Recent Questions - Server Fault |
- How do I fix issue with renewing my certbot certificates on ubuntu
- Solution for hosting a growable farm of different containers
- Cannot make outbound connections with iptables set to allow all
- How to clear Windows Server 2019 DNS suffix search list
- How to configure an Apache load balancing proxy with a hot standby BalancerMember
- How to install packages from command line on Suse
- Does packages security patches are backported to older version?
- DNS best practice for large resilience orientated org
- Is it possible to host the database on one server, but the actual data on another?
- E-Mail from Postfix Server goes to Spam for Gmail and Hotmail/Outlook: How can i correctly setup my PTR and rDNS and HELO?
- What is the relation between host.conf and resolv.conf
- How to debug FAILED - RETRYING: wait for hosts (12 retries left)
- Can I use a terminal server as it's own license server?
- Stress test a server running on the local machine?
- Rolling updates of backend with udp server sockets
- Let an unattended script connect from windows to an applaince with ssh password
- Endless redirect loop on nginx config
- How to find Free IP address in a sub range?
- Running certbot on an ECS instance
- OpenVPN Layer 2 Ethernet Bridging
- Clamav is very slow with tcp
- Adminer or mysql error: no connection could be made because the target machine actively refused it
- BitLocker with TPM: how to replace the numerical password recovery key protector with an alphanumeric password recovery key protector?
- Can ping NAS by ip and hostname in Windows 10 console, but not find by ip or hostname in Windows explorer
- How to route default destination not via VPN tunnel?
- PXE boot cannot find syslinux config file, where is it looking?
- VSFTPD Cant perform anon uploads. 500 OOPS
- How do I create DNS entries for EC2 instances created by Auto Scaling?
- Is STARTTLS less safe than TLS/SSL?
- Setting an SPF record for all subdomains of my domain
| How do I fix issue with renewing my certbot certificates on ubuntu Posted: 02 Dec 2021 02:56 AM PST I am trying to renew my certbot certificates running the command When I run |
| Solution for hosting a growable farm of different containers Posted: 02 Dec 2021 02:54 AM PST I'm trying to find a solution for the following criteria:
I know this requirement list potentially screams "k8", but I just hope there's a simpler technology. |
| Cannot make outbound connections with iptables set to allow all Posted: 02 Dec 2021 02:51 AM PST I cannot for the life of me figure out why the DROP winds up getting hit with outbound requests originating off my openvz based VPS. I know it has to be something with how the packet isn't going directly outbound, or something, and I seem to be missing some basic thing here. I have tried various things, and the only way I can get it to work again is flushing the rules ( The goal is to block all incoming traffic, except from one IP (1.2.3.4) and port 53/113 to everyone, and allow all outbound. Here's output of this is from these are the interfaces (IPs slightly modified for privacy) |
| How to clear Windows Server 2019 DNS suffix search list Posted: 02 Dec 2021 02:43 AM PST I have a Server 2019 which should be with a static IP address. By mistake a DHCP address was assigned to it once during installation and the DHCP also has set the DNS suffix search list. When running I have tried resetting the network, running various powershell commands and even resetting the whole TCP stack but nothing seems to clear this nycab value. If I set in the NIC a specific value in the DNS suffix that value is displayed in ipconfig but when clearing it the value reverts back to nycab. Short of re-installing windows, how can I clear the DNS suffix? I searched the entire registry and it does not appear anywhere |
| How to configure an Apache load balancing proxy with a hot standby BalancerMember Posted: 02 Dec 2021 02:38 AM PST I have two docker containers each with a running application on port 8080. This application has a REST endpoint "/status" that can signal if the application still has the resources to accept another request by a user. A user request will be forwarded and balanced to the two containers by an load balancing Apache proxy. What I want to achieve:
What I've configured: As you can see here, application1 is definded as a hot standby and should be the "victim" to handle requests if all other BalanceMembers are "offline" for new requests What works:
What doesn't work:
What's possible but I don't want to do:
It seems like Apache just removes a BalancerMember if host and port are equal to another BalancerMember. Do I miss something or is there another way to achieve what I want? |
| How to install packages from command line on Suse Posted: 02 Dec 2021 02:28 AM PST What is the Suse version of A fairly intense session of googling suggests that it may be If I am an administrator for a remote Suse server, how do I install packages from the command line? (Not using a GUI and preferably installing from a central repo) |
| Does packages security patches are backported to older version? Posted: 02 Dec 2021 02:27 AM PST I see on cve.mitre.org that OpenLDAP (slapd) package have plenty of vulnerabilities prior to If I want to install OpenLDAP from official repositories on my Debian 10, which version is Do the security patches for those CVE are backported to this Thank you. |
| DNS best practice for large resilience orientated org Posted: 02 Dec 2021 01:55 AM PST I have been asked to investigate the resiliency of our DNS and it's config. What's the industry best practice around this? The following have been suggested: the DNSAdmin group (which is usually created by default when creating a domain) has been removed from all the DNS servers. I doubt this would cause any issues as there are no members in this group, however what's the easiest way to add it top level and for inheritance to work (tested it in a lab environment and inheritance didn't work). Thanks. |
| Is it possible to host the database on one server, but the actual data on another? Posted: 02 Dec 2021 02:36 AM PST We're planning to do AI research using an HPC. This HPC will use datasets that we've created. These datasets are fairly big subsets of the entire dataset (~1TB). All the data we've gathered from experiments will be stored in an SQL database. We want to use SQL queries to fetch relevant subsets from the database which are relevant at a given time - so for that we've developed a RESTful service, which allows people to send sanitized queries. There are some limitations that are currently halting our setup. We have a host for the RESTful service, but using ~1TB storage on it is a bit of a last resort, and we'd prefer to find an alternative way to do things. I was wondering is it possible to host the database on one server, but have the actual data sit on another server? So that when the researcher sends a query to the RESTful service, the SQL server selects which files to send, returns them to the restful service, the restful service returns download links to all the datasets. We're using MySQL at the moment to store the data, and an instance of Flask to allow researchers to submit new experiments, and fetch them. |
| Posted: 02 Dec 2021 01:16 AM PST I know, that this Question has been asked SEVERAL times and I also know, that you have to do a lot of tweaking to make the e-mails not go into spam. However, I am having issues while setting up the PTR and rDNS and my HELO message and am getting desperate with my e-mails going to spam. I setup a mailserver for my one and only domain on my VPS with its own IPv4-Address, which I own for over a year now. I registered the domain 6 days ago. Before that, I solely used this VPS for data-storage. I will use following name-conventions in the following post: My FQDN = My domain = I am using following tools, setup with
GMail passes my DMARC, DKIM and SPF Headers: I think, that they are setup correctly, as the results of mail-tester says the same. However, mail-tester also says, that my rDNS entry does not match my HELO message. What I did was following:
and still mail-tester says the following:
Shouldn't my HELO be the FQDN after all these changes? It still appears to be my domain instead of my fqdn I read in several resources, that mails go into Spam, if you don't use a FQDN as your rDNS. They also should match up with the HELO, however, the HELO doesn't change in my case. I am so sorry, I know, that these types of questions are getting asked A LOT on here, however, I tried everything I read on this and several other forums, my mails always still go to spam in Gmail and Outlook. |
| What is the relation between host.conf and resolv.conf Posted: 02 Dec 2021 01:13 AM PST I am using ubuntu. I see the following information from the manpage:
Does the resolver use both files, in which order and what are the differences? |
| How to debug FAILED - RETRYING: wait for hosts (12 retries left) Posted: 02 Dec 2021 12:55 AM PST Trying to deploy a VM landscape using https://github.com/GoogleCloudPlatform/sap-deployment-automation, I often get the message: It usually repeats failing, and I resolve it by trying various things to enable ssh access. But this time I would like to get some ideas how to make it better than blindly trying. How can I debug Terraform? |
| Can I use a terminal server as it's own license server? Posted: 02 Dec 2021 12:55 AM PST I'm currently setting up a Windows Terminal Server (Windows Server 2022) for our employees and I've been wondering: I know that for a terminal server you need a license server with a RDS User CAL or RDS Computer CAL licenses. My question is: Do I need a separate license server or can I run the license server on the terminal server itself? |
| Stress test a server running on the local machine? Posted: 02 Dec 2021 12:42 AM PST I tried searching around and everything gives me completely different answers I'm comparing nginx and a proprietary server my boss wants to use. We're trying to figure out if it's a lot slower or roughly the same. Both are http servers (we don't care about https unfortunately but I'd like to check for that too) I suspect we'll want to know number of simultaneous connections (how many can make a request every few seconds, data throughput (file transfers or dummy generated data to mock large API response) and request per second I'm not sure if I need to know more information than that (do you have any recommendations?) but I would expect there's some open source software I can use that checks for these and generates a report? |
| Rolling updates of backend with udp server sockets Posted: 02 Dec 2021 01:20 AM PST I have a backend system used for IOT devices which use UDP protocol for communications. And there are certain TCP (HTTP2) based APIs for mobile apps from the same backend. I am trying to build a rolling update feature to enable 0 downtime patching of the backend services. My setup is like this. Instead of directly exposing the sockets to the apps, I am trying to do transparent proxy to my processes. I have exposed 2 sockets (1 udp and 1 tcp) to the public internet using firewall. My production server is opening different set of ports for udp and tcp (which are changeable via environment variables without changing the underlying binary). Step 1:
I am trying to create transparent proxy in the same machine from udp port 16002 to 17002. For udp, my server will also initiate some communication with the devices in the wild. Server should see the source IP/port as well as communicate back with these devices which could be under some NATs (typically, WiFi router) by respecting same origin policy of the NATs. And same for tcp. From port 16012 to port 17012. This is the typical deployment by externalizing the real ports. I am not able to make this work. Step 2: Whenever there is new code to be patched, I want to bring up the new code on two different set of ports as shown in the below picture (P2 - Process 2). When process 2 is up and running, I will change the IP address mapping to the new Process (P2). After giving certain time for P1 to finish off any pending IO operations, we will bring down the Process P1. For the next patch, we will bring up P1' and the process inverses.
Is there any flaw in this design? Can this be achieved technically by using iptables and tproxy or any other linux tools? I have considered building an L7 router and relaying the packets back and forth by defining high level objects. But I am curious if this can be done using low level routing L3/L4 since it can be more efficient and battle tested. For sure, these nft, iptables tools have usability issues and not very intuitive, especially nft, for a developer. |
| Let an unattended script connect from windows to an applaince with ssh password Posted: 02 Dec 2021 12:42 AM PST I'm creating a script that will run unnatended on Windows. The script needs to execute commands via SSH on an appliance. The appliance does not support public/private key authentication only password authentication is supported. The script will need to execute some commands via SSH and capture the results (via stdout). The script will be run on Windows and will use built-in Windows SSH Client, this is preferred for the compliance reason, but if a different client can do the job I would also like to know. I need a way to bypass the password propmpt, so that the password is supplied by the script. How can this be achieved? What I have considered:
|
| Endless redirect loop on nginx config Posted: 01 Dec 2021 11:51 PM PST I have an nginx config with SSL configured and two redirects to docker container. One of them (edit https://psono.example.com/portal) is working, but the one that forwards the domain itself (edit https://psono.example.com/) is not working and instead leads to an endless redirect (https://psono.example.com/psono.example.com/psono.example.com/psono.example.com/psono.example.com/...) This is my config. Edit The output of curl -v is: |
| How to find Free IP address in a sub range? Posted: 01 Dec 2021 11:42 PM PST We are using below command to figure out the IP addresses which are down (which is free IP address to use) I wanted to get a subrange within that . For example the above command shows all the free IP address from 192.168.1.1 to 192.168.1.124. [ Note: This is for test automation and we are using static IP addresses. Multiple team members are sharing range of IP addresses but often overstep other's range. So this will help us to decide whether IP is really free at that moment before using it) But I want to find free IP address within the range of
