Recent Questions - Server Fault |
- Why does StrongSwan charon-cmd client require the --cert command-line option for multiple CA chain certificates?
- Active Directory Web based Self Service
- Ansible AWX - ansible-playbook command not found
- How to unlock multiple luks-devices using dropbear-initramfs
- What's required to let a domain send outbound emails from multiple domains?
- Can not connect to Linux instance using SSH through Putty
- Windows Server Slow NFS Performance
- Kubeadm 1.24 with containerd. Kubeadm init fail (centos 7)
- Parallel OpenVPN Connection Over multiple Libvirt Network Interfaces
- kubeadm init failing to connect through proxy
- Basic auth and data from curl to HAProxy backend not working on TLS Termination - but works on TLS passthrough
- Should HTTP load balancer forward bad requests to backend?
- Exposing an internal IP to the internet on GCP
- Alertmanager telegram config chat_id and cannot unmarshal errror
- Can you damage a POE camera by plugging it quickly into a PoE switch over and over
- Postfix - Recipient Address Rejected on Incoming Mail Only
- Mounting a cifs share dir_mode and file_mode are being ignored
- Azure DNS with GoDaddy
- Unable to retrieve users from AD on VMWare vcenter
- Can't connect to Ubuntu server on LAN from pfSense VPN
- SERVER2012 R2 Core access denied when deploying domain controller from remote system
- How do iptables work with NFQ in terms of traffic shaping in snort?
- Configure Centos7 Apache 2.4 php-fpm to run as user
- How do I upgrade an end-of-life Ubuntu distribution?
- Redirecting www.subdomain.domain.com to domain.com with htaccess
- NGINX Reverse Proxy Sharepoint 2010 authentication fails
- Factory Reset Cisco SPA504G without admin password
- Bad IIS 7.5 performance on webserver
- IIS returns 302 when not on local host
| Posted: 20 May 2022 03:36 PM PDT I have a StrongSwan charon server on Ubuntu 18.04. I connect to this server with a StrongSwan charon-cmd client from another Ubuntu Linux machine. The command I use from the client machine to connect to the server is:
It works great, but I don't understand why I need two "--cert" options in the command line to trust both GoDaddy CA certificates in the chain. My personal certificate is served by the StrongSwan server, and its authority is the GoDaddyCA1.crt. The GoDaddyCA1.crt certificate has an authority of the GoDaddyCA2.crt certificate. The GoDaddyCA2.crt is a self-signed root certificate. So, the authority chain is:
The meaning of the charon-cmd command-line option "--cert" is to declare that "this is a certificate that I trust". So, I would expect that by trusting the GoDaddyCA1.crt, then my personal certificate should also be trusted. But that's not good enough for charon-cmd. The charon-cmd client demands that I specify "--cert" to trust all the way to a self-signed certificate. But this seems superfluous. If I trust the intermediate CA certificate, then obviously I must also trust it's authority CA cert, right? Is this a bug, or a feature? If it's a feature, what benefit does it provide? |
| Active Directory Web based Self Service Posted: 20 May 2022 03:40 PM PDT I am a service provider and have installed an active directory infrastructure as the backend to a number of applications. The issue is that the end users will never login to a domain bound machine, Limiting the ability to have passwords expire, reset, etc. Looking for recommendations on solutions. I like the look of https://www.logonbox.com/ however cant swallow the cost. The ability to give the customer the ability to manage users, Limited by which OU's, users, Groups they can see and manage would be a bonus. |
| Ansible AWX - ansible-playbook command not found Posted: 20 May 2022 02:20 PM PDT For some reason I'm getting the following error Any idea what the issue might be?
