Recent Questions - Server Fault |
- IPsec site-to-site VPN issues after recent Linux kernel update
- Why is mdadm unable to deal with an "almost failed" disk?
- Error Hostname DOES NOT VERIFY - Test certificates TLS Exchange 2016 cu21
- Privoxy -> Tor Does Not Go Through Tor on Ubuntu 20.04
- Create lvm volume in the last cylinders of the disk
- Why an AC wifi with an AC router is slow? [migrated]
- AZURE Extend an on-premises network using multiple VPN's and VPN GateWay
- Only have connectivity to nginx pod from the node its running on
- Same DNS names, private ip-addresses used over multiple AZURE Corporate Accounts
- Apache Indexes Option works for HTTP but not for HTTPS
- SELinux Issue - git status fatal: Out of memory? mmap failed: Permission denied
- azure linux has not default ipv6 route
- Is JDK 1.6 supported in IBM POWER 9(AIX 7.1-7.2)?
- High CPU usage by Apache/MySQL
- Error "This certificate cannot be verified up to a trusted certification authority"
- Ubuntu 20.10 Active directory integration not working
- Memcached error: SERVER HAS FAILED AND IS DISABLED UNTIL TIMED RETRY
- Why is are database queries running so much slower on AWS RDS?
- How to create a non-nat lxd network bridge (using lxd network)?
- SSH and GIT auth suddenly stopped working
- nginx: FastCGI sent in stderr: "Primary script unknown"
- Why may add_header not work in nginx' reverse-proxy configuration?
- showmount -e fails from one node
- lftp reverse mirror silently skips files in subfolders
- Do I need a RHEL subscription to install packages?
- OpenLDAP memberOf attribute is not updated after group update
- Adding a "dynamic" route manually for troubleshooting
- How to view if partitions primary or secondary in Linux
- Is it safe to set validateIntegratedModeConfiguration=false in order to continue using identity impersonate=true?
- Execute local (bash|python) script with mysql SQL
| IPsec site-to-site VPN issues after recent Linux kernel update Posted: 05 Sep 2021 09:42 PM PDT Last weekend we had an automatic security upgrade on one of our VPN gateways that connect sites to our cloud environment. After performing troubleshooting (via basic network troubleshooting e.g. via Wireshark) we identified one of the most recent security updates to be the cause of this. We have restored the system back to a known good state and have set (we believe to be) affected packages on hold. It is a Ubuntu 20.04 LTS instance on AWS with linux-image-aws installed. We are using IPsec to connect several EdgeRouters to a private cloud environment. After the upgrade all sites connect and communicate as usual, e.g. ICMP is working but we are unable to access certain services (such as RDP or SMB) in the private cloud environment. The change logs for the related packages don't show any obvious linked change, so I am wondering if I am missing something fundamental. This configuration/setup has worked well for over a year now with no issues. Known good version: linux-image-aws 5.8.0.1041.43~20.04.13 Problematic version: linux-image-aws 5.8.0.1042.44~20.04.14 and onwards (we have also tested latest 5.11 which seems to be affected) IPsec configuration extract Thank you in advance.  | ||||||||||||||||||||||||||||||
| Why is mdadm unable to deal with an "almost failed" disk? Posted: 05 Sep 2021 09:52 PM PDT Multiple times in my career now I've come across mdadm RAID sets (RAID1+0, 5, 6 etc) in various environments (e.g. CentOS/Debian boxes, Synology/QNAP NASes) which appear to be simply unable to handle failing disk. That is a disk that is not totally dead, but has tens of thousands of bad sectors and is simply unable to handle I/O. But, it isnt totally dead, it's still kind of working. The kernel log is typically full of UNC errors. Sometimes, SMART will identify the disk as failing, other times there are no other symptoms other than slow I/O. The slow I/O actually causes the entire system to freeze up. Connecting via ssh takes forever, the webGUI (if it is a NAS) stops working usually. Running commands over ssh takes forever as well. That is until I disconnect / purposely "fail" the disk out of the array, then things go back to "normal" - that is as normal as they can be with a degraded array. I'm just wondering, if a disk is taking so long to read/write from, why not just knock it out of the array, drop a message in the log and keep going? It seems making the whole system grind to a halt because one disk is kinda screwy totally nullifies one of the main benefits of using RAID (fault tolerance - the ability to keep running if a disk fails). I can understand that in a single-disk scenario (e.g. your system has as single SATA disk connected and it is unable to execute read/writes properly) this is catastrophic, but in a RAID set (especially the fault tolerant "personalities") it seems not only annoying but also contrary to common sense. Is there a very good reason the default behavior of mdadm is to basically cripple the box until someone remotes in and fixes it manually?  | ||||||||||||||||||||||||||||||