. How to do it? |
| Running certbot on an ECS instance Posted: 02 Dec 2021 02:01 AM PST I am trying to run certbot on an ECS instance which is running a docker image (docker.io/existdb/teipublisher). The image runs well and I have associated it with a custom subdomain teipub.dh-dev.com using an elastic IP. Trying to install and run certbot so I can have an Https connection has proven to be surprisingly difficult. running as root, I install nginx with: then, following this from nginx I create but now when running Which makes sense to me because when I built the task definition to run my image on the ECS cluster I used a portMapping between the hostPorts 80 and 443 and the corresponding containerPorts, which means something is already listening on port 80 (as well as 443). running So my question is: isn't there already a webserver on the ECS instance? What is it and can I install the certbot on it? Or else, what is listening on port 80? Alternatively - is there a different way to use certbot on an ECS instance? BTW, and I don't think this is relevant, my main domain (dh-dev.com and www.dh-dev.com) allows https connections, probably through a certificate supplied by my hosting provider. ===Update=== following @dave_thompson_085's comment, I now understand (see image below) that a process called
|
| OpenVPN Layer 2 Ethernet Bridging Posted: 02 Dec 2021 12:05 AM PST I have an OpenVPN server running on an Ubuntu 18.04 machine and I want to connect to the server using an Ubuntu 20.04 machine through ethernet bridging (layer 2). I have successfully created the OpenVPN, but i cannot seem to connect to it. The tap0 in my client side does not receive an IP. I would also like to state that I am new to networking and such. My end goal would be having a STATIC IP ADDRESS for both the server and client. I do not want to use DHCP. The following are my configs: Server.conf Client.ovpn |
| Posted: 02 Dec 2021 12:13 AM PST I'm using clamonacc on my desktop computer and servers. I use a raspberry pi as clamd server. The clamd process only uses ~25% of all 4 cores so with htop I see it's using like ~100% and 400% is the maximum a process could use because the raspberry pi has 4 cores. RAM isn't full and there isn't much i/o wait (according to htop) I'm currently testing clamonacc on one server but the clamonacc queue fills up until it's limit (too many opened files) I only have these problems if I use a dedicated clamd server - with the socket it doesn't fill up the queue often. There's always only one clamd thread (two if I look with clamdtop because clamdtop needs another one) on the raspberry pi. I think that the tcp connection makes all slower. The traffic goes through a switch from my server with clamonacc to my raspberry pi clamd server - but that shouldn't be a problem. htop says that there's ~7MB/s (3000/8000 packets) The raspberry pi isn't the problem because I used another device and it still didn't work How can I fix this? Both systems have ubuntu installed. Clamav version: 0.103.3 btw, clamdscan doesn't seem to have problems but it's slower through tcp edit: I got it.. The problem's like you would run clamav under root but you don't exclude root so it's scanning in a loop. I use clamonaccess mount-path / to scan my system. The problem is that even if I exclude both, clamav and root, it will still scan in a loop. If I change to a local socket it wont scan in a loop but if I use a dedicated clamd server it does Is this a bug by clamav? |
| Adminer or mysql error: no connection could be made because the target machine actively refused it Posted: 02 Dec 2021 02:05 AM PST I have been trying to set up wordpress.org using localbyflywheel, but when I open Adminer I keep getting this error: No connection could be made because the target machine actively refused it, what can I do to solve this error? I am running MySQL on the same machine I installed Wordpress and I'm using Local by Flywheel instead of MAMP as the development environment. The MySQL service is up. Do I need to change anything in the config file? Added info from comments TCP 0.0.0.0:135 TCP 0.0.0.0:445 TCP 0.0.0.0:1801 TCP 0.0.0.0:2103 0.0.0.0:0 TCP 0.0.0.0:2105 0.0.0.0:0 TCP 0.0.0.0:2107 0.0.0.0:0 TCP 0.0.0.0:2869 0.0.0.0:0 TCP 0.0.0.0:3306 TCP 0.0.0.0:5040 TCP 0.0.0.0:5357 TCP 0.0.0.0:12666 TCP 0.0.0.0:49664 TCP 0.0.0.0:49665 TCP 0.0.0.0:49666 TCP 0.0.0.0:49667 TCP 0.0.0.0:49668 TCP 0.0.0.0:49677 TCP 0.0.0.0:49678 TCP 0.0.0.0:49896 TCP 127.0.0.1:4001 TCP 127.0.0.1:5354 TCP 127.0.0.1:16920 |
| Posted: 02 Dec 2021 12:01 AM PST Can I replace the numerical password key protector with an alphanumeric password protector since they're more secure (more possible permutations with all characters instead of just numbers 0-9)? |
| Posted: 02 Dec 2021 12:01 AM PST I have set up a new PC with Windows 10. Now I want to access two local NAS drives but can't connect to them. With my old PC and all coworkers pcs everything is fine. There is no special access restriction. I also can't see them in the network overview. I am in the same network group and use the same credentials as on my old pc. Weird is that I can connect to our servers harddrive which is no NAS and its within the same network as the NAS. I can ping it in the console via hostname and ip address but when i try to access it in windows via the explorer it can't be found. I added the ip to the local hosts file, but it didn't solved the problem: 192.168.1.5 NASDAILY What i found out so far: ping NASDAILY -n 1 // Is working ping -6 NASDAILY -n 1 // Not working On the command "ipconfig /displaydns" i get this: nasdailyKeine Einträge vom Typ AAAA nasdailyEintragsname . . . . . : NASDAILY Eintragstyp . . . . . : 1 Gültigkeitsdauer . . . : 86400 Datenlänge . . . . . . : 4 Abschnitt. . . . . . . : Antwort (Host-)A-Eintrag . . : 192.168.1.5 I turned off the pc several times, reset the network connection, turned off firewall, turned of ipv6, nothing helped so far. |
| How to route default destination not via VPN tunnel? Posted: 02 Dec 2021 02:05 AM PST There a millions of sites which describe how to configure the network routing to send all traffic through the VPN tunnel. However, what is the exact opposite? There is an OpenVPN server configured on the pfSense firewall, and only certain destinations should pass the VPN tunnel. The default route should not use the tunnel. (Obvisouly, either 1st line is too much or its Metric should be >600). I want this to be set in Linux Networkmanager and Windows 10. How to do that? PfSense can only force the default gateway to point to the tunnel, so I think that the decision of not using the tunnel for the default route is up to the client. |
| PXE boot cannot find syslinux config file, where is it looking? Posted: 02 Dec 2021 01:04 AM PST I am running a PXE server mock up in VMware Workstation. I have the DHCP and TFTP servers working and I can get my to grab an IP address and boot the firmware for their platform. Where I seem to be running into trouble is all clients are failing to find the configuration file for syslinux. I intend on using multiple platforms so I have each platform in its own folder. Here is my structure; This is the error I am receiveing from the clients; From what I have read on the syslinux wiki it says the bootloader will try looking for a config file in a specific order.
I am pretty sure its something to do with my configuration that is causing the failure. The issue I am stumped on what it would be. Since my each platform has its own folder I am think the context of `/mybootdir' has changed. The question is to what? You can see in the file tree I tried making a symlink as a workaround but it did not seem to make any difference. Any ideas what is wrong? UPDATE Here is what my DHCP config looks like; I copied some of it from a few examples I found on how to boot different platforms from the same DHCP scope and made it my own.
|
| VSFTPD Cant perform anon uploads. 500 OOPS Posted: 02 Dec 2021 01:04 AM PST I can't get my vsftpd config to allow anon root uploads. Yet I'm still getting the error: Any suggestions to solve this. I don't want to use vsftpd-ext or the Frontier Groups back-ported version. I'm currently using an anon subdirectory as a workaround but would like users to be able to create their own subdirectories from ftp clients. |
| How do I create DNS entries for EC2 instances created by Auto Scaling? Posted: 02 Dec 2021 02:03 AM PST I'm looking into using auto scaling groups for a tier of webservers that would be fronted by an ELB. One of the things I'm having a hard time with is how to give each new instance the proper DNS name. For example, I'd like webservers to have names like |
| Is STARTTLS less safe than TLS/SSL? Posted: 02 Dec 2021 01:23 AM PST In Thunderbird (and I assume in many other clients, too) I have the option to choose between "SSL/TLS" and "STARTTLS". As far as I understand it, "STARTTLS" means in simple words "encrypt if both ends support TLS, otherwise don't encrypt the transfer". And "SSL/TLS" means in simple words "always encrypt or don't connect at all". Is this correct? Or in other words: Is STARTTLS less secure than SSL/TLS, because it can fallback to plaintext without notifying me? |
| Setting an SPF record for all subdomains of my domain Posted: 02 Dec 2021 02:11 AM PST Is this possible? Like a wildcard TXT record of some sort? |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