|
| How to unlock multiple luks-devices using dropbear-initramfs Posted: 20 May 2022 02:22 PM PDT My system setup is as following:
To unlock to LUKS-devices at boot time from remote, I tried to use dropbear-initramfs. That works fine, to unlock the first LUKS device (on the SSD, with the debian system installed on):
But to unlock the second LUKS device (on the RAID0), I still needs some console. Is there any way to unlock both LUKS devices together (or after another) using dropbear-initramfs / busybox? TIA! |
| What's required to let a domain send outbound emails from multiple domains? Posted: 20 May 2022 02:06 PM PDT Let's say I have:
Goal: send 10 emails via each of 4 worker-Postfix domains, on behalf on Question: How? What is it what should be set up in terms of DNS records? Since MX records are required to receive email, that is, for inboud emails, what is it what's required to send, outbound, emails? |
| Can not connect to Linux instance using SSH through Putty Posted: 20 May 2022 01:47 PM PDT Just signed up for GCP account and created a Linux VM on GCP (SUSE) and having issues to connect via SSH through Putty. Also tried through CMD prompt on Windows 10 and get the same issue. Followed up all the steps to generate ssh keys and uploaded public key on GCP (also, I can see the key in .ssh directory). Firewall is set to enable all hosts and ports to connect. I am able to ping the External IP but when trying to ssh into the VM there is no response and ends in timeout. ssh -i pathtoKeyfile user@External_IP ssh: connect to host xx.xx.xx.xx port 22: Connection timed out Please help with any suggestion on similar issues. |
| Windows Server Slow NFS Performance Posted: 20 May 2022 12:42 PM PDT Setup: Server: Windows Server 2019 w/NFS feature installed. Virtualized on Proxmox backed by 6-disk zfs Client: Windows 10 Network: 1GB backbone NFS: Authentication Kerberos V5 w/Server authentication disabled. ACL by IP. Otherwise default configuration. Issue: 5-10mbps peak performance. SMB Share for the same folder I'm seeing closer to 100-200mbps. Server/Client CPU/Memory usage isn't indicating saturation. Changing mode from TCP/UDP to TCP only didn't impact rate. |
| Kubeadm 1.24 with containerd. Kubeadm init fail (centos 7) Posted: 20 May 2022 02:03 PM PDT I try to install a single node cluster on centos 7, with kubadm 1.24 and with containerd, i followed the installation steps, and i did: containerd config default > /etc/containerd/config.toml and passed : SystemdCgroup = true but the kubeadm init fails at : systemctl status kubelet : is Active: active (running) and the logs : journalctl -xeu kubelet : i can't figure out if, due to containerd, i have to run a kubeadm init --config.yaml ? or what could be the error Could you help me with that ? |
| Parallel OpenVPN Connection Over multiple Libvirt Network Interfaces Posted: 20 May 2022 12:30 PM PDT Let's Say That I have 20 VMs (Host: Ubuntu, Using Qemu-KVM, libvirt) and that I would use different network interfaces for different groups of vms. (1-6 using Network1, 7-15 using Network2, 16-20 using Network3). The Network interfaces were created by libvirt. And I would want The network interfaces to use a openVPN connection. (So Network1 uses conn1, Network2 uses conn2, Network3 uses conn3) to serve the purpose which is that the first group of vms all use the conn1 and so on... |
| kubeadm init failing to connect through proxy Posted: 20 May 2022 10:07 AM PDT I have this version of kubeadm My docker is setup and working properly, and can easily and properly pull all the needed images through the proxy I am using. I have the HTTP proxy configurations across the board in profile and bashrc and environment etc.. When I try to run kubeadm and have it pull images it times out I have even manually pulled the necessary images I need help understanding why kubeadm is not using the proper http proxy which seems to be the case when trying to get https://dl.k8s.io/release/stable-1.txt There are no problems getting that file, why isn't kubeadm getting it? Update: After looking at the forced version option I tried that Now it doesn't try to retrieve the stable-1.txt. I suspect I missed the fact that it may have been able to retrieve it regardless. Now it is STILL trying to pull images that docker already has. Why is kubeadm trying to pull images that already exist? It still doesn't help that the proxy is not being used.I can accept that but why isn't kubeadm using the existing images? |
| Posted: 20 May 2022 11:16 AM PDT Using the above config we are able to call the backend successfully from curl on a certain endpoint, using the same certificates, but we are blocked on another endpoint of the same server which requires basic auth. The curl call is:
Is there some way to forward everything from this curl command to the backend? The weird thing is , when we remove all ssl auth and switch to tcp mode as transparent proxy, the basic auth works! |
| Should HTTP load balancer forward bad requests to backend? Posted: 20 May 2022 03:08 PM PDT If a HTTP client sends a GET request with a body that would generate a 400 Bad Request response, should the load balancer forward that request to the backend or deal with it immediately? Is there any advantage in NOT dealing with it at the load balancing layer? Recently, an application team complained that a load balancer was returning 400 Bad Request when the application itself would return 405 Method Not Allowed. It seemed the load balancer was right and the application team had a misunderstanding but that left me wondering when the load balancer should more forgiving and forward crap to backends anyway. |
| Exposing an internal IP to the internet on GCP Posted: 20 May 2022 11:03 AM PDT Be warned, noob question here. I want to play around with GCP AlloyDB. I have created a cluster and it has been assigned an internal IP. This is fine for applications running in the same VPC/ project network but I would love to connect to it directly from my workstation in the simplest way. I am a total noob and don't even know what I don't know and would really appreciate any guidance on how to expose/map an internal IP to an external IP in GCP. Especially when I cannot pick the AlloyDB instance or internal IP when trying to reserve an external IP via GCP web console. I'm thinking NAT and some router would do the trick but it's beyond my current knowledge and not even sure where to start searching. |
| Alertmanager telegram config chat_id and cannot unmarshal errror Posted: 20 May 2022 01:10 PM PDT I am trying to configure alertmanager to send alerts to my telegram group. Following the configuration I have: The problem is that the container crashloopback with ts=2022-05-01T22:06:11.142Z caller=coordinator.go:118 level=error component=configuration msg="Loading configuration file failed" file=/etc/alertmanager/config/alertmanager.yaml err="yaml: unmarshal errors:\n line 26: cannot unmarshal !!str How can I fix this? I have tried add single quotes and double quotes but I still get the same errors |
| Can you damage a POE camera by plugging it quickly into a PoE switch over and over Posted: 20 May 2022 02:14 PM PDT Here is the context as I am a newbie at this - I got a free HP procurve 24 port POE switch from a nearby university. I have 12 cameras and long story short only 4 of the ports worked and the unit flashes stating their is a POE fault. I tested the unit by plugging in a live single camera connection into each port 1-24 rapidly to see which ports would show activity and which ports do not. Now that camera does not work. Its a Ubiquiti G3 bullet. I wanna know if plugging in a ethernet connection rapidly into each port could cause damage to the camera. I would like to understand why if possible, thanks |
| Postfix - Recipient Address Rejected on Incoming Mail Only Posted: 20 May 2022 12:00 PM PDT I am working on building a secure mail server for the first time using Postfix and Dovecot and I have encountered a problem that I cannot surpass. To avoid the email delivery in the spam box of remote servers I set up a SPF and DKIM following this tutorial. The problem now I have is my server is rejecting the recipient address on my server when delivered from remote services like Gmail.
This is my /etc/postfix/main.cf Initially, Outbound mail timed out until I added under smtpd_recipient_restrictions How do I get my server to accept mail? Edit This is what I get when using a testing tool: Edit 2 This is the output in /var/log/mail.log Edit 3 This is my /etc/postfix/master.cf |
| Mounting a cifs share dir_mode and file_mode are being ignored Posted: 20 May 2022 11:06 AM PDT I have an Ubuntu Server that is trying to mount a Windows Server shared folder. Firstly, what I'm trying to do here is mount the share as the person in the credentials file and all actions take place as this person regardless of what user on the Ubuntu server is accessing the files.
I can read/write as the root user but I can only read as any other user on the Ubuntu server. How can I give other users (like my web server user) write access to this cifs share? |
| Posted: 20 May 2022 11:06 AM PDT I have purchased my domain from GoDaddy. I have hosted my website in Azure VMSS with Azure Application Gateway. In Azure DNS, I have create the zone for mine website. In GoDaddy, I have added Name Servers that I got from Azure DNS. But my site is not accessible. Also when I am trying to do nslookup "site.com" it is giving me error as "** server can't find site.com: NXDOMAIN" Please help |
| Unable to retrieve users from AD on VMWare vcenter Posted: 20 May 2022 02:06 PM PDT I have added the AD successfully from the vcenter console and also configured the Single Sign On.
When I try to retrieve the users from the AD, I first set the domain in the Users and Groups tab, then after a while I get the following error:
So, I attempted to do the same procedure using the Desktop client.
But, I get the following error.
Call "UserDirectory.RetrieveUserGroups" for object "UserDirectory" on vCenter Server "gspsec-vcenter" failed. I cannot understand as to what I doing wrong. There is no firewall in between. IN fact, the AD is a VM on the same ESXi that the vCenter is managing. The version is 5.5.0.5101 Build 1398493. I restarted the complete appliance after configuring the AD auth as that was recommended |
| Can't connect to Ubuntu server on LAN from pfSense VPN Posted: 20 May 2022 12:00 PM PDT Quick summary pfSense server is connected to the WAN and LAN. This box also has an OpenVPN server running.
On the LAN I have two servers, one running Ubuntu (15.10) and one running OS X (10.11 with Server).
Problem When connected via the VPN, I can ping, traceroute and generally access the OS X server fine. However, the Ubuntu server just times out (no ping, and the traceroute stops at I've confirmed this problem using both ping and traceroute tools from pfSense as well. I can hit both servers with a LAN source, but only OS X with an OpenVPN source. This lead me to believe it's an issue with Ubuntu, so I temporarily disabled UFW and enabled IP Forwarding. Didn't fix it (not that I expected either of those to work, but I'm drawing at straws at this point). More details about the VPN setup Tunnel settings
Client settings
Conclusion The part I can't wrap my head around is why it works for one server, but not the other. I suspect something is wrong with the Ubuntu setup, but I can't put my finger on what. Any thoughts on what I'm missing here, or where I should be looking? Update 1 I've also made sure that unbound on the pfSense box explicitly allows DNS traffic between Update 2 I've found that I can ping the OpenVPN gateway Update 3 After more hours than I care to admit, I found the solution. I was missing the bloody route to the VPN subnet (I assume OS X just falls back to the main gateway when in doubt or something, which is why I didn't have to add a route there). So, this fixed everything from the Ubuntu server side.
Once that was fixed, everything worked like a charm. Many thanks to this issue as well for pointing me the right direction. |
| SERVER2012 R2 Core access denied when deploying domain controller from remote system Posted: 20 May 2022 01:01 PM PDT I have installed Windows Server 2012r2 Core edition and want to promote it to my first domain controller. I intended to do this with a Server Manager installed on a client computer. I connected to the server with the Server Manager and was able to install the AD DS role and the DNS role. After installation when I want to deploy the Domain Controller however I get an error:
This happens while using the same user that was used to install the roles. The server IP has been set to static, the DNS server points to itself, client and server are part of the same workgroup. I tried with RSAT tools in both Windows 8.1 and 10. As a stop gap I installed the Server Manager on the server itself and from there I can deploy the Domain controller. However, I would like to understand why it is not working from the remote system. All is done in virtual machines (not actual hardware) and I can therefore go back to the state before deployment. |
| How do iptables work with NFQ in terms of traffic shaping in snort? Posted: 20 May 2022 04:04 PM PDT I'm trying to understand how The reason that I ask this is because from what I understand The caveat to this is that |
| Configure Centos7 Apache 2.4 php-fpm to run as user Posted: 20 May 2022 02:06 PM PDT I would like to configure a Centos 7 Apache 2.4 Linode to use php-fpm to execute php as the file owner. The docs for earlier Centos6 / Apache2.2 don't work and the configurations I have seen for setting up Lamp servers on Centos7 just run as the apache user. Are there any good tutorials to do this, or can someone provide the configuration files and virtual host directives need to do so? Thanks. |
| How do I upgrade an end-of-life Ubuntu distribution? Posted: 20 May 2022 03:22 PM PDT My So it says my version is not supported anymore. I have Ubuntu Quantal (12.10). What should I do now? |
| Redirecting www.subdomain.domain.com to domain.com with htaccess Posted: 20 May 2022 04:04 PM PDT So I'm trying to get my server configured in a specific way so that anyone who visits http://www.subdomain.domain.com or https://www.subdomain.domain.com gets redirected to https:// without the www. What Htaccess would I need to achieve this? |
| NGINX Reverse Proxy Sharepoint 2010 authentication fails Posted: 20 May 2022 03:01 PM PDT When presented with the Windows forms based authentication after entering the users credentials I am prompted again for a username and password. This just keeps prompting you, I see no errors in the logs that would help. I feel the Microsoft side may be seeing some errors but I do not have access to that server. I am sure this is a common issue. Can anyone give me some pointers? My config: |
| Factory Reset Cisco SPA504G without admin password Posted: 20 May 2022 02:05 PM PDT I've been trying to factory reset some SPA50x phones, specifically the 504G but the old provider has locked out everything. I need to reset about 50 phones for use with a new service. I've man in the middle'd their provisioning server, but the phone profiles are compiled with SPC. I've found a reference to how the old provider created the compiled profiles, and I have recompiled a new profile overriding the Admin_Passwd in the config file, but the phone simply complained that the config file was corrupted. The phone is configured for SIP, but I have tried connecting it to a UC540 to see what would happen. The phone is able to re provisioned against it, but I still can't reset it without the admin password. This was just for testing anyways, since I actually need the phones connected to Asterisk. I am very close to considering opening the phone and looking for a jtag port or some other way to reset these phones. I have a single phone on my desk right now that I can play with. I am hoping to find a repeatable solution to this. Any advice would be great. |
| Bad IIS 7.5 performance on webserver Posted: 20 May 2022 03:01 PM PDT I have a webpage (ASP.NET 4.0 / MVC 4). On my development machine (i5-2500 3.3 8GB Win7 VS2010 SP1 Fujitsu Esprimo P700) the page performs with 160 requests/sec on devenv webserver on my machine. The page performs with 250 requests/sec on my local IIS 7.5. (uncompiled web) The page performs with 20 requests per second on a 16core 32gb ram production server (Fujitsu RX-300 w2k8 rc2 IIS 7.5). (compiled web) Why? I think it's the IIS configuration but i can't figure out whats the problem. The page runs with 1 worker process on both machines. Web garden is not an option (it helps but the app isnt compatible with) EDIT: The driver versions of http.sys and tcpip.sys are same on prod and dev. The tests were always run on the machines itsself on localhost. The CPU usage on prod is 95% @ 20 req. On dev 80% @ 250 req. (32 threads) there is no db or io involved in this test. I opened the server, and yes there are really 16 xeon cores inside on prod. |
| IIS returns 302 when not on local host Posted: 20 May 2022 01:01 PM PDT I am working on an asp.net page that handles paypal IPNs (instant payment notification). For those who don't know how IPNs work, I'll explain. When some kind of transaction occurs on paypals servers, paypal will send a POST message back to a certain page on my server. If customer A uses paypal, paypal lets us know so we can keep records of transactions that don't actually occur on our machines. My box has proper port forwarding. Paypay sends data to http://www.companyurl.com:2343/ProcessPaypal.ashx, where port 2343 redirects to my box running IIS. This set up was working fine yesterday. Today, however, I stopped getting any of my test IPNs. Running wireshark, it looks like my box is receiving those IPNs, but returning 302s that look like this: http://www.companyurl.com/ProcessPaypal.ashx (notice the lack of a port number). My question is this: is there a way to tell my computer not to 302 the IPNs and just process them like it should? As far as I know I didn't change any config files. Also, I can access these pages fine on local host. |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment