Recent Questions - Server Fault |
- Errors mounting Windows share (cifs) with pam_mount
- Reduce ansible task boilerplate with some kind of template?
- Docker isn't fowarding port to redis
- As a manager of a Google Shared Drive why can't I add folders?
- On Apache how to switch off DirectorySlash only for requests to a specific subdomain?
- Trimming the path and redirect in Nginx
- Different ping feedback from seemingly identical LAN machines
- Testing Regular Expressions
- Conditional directives based on User-Agent with Apache 2.2.x?
- Using environment file in haproxy container
- If I want to use dig/nslookup to query about machines in a VLAN, how can I find which name server to use?
- How can I remove an accept-encoding request header in nginx?
- nagios-nrpe-server output different vs running locally
- Service Account Permissions for Task Scheduler READ
- Git over ssh on remote machine [closed]
- A TLS fatal alert has been received with exim4 in debian 9
- How to disable TLS 1.0 in Windows Server 2012R2
- Is it possible to switch between AWS accounts without signing out first?
- How do you restart the network service on Fedora 30?
- Create Google Cloud Managed SSL Certificate for a subdomain
- Add LimitNOFILE on haproxy init script
- Windows Update bypassing server as download source
- multiple ipv6 routers on the same physical network, how to get it working?
- Robocopy - Copy a single file from a directory and overwrite a file in a destination directory if its newer
- Access remote VLAN over IPsec VPN using Zyxel routers
- Processes spawning randomly and sucking CPU
- Change TMP/TEMP variables for a Domain Service Account
- postfix deliveries per connection
- How to configure CentOS Iptables without getting locked out
| Errors mounting Windows share (cifs) with pam_mount Posted: 31 Mar 2022 11:02 PM PDT I have an Ubuntu 21.10 pc joined to a Samba AD domain controller. Everything is working absolutely fine - Kerberos is working (can get tickets with kinit), winbind is working (can get info abount users and groups), I am able to log in to the system with domain credentials. And mounting shares manually also works, both with Kerberos and ntlmssp authorization: Setting username like username=USER@DOMAIN works too. The problem is I can't get pam_mount to work when a user logs in via gnome! Using krb5 in pam_mount.conf.xml like this Gives an error in auth.conf Using ntlmssp in pam_mount.conf.xml like this Gives a different error in auth.conf After enabling debugging in pam_mount I can also see the exact mount command it is executing in auth.log and it is identical to the ones above which work, when I run them manually. I've tried the following:
Any ideas? |
| Reduce ansible task boilerplate with some kind of template? Posted: 31 Mar 2022 11:10 PM PDT I'm looking for ways to reduce the amount of boiler plate config I have to put into some of my ansible tasks. For instance I have many tasks using the (The problem researching this is that 99.9% of search results on this subject are about the copy/template module itself). I guess I could write a custom module in python which extends the docker_container module, but that seems really overkill. Any ideas on reducing boilerplate config? |
| Docker isn't fowarding port to redis Posted: 31 Mar 2022 11:16 PM PDT I'm trying to run redis in a docker container on AmazonLinux, and I can't for the life of me get it to forward the port. It starts as it should and appears to be working, but there is no process listening on 6379 on the host box, as one would expect. What should I do? Here is Output of Logs from Even after starting, output of Result of Output of Output of |
| As a manager of a Google Shared Drive why can't I add folders? Posted: 31 Mar 2022 09:33 PM PDT I have the "manager" role on a google shared drive, yet I am unable to add files or folders to it. All options are greyed out on the (right click) context menu. If I try to drag and drop - it gives the message, "you need to be a manager on {shared drive} to move to this folder". I already have the manager role, and can confirm this by checking "manage members". What could it be? |
| On Apache how to switch off DirectorySlash only for requests to a specific subdomain? Posted: 31 Mar 2022 09:08 PM PDT Served by Apache I'd like on one subdomain site of mine (say All the directives have to go in my .htaccess file. For this to work I am planning to do the following:
I have a good idea how to do 2. and 3., but how can I issue |
| Trimming the path and redirect in Nginx Posted: 31 Mar 2022 08:53 PM PDT I have a Wordpress server at This is working fine. What I want to do now is to redirect a legacy path to the new path. Basically I want I believe I could do it with: But it didn't work. Then I tried I think I maybe need another way since I need the Any help appreciated. Thank you. |
| Different ping feedback from seemingly identical LAN machines Posted: 31 Mar 2022 07:22 PM PDT LAN of several Windows 10 machines is set up as follows
The Internet modem is deliberately powered down to eliminate Internet access. The router When I do from the first machine ( which is what I'd expect. Also, However, when I run the same command from the other two machines I get and What exactly is going on with these two machines? They seem to report some sort of successful ping. "Sent = 1, Received = 1"? Received from where? Is this somehow normal for Windows And what could be the possible difference between the first machine ("Request timed out") and the remaining ones ("Destination net unreachable")? What should I look for? I don't see any differences to speak of in their |
| Posted: 31 Mar 2022 10:02 PM PDT I am trying to learn regular expressions, and came across some examples online. Trying to put things together, I inputted this into bash It returns the following error
Why do you believe I am getting that? Should I create a to j files? or should I create 1 file with a-j in it? Why is it returning that? Thank you for your help. |
| Conditional directives based on User-Agent with Apache 2.2.x? Posted: 31 Mar 2022 05:23 PM PDT I want to implement something like the following in our Apache httpd configuration: but my understanding is that this conditional |
| Using environment file in haproxy container Posted: 31 Mar 2022 05:09 PM PDT Im trying, unsuccessfully, to run the official haproxy container (https://hub.docker.com/_/haproxy) with an environment file per (something like this https://www.loadbalancer.org/blog/how-to-install-haproxy-rhel/) to allow me to substitute vars in my haproxy.cfg, example: i cant seem to figure out how haproxy is even running on that container to figure out where i would even put the environment file. i found /etc/environment, overrode it w/ an env file and reloaded the config but those vars didnt take. What im trying to accomplish is having a docker env that if i want i can point a node to our dev server instead of a local container and do so just by editing the environment file. This too would be useful, as i can use the same haproxy.cfg in production as well as locally and the only difference being is the env file. |
| Posted: 31 Mar 2022 05:51 PM PDT If I want to use |
| How can I remove an accept-encoding request header in nginx? Posted: 31 Mar 2022 09:41 PM PDT The recent update to zlib due to a security hole appears to cause a major problem when serving PHP-FPM 8.0 via nginx on Ubuntu focal. Any requests with a gzip encoding fail right at the start of the response, though nginx logs the requests as successful and the correct size. If I make requests without an and I've also checked that there are no other directives that turn these back on again by grepping However, if I dump the request headers from PHP (i.e. after it's been through nginx), I still see this accept header: so nginx is not stripping it from the request before it's passed through to PHP-FPM. I've tried setting these directives at the server and location levels, with the same results. In PHP I've disabled all output buffering, but it doesn't appear to be possible to disable zlib without a recompile. How can I get nginx to strip this request header so that neither nginx nor PHP will compress responses? |
| nagios-nrpe-server output different vs running locally Posted: 01 Apr 2022 12:08 AM PDT To be sure I don't have any double definition of the command, I created a new debug command name in the nrpe config Executing it via nrpe plugin gives me a warning But running it locally reports OK. nagios-nrpe-server is running under the user nagios (as per default) Any ideas why this discrepancy? Thanks! The server is running ubuntu 20.04.4 and was originally installed with ubuntu 16.06 and dist-upgraded twice. |
| Service Account Permissions for Task Scheduler READ Posted: 31 Mar 2022 09:28 PM PDT I have a PowerShell script I've written to do a comparison of Scheduled Tasks between two nodes of our application server cluster. It uses this code to query the tasks from a given server... It works perfect when run under my domain admin account. However when I try to run it under our service account as a scheduled task, it gets this error when trying to query the scheduled tasks on the other node ... Googling and looking around it LOOKS like the only way to allow an account to access this list would be to add them to the LocalAdmins on the server in question? But it really doesn't feel right to have to make our service account as a local admin, and obviously we don't want to have the task run under my domain admin account. I've tried solution no. 3 here, which sounds like it would be it... but even after doing all those steps, it still won't work. How can I allow our service account to query (read-only) the scheduled tasks from our servers, while being as security conscious as possible? |
| Git over ssh on remote machine [closed] Posted: 31 Mar 2022 05:53 PM PDT I have a stationary computer on which I am used to write some programs. I've setup a few git repos on it and it works well. I am able to git pull/push when I'm physically using my computer (I launch terminal, get into a repo folder and run my git command). For a few weeks I'll be unavailable physically, so I want to use ssh (with the same user as when I physically log in) to use my computer remotely. However I'm not able to use git properly via ssh. I run the following commands to connect on the remote computer: When running a git command, I keep getting the following output/error: The key "id_rsa" is a key on the remote computer, that I used with git when I was on the computer physically. Any Idea which parameters do I have to set for git command to work? Thank you! |