| Error Hostname DOES NOT VERIFY - Test certificates TLS Exchange 2016 cu21 Posted: 05 Sep 2021 10:43 PM PDT Practicing with the certificates, in let's encrypt win-acme normal is created, I send and receive normal mail, https in owa and the other services Testing with checktls, it gives me an alert message : Cert Hostname DOES NOT VERIFY: I don't understand the mail.lan.contoso.com DNS error. I thought the error was the DNS SPLIT, but reading in the forum they comment on something about the error. I understand that the other connectors should not be changed in forums, books and tutorials, nobody changes them. That is why a new connector is created to receive from the internet, to which the FQDN can be changed. Recommendations of this forum, my dns settings : Private AD DNS (lan.contoso.com)
Private DNS (contoso.com) SPLIT
Public DNS (contoso.com)
 | ||||||||||||||||||||||||||||||
| Privoxy -> Tor Does Not Go Through Tor on Ubuntu 20.04 Posted: 05 Sep 2021 05:24 PM PDT It is quite the simple setup, as one could imagine, yet it seems that I am having trouble getting Privoxy to talk to Tor. The setup is running Ubuntu 20.04 with the latest packages for tor, privoxy, and squid, whereas the computer I am browsing from is on the same local network. I am able to access error pages for squid and privoxy, as well as privoxy's configuration page, so there is no error between those two... Here is my Privoxy configuration file: I have tried editing the forward lines to include a trailing dot, and that does not work either. Here, then, is my tor configuration file: From the Ubuntu machine, for a short period of time, I was able to use wget to reach api.ipify.org and request my IP, which was different from my usual IP, thus signifying that tor was indeed working, however I cannot reproduce this and I suspect that my request was not being routed through privoxy. (Though I do not have proof of this either.) Here is my ufw rules list. Pardon the mess. Can anybody tell me where I went wrong with my setup, aside from redundant firewall rules?  | ||||||||||||||||||||||||||||||
| Create lvm volume in the last cylinders of the disk Posted: 05 Sep 2021 05:37 PM PDT In all magnetic disks, the speed difference between the first and last sectors is noticeable, up to a factor two or three. This is still true with the new multi-terabyte disks. So it still makes sense to reserve the last cylinders of the disk for infrequently used files, particularly backups. With a partitioned disk, it is trivial to do this, with the only caveat of allowing for future changes of size. But my configuration is unpartitioned LVM. So I need either to put two volume groups in the same physical hardware (one using the starts of a set of disks, other using the ends) or to make sure that a logical volume prefers to use the extensions in the last cylinders of the hardware. Is it possible? Do we have some control about where a LV is going to be?  | ||||||||||||||||||||||||||||||
| Why an AC wifi with an AC router is slow? [migrated] Posted: 05 Sep 2021 03:08 PM PDT I have a Lenovo ideapad l340 with a built in Realtel 8821CE Wireless 802.11 ac network adapter. The fastest download speed I can reach is around 150 Mbps, even though windows claims the double :
My machine is close to the router and other devices with the same router are much quicker. What can be the problem?  | ||||||||||||||||||||||||||||||
| AZURE Extend an on-premises network using multiple VPN's and VPN GateWay Posted: 05 Sep 2021 03:36 PM PDT I am looking at this https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/ It states 4 options to connect from on-prem to AZURE:
I am looking at the first option: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn?tabs=portal This diagram is there:
Questions I find the diagram above hard to follow, being a non-networking specialist. I suspect it is economizing things and for folks such as myself less clear.
Hard to interpret diagram with text. I think I am missing something elementary here.  | ||||||||||||||||||||||||||||||
| Only have connectivity to nginx pod from the node its running on Posted: 05 Sep 2021 04:40 PM PDT I've installed kubernetes master and one node v 1.20. I deployed nginx with On master when I curl on master it times out: On the node it works. I've tried from other hosts on my network and they timeout too. Why can I only connect from the node the pod is actually running on? ----Edit---- The calico-nodes are running but they are not ready. I don't know what this means:  | ||||||||||||||||||||||||||||||
| Same DNS names, private ip-addresses used over multiple AZURE Corporate Accounts Posted: 05 Sep 2021 08:31 PM PDT Looking at the below: Here we see a single AZURE Corporate Account X. See "azsql1.database.windows.net". You can access that from on-prem. What if for arguments sake I had a second AZURE env. configured exactly the same - AZURE Corporate Account Y, with "azsql1.database.windows.net". It's theoretical, but I would like to know how the on-prem reolves this if one tries to use "azsql1.database.windows.net" for a connection report in say, Tableau, Spotfire? I presume that in some way you need to tell which DNS Forwarder to use in which AZURE Corporate Account. So, forgive me, but I understand basic DNS resolution stuff with internet bla bla bla, but not a networking expert.  | ||||||||||||||||||||||||||||||
| Apache Indexes Option works for HTTP but not for HTTPS Posted: 05 Sep 2021 04:00 PM PDT I am testing with a vanilla install of Rocky Linux 8.4 and Apache 2.4. I have a virtual host configured and working and I also configured Lets Encrypt cert via Certbot, this also works great. I want to allow directory listings on a specific folder so have enabled Options Indexes, this works as expected via HTTP but via HTTPS I get 403 Forbidden. The Certbot script inserted the rewrite rule but I don't think that is the issue, I tried disabling that so I could test via HTTP and makes no difference but including it here in case it is infact relevant. My virtual host conf looks like this: Accessing http://test.prot0type.com/test/ works as expected. Accessing https://test.prot0type.com/test/ results in 403 and in the error log I get: Cannot serve directory /var/www/test.prot0type.com/test/: No matching DirectoryIndex (index.html) found, and server-generated directory index forbidden by Options directive How do I find which Options directive is doing this? I have searched all the conf files but can't find it.  | ||||||||||||||||||||||||||||||
| SELinux Issue - git status fatal: Out of memory? mmap failed: Permission denied Posted: 05 Sep 2021 04:58 PM PDT I have Centos 7.9 server running with Apache and Git, however if I do a But if Disable or Permissive the SE-Linux via below commands it start working fine. Any idea on how to fix this issue permanently with SELinux enabled? Audit log says  | ||||||||||||||||||||||||||||||
| azure linux has not default ipv6 route Posted: 05 Sep 2021 07:52 PM PDT Environment
Network Security Group:
Network NIC Effective routes
ProblemCannot connect http://ipv6.google.com No ipv6 default routeNo default route in ipv6 router advertisementRouter advertisement only contains prefix length IPV6 Address | ||||||||||||||||||||||||||||||
| Is JDK 1.6 supported in IBM POWER 9(AIX 7.1-7.2)? Posted: 05 Sep 2021 06:41 PM PDT I would like to check if jdk 1.6 is supported in AIX 7.2. We are planning to upgrade from AIX7.1-7.2 (POWER7-POWER9). But we are not sure if we have to upgrade java . As our development is done in JDK 1.6. Can anyone suggest if java needs to be upgraded to JDK 1.8 if we are upgrading AIX 7.1-7.2 (POWER 7 TO POWER 9)?  | ||||||||||||||||||||||||||||||
| High CPU usage by Apache/MySQL Posted: 05 Sep 2021 10:57 PM PDT I have a problem with CPU usage on the website that uses WordPress, Apache, and MySQL. During the day, from time to time, CPU usage by MySQL and Apache goes up to 2400% (I have 24 cores in total), the server freezes, the average load goes up to 24. Recently, there was a little more traffic than usual, but this thing shouldn't be permanent, right? I've updated the kernel, the database, libraries, restarted many times. And still, it freezes. I've looked at the process list of the DB, but there is nothing extraordinary. In the database, there are pretty large amounts of data. Just a couple of weeks ago it worked fine, and now it doesn't. So, it shouldn't be unoptimized queries. What can be the causes of such behavior? Update: the result of A) SHOW GLOBAL STATUS LIKE 'com_%r%_table'; B) SHOW GLOBAL STATUS LIKE 'uptime%'; C) SHOW GLOBAL STATUS LIKE '%dirty%'; p.s. I still have problems with the server. I needed to change the character set on one of the databases, and it took a little more than a day to finish, with just 400 000 rows. Before, it used to take some time, but not that much. I was wondering, could it be, that after the DDOS attack, there can be some changes to the database, so that it performs worse?  | ||||||||||||||||||||||||||||||
| Error "This certificate cannot be verified up to a trusted certification authority" Posted: 05 Sep 2021 08:03 PM PDT In my VirtualBox I have following network for testing and every software on virtual machines is a fresh installation.
On virtual machine, named Now, this Default Web Site is accessible from this Default Web Site is accessible from However, I am getting error from
What can be a solution to this issue? What should I do next?  | ||||||||||||||||||||||||||||||
| Ubuntu 20.10 Active directory integration not working Posted: 05 Sep 2021 09:08 PM PDT I've just installed Ubuntu 20.10 and I enabled Active Directory integration during setup. It asked me AD user and password, I provided those and the setup showed green thicks and went on. After completing setup, I tried to login with a domain user (ufficio.lan\lucio), but it failed as if the password was incorrect (which was not, I tried several times and I'm sure about my password). I then logged in with the local user I created during setup and checked the machine was effectively joined to the domain: Please note that after trying to login with my AD user, I tried to install Ubuntu 20.10 from scratch again, just in case I made some mistakes the first time, but I got the same results. The server is a Zentyal Community Edition 6.2 and other Linux computers in the LAN manage to login with AD credentials, but those are old Fedora or Ubuntu 14.04 setups that were manually joined to the AD domain back then, so I can't just copy /etc/ over and hope for the best: it won't work. Before reinstalling from scratch I had already tried to follow the guide linked in the answer, but it did not solve the problem. It was precisely that guide that, in Step 5, suggested me the command to check if the system was already joined to the domain. Despite being already joined, I tried following that guide anyway (even from its Step 1), but at the end of Step 5 the Anyway, I suspect the point is quite different, and that's why I did not mention these trials before: Ubuntu 20.10 has AD integration option during setup and it's a new feature that up to 20.04 included did not exist, so I suspect something different is needed on Ubuntu 20.10, while that guide assumes Ubuntu 20.04. EDIT #2 I've tried starting from fresh Zentyal 6.2 + Ubuntu 20.04 (mind it, not 20.10) virtual machines in a virtual LAN and then following the guide linked in Sturban's answer, which is supposed to be valid for Ubuntu 20.04. It didn't work just the same way as with Ubuntu 20.10. To be honest, I did NOT follow the guide verbatim (never did that), but I always assumed I had to adapt Step 1 to the actual OS I was using. Step 1 suggests to add Ubuntu 18.04 repositories to Other than that, I followed the guide verbatim, but at the end of step 5 the So now I assume my question is applicable to Ubuntu 20.04 too, and that guide is more outdated than I thought. That means if you know the solution to have AD users authentication working on Ubuntu 20.04 I assume it will work on Ubuntu 20.10 too, but that guide is missing something and it's not enough as solution.  | ||||||||||||||||||||||||||||||
| Memcached error: SERVER HAS FAILED AND IS DISABLED UNTIL TIMED RETRY Posted: 05 Sep 2021 04:03 PM PDT Here is my test code: The output is:
SELinux is disabled, I've also tried to turn off I've read this question - How to debug memcached "SERVER HAS FAILED AND IS DISABLED UNTIL TIMED RETRY" errors? But nothing helped and I cannot comment, because I have not enough points.  | ||||||||||||||||||||||||||||||
| Why is are database queries running so much slower on AWS RDS? Posted: 05 Sep 2021 08:32 PM PDT I've been working on performance-sensitive features. I've been developing locally, running a MySQL server on my Mac. One key query runs in about 1.2 seconds on my machine, which is in the acceptable range for me. Everything was running speedy enough, so I decided to move it onto an AWS RDS Aurora database so that I could start using the new system in production. But once I started connecting to RDS instead of my local server, the queries started to take more than twice as long. And this is comparing the time it takes the actual query to run, unaffected by networking speed. This is how I'm measuring. I've bumped up the instance that RDS is using to Main question: What else can I look into to get the cloud database running as quickly as my local machine? Things that seemed like plausible causes but don't appear to be:
Things that could be factors, but I really don't know:
I'm really at a bit of a loss here. If anyone has any ideas or advice, it would be very much appreciated!  | ||||||||||||||||||||||||||||||
| How to create a non-nat lxd network bridge (using lxd network)? Posted: 05 Sep 2021 04:06 PM PDT How to create a non-nat lxd network bridge? I have tried the below network configs, then ran I have tried the below configurations. First without assigning a subnet: The with assigning a subnet: When to above configurations were used the host lost network connectivity. How to create a non-nat lxd network bridge (using lxd network)?  | ||||||||||||||||||||||||||||||
| SSH and GIT auth suddenly stopped working Posted: 05 Sep 2021 06:03 PM PDT I've been happily pulling from my repository for months, until now.. :'( For the first time ever git now asks me to add github.com to the known_hosts file. It never did that before, I even didn't have a .ssh directory until after I say 'yes' to the question below. I can't figure out what could have changed... doing I can't do a Shouldn't I be able to pull from repo's without having to add a github ssh key? This all happens on a small embedded systems, that I deploy on various places, so I don't like to add any account details, I just want it to pull the latest version from github. My git config: I've tried changing git to https, but that gives me a certificate error instead. (I've redacted the user and repo name)  | ||||||||||||||||||||||||||||||
| nginx: FastCGI sent in stderr: "Primary script unknown" Posted: 05 Sep 2021 04:06 PM PDT Using the latest version of nginx (1.10.0) and php-fpm (PHP 7.0.6) on 64-bit arch linux. When attempting to request index.php for a DokuWiki installation, I get the following error: Here is the relevant server config: Here is fastcgi_params: As can be seen in my server config, I am attempting to log the output of the When requesting the index.php page, the below is generated in Doing an ls on that file: It's worth noting that both the nginx daemon and the php-fpm daemon are configured to run as the nginx user using the nginx group. I'm at a loss as to why I am getting the initial error as the logging as effectively proven that Out of all the ServerFault answers I reviewed, adding that param to the server config seemed to be the #1 solution to my error, but it does not seem to fix it in my case. Any suggestions?  | ||||||||||||||||||||||||||||||
| Why may add_header not work in nginx' reverse-proxy configuration? Posted: 05 Sep 2021 07:05 PM PDT Please help me to understand why the following proxy configuration does not set the header I expect the header to be added because of the following instruction:
But whatever HTTP requests I make, no such a header is present in responses. No errors or warnings in the log file. What should I check to identify the problem?  | ||||||||||||||||||||||||||||||
| showmount -e fails from one node Posted: 05 Sep 2021 08:22 PM PDT When I run: But works The client and server (freenas 9.3) are on the same subnet. How to resolve this?  | ||||||||||||||||||||||||||||||
| lftp reverse mirror silently skips files in subfolders Posted: 05 Sep 2021 05:06 PM PDT I'm using lftp to push content to an ftp-only web-server. It worked to upload the files recursively at first, and even incrementally. Any idea why this would skip files changed in a subfolder, but not skip files changed in the home directory? Details: I'm using the reverse mirror mode, which pushes local data up to the server instead of downloading it from the server. Throughout the web, this is the recommended option for recursive upgrade. Here's the full script (from this answer) The related question, was solved by permission issues, which is not an issue in this case. Everything is "rwxr-xr-x" on the server. Further Testing: The lftp seems to work intermittently. For example, I will run the command twice, and it skips the changes, then the third time it works, correctly copying the changed files up to the server.  | ||||||||||||||||||||||||||||||
| Do I need a RHEL subscription to install packages? Posted: 05 Sep 2021 06:58 PM PDT I'm new to RHEL. Trying to install software this morning and running into road blocks. Is it required to have a subscription to download packages via yum on RHEL? I'm coming across different sources on the net, some make it sound like yes, you need a subscription, others making it sound like no, a subscription is only required for support. In either case I'm stuck unable to install software ATM, because the machines I'm on don't have the subscription registered. Is there a way to install RHEL software without registering a subscription? If so, how?  | ||||||||||||||||||||||||||||||
| OpenLDAP memberOf attribute is not updated after group update Posted: 05 Sep 2021 08:03 PM PDT I have an OpenLDAP setup on Debian 7.1, (OpenLDAP 2.4.31), and I am trying to set up the memberof overlay. My configuration is just like I have read at lots of sites throughout the internet, however, it still does not work for me. The issue is that the memberOf attributes of the entities are only updated when I create a group, but are not updated when I modify or delete a group. Actually this same issue was once asked before here: How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf), but even if it is checked as answered, I could not find any usable information in the answers. (Even the original poster couldn't do anything with the answers according to the comments...) My configuration is like this: cn=config/cn=module{0}.ldif And for the module: cn=config/olcDatabase={1}hdb/olcOverlay={0}memberof.ldif The group I add: The query I run: So the issue is not with how to query the attribute, but that after modifying or removing the group, the result of the search does not change... Update: As for Brian's answer, I also set up refint overlay, with the following config: But neither it fixed memberof overlay, nor it worked in itself. When I modified the name of a member of a group, the member attribute of the group was not updated. Could this two issues be related?  | ||||||||||||||||||||||||||||||
| Adding a "dynamic" route manually for troubleshooting Posted: 05 Sep 2021 05:06 PM PDT Is there a way to add a route in Linux with the Dynamic flag set? The reason I want to do this is to troubleshoot an issue where there exist identically static and dynamic routes, and what happen if I try to delete the static route. We suspect that the dynamic route was removed, and not the static route. I have tried: But  | ||||||||||||||||||||||||||||||
| How to view if partitions primary or secondary in Linux Posted: 05 Sep 2021 03:43 PM PDT How do I view my partitions if they are primary or secondary in Linux CentOS? I tried  | ||||||||||||||||||||||||||||||
| Posted: 05 Sep 2021 09:08 PM PDT We have upgraded an ASP.NET web application from IIS6 to IIS7 integrated mode. Our application uses: and therefore we have had to set: Is this sensible? My instincts say not, but searching on google for this issue, this "workaround" is suggested on every page visited. Is impersonation no longer a good practice in IIS7 integrated, and should we abandon it and come up with a different solution?  | ||||||||||||||||||||||||||||||
| Execute local (bash|python) script with mysql SQL Posted: 05 Sep 2021 06:03 PM PDT I want to create a trigger so that when a field is updated it kicks off a local bash script (or python...whatever) to kick off a workflow (emails, work requests, etc). Is it possible to execute local system scripts/executables from mysql SQL? My google searches have been unsuccessful.  |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment