All Questions(server)

I would like to use the same limit_req_zone (i.e. the same request rate) across various locations, but with different burst values for limit_req. The following configuration should be able to serve 2 pages, and up to 10 supporting assets for a page in a single burst. It tests ok, but is this the right way to do it, or would I need two different limit_req_zone directives?

http {
    limit_req_zone $binary_remote_addr zone=lr_zone:10m rate=1r/s;
    #...
    server {
        #...
        location / {
            limit_req zone=lr_zone burst=2 nodelay;
            #...
        }
        location ~ ^/(css|fonts|images|pdf)/ {
            limit_req zone=lr_zone burst=10 nodelay;
            #...
        }
    }
}

I'm trying to understand the correct approach to support email via Postfix/Dovecot for both network-authenticated users and various network services such as Gitlab.

My network-authentication server is Ubuntu 22.04, using OpenLDAP and Kerberos. My network-authenticated users all inherit from the posixAccount and PostfixBookMailAccount object classes while my service accounts only inherit from the latter. This is an attempt to only allow login on various machines from my users but not service accounts, but to support email for both.

I've tried configuring Dovecot to use the pam driver which has worked for user email but Gitlab didn't work. I modified the PAM configurations (which all utilized Kerberos but not LDAP) by adding LDAP ahead of Kerberos. This included configuring PAM LDAP to search based on mailEnabled instead of posixAccount for user lookup but something may be off as it still worked for users but not services.

I also tried configuring Dovecot to use the ldap driver and similarly search for mailEnabled but something is also off as it did not work for any account.

It seems I could potentially capitulate and just make user accounts for services like Gitlab but this tickles my security paranoia.

Before spinning my wheels too much farther or going in the wrong direction, I would first like to understand if it makes sense to distinguish these two email sources or if I'm just overthinking it. If I should distinguish, can someone point me to reference materials that outline this approach or provide some pointers if there are / what considerations to make when configuring Postfix/Dovecot. So far I have no combination that suits both account types. My web searching has not turned up anything on what approach to take and therefore any relevant material.

My 10-auth.conf contains:

auth_krb5_keytab = /etc/dovecot/dovecot.keytab
auth_mechanisms = plain login gssapi

where the keytab was populated with imap, nslcd, and smtp principals.

When configured for PAM, my auth-network.conf.ext looks like:

passdb {
  driver = pam
}
userdb {
  driver = passwd
  args = uid=vmail gid=vmail home=/srv/vmail/%u mail=maildir:/srv/vmail/%u/Maildir
}

and when configured for LDAP it's:

passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
userdb {
  driver = prefetch
}
userdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}

Context

Software engineering has software design patterns (e.g. GoF), which describe solutions to common coding problems - usually at the code-level; similarly there are architectural patterns (e.g. Fowler) that deal with system architecture in general (whilst these deal with considerations outside of pure code, they often seem to focus more on software engineering concerns rather than infrastructure concerns).

I've also noticed platform providers like Microsoft putting out "cloud design patterns".

Infrastructure as Code (IoC) is a further complication where software/coding-level considerations start to become relevant.

Specific Question(s)

In the realm of Infrastructure, are infrastructure-orientated patterns even a thing? If so, is there any relatively definitive collection of them that is widely understood by the infrastructure community? Or do you just 'borrow' system architecture patterns?

As an aside, assuming the answer to the above is broadly "yes", are cloud infrastructure patterns seen as a part of, or extension to, these patterns - or are they seen as a separate collection?

FYI

I'm a solution architect who comes from a software development background, not an infrastructure one. When I say "infrastructure" I'm meaning stuff like networking, physical and virtual servers and their deployment architecture, capacity and volume planning, server and network security, and so on - basically anything that a "software" architect might rely on but not explicitly architect themselves.

Update - Definitions

Just for clarity for people reading this later:

• "Patterns" is a broad term, which is not discipline specific...

• In software engineering a software design pattern is a specific solution (much like a recipe) to a common code-level problem. These types of pattern are usually technology agnostic, but may be specific to a programming language paradigm (e.g. Object Orientated vs an alternative).

• (System / Application) Architecture Patterns, cover common system-level architecture & design problems, including: internal component structure, component-level roles and responsibilities, cross-cutting aspects such as authentication and authorization, error handling and observability, data persistence.

We have an old AD user account with a static password that is used on several machines for a scheduled task and a service. I know gMSA is better and separately am in the process of getting that in place, but this account needs to be up for a little while longer.

Back to this account: I want to change the password to meet current password strength critera and ensure the AES hash, but I wasn't sure if I needed to change it 2x with a 10 hour pause in-between, or if I can just change it back-to-back and push out the password update to the affected endpoints.

If anyone can clarify the 2x, 10-hour gap reset method or whether it can be back-to-back for this purpose, I'd be grateful.

Thanks!

I have a client certificate which has non English characters in the subject, when I use the attribute $ssl_client_s_dn of ngx_http_ssl_module the value is escaped twice.

real value = "L=D'UNCONGÉ"

the \xC3 is encoded again to get \x5CC3 ,I need to avoid this

actual value = "L=D'UNCONG\x5CC3\x5C89"

expected value = "L=D'UNCONG\xC3\x89"

can someone please advise me on what I did wrong, How can I avoid this.