| A TLS fatal alert has been received with exim4 in debian 9 Posted: 31 Mar 2022 10:06 PM PDT I am trying to configure my server to send mail and I receive an "TLS fatal alert" error every time I try to send mail. I have followed the steps indicated in this post related to my problem to try to overcome the problem, but it finally gives me the error that I describe:
I try to connect to my mail server by tls:
I dont know why appear CN=server.example.com like subject. The /var/log/exim4/mainlog file said: In my linode-vps the main domain is gestiondecorreos.es and orbelanet.com is another domain i am running smtp tests on. Thanks in advance! Mikel |
| How to disable TLS 1.0 in Windows Server 2012R2 Posted: 01 Apr 2022 12:06 AM PDT I have disabled SSL 2.0 and SSL 3.0 in Windows 2012R2 server by going into HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ and adding entries as shown in the attachment. It is working perfectly fine. However, it is not the case when am trying to disable TLS 1.0. If I add entries similar to what I have done for SSL 2.0, SSL 3.0, it blocks the port 443. I am not able to get my head around this. Pictures: TLS 1.0 - Client Key settings TLS 1.0 - Server Key settings Nmap result with TLS 1.0 in the registry:
But When I delete the TLS 1.0 entry from the registry, It works fine and says that TLS1.0 is enabled. NMAP result without TLS1.0 in the registry:
Please let me know if I am doing anything wrong. I have followed a handful of links and all of them suggest the way I have been following already. |
| Is it possible to switch between AWS accounts without signing out first? Posted: 31 Mar 2022 07:12 PM PDT My organisation uses AWS Federation to handle multiple AWS accounts. However, every time I try to log into another account, I get the following error:
This requires me to click "Sign out", and sign into the account again. This can become very tedious when often switching between multiple accounts. Is it possible to switch between accounts without having to sign out first? |
| How do you restart the network service on Fedora 30? Posted: 31 Mar 2022 11:48 PM PDT On previous versions on RHEL/Fedora, the Using Where'd the |
| Create Google Cloud Managed SSL Certificate for a subdomain Posted: 31 Mar 2022 08:09 PM PDT I have my main domain I've created the custom domain on Google Cloud What I want to do now is create a new managed SSL certificate for this subdomain as shown below:
Is this possible? Is it good practice given that I want to continue adding more subdomains like |
| Add LimitNOFILE on haproxy init script Posted: 31 Mar 2022 06:06 PM PDT I want to add open files limit to HAProxy 1.8 process to 1024576. But since I use version 1.8, I cannot add LimitNOFILE to init scripts, instead of systemd file. How can I add limitNOFILE to those processes ? *P.S: I had changed openfile on |
| Windows Update bypassing server as download source Posted: 31 Mar 2022 11:01 PM PDT I have a Windows Server 2008 R2 SP1 machine that is isolated in a DMZ. Historically it has not had issues but everything works before it breaks. The port 8530 is open on the firewall appliance and I can telnet from the client to the server which proves the site is ready and open. This machine is not attached to the domain so WSUS server is set in the registry. So under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate I have The windowsupdate.log corroborates this. I would like to try and include only what is required to try and keep the post length down. The client reaches out to the server and see that it has X available updates. However it fails to download those. The log shows entries like this: With regards to the SendRequestUsingProxy failed, that should fail. The server does not have access to Microsoft websites so it will be blocked from being able to go there. What I can't figure out is why it isnt getting the updates from the WSUS server directly. We do not use a proxy nor is one configured. On the WSUS Server side of things I see that it get a download failed status for each of the updates. So in short the communication is there but the client is trying to download the updates from externally. It is a 2k16 server and reading the logs with This is the only external server I have to the network so I do not have any comparison systems to know exactly where the system is. In an attempt to testing connectivity to the server I try to browse to http://kanwsus2k16:8530/selfupdate/wuident.cab which is met with page cannot be displayed on the client server. (That link works fine on the internal network) Why is my Windows Update client not honoring the WSUS path for updates and instead attempting to go externally for Microsoft? Other things I have tried:
|
| multiple ipv6 routers on the same physical network, how to get it working? Posted: 31 Mar 2022 10:06 PM PDT I have multiple Internet routers from the same provider (I'll name "boxes" the Internet routers), all linked to the same hardware network switch forming a physical network (I'll name "NML" that physical network for "No Man's Land") on which are connected two routers (I'll name them "routers") doing routing and firewall tasks for a private LAN: On the ipv4 side, NML is a local network using an ipv4 private class, it works. On the ipv6 side, each boxes share the same /64 prefix and each router get an auto-configured ipv6 address from each box (each router get four ipv6, one per box). To make it simple you can imagine ipv6 addresses with 3 chars:
So each router get four ipv6 addresses, one per box.
At first only one box had ipv6 activated and at this time I was able to query the Internet using ipv6, but since I activated ipv6 on all the boxes I'm not able to query the Internet using ipv6 anymore. If I do a Note that I don't need to do ipv6 stuff from LAN through the routers at this time, I only need routers to be able to do Internet stuff using ipv6 (mainly to build some VPN over ipv6). The Internet routers (named "boxes") are property of ISP and the only option I have is an "enable IPv6" checkbox on the customer page, I don't have any access to router configuration itself and no one other option than enabling or disabling ipv6. The routers between LAN and NML (named "routers") are standard Debian systems running on some x86-based networking hardware. On a Debian point of view you can imagine it's like a PC : I can do whatever a standard Debian can do. So, two questions:
I removed some "expires" information and stuff like that to remove some verbosity, plus I sometime added some leading Some traceroute example: |
| Posted: 31 Mar 2022 08:09 PM PDT All, I've come across an issue with deploying a time sheet to users. I've researched robocopy a little bit and think it might be a solution. I need to overwrite a copy of the time sheet located on the public desktop of each user every time I make changes to it. It has become a hassle navigating to each user's public desktop, primarily the ones connected through VPN on a poor connection. Is there a way to copy the time sheet from a directory on a server and then overwrite the old copy on the users machine and attach it to a scheduled task so I don't have to reach out to each user every time I update the time sheet? |
| Access remote VLAN over IPsec VPN using Zyxel routers Posted: 31 Mar 2022 06:06 PM PDT I have a central site with a Zyxel Zywall 310 and a remote site with a Zyxel USG 20w. I also have a working IPsec VPN between the two sites. PCs on What rules would I need to add to allow PCs at the remote site (behind the USG 20w) to access Server2 on Here's what the network looks like:
I suspect the solution may involve either Policy or Static Route rules (I currently have none set, though I've tinkered with them a bit, but was unable to get anything working). |
| Processes spawning randomly and sucking CPU Posted: 31 Mar 2022 11:01 PM PDT I am currently on Ubuntu 16.04, and I have noticed slowdowns across the server in general. Upon viewing I successfully killed the process with signal 9, but after a few seconds, another process with a completely different command pops up, and ran until I killed it. Rebooting the server did not fix this. Would appreciate some advice on this, thanks! |
| Change TMP/TEMP variables for a Domain Service Account Posted: 01 Apr 2022 12:06 AM PDT I want to change the TMP and TEMP variables for a Domain Service Account Normally, for local users I can change this variable via regedit > HKEY_USERS > SID number of account But for the Domain Service Account I can't find the Sid number in HKEY_USERS. How can I change these variables for such an account? |
| postfix deliveries per connection Posted: 31 Mar 2022 10:16 PM PDT hope you can assist me in this case. I am administrating an Postfix server which is used for newsletters. Recently one of the major recipient domains changed their policies to only accept one email per smtp session/connection. To adhere to their policy I found the following settings in main.cf to be kind of useful as they refer to concurrency of email delivery, though it doesn't seem to help. (I've tested with values as low as 1)
The error I am facing is: dsn=4.4.2, status=deferred, along with a link telling me to send a single email per SMTP connection. Postfix version: 2.9.6 Any suggestions will be appreciated! |
| How to configure CentOS Iptables without getting locked out Posted: 31 Mar 2022 07:40 PM PDT I am trying to apply these firewall rules: However, when I copy and paste them into the command line I get locked out of the server (of course since the rules are being applied line by line). How do I apply these rules all at once since /sbin/iptables -P INPUT DROP is executed first, but the line to allow shell access comes after (I have removed this to protect my IP. |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment