Alexander's questions

I have a lot of VMs set up by hands during years, so each VM is a bit unique (so to say, you know). Zabbix agents on these VMs are of different versions and maybe differently configured.

The idea is to use Ansible to install commonly configured Zabbix agents on all of these VMs. Now I'd like to fill Ansible inventory with hosts from Zabbix server host list - and it would be pretty good idea to use this host list dynamically.

So the question is, if I can use Zabbix host list instead of "-i host" list and do that in some standard way?

I can find this but I can't figure out how to use it in my case. And most Google queries for "Ansible over Zabbix server host list" entries are about setting up Zabbix server or agents with Ansible, not about dynamic host list.

All I can imagine is to create host list statically with SQL query to Zabbix DB (or Zabbix API) but this seems to be "my own buggy way" to do thing which is already done by someone.

Please advice or maybe give some example!

I use Dovecot and Exim in my mail server, and auth them against MariaDB. The server keep mails for multiply mail domain, and it works this way for years.

Now I need to migrate (rename) one of mail domains into another name (don't ask, business demands that), so all mailboxes in first (old) domain should have the same local_part in second (new) domain:

• [email protected] -> [email protected]
• [email protected] -> [email protected]
• etc

To simplify the transition, I try to implement this logic:

• whatever domain (old or new) user uses to auth itself to send or receive mail, it should be accepted (if password fits);
• mail should be served from the same (named after old domain) directory on the server
• if user sends mail originated from his box in old domain, Exim should rewrite old email into new email in the headers.

After this will be in effect I can slowly reconfigure clients so they be authed with new domain-based email addresses instead of old domain-based.

This will give me (and users) smooth transition into new domain, and it sounds nice.

So to say, sound nice, but can't figure out how to implement that in a nice way.

If the new domain be the only one, I can put that logic into SQL requests in Dovecot and Exim. But this time I need to deal with several such "renamed" domains, and it looks too tricky to hard-code these domains names into SQL queries.

I created new table and store old/new domains pairs there, like this:

• 'olddomain1.com', 'newdomain1.com'
• 'olddomain2.com', 'newdomain2.com'
• etc

But this time I doubt I can use this replacement table along in queries to auth. Dovecot, so to say, won't allow severay different queries to be used to get iterate_query or user_query reply.

Please advice how would you implement that domain rename case!

Thank you in advance!

I have several mail servers which host different domains (e.g. domain1.com is served by mail.domain1.com, while domain2.com is served by mail.domain2.com). I try to set up a single point to access these domains' mails so I set up a VM with Nginx server as mail reverse proxy.

Each of the domains uses different TLS certificate so I decided to set up different server blocks with different server_name and ssl_certificate specified (just like I used to do with http server's), like this:

mail {
  ...
  server {
    listen              25;
    protocol            smtp;
    server_name         mail.domain1.com;
    ssl_certificate     ...;
    ssl_certificate_key ...;
    starttls            on;
    proxy               on;
    xclient             off;
  }

  server {
    listen              25;
    protocol            smtp;
    server_name         mail.domain2.com;
    ssl_certificate     ...;
    ssl_certificate_key ...;
    starttls            on;
    proxy               on;
    xclient             off;
  }
}

but this suddenly won't work, nginx can't run saying "nginx: [emerg] duplicate "0.0.0.0:25" address and port pair in nginx.conf"

I expect server blocks will be checked for exact server_name and this very block will be used to set up TLS/SSL connection, but I was wrong with that. At the same time, I can't join two domain certs into a single file and use it on a single (joined) server block.

So to say, above is only an example, I used to host many more mail domains, so this problem is huge for me. I can surely proxy IMAP/SMTP with Dovecot's proxy feature while proxy SMTP with some other software (which one?) but Nginx looked like a good universal approach.

Please advice, if I can archive my goals with Nginx, or how can I do that without many bits of different software?

Thank you in advance!

Today I face a server which videoport is dead (no picture when monitor connects to even on reboot), but this server has IPMI.

The problem is, the IP of IPMI is set to some dummy value (I was told that was for security reason), and now I can't change it since no video available.

Is there any way to reset IPMI IP by changing some jumpers on motherboard or any other non-interactive way?

Please advice!

Thank you!

I try to plan Hyper-V cluster deployment over several host servers (10 or maybe 12; hosts are rented) placed in two separate datacenters. This will be Hyper-V Server 2019 Core hosts. The problem is, I don't know if I should rely on AD for host auth, and if not, then what's the best way to maintain the cluster.

The main idea was to create Hyper-V cluster that's not connected to office AD servers so even if office goes down for a long time services in datacenters should stay alive. I have no physical hosts in datacenters to serve AD only, all of these hosts are for Hyper-V, and I don't want to host AD controllers as VMs as it kills the whole idea.

Feel I miss something as I believe this is the question for each and every Hyper-V deplyment on a remote location, so pleace advice best way of how to work this out.

Thank you!

Strange enough, some of my mail domain external sender used to send us messages where Message-ID field set to $Null like this:

    ...
    Date: Tue, 1 Dec 2020 07:16:22 +0000
    Message-ID: $Null
    Subject: Test
    ...

(looks like this is due to Exchange + Outlook setup used in their company, but can't find more info).

This is a bit problem until recent times as Apple updated iOS mail client and recent Mail app in iOS messed up all messages list when try to analyze such a message.

The fix I try to implement is simple, I try to add this action to Exim's acl_check_data:

    warn
      condition               = ${if eq{$h_message-id:}{\$Null}}
      remove_header           = message-id : message_id : Message-ID : Message_ID

I tried many ways of referencing Message-ID header line but even that condition yields to true the "remove header" action won't remove the Message-ID header line.

So please advice, how can I remove or (better) replace broken header line of Message-ID with some correct value?

As I can see Zabbix 5.x have no charts.php page so no way to get individual graph displayed without loading all graphs for the host.

I tried to copy charts.php from 4.4.10 to 5.0 - no luck, it won't work and says "Class not found for action charts.php".

May there be any way of porting this functionality to Zabbix 5.x?

I have a host server in datacenter connected directly to Internet. I also can use up to 2 public IP addresses (3 or more is hard to obtain but possible). I have no firewall in front of this host, and I'd like to protect Management traffic from outside world if possible. The purpose of this server is to run test deployment of VMWare Horizon.

How I try to deploy ESXi on the host server and vSphere as a VM inside this host server. My plan was to assign first public IP to ESXi, then create virtual network inside the ESXi, and put some software router with DHCP server to that network, so all VMs will be in that network (will obtain private IPs via DHCP), and that router will supply internet to private network and I can do some dNAT on that router to reach specific VM ports from outside.

Ok, as I set up ESXi 7.0 with 1st public IP, I set up vSphere appliance as VM attached to private network. I added that ESXi to the vSphere.

But the problem is, I can not even do the upgrade on ESXi via vSphere update manager - since ESXi try to reach update manager and its IP is private one. vSphere also used to disconnect ESXi host (appears problem to be the same nature). I suspect this scheme won't be robust so I'd like to redo the project and implement this setup a bit differently.

Here is what I can do:

1. Assign second of my public IP to vSphere so both ESXi and vSphere can "see" each other. I'll need to get 3rd IP to assign it to router, too.
2. Can change ESXi IP to private one (taken from private subnet discussed above), so the only public IP will be the one assigned to router. Risky but may work (or not).

Please advise how to do that better way!

In our company we are planning to do Windows 2008 R2 migration due to End of Support it reached. We're not that fans of living on edge but this time it appear to be wiser target to Windows Server 2019, not 2016 (so we'll live with for years further).

While reading on this topic and looking for best practice approaches I can see many people recommend to do step-by-step migration (2008R2 -> 2012 -> 2016 -> 2019), but in our case it appears to be very lengthy and error-prone way, isn't it? At the same time, looks like we can do that in one giant step (2008R2 -> 2019) so I would like to ask your advice, is it true?

As I plan upcoming AD upgrade (from 2008R2 to 2019) I face another problem: we're actually have AD Forest that consists of several sites, each of them on 2008R2 AD version. As we upgrade one site AD version from 2008R2 to 2019, other sites will remain on 2008R2 for quite site time until we'll see 2019 scheme works well and no problem appears. And now I doubt if the whole forest be functional and no problem arise when one site be on 2019 and other sites on 2008R2 AD scheme versions.

So the question is: in practice (that is, in real life) will the forest still be functional and usable as one site (and, eventually, one by one all other sites, too) be upgraded, while remaining sites still be on lower AD version? In general, the forest needed to have cross-sites auth, so no sophisticated features are needed, but anyway I'd better ask before jumping into the water :)

Imagine we have an online store site. It contains list of items to sell, and prices associated with it. Due to messy math behind price (they used to offer discounts based on user history, and we can't change this), each page may take time to be rendered.

This is not generally a problem, unless search spiders/bot come to reindex the site aggressively. And site starts to count prices for each bit request despite bots won't have any "personal" discounts etc.

I'd like to use nginx cache feature like but the problem is nginx won't cache answers that have 'Set-Cookie' headers. And yes, site's pages always try to set cookie even for bots.

I can't modify site's code, so the only idea is to use cache and serve staled cache for bots only.

map $http_user_agent $do_not_cache_it {
  "~Bot"  "1";
  default "0";
}
..
server  {
  location / {
    ...
    proxy_cache_bypass $do_not_cache_it;
    proxy_ignore_headers "Set-Cookie";
    proxy_hide_header "Set-Cookie";
    ...
  }
}

this works but cookies are cleared and hidden for all requests, not bot-initiated only, so even human users can not, say, login to the site.

Any way I can play this nginx cache game successfully, please?

Playing with Proxmox 5.0 as a hypervisor platform and set up KVM VM to serve website, I really wonder if I should use kvm64 "virtual" CPU or try to use host. To be specific, I have an 4-core CPU that's capable of hyper-threading which results in 8 cores to use in KVM (or maybe I should disable hyper-threading to get more power per core, in the end?) and I would devote most of the server's power to my website.

The ideas behind both are good:

• If I go with 'host' type CPU I'll get all the hardware power of the CPU and looks like I'll get most of it. The only question is how many cores should I set to be used by VM? If I set 8, then which core(s) will be used by KVM itself, and if I set to 7 (so one will be used only by KVM itself) then I have 1/8 of power less. Correct?

If I set CPU type to 'kvm64', then I can assign more CPU cores to VM (these cores to be virtual, so I can easily assign some like 64 or even 128 of such cores), so physical CPU be 'split' into a lot of smaller one, which may be useful for web type of load. Is my assumption correct?

What would you recommend me to choose?

I try to set up an Ubuntu server so it start specific services (daemon) only when machine uses specific IP.

The idea is that I have a server to run some service on (and service is RAM-intensive), the server has its static IP. I would like to have copy of that server with different IP (but with all the same software installed on it), and I'd like to have this specific service to start at machine startup only if its IP is the specific one.

This way I can use backup machine for some other purposes (so the hardware will be used anyway), but in the case primary machine fail to run I can manually change the IP of backup machine to IP of the primary, reboot it and have specific service run under same IP.

The Ubuntu is 16.04 LTS.

Please advice!

I run KVM based virtualization server (namely, Proxmox) where some Debian based machines are run in KVM VM's. Proxmox can create backups of VMs, it also compress the VM disks images.

As we understand, backup sizes are increasing over time, since more data stored on each VM disk and more 'clean' blocks of VM disk become 'dirty' (that is, contains remaining of old files). So, even if I delete all files on such a virtual disk by rm -rf it, in fact the backup will be of the same size since this won't clear all the blocks of VM disk.

I can 'clear' the VM disk by doing something like dd if=/dev/zero of=/BIG.txt and then rm -f /BIG.txt - this way I create big file full of zeros that will use all of the disk space and after I delete it its ex-blocks will contain zeroes. The downside is that for a moment the disk become full which affects every program that want to write anything.

But maybe there are some other way to clear unused disk blocks with zeroes so backup will compress such a disk with better rate? Some Windows based programs offer options to 'clear unused disk space' (e.g. CCleaner), but I need that for Linux.

I have an RPM package that depends on many other packages, so installing it will install everything I need - quite a normal approach. But one of the packages depends on custom nginx build (general nginx + some extra modules) from 3rd-part repo, which is not supported anymore. The bad part of it is that maintainer named that custom nginx package with some 'custom' name, not just 'nginx' but 'my-nginx').

As I do not use any of the nginx modules I'd better to use nginx.org's nginx package, but of course I can not install 'nginx' as it conflicts with 'my-nginx'. I can only do that by 'force' install.

Is there any way for me to have nginx as 'my-nginx' so dependency won't be break and system can be updated without complaining on broken packages?

Thank you!

It is quite a question for me: I have Cisco Catalyst 2960S switch which is nice hardware even despite its age and EOL. I'd like to set it as small router between several networks within a remote building. Static routes, nothing more.

What I completely miss is its routing performance numbers, and if there any way I can use to predict its congestion during its work.

All the datasheets show me forwarding rates, and yet I can't find anything on how many bytes/packets it can route per seconds. I do understand routing is not the primary use of the switch, but since we do own this switch already, this comes at no extra cost which is good for this very application.

I can also monitor device's CPU usage via SNMP. This tells me some number (up to 100) of how many CPU cycles are used, but I'm not sure what's the target number I should afraid of as I'll load the routing: if the routing is pure made by CPU, and 100% busy of CPU results in switch offline?

Imagine we have a site made of nginx as a frontend, and apache (with php or whatever) as a backend. The idea is that nginx will serve static while proxy requests to *.php files to backend. Easy to implement and no-brain-needed config, isn't it?

Now imagine we have bad-behaviour backend. It uses some unstable modules, it used to produce pages for seconds and we're not sure if the page be rendered at all. Weird, but still possible, right? Legacy code and so on. By the way, the backend may be on different machine (yes, legacy: old OS, old software, "don't even touch it!" etc.)

Now we'd like to "protect" ourself in a case the backend won't answer. It would be great to serve page as we served it last successful time when we got no page or get 5xx error. To say in other words, if backend returned 200 code and the page content, then we serve it. If we got timeout or we got 5xx code from backend, we serve the page for the same URI but cached one. This will give us some time to fix backend while users will see at least something.

Nginx is a nice piece of software. I found proxy_cache_use_stale directive and also some others but I'm afraid what will be the version that will be served if backend fails.

I can also imagine some http balancer (nginx as an example) that will check the backend status and stop use it whatever happens. The second backend then maybe server full of static pages that mimics the original site (maybe even without some element, like 'login' link). If so, how should I wisely update the 'mimics' server over time?

What approach may be better? What would you choose?

I'm trying to set up some homegrown storage using a desktop motherboard, 4 x SATA drives and 2 x SSD drives.

I'd really like to use NexentaStor for its nice web interface and for it is some production-ready status, but I also want to use ZIL and L2ARC on my storage to speed things up.

I plan to partition both SSDs as 4 partitions (OS, swap, ZIL, L2ARC), put NexentaStor on mirror made of 1st partitions of each SSD, ZIL on mirror made of 3rd partitions, and added both 4th partitions as two L2ARC devices. Then I plan to create RAID-Z2 pool, add ZIL and 2 x L2ARC to it.

The problem is, NexentaStor won't partition and drive it uses. So I can't simply "break" SSDs for some partitions, I need to use the whole SSD drive for one purpose, which is not a good idea since SSD are too big for "just boot me up" usage.

So, the question is: are there any way I can setup NexentaStor with ZIL and L2ARC using 4 x SATA HDD and 2 x SSD?

P.S. I was successful to do the same setup under FreeBSD, so there is no any ZFS limitation on that (no wonder about).

P.P.S. I'm not sure but what if I use Solaris LiveCD to per-partition SSD and try to install Nexentra on it but if it is possible at all?

I run Proxmox 2.0, and installed Windows 2003 R2 (32-bit) server on it. I've use VIRTIO disk and NIC virtual devices (and installed appropriate drivers into Windows), and everything's fine. Physical server is HP DL 180 G6 with RAID 410i (256 Mb battery-backed cache, 4 x 300 Gb 15K SAS disks in RAID10). Server is UPS-backed (of course) so it won't suddenly be poweroff.

Now I see I can set disk mode in Proxmox to 'default (no cache)', 'Direct sync', 'Write through', 'Write back', 'Write back (unsafe)', and I can also on/off cache mode in Windows iеself. I'd like to optimize Windows Server IO speed, so I'd like to use 'write back'-ed disks, while at the same time it looks like I don't need Windows cache on disks at all.

What's the better strategy for my case? What mode I need to set for virtual disks in Proxmox, and what setting are better to use inside Windows Server in VM?

By the way, what if I install Debian in another VM on the same Proxmox - what disks modes should I set in Proxmox for better IO performance of Debian?

I'm using zfs on my FreeBSD 9.0 x64 and pretty happy with it, but I find it hard to count directory real, not compressed, size.

Surely I can walk over the directory and count every file size with ls, but I'd expect some extra key for du for that purpose.

So, how can I tell the directory size for dir placed on zfs with compression on?

Thamk you in advance for the advice, I simple can't rememeber there is no such a 'simple' way, without 'find ./ -type d -exec ls -l '{}' \; | awk ...'!