All Questions(server)

We are planning to migrate away from VMware ESXi for our company servers. We have a LOT of Windows virtual machines used for testing (different configurations, combinations of options, etc) in our test lab. These include Windows 10 and Windows Server 2019 VM's.

I want to ensure that all of our test VM's don't trigger activation when Windows detects the hardware signature has changed, as I suspect would happen when moving to a new hypervisor.

We are considering what hypervisor to move to next, and we like the Red Hat 9's KVM.

Does anyone have experience with this migration?

Do your Windows VM's require activation after moving?

Please note that our test lab containing the VM's is air-gapped, and must never connect to the Internet.

So don't suggest 'just reactivate'...not an option.

I defined and applied a ServiceAccount "service-account-token" : Vault-Config/service-account-token.yaml :

apiVersion: v1
kind: ServiceAccount
metadata:
  name: service-account-token
automountServiceAccountToken: false

root@k8s-eu-1-control-plane-node-1:~# kubectl apply -f Vault-Config/service-account- 
token.yaml 
serviceaccount/service-account-token created

root@k8s-eu-1-control-plane-node-1:~# kubectl get ServiceAccount
NAME                       SECRETS   AGE
default                    0         10d
issuer                     0         20h
secrets-store-csi-driver   0         2d9h
service-account-token      0         22s   // <----------------------
webapp-sa                  0         2d1h

I defined and applied a vault issuer secret :

root@k8s-eu-1-control-plane-node-1:~# nano Vault-Config/cert-manager-vault-issuer-
secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: issuer-token-abcde
  #namespace: nats
  annotations:
    kubernetes.io/service-account.name: issuer
type: kubernetes.io/service-account-token # https://developer.hashicorp.com/vault
/docs/auth/kubernetes#continue-using-long-lived-tokens

->

root@k8s-eu-1-control-plane-node-1:~# kubectl apply -f Vault-Config/cert-manager-vault-
issuer-secret.yaml 
secret/issuer-token-abcde created

->

root@k8s-eu-1-control-plane-node-1:~# kubectl get secrets
NAME                         TYPE                                  DATA   AGE
issuer-token-abcde           kubernetes.io/service-account-token   3      8s  // <------------
nats-box-contexts            Opaque                                1      6d
sh.helm.release.v1.csi.v1    helm.sh/release.v1                    1      2d9h
sh.helm.release.v1.nats.v1   helm.sh/release.v1                    1      6d

When I apply this vault-issuer : Vault-Config/vault-issuer-cert-manager.yaml :

# https://developer.hashicorp.com/vault/tutorials/archive/kubernetes-cert-   
manager#configure-an-issuer-and-generate-a-certificate

    apiVersion: cert-manager.io/v1
    kind: Issuer
    metadata:
      name: vault-issuer
      #namespace: nats
    spec:
      vault:
        server: http://vault.default // <---- as suggested here: https://cert-manager.io/docs/configuration/vault/#deployment
        path: pki_int/sign/nats
        auth:
          kubernetes:
            mountPath: /v1/auth/kubernetes
            role: issuer
            secretRef:
              name: issuer-token-abcde
              #key: token

-> :

root@k8s-eu-1-control-plane-node-1:~# kubectl apply -f Vault-Config/vault-issuer-cert-
manager.yaml 
issuer.cert-manager.io/vault-issuer created

I get this error:

root@k8s-eu-1-control-plane-node-1:~# kubectl describe issuer vault-issue
Failed to initialize Vault client: while requesting a Vault token using the Kubernetes auth:
error calling Vault server: Post "https://vault.default/v1/auth/kubernetes/login": dial tcp: 
lookup vault.default on 10.96.0.10:53: no such host

For the Vault configuration I applied through helm these values :

root@k8s-eu-1-control-plane-node-1:~# nano Vault-Config/overrides.yaml :

global:
   enabled: true
   tlsDisable: false
injector:
   enabled: true
server:
   extraEnvironmentVars:
      VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
      VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
      VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
   dataStorage:
       enabled: true
   volumes:
      - name: userconfig-vault-ha-tls
        secret:
         defaultMode: 420
         secretName: vault-ha-tls
   volumeMounts:
      - mountPath: /vault/userconfig/vault-ha-tls
        name: userconfig-vault-ha-tls
        readOnly: true
   standalone:
      enabled: false
   affinity: ""
   readinessProbe:
     enabled: true
     path: "/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204"
   ha:
      enabled: true
      replicas: 3
      raft:
         enabled: true
         setNodeId: true
         config: |
            cluster_name = "vault-integrated-storage"
            ui = true
            listener "tcp" {
               tls_disable = 0
               address = "[::]:8200"
               cluster_address = "[::]:8201"
               tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
               tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
               tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
            }

            # https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-raft-deployment-guide#vault-storage-configuration

            storage "raft" {
               path = "/vault/data"

               retry_join {
                 leader_api_addr = "https://vault-0.vault-internal:8200"
                 leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt"
                 leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt"
                 leader_client_key_file = "/vault/userconfig/tls-server/tls.key"
               }

               retry_join {
                 leader_api_addr = "https://vault-1.vault-internal:8200"
                 leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt"
                 leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt"
                 leader_client_key_file = "/vault/userconfig/tls-server/tls.key"
               }

               retry_join {
                 leader_api_addr = "https://vault-2.vault-internal:8200"
                 leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt"
                 leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt"
                 leader_client_key_file = "/vault/userconfig/tls-server/tls.key"
               }

               retry_join {
                 leader_api_addr = "https://vault-3.vault-internal:8200"
                 leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt"
                 leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt"
                 leader_client_key_file = "/vault/userconfig/tls-server/tls.key"
               }

               retry_join {
                 leader_api_addr = "https://vault-4.vault-internal:8200"
                 leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt"
                 leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt"
                 leader_client_key_file = "/vault/userconfig/tls-server/tls.key"
               }

               autopilot {
                 server_stabilization_time = "10s"
                 last_contact_threshold = "10s"
                 min_quorum = 5
                 cleanup_dead_servers = false
                 dead_server_last_contact_threshold = "10m"
                 max_trailing_logs = 1000
                 disable_upgrade_migration = false
               }


            }
            disable_mlock = true
            service_registration "kubernetes" {}

What server address do I have to put into the vault-issuer configuration file : Vault-Config/vault-issuer-cert-manager.yaml :

# https://developer.hashicorp.com/vault/tutorials/archive/kubernetes-cert-manager#configure-an-issuer-and-generate-a-certificate

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: vault-issuer
  #namespace: nats
spec:
  vault:
    server: https://vault-0.vault-internal:8200/    // <----------------- ????????
    path: pki_int/sign/nats
    auth:
      kubernetes:
        mountPath: /v1/auth/kubernetes
        role: issuer
        secretRef:
          name: issuer-token-abcde
          key: token

--> :

root@k8s-eu-1-control-plane-node-1:~# kubectl describe issuer     vault-issue

Message:               Failed to initialize Vault client: while  
requesting a Vault token using the Kubernetes auth: error calling 
Vault server: Post "http://vault.default:8200/v1/auth/kubernetes
/login": dial tcp: lookup vault.default on 10.96.0.10:53: no such 
host

?

I've built a website and have used certbot to create SSL certs.

The page loads fine on every system I've tried it, except in Chrome on my phone.

In Chrome, on the phone (Android), I get NET::ERR_CERT_AUTHORITY_INVALID

In FF on the phone it loads fine. In Chrome or FF on my tablet it loads fine. In Chrome or FF on laptop and/or on desktop it loads fine.

What's up with Chrome not playing nice?

I have a running OpenVPN server on Ubuntu 22.04.

Everything is working fine, but I want to log more info about connected devices to my server. I need to send some custom info about the device using my servers.

I successfully integrated client-connect/client-disconnect scripts, but I want to have more environment variables about the client's device to use in those scripts.

I tried to push these variables from the client config file like this:

push-peer-info
setenv IV_TEST="test1"
setenv UV_TEST="test2"

But I can't recover those variables from the script. In the logs, I can see some variables been transmitted:

2024-09-11 07:31:09 us=326572 192.168.175.1:49395 peer info: IV_VER=3.8.2connect3
2024-09-11 07:31:09 us=326583 192.168.175.1:49395 peer info: IV_PLAT=win
2024-09-11 07:31:09 us=326588 192.168.175.1:49395 peer info: IV_NCP=2
2024-09-11 07:31:09 us=326593 192.168.175.1:49395 peer info: IV_TCPNL=1
2024-09-11 07:31:09 us=326597 192.168.175.1:49395 peer info: IV_PROTO=990
2024-09-11 07:31:09 us=326601 192.168.175.1:49395 peer info: IV_MTU=1600
2024-09-11 07:31:09 us=326605 192.168.175.1:49395 peer info: IV_CIPHERS=xxxxxxxx
2024-09-11 07:31:09 us=326609 192.168.175.1:49395 peer info: UV_ASCLI_VER=3.4.4-3412
2024-09-11 07:31:09 us=326614 192.168.175.1:49395 peer info: UV_PLAT_REL= xxxxxx
2024-09-11 07:31:09 us=326618 192.168.175.1:49395 peer info: UV_UUID=xxxxxxxxxxx
2024-09-11 07:31:09 us=326635 192.168.175.1:49395 peer info: IV_GUI_VER=OCWindows_3.4.4-3412
2024-09-11 07:31:09 us=326638 192.168.175.1:49395 peer info: IV_SSO=webauth,crtext
2024-09-11 07:31:09 us=326641 192.168.175.1:49395 peer info: IV_HWADDR=xxxxxxxxxxx
2024-09-11 07:31:09 us=326645 192.168.175.1:49395 peer info: IV_SSL=OpenSSL_3.1.4_24_Oct_2023

But not the variables I have set.

Checking out the documentation we can see this:

EDIT1:

--push-peer-info : Push additional information about the client to server. The following data is always pushed to the server:

This implies that using --push-peer-info, we can allow client to push additional custom variables, besides the default ones, but how to accomplish that?

EDIT2: I even tried overriding default variables and changing the order, no luck:

setenv IV_HWADDR="test1"
push-peer-info

Any help is much appreciated.

I have been trying to get nginx to reverse proxy gacamole, but was not very successful. For this, over the past days, I have been following several howto's describing how to install nginx, guacamole and configure nginx to proxy the Tomcat 8080 port. I have the feeling I'm almost there, but simply can't make the last step...

On an Ubuntu 22.04.05 LTS machine, I installed nginx and Tomcat9 out of the box. Next, I deleted the /etc/nginx/sites-available/default file, and removed the symlink to that file in /etc/nginx/sites-enabled, and restarted nginx.

Then I installed guacamole (1.55, guacd and the webapp in tomcat). After having done this, I can get to the webapp from another machine using http://nginx-handbook.test:8080/guacamole. So, guacamole works.

Now for the proxying bit: I created a file guacamole.conf in /etc/nginx/conf.d with the following content :

server {

  listen 80;
  server_name nginx-handbook.test;

  access_log /var/log/nginx/guac_access.log;
  error_log /var/log/nginx/guac_error.log;

  location = / {
    proxy_pass http://127.0.0.1:8080/guacamole;
    proxy_buffering off;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    client_max_body_size 1g;
    access_log off;
  } 

}

Restarted nginx, and tried to go to guacamole from another server using http://nginx-handbook.test/ , but I'm getting a 404.

I know the proxy does work (sort of), because my actions are being logged in the proxy logs :

(guac_access.log)

192.168.56.1 - - [11/Sep/2024:16:07:38 +0000] "GET /guacamole/ HTTP/1.1" 404 197 "-" 
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/128.0.0.0 Safari/537.36"
192.168.56.1 - - [11/Sep/2024:16:07:40 +0000] "GET /guacamole/ HTTP/1.1" 404 197 "-" 
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/128.0.0.0 Safari/537.36"

(guac_error.log)

2024/09/11 16:07:38 [error] 29619#29619: *1 
"/usr/share/nginx/html/guacamole/index.html" is not found (2: No such file or 
directory), client: 192.168.56.1, server: nginx-handbook.test, request: "GET 
/guacamole/ HTTP/1.1", host: "nginx-handbook.test"
2024/09/11 16:07:40 [error] 29619#29619: *1 
"/usr/share/nginx/html/guacamole/index.html" is not found (2: No such file or 
directory), client: 192.168.56.1, server: nginx-handbook.test, request: "GET 
/guacamole/ HTTP/1.1", host: "nginx-handbook.test"

Although the error is quite clear (nginx is looking for guacamole in /usr/share/nginx/html), I don't quite understand. Was expecting to redirect to port 8080, and let Tomcat do the rest.

The /usr/share/nginx/html root is not set in any of the other nginx config files.

Should I set the root directive to point to /var/lib/tomcat/webapps ? That was not documented anywhere in the howto's I've seen.

Any help would be greatly appreciated.