domain administrator and it still makes like it doesn't exist. I've never seen this sort of behavior before, it's really strange.

Wildcard SSL or Automatically Install New Ones?

Posted: 07 Apr 2021 08:18 PM PDT

I'm very new to SSLs and trying to figure out if something is possible to do.

I have a VPS with Ubuntu 20.04 and have multiple domains pointing to the /var/www/html directory. Some are pointed using an A Record and others use a CNAME. Not sure if that really matters.

Is there any way to install an SSL so any domain that's pointed to my server will work?

And if not, is there any way to have Ubuntu automatically recognize when a new domain has been pointed to the server and issue a certificate from Let's Encrypt? For example, the first time a visitor goes to the domain, the server could recognize that it doesn't have an SSL installed for that domain and just does it on the fly?

Attempting to drop packets to simulate a network failure

Posted: 07 Apr 2021 07:23 PM PDT

I have a switch running Linux with multiple devices on it. I'm attempting to simulate a network outage on one of the devices.

I've attempted to drop the packets with both netem and iptables using either one of the commands:

tc qdisc add dev <interface> root netem loss 100%

or

iptables -A INPUT -i <interface> -p all -j DROP

However, the device stays connected.

Any ideas?

NFS super simple user mapping between Windows (NFS "share") and Unix (mount_nfs)

Posted: 07 Apr 2021 06:43 PM PDT

I have a Windows 2012 server system all firewalled off to do one particular task only converting files using a program that only runs on Windows. That Windows server exports a directory (a so called "share") through NFS. I managed to mount_nfs that on Unix (FreeBSD) and I can put files in and use this NFS directory as a mailbox to pass files in and out.

Except the user ids and permission bits. The user and group id comes as some ridiculously large number, like 4294967294. I have already then created a group on the Unix system with that GID and added the user who needs to write and read to this NFS directory into that group.

But the problem is that the files in Windows all appear with mode bits 700 to the Unix side, so I cannot be user foo in group bar reading these files that the Windows system produced. Likewise the files I stick into that NFS tree on the Unix side, I need to give them mod 666 so that the Windows thing can read them.

I wish there was a simple way to tell the mount_nfs to map that one number to the local user who will use this thing and that's it. I don't want to start some usermap daemon and get into all the horror of configuring these things with Windows. I am already considering myself extremely lucky I can just share the NFS volume.

I could also use the umask 000 on Unix to just write the files with all bits on. But what can I do on that windows system to make sure all files written to that NFS "share" will have the read and write permissions to everyone?

Exchange 2013 Hybrid EAC not seeing mailboxes in a second domain

Posted: 07 Apr 2021 06:07 PM PDT

We have a hybrid setup.

I have a situation where certain users are not showing up on the local on-prem Exchange 2013 server under recipients.

We have two domains in our single forest. I will call our primary domain abc.com and the second domain xyz.local.

The users in the xyz.local domain just recently were added as cloud only 365 users and this past weekend, I merged their local domain accounts with their 365 accounts and modified Azure AD Connect to sync with both xyz.local as well as abc.com. Azure AD Connect syncs are working.

The users who do not show are all in the xyz.local domain. It is like the on-premise exchange server is not aware of the Active Directory partition that contains the xyz.local domain.

I tried to modify some of the attributes in AD on some of the users in xyz.local and then they started showing up in recipients -> mailboxes in the Exchange admin center for the on-prem Exchange server.

These are the attributes I modified, matching them with attributes from a user in abc.com:

targetAddress to user@tenantname.mail.onmicrosoft.com msExchRemoteRecipientType to 6 msExchRecipientDisplayType to -2147483642 msExchRecipientTypeDetails to 2147483648 msExchVersion to 44220983382016

I am not sure if it is just one of the above attribute changes that allows the user to start showing in the on-premise Exchange server recipient mailboxes, or a combo of attributes.

However, once the user from xyz.local shows up, I get an error if I try to view or modify any properties via the Exchange admin center (on-prem):

The call to Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)' returned an error. Error details No suitable domain controller was found in domain 'xyz.local'. Errors: .

I am wondering if you might have any advice. It seems like maybe the on-premise Exchange server just needs to be made aware of xyz.local. I did a lot of searching and have not been able to figure out if there is a setting in EAC or a PowerShell command that I should run in the Exchange Management Shell. Any help would be much appreciated.

Why EC2 and DigitalOcean's new server IPs are blocked in Spamhaus, Microsoft etc?

Posted: 07 Apr 2021 05:27 PM PDT

I need to verify some email addresses. So I was trying to do this job with Golang's mailck and checkmail packages.

The problem is when I try to verify any hotmail/outlook email, my DigitalOcean server IP is getting blocked by their mail server.

Screenshot of DigitalOcean

The same issue is happening on my AWS EC2 instance. In this case, EC2 IP is blacklisted on Spamhaus.

Screenshot of EC2

Both of my EC2 and DigitalOcean servers are newly created. So there is no chance of getting blocked for spamming.

I would like to know why do Microsoft/Spamhaus block the IP range of EC2 and DigitalOcean.

Docker daemon ignores daemon.json on boot

Posted: 07 Apr 2021 07:24 PM PDT

My Docker Daemon seems to ignore /etc/docker/daemon.json on boot.

Similar to this question, I'm having some troubles telling the Docker daemon that it should not use the default 172.17.* range. That range is already claimed by our VPN and prevents people connected through that VPN from making a connection to the server Docker runs on.

The hugely annoying thing is that every time I reboot my server, Docker claims an IP from the VPN's range again, regardless of what I put in /etc/docker/daemon.json. I have to manually issue

# systemctl restart docker  

directly after boot before people on the 172.17.* network can reach the server again.

This obviously gets forgotten quite often and leads to many problem tickets.

My /etc/docker/daemon.json looks like this:

{   "default-address-pools": [     {        "base": "172.20.0.0/16",        "size": 24     }   ]  }  

and is permissioned like so:

-rw-r--r--   1 root root   123 Dec  8 10:43 daemon.json  

I have no idea how to even start diagnosing this problem; any ideas?

For completeness:

  • Ubuntu 18.04.5 LTS
  • Docker version 19.03.6, build 369ce74a3c

EDIT: output of systemctl cat docker:

# /lib/systemd/system/docker.service  [Unit]  Description=Docker Application Container Engine  Documentation=https://docs.docker.com  After=network-online.target firewalld.service containerd.service  Wants=network-online.target  Requires=docker.socket  Wants=containerd.service    [Service]  Type=notify  # the default is not to use systemd for cgroups because the delegate issues still  # exists and systemd currently does not support the cgroup feature set required  # for containers run by docker  ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock  ExecReload=/bin/kill -s HUP $MAINPID  TimeoutSec=0  RestartSec=2  Restart=always    # Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.  # Both the old, and new location are accepted by systemd 229 and up, so using the old location  # to make them work for either version of systemd.  StartLimitBurst=3    # Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.  # Both the old, and new name are accepted by systemd 230 and up, so using the old name to make  # this option work for either version of systemd.  StartLimitInterval=60s    # Having non-zero Limit*s causes performance problems due to accounting overhead  # in the kernel. We recommend using cgroups to do container-local accounting.  LimitNOFILE=infinity  LimitNPROC=infinity  LimitCORE=infinity    # Comment TasksMax if your systemd version does not support it.  # Only systemd 226 and above support this option.  TasksMax=infinity    # set delegate yes so that systemd does not reset the cgroups of docker containers  Delegate=yes    # kill only the docker process, not all processes in the cgroup  KillMode=process    [Install]  WantedBy=multi-user.target  

Output of sudo docker info (after systemctl restart docker):

Client:   Debug Mode: false    Server:   Containers: 34    Running: 19    Paused: 0    Stopped: 15   Images: 589   Server Version: 19.03.6   Storage Driver: overlay2    Backing Filesystem: extfs    Supports d_type: true    Native Overlay Diff: true   Logging Driver: json-file   Cgroup Driver: cgroupfs   Plugins:    Volume: local    Network: bridge host ipvlan macvlan null overlay    Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog   Swarm: inactive   Runtimes: runc   Default Runtime: runc   Init Binary: docker-init   containerd version:    runc version:    init version:    Security Options:    apparmor    seccomp     Profile: default   Kernel Version: 4.15.0-140-generic   Operating System: Ubuntu 18.04.5 LTS   OSType: linux   Architecture: x86_64   CPUs: 16   Total Memory: 47.16GiB   Name: linuxsrv   ID: <redacted>   Docker Root Dir: /var/lib/docker   Debug Mode: false   Username: <redacted>   Registry: https://index.docker.io/v1/   Labels:   Experimental: false   Insecure Registries:    127.0.0.0/8   Registry Mirrors:    http://172.16.30.33:6000/   Live Restore Enabled: false    WARNING: No swap limit support  

Nginx Reverse Proxy Can't Show Slide/Banner

Posted: 07 Apr 2021 09:13 PM PDT

I face a problem with nginx reverse proxy, anything works fine except for some images that didn't show, which is images at slides/carousel/banner. Another images show properly. I don't know if the issue related to javascript or anything, here is my config.

server {        listen 80;          server_name example.net;          location / {            proxy_pass http://example.com;            proxy_set_header Accept-Encoding "";            sub_filter "http://example.com/" "http://example.net/";            sub_filter 'href="http://example.com/' 'href="http://example.net/';            sub_filter 'src="http://example.com/' 'src="http://example.net/';            sub_filter 'action="http://example.com/'         'action="http://example.net/';            sub_filter_once off;            proxy_set_header X-Real-IP $remote_addr;            proxy_set_header X-Forwarded-Host $host;            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        }  }  

So after I found the problem is in the code at example.com like below

<div id="bannerSlider" style="display:none" v-show="bannerShow">      <div class="kv lazyload" id="mainKv" v-if="bannerLength > 1">          <div class="owl-carousel owl-theme">              <template v-for="item in banner">                  <div class="item" v-if="item.TargetLink != ''">                      <a :href="item.TargetLink" :target="item.PopUpLink ? '_blank':'_self'">                          <img :src="'/Content/common/images/catch/' + item.ImgId" :title="item.Title">                      </a>                  </div>                  <div class="item" v-else>                      <img :src="'/Content/common/images/catch/' + item.ImgId" :title="item.Title">                  </div>              </template>          </div>  

Anyone can help?

Websocket based website behind a reverse proxy in IIS

Posted: 07 Apr 2021 09:55 PM PDT

I'm trying to get a websocket based website to work that is being reverse proxied by an IIS server.

Situation

  • IIS v10.0.19041.1 running on Windows 10 Pro.
  • SSL certificate from LetsEncrypt and installed/managed by Win-ACME into IIS.
  • FoundryVTT v0.7.3 dedicated server running in a FreeNAS 11.4-RELEASE-p2 jail (this is the websocket based website).
  • FoundryVTT uses socket.io for node.js.
  • FoundryVTT server is at IP 192.168.2.36 and Port 30000.

Observation

  • The FoundryVTT server works fine on LAN.
  • The SSL certificate is valid and working and the server is approachable from WAN.
  • Everything works fine upon loading the FoundryVTT set-up page via WAN, however as soon as I've entered my Admin Access Key I'm presented with an empty set-up page. The FoundryVTT community mentions that this is a known issue with wrongly configured proxies. Empty Setup page
  • Upon Observing the web traffic using Fiddler v5.0.2020.18177 I observe that I do get to the point of a 101 HTTP response to switch protocol to websocket.Fiddler websocket response
  • Double-clicking the capture does not let me go to the websocket tab to inspect traffic there. I suspect that no connection is made at all as I see several more 101 switch protocol responses after the initial first one with slight delays in between.

What have I tried

  • I have verified that I have the WebSocket Protocol feature installed. Windows Features - WebSocket Protocol

  • I have verified that websockets are enabled on my website in IIS. IIS - Configuration Editor - webSocket

  • I have tried messing around with the web.config by following various suggestions people made on the internet (i.e. this, this and this). web.config as it is now:

      <?xml version="1.0" encoding="UTF-8"?>    <configuration>        <system.webServer>            <rewrite>                <rules>                    <clear />                    <rule name="Web Socket Reverse" enabled="true" stopProcessing="true">                        <match url="ws:///example.com:30000(.*)" />                        <conditions logicalGrouping="MatchAll" trackAllCaptures="false">                        </conditions>                        <action type="Rewrite" url="ws://192.168.2.36:30000/{R:1}" />                    </rule>                    <rule name="Web Socket Reverse 2" enabled="true" stopProcessing="true">                        <match url="wss://example.com:30000(.*)" />                        <conditions logicalGrouping="MatchAll" trackAllCaptures="false">                        </conditions>                        <action type="Rewrite" url="wss://192.168.2.36:30000/{R:1}" />                    </rule>                    <rule name="HTTPS redirect" enabled="true" stopProcessing="true">                        <match url="(.*)" />                        <conditions logicalGrouping="MatchAll" trackAllCaptures="false">                            <add input="{HTTPS}" pattern="^OFF$" />                        </conditions>                        <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" />                    </rule>                         <rule name="FoundryVTT proxy" stopProcessing="true">                      <match url="(.*)" />                      <conditions logicalGrouping="MatchAll" trackAllCaptures="false">                        <add input="{HTTP_HOST}" pattern="example.com" />                      </conditions>                      <action type="Rewrite" url="http://192.168.2.36:30000/{R:1}" />                      <serverVariables>                        <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="{HTTP_ACCEPT_ENCODING}" />                        <set name="HTTP_ACCEPT_ENCODING" value="" />                      </serverVariables>                    </rule>                    <rule name="RequestBlockingRule1" enabled="true" patternSyntax="Wildcard" stopProcessing="true">                        <match url="*" />                        <conditions logicalGrouping="MatchAll" trackAllCaptures="false">                            <add input="{URL}" pattern="*" />                            <add input="{HTTP_HOST}" pattern="example.com" negate="true" />                        </conditions>                        <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />                    </rule>                </rules>                <outboundRules>                    <rule name="RestoreAcceptEncoding" preCondition="NeedsRestoringAcceptEncoding">                      <match serverVariable="HTTP_ACCEPT_ENCODING" pattern="^(.*)" />                      <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />                      <action type="Rewrite" value="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" />                    </rule>                    <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">                        <match filterByTags="A, Form, Img" pattern="^http(s)?://192.168.2.36:30000/(.*)" />                        <action type="Rewrite" value="http{R:1}://example.com/{R:2}" />                    </rule>                    <preConditions>                      <preCondition name="ResponseIsHtml1">                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />                      </preCondition>                      <preCondition name="NeedsRestoringAcceptEncoding">                        <add input="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" pattern=".+" />                      </preCondition>                    </preConditions>                  </outboundRules>                <rewriteMaps>                    <!--{MapProtocol:{HTTPS}}-->                    <rewriteMap name="MapProtocol">                        <add key="on" value="https" />                        <add key="off" value="http" />                    </rewriteMap>                </rewriteMaps>            </rewrite>            <urlCompression doStaticCompression="false" doDynamicCompression="false" />        </system.webServer>    </configuration>  
  • I've restarted the IIS website, used incognito mode in my browser, disabled add-ons and used a different browser.

  • I've looked at guides on how to configure it for NGINX, Caddy and Apache as inspiritation (IIS is not present on the wiki).

  • I've asked around on their Discord chat, but nobody seems to know enough about IIS.

A snippet from the IIS log when visiting the FoundryVTT website:

    2020-10-12 16:04:13 192.168.2.11 POST /setup X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=8c5986c1-768f-4833-b71b-04ed4bae47f1&SERVER-STATUS=302 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 302 0 0 35      2020-10-12 16:04:13 192.168.2.11 GET /setup X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=fddb90ae-27b7-4cce-b3b0-a6864d451514&SERVER-STATUS=200 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 200 0 0 25      2020-10-12 16:04:13 192.168.2.11 GET /css/style.css X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=0a2d276f-6985-4fd7-9d21-1e4f63cacb80&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 26      2020-10-12 16:04:13 192.168.2.11 GET /fonts/fontawesome/css/all.min.css X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=78f40fa3-22bd-47ac-8987-03ec7ea70a5d&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 23      2020-10-12 16:04:13 192.168.2.11 GET /scripts/jquery.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=f94993ac-23a7-4b71-8db9-45b564c91a40&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 22      2020-10-12 16:04:13 192.168.2.11 GET /scripts/handlebars.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=cf0118b0-6a3d-4fb1-8654-abfbcfc6af35&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 21      2020-10-12 16:04:13 192.168.2.11 GET /scripts/handlebars-intl.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=b76f116d-213f-44b8-9479-8ed79157c623&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 21      2020-10-12 16:04:13 192.168.2.11 GET /scripts/foundry.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=94e56a90-ae3e-4095-bb40-00ae04033be1&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 27      2020-10-12 16:04:13 192.168.2.11 GET /scripts/howler.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=31c85a47-e7f8-40e6-b242-79377bb9136f&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 27      2020-10-12 16:04:13 192.168.2.11 GET /scripts/pixi.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=ffb1b3d7-00cf-4d68-8cf9-e3e87bf6b811&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 27      2020-10-12 16:04:13 192.168.2.11 GET /scripts/socket.io.slim.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=4f937d01-ead6-437c-9e4e-fc050ccd2556&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 27      2020-10-12 16:04:13 192.168.2.11 GET /scripts/tinymce.min.js X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=343bfaca-427e-47a1-a168-b4250f62fc0e&SERVER-STATUS=304 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 https://example.com/setup 304 0 0 27      2020-10-12 16:04:13 192.168.2.11 GET /socket.io/ session=ne19sc1orug1dsk7ndn1u4i7&EIO=3&transport=websocket&X-ARR-CACHE-HIT=0&X-ARR-LOG-ID=7afb0d81-b323-4e94-8ae7-c1a90bc2ef1c&SERVER-STATUS=101 443 - SOMEHOST.net Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36 - 502 5 12152 53  

Apache2 Won't Start: (98)Address already in use: AH00072: make_sock: could not bind to address 0.0.0.0:80

Posted: 07 Apr 2021 08:01 PM PDT

I've been trying to use Apache2 to put an SSL certificate on my Ubuntu Server 18.04.4 LTS for Nextcloud, and I can't even get a far as to start Apache. I keep getting this error:

Error Picture

I've looked up solutions to this and found about a hundred of them, each of them not working, or I just don't know how to solve it properly.

Help would be much appreciated, I've been suck on this for a few days now. :(

How do I fix verify certificate error when connecting to an AWS Client VPN endpoint?

Posted: 07 Apr 2021 05:11 PM PDT

I have setup a Client VPN, using steps described in Create a Client VPN Endpoint.

For the server certificate, I picked a public certificate that was newly created and verified by AWS Certificate Manager.

I configured the authentication method to be Use Active Directory authentication with a Directory ID that corresponds to an AWS SimpleAD directory.

I left the Transport Protocol set to UDP.

When I download the client configuration and try connecting via Tunnelblick (v3.7.8) on OSX, I get the following error:

VERIFY ERROR: depth=3, error=unable to get issuer certificate: C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2  OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed  TLS_ERROR: BIO read tls_read_plaintext error  TLS Error: TLS object -> incoming plaintext read error  TLS Error: TLS handshake failed  

Any ideas what is not configured correctly or what I could do to resolve this?

Does a pod in Kubernetes inherit every kernel settings from its pod?

Posted: 07 Apr 2021 07:06 PM PDT

I'm trying to see if my pods are using tcp_keepalive_time.

When I ssh into my node and run sysctl -a I see that there is value for tcp_keepalive_time, but pods don't have them when run the same command in the pod.

In this case, do pods inherit their node's kernel values?

How do I confirm that a pod has its node's kernel value when a pod does not show with sysctl -a command?

Why is SELinux blocking systemctl --user / systemd user instance commands?

Posted: 07 Apr 2021 10:04 PM PDT

I have a number of Fedora 27 systems. I am reasonably comfortable with SELinux. I run it on all my systems, with the "unconfined" module disabled.

On this particular system, SELinux is blocking all "systemctl --user" commands:

$ systemctl --user status  Failed to read server status: Access denied  

This worked until recently. I don't know what changed. I did upgrade from Fedora 26 to Fedora 27 recently, but the timing is not the same as this problem, I don't think.

The part that's weirding me out, and making it hard to know what to do next, is that there's nothing about it in auditd, at all.

In syslog I get:

Dec 25 09:48:07 jukni systemd[669]: selinux: avc:  denied  { status } for auid=n/a uid=1086 gid=1086 cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=system permissive=0  

Further, this:

$ systemctl --user restart lojban_mediawiki_web  Failed to restart lojban_mediawiki_web.service: Access denied  See user logs and 'systemctl --user status lojban_mediawiki_web.service' for details.  

Gives this in syslog:

Dec 25 09:49:06 jukni systemd[669]: selinux: avc:  denied  { start } for auid=n/a uid=1086 gid=1086 path="/home/sampre_mw/.config/systemd/user/lojban_mediawiki_web.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:systemd_unit_file_t:s0 tclass=service permissive=0  

I can't find anything in sesearch about self:system, and all I can find in https://github.com/TresysTechnology/refpolicy.git or https://github.com/TresysTechnology/refpolicy-contrib.git is:

policy/modules/kernel/kernel.te  481:    allow can_load_kernmodule self:system module_load;    policy/modules/system/init.te  225:    allow init_t self:system { status reboot halt reload };  

My other similar systems don't have this problem. A relabel reboot did not help. The contexts of the user unit files are:

$ ls -lZ ~/.config/systemd/user/  total 8  drwxr-xr-x. 2 sampre sampre staff_u:object_r:user_home_t:s0  66 Feb  6  2017 default.target.wants  -rw-rw-r--. 1 sampre sampre staff_u:object_r:user_home_t:s0 417 Jul 14 00:32 jbotcan_database.service  -rw-rw-r--. 1 sampre sampre staff_u:object_r:user_home_t:s0 419 Jul 14 00:32 jbotcan_site.service  

, which I have no idea if that's correct or not.

Changing this user's login to sysadm_u or user_u didn't help either.

I have no idea where to even go from here. I mean, I could make a custom module to implement the AVCs that are going to syslog, but that seems like The Wrong Thing (tm), since clearly the OS didn't ship without this working.

Added:

$ cat /etc/selinux/config    # This file controls the state of SELinux on the system.  # SELINUX= can take one of these three values:  #     enforcing - SELinux security policy is enforced.  #     permissive - SELinux prints warnings instead of enforcing.  #     disabled - No SELinux policy is loaded.  SELINUX=enforcing  # SELINUXTYPE= can take one of these two values:  #     targeted - Targeted processes are protected,  #     mls - Multi Level Security protection.  SELINUXTYPE=targeted  

Added #2:

I've now rebooted one of my other Fedora 27 boxes and:

Jan  5 23:31:38 vrici systemd[5992]: selinux: avc:  denied  { status } for auid=n/a uid=1000 gid=1000 cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcla  

ss=system permissive=0

which makes it feel a lot more like a bug with systemd or selinux.

Unable to restart a systemctl service remotely as a non root user

Posted: 07 Apr 2021 06:04 PM PDT

I have a systemd.socket named gunicorn.socket which I would like to restart after updating some code on a remote server.

I've followed the steps detailed in Allowing a non-root user to restart a service and systemctl keeps asking for my user password. Here is what I've done trying to run systemctl restart gunicorn.socket with user john:

# added an appadmin group to allow the restart command to john  addgroup appadmin  usermod -a -G appadmin john  visudo  

In sudoers:

Cmnd_Alias MYAPP_CMNDS = /bin/systemctl start gunicorn.socket, /bin/systemctl stop gunicorn.socket, /bin/systemctl restart gunicorn.socket  %appadmin ALL=(ALL) NOPASSWD: MYAPP_CMNDS  

Then sudo systemctl restart gunicorn.socket works fine while being on the server, but when I try it remotely I get:

ssh example.com "sudo systemctl restart gunicorn.socket"  Failed to restart gunicorn.socket: Interactive authentication required.  See system logs and 'systemctl status gunicorn.socket' for details.  

Any ideas? I'm using Ubuntu 17.04.

Update: adding full content of /etc/sudoers:

Defaults        env_reset  Defaults        mail_badpass  Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"    # Cmnd alias specification  Cmnd_Alias MYAPP_CMNDS = /bin/systemctl start gunicorn.socket, /bin/systemctl stop gunicorn.socket, /bin/systemctl restart gunicorn.socket  %appadmin ALL=(ALL) NOPASSWD: MYAPP_CMNDS    # User privilege specification  root    ALL=(ALL:ALL) ALL  john        ALL=(ALL:ALL) ALL    # Members of the admin group may gain root privileges  %admin ALL=(ALL) ALL    # Allow members of group sudo to execute any command  %sudo   ALL=(ALL:ALL) ALL  

apache http 2.2.29: Segmentation fault

Posted: 07 Apr 2021 07:06 PM PDT

We are using apache http server 2.2.29 on Linux. Below is the information related to Linux version (as found in /proc/version file) Linux version 2.6.32-573.el6.x86_64 (mockbuild@x86-027.build.eng.bos.redhat.com) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) ) #1 SMP Wed Jul 1 18:23:37 EDT 2015

We have observed that apache is generating many core dumps and getting crashed regularly. When it generates the core dump, below is being printed in the http's error log:

[Mon Jun 20 01:28:09 2016] [notice] child pid 6520 exit signal Segmentation fault (11), possible coredump in /app/http_instance_name [Mon Jun 20 03:27:54 2016] [notice] child pid 6462 exit signal Segmentation fault (11), possible coredump in /app/http_instance_name

Below core files had generated at these segmentation faults.

-rw------- 1 http http 65130496 Jun 20 01:28 core.6520 -rw------- 1 http http 66134016 Jun 20 03:27 core.6462

We are running on below Apache http version:

Server version: Apache/2.2.29 (Unix) Server built: Mar 4 2016 15:21:54

I have tried to analyse the core files using gdb tool , however, i was not able to understand much from it?

Please let me know if further information is required help get more understanding pertinent to this issue.

can this be due to some modules used in httpd.conf file? We are observing this issue across all our environments.

UPDATE: Common Pattern

The most common pattern I am observing when the segmentation fault error being is thrown is , the below error comes for most of the cases just before the segmentation fault appears

[Mon May 16 16:08:02 2016] [error] [client 10.10.12.113] (-2)Unknown error 18446744073709551614: proxy: error reading status line from remote server rxxxx.xxxx.net:8543, referer: https://sit1-xxxxxx.co.uk:8443/CommonWeb/pages/common/jsp/login.jsp [Mon May 16 16:08:02 2016] [error] [client 10.10.12.113] proxy: Error reading from remote server returned by /CommonWeb/pages/common/includes/js/dojo.js, referer: https://sit1.xxxxxx:8443/CommonWeb/pages/common/jsp/login.jsp [Mon May 16 16:08:02 2016] [error] [client 10.10.12.113] (-2)Unknown error 18446744073709551614: proxy: error reading status line from remote server rpovassxxxx.srxxx.net:8543, referer: https://sit1-****:8443/CommonWeb/pages/common/jsp/login.jsp [Mon May 16 16:08:02 2016] [error] [client 10.10.12.113] proxy: Error reading from remote server returned by /CommonWeb/pages/common/includes/js/resize.js, referer: https://xxxx-xxxx:8443/CommonWeb/pages/common/jsp/login.jsp [Mon May 16 16:08:03 2016] [notice] child pid 28308 exit signal Segmentation fault (11), possible coredump in /app/

Below is the output of 'gdb full' during debugging:

     #0  0x0000003704a0e7dd in read () from /lib64/libpthread.so.0       No symbol table info available.      #1  0x000000000044f8b7 in ap_mpm_pod_check (pod=<value optimized out>)     at pod.c:54      c = <value optimized out>      fd = 6      rc = <value optimized out>     #2  0x000000000044de74 in child_main (child_num_arg=1) at worker.c:1259      threads = 0xc2bab0      rv = <value optimized out>      ts = 0xc079f8      thread_attr = 0xc07a18      start_thread_id = <value optimized out>    #3  0x000000000044e0dd in make_child (s=0xb44870, slot=1) at worker.c:1342      pid = 0     #4  0x000000000044efc0 in perform_idle_server_maintenance     (_pconf=<value             optimized out>, plog=<value optimized out>, s=<value optimized out>)  at worker.c:1568      j = <value optimized out>      free_slots = {1, 5, 6, 7, 11817336, 0, 11784504, 0, -1236161560, 11137,   11817336, 0, 11800920, 0, 11815024, 0, 11784504, 0, -1361903789, 11137,        4337480, 0, -1238262800, 11137, 29, 0, 12768544, 0, 11815024, 0, 12489224, 0}      total_non_dead = <value optimized out>      active_thread_count = <value optimized out>      idle_thread_count = <value optimized out>      free_length = 1      i = <value optimized out>      ps = <value optimized out>      totally_free_length = <value optimized out>      last_non_dead = <value optimized out>        #5  server_main_loop (_pconf=<value optimized out>, plog=<value optimized out>, s=<value optimized out>) at worker.c:1680      status = 11      pid = {pid = -1, in = 0xb45178, out = 0xb41158, err = 0xb3d138}      i = <value optimized out>      child_slot = <value optimized out>      exitwhy = 6      processed_status = <value optimized out>      #6  ap_mpm_run (_pconf=<value optimized out>, plog=<value optimized out>,     s=<value optimized out>) at worker.c:1782      remaining_children_to_start = <value optimized out>      rv = <value optimized out>      #7  0x0000000000425e34 in main (argc=3, argv=0x7ffcafb44eb8) at main.c:753      c = 0 '\000'      configtestonly = <value optimized out>      confname = 0x458a64 "conf/httpd.conf"      def_server_root = 0x458a4f "/app/***"      temp_error_log = 0x0      error = <value optimized out>      process = 0xb44870      server_conf = 0xb44870      pglobal = 0xb3b128      pconf = 0xb3d138      plog = 0xb45178      ptemp = 0xb41158      pcommands = 0xb3f148      opt = 0xb3f238      rv = <value optimized out>      mod = <value optimized out>      optarg = 0x0      signal_server = <value optimized out>'  

Below modules are being used in httpd.conf file.

   `cat httpd.conf | grep LoadMo  

# have to place corresponding LoadModule' lines at this location so the # LoadModule foo_module modules/mod_foo.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authn_dbd_module modules/mod_authn_dbd.so LoadModule authn_default_module modules/mod_authn_default.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_dbm_module modules/mod_authz_dbm.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_default_module modules/mod_authz_default.so LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule auth_digest_module modules/mod_auth_digest.so LoadModule dbd_module modules/mod_dbd.so LoadModule dumpio_module modules/mod_dumpio.so LoadModule reqtimeout_module modules/mod_reqtimeout.so LoadModule ext_filter_module modules/mod_ext_filter.so LoadModule include_module modules/mod_include.so LoadModule filter_module modules/mod_filter.so LoadModule substitute_module modules/mod_substitute.so LoadModule deflate_module modules/mod_deflate.so LoadModule log_config_module modules/mod_log_config.so LoadModule log_forensic_module modules/mod_log_forensic.so LoadModule logio_module modules/mod_logio.so LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule cern_meta_module modules/mod_cern_meta.so LoadModule expires_module modules/mod_expires.so LoadModule headers_module modules/mod_headers.so LoadModule ident_module modules/mod_ident.so LoadModule usertrack_module modules/mod_usertrack.so LoadModule unique_id_module modules/mod_unique_id.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule version_module modules/mod_version.so LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_connect_module modules/mod_proxy_connect.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so #LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule ssl_module modules/mod_ssl.so LoadModule mime_module modules/mod_mime.so LoadModule dav_module modules/mod_dav.so LoadModule status_module modules/mod_status.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule info_module modules/mod_info.so LoadModule cgid_module modules/mod_cgid.so LoadModule cgi_module modules/mod_cgi.so LoadModule dav_fs_module modules/mod_dav_fs.so LoadModule vhost_alias_module modules/mod_vhost_alias.so LoadModule negotiation_module modules/mod_negotiation.so LoadModule dir_module modules/mod_dir.so LoadModule imagemap_module modules/mod_imagemap.so LoadModule actions_module modules/mod_actions.so LoadModule speling_module modules/mod_speling.so LoadModule userdir_module modules/mod_userdir.so LoadModule alias_module modules/mod_alias.so LoadModule rewrite_module modules/mod_rewrite.so LoadModule auth_kerb_module modules/mod_auth_kerb.so LoadModule manager_module modules/mod_manager.so LoadModule slotmem_module modules/mod_slotmem.so LoadModule proxy_cluster_module modules/mod_proxy_cluster.so LoadModule advertise_module modules/mod_advertise.so

Below is the output of httpd -V (capital V)

 ./httpd -V   Server version: Apache/2.2.29 (Unix)   Server built:   Jan 13 2016 15:10:57   Server's Module Magic Number: 20051115:36   Server loaded:  APR 1.5.1, APR-Util 1.5.3   Compiled using: APR 1.5.1, APR-Util 1.5.3   Architecture:   64-bit   Server MPM:     Worker   threaded:     yes (fixed thread count)   forked:     yes (variable process count)   Server compiled with....   -D APACHE_MPM_DIR="server/mpm/worker"   -D APR_HAS_SENDFILE   -D APR_HAS_MMAP   -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)   -D APR_USE_SYSVSEM_SERIALIZE   -D APR_USE_PTHREAD_SERIALIZE   -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT   -D APR_HAS_OTHER_CHILD   -D AP_HAVE_RELIABLE_PIPED_LOGS   -D DYNAMIC_MODULE_LIMIT=128   -D HTTPD_ROOT="/app/****"   -D SUEXEC_BIN="/app/****/bin/suexec"   -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"   -D DEFAULT_ERRORLOG="logs/error_log"   -D AP_TYPES_CONFIG_FILE="conf/mime.types"   -D SERVER_CONFIG_FILE="conf/httpd.conf"  

**OUTPUT of file * **

     httpd.exp:              script text executable for .       mod_actions.so:         ELF 64-bit LSB shared object, x86-64, version  1 (SYSV), dynamically linked, not stripped       mod_advertise.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_alias.so:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_auth_basic.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_auth_digest.so:     ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_auth_kerb.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_authn_anon.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authn_dbd.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped           mod_authn_dbm.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authn_default.so:   ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authn_file.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authz_dbm.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authz_default.so:   ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped           mod_authz_groupfile.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped           mod_authz_host.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped           mod_authz_owner.so:     ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_authz_user.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped           mod_autoindex.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_cern_meta.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_cgid.so:            ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_cgi.so:             ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_dav_fs.so:          ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_dav.so:             ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_dbd.so:             ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_deflate.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_dir.so:             ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_dumpio.so:          ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_expires.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_ext_filter.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_filter.so:          ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_headers.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_ident.so:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_imagemap.so:        ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_include.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_info.so:            ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_log_config.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_log_forensic.so:    ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_logio.so:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_manager.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_mime_magic.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_mime.so:            ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_negotiation.so:     ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped       mod_proxy_ajp.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_proxy_balancer.so:  ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_proxy_cluster.so:   ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_proxy_connect.so:   ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_proxy_ftp.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_proxy_http.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_proxy_scgi.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_proxy.so:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_reqtimeout.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped          mod_rewrite.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped         mod_setenvif.so:        ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_slotmem.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped        mod_speling.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped     mod_ssl.so:             ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped    mod_status.so:          ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_substitute.so:      ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_unique_id.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_userdir.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_usertrack.so:       ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_version.so:         ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped   mod_vhost_alias.so:     ELF 64-bit LSB shared object, x86-64, version 1    (SYSV), dynamically linked, not stripped  

Apache environment variables for CGI not setting

Posted: 07 Apr 2021 08:01 PM PDT

I am trying to set my environment variables for the Apache webserver as it is not the correct Perl package. I followed the recommendation of one of the answers on Server Fault for updating the httpd file and adding the environment variables and it still isn't working. After I updated the httpd file I bounced the httpd process as well. On the command line the correct PATH is being used for Perl. Can anyone offer any guidance?

Error in apache error.log file:

[pid 29460] [client 10.199.106.141:57768] AH01215: install_driver(Informix) failed: Can't locate DBD/Informix.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .) at (eval 7)  

The correct location of Perl where Apache should check for Perl Modules

/usr/bin/perl  

Updated /etc/sysconfig/httpd file

#Configuration of variables for webserver    export INFORMIXDIR=/opt/informix    export    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$INFORMIXDIR/lib:$INFORMIXDIR/lib/cli:$INFORMIXDIR/lib/esql:$INFORMIXDIR/lib/tools    export INFORMIXSQLHOSTS=$INFORMIXDIR/etc/sqlhosts    PATH=$PATH:$HOME/bin:$INFORMIXDIR/bin:$LD_LIBRARY_PATH    export PATH  

Other environment variables

OS Package:  Apache/2.4.6 (Red Hat Enterprise Linux) PHP/5.4.16  CONTEXT_DOCUMENT_ROOT = /var/www/cgi-bin/  

different servers different databases replication mysql

Posted: 07 Apr 2021 10:04 PM PDT

I am not sure if this is possible or not but I have 3 servers.

Server A, B and C  Server A has database A_dataBase, B_database  Server B has database A_dataBase, B_database and C_database  Server C has database C_database  

Currently Server A and B are in sync perfectly. Now I want to sync the database C_database between server B and Server C.

Server B has this my.cnf

###  server-id = 2  log_bin                = /var/log/mysql/mysql-bin.log  binlog_do_db           = A_dataBase  binlog-do-db           = B_database  relay-log = /var/log/mysql/slave-relay.log  relay-log-index = /var/log/mysql/slave-relay-log.index  #####  

This is the command I ran on Server B to set server A up

CHANGE MASTER TO MASTER_HOST = 'serverA_ip', MASTER_USER = 'username', MASTER_PASSWORD = 'userpassword', MASTER_LOG_FILE = 'mysql-bin.000007', MASTER_LOG_POS = 107;  

Now my question is how to setup the sync of C_database between server C and B? Keeping in mind that I already have syncing working between A and B

Thanks

UAG 2010 and Exchange 2010 Service Pack installs

Posted: 07 Apr 2021 05:05 PM PDT

We are currently on Exchange 2010 SP2 and UAG 2010 SP1. I want to upgrade Exchange to SP3, and later on UAG to SP4, but not all at the same time due to scheduling. Ideally we'd like to do Exchange first, then a week later update UAG.

Will Exchange 2010 SP3 be supported (function) on UAG SP1? Should we update UAG to SP4 first, then later update Exchange?

Forcing fast stop of IIS 7.5 or app pool

Posted: 07 Apr 2021 09:08 PM PDT

We have a busy webserver handling around 1000 asp.net requests/second.

We have a deploy script which copies compiled asp.net from our development box.

The script first stops IIS on the production server, copies the code, then restarts.

We use the following command to stop the app pool for the site:

%windir%\system32\inetsrv\appcmd stop apppool /apppool.name:ourappname

The problem is that this stops accepting new requests but waits for existing requests to complete. There are usually a handful of requests that take up to a minute to finish, during which time no new requests are served. So for the sake of fulfilling a dozen or so requests, we miss out on serving the 1000 * 60 = 60,000 requests that have come in during the minute or so while we're waiting for 12-20 to complete. This is dumb.

What we would LOVE to do is force an app pool stop within x seconds. This doesn't seem to be possible. Is there a better way to accomplish what we're doing i.e. fast stop of iis 7?

How to make pip or easy_install use aliases

Posted: 07 Apr 2021 09:08 PM PDT

I have some trouble installing python-mysqldb. The error I get is

E: Could not perform immediate configuration on 'gcc'. Please see man 5 apt.conf under APT::Immediate-Configure for details. (2)  

So I tried installing it using pip or easy_install and then I get this error:

unable to execute i486-linux-gnu-gcc: No such file or directory    error: command 'i486-linux-gnu-gcc' failed with exit status 1  

And then I found out that I actually can't use 'i486-linux-gnu-gcc' but after finding the file I noticed that there is no such command but there is 'i486-linux-gnu-gcc-4.3'

So I created an alias and when I try it it works but pip and easy_install still say that the command can't be found so I assumed that they don't use my aliases. I tried to do an export but it says my identifier is not valid (while the alias works).

Please help me.

Edit:

just tried

env 'i486-linux-gnu-gcc=i486-linux-gnu-gcc-4.3' pip install mysql-python  

and still the same error.

Restrict listing a "root" directory in ProFTPD

Posted: 07 Apr 2021 06:04 PM PDT

I have an FTP server set up where, off the root, there is a file structure laid out by city. Underneath each city's folder are more folders organized by project. I would like to be able to restrict my guest users (using a specific login/password) in such a way that they are unable to view the folders under the city name, but instead have be brought directly to them via an FTP link.

Example:

/
--City1
----Project1
----Project2
----Project3
--City2
----Project4
--City3
----Project5

link: ftp://ftp.company.com/City2/Project4

Project Server 2010 - Exchange Server 2010 Integration Architecture

Posted: 07 Apr 2021 05:13 PM PDT

Is there anybody know how this integration works. There are some docs about how to configure Project Server 2010 to work with Exchange Server 2010 ( http://technet.microsoft.com/en-us/library/ff468700.aspx ) but I don't understand how it works.

I'm looking for integration architecture, which server uses which web service and when ?

Do you have any idea ?

How to grep ps output with headers

Posted: 07 Apr 2021 05:30 PM PDT

How can I grep the PS output with the headers in place?

These two process make up an app running on my server....

root     17123 16727  0 16:25 pts/6    00:00:00 grep GMC  root     32017     1 83 May03 ?        6-22:01:17 /scripts/GMC/PNetT-5.1-SP1/PNetTNetServer.bin -tempdir /usr/local/GMC/PNetT-5.1-SP1/tmpData -D  

does 6-22:01:17 mean that it's been running for 6 days? I'm tring to determine the length of how long the process has been running...

Is the 2nd column the process id? So if I do kill 32017 it'll kill the 2nd process?

lync 2010 + exchange 2010 on same server

Posted: 07 Apr 2021 05:10 PM PDT

I'm attempting to build a test infrastructure Active Directory + Lync + Exchange. After installing Lync on my Exchange Server, I was unable to connect to Exchange. I don't know for sure that I was able to connect to Exchange before I installed Lync though. Rather than go through the installation process again, I'm hoping if someone can tell me for sure if Lync 2010 and Exchange 2010 can exist on the same server.

SharePoint 2010 - Exchange 2010 -SMTP Outgoing email

Posted: 07 Apr 2021 05:03 PM PDT

I'm trying to setup the outgoing email settings on my sharepoint 2010 Server.

I have installed an exchange 2010 server out of the box but when I type in the FQDN address to the exchange 2010 server in the outgoing settings on the SharePoint 2010 page I'm not getting any emails from the sharepoint 2010 server.

How can I configure my Exchange 2010 server to work with SharePoint Server 2010 for outgoing email notifications?

I've tried looking at http://www.lazynetworkadmin.com/knowledgebase-mainmenu-6/2-windows/149-exchange-2010-configure-anonymous-relay-to-external-domains

No comments:

Post a Comment