Got a Docker container that runs at startup and needs to have this added to the startup arguments:
--add-host=host.docker.internal:host-gateway
I'm not readily seeing where to change the startup args for containers that are already setup and going. How would this be added to an existing container?
I've been having trouble connecting a macOS 10.13 High Sierra server to a Windows Server 2019 server with a bonded ethernet connection consisting of 3 directly connected ethernet adapters. Windows seems fine, but macOS is giving an error about 802.3ad being unavailable.
In terms of memory usage and processor utilization, how does Windows Server 2019 ReFS deduplication compare to ZFS deduplication?
There seems to be a lot of chatter about Microsoft adding missing features to ReFS in Windows Server 2019. Is disk compression now available? And if so, does it work in conjunction with data deduplication?
I have a scenario where I'm using a primary SMTP server from cPanel, however I'm running a Dockerized web app on a second server that is having trouble delivering to the main smtp server due to a bug in a Ruby library that's being used.
Would there be any problems caused by setting up Postfix or Exim as a local SMPT server on the Docker app server for the system to use to deliver emails when there's already an existing primary STMP server for the domain? Are there some additional steps that are necessary in order to eliminate any problems in such a configuration?
Git access fails with "Permission denied, please try again." after a client changed their system processor.
Is there a way to check to see if SSHD is getting the proper auth / key info from GitLab's server? This seems to be the crux of the issue.
This was working fine for the user on my GitLab server for several months and then after the CPU change they were no longer able to login. No such problems happen for them on GitHub or other git servers, so they're thinking it could be server related.
It fails with a simple git ls-remote (to emulate the first step in deployment of a project update):
ssh -vv -p 43210 -A [email protected] 'git ls-remote [email protected]:projects/project_name.git'
It gets onto the server (hostname1.tld) just fine (for example, if they issue ls instead of the git ls-remote command there the remote server directory contents are returned). However, when it executes the git ls-remote command, we see the following:
...
debug1: Authentication succeeded (publickey).
Authenticated to hostname1.tld ([hostname1.tld]:43210).
debug1: setting up multiplex master socket
debug2: fd 4 setting O_NONBLOCK
debug1: channel 0: new [/tmp/[email protected]:43210]
debug1: channel 1: new [client-session]
debug2: channel 1: send open
debug1: Entering interactive session.
debug1: pledge: id
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug2: channel_input_open_confirmation: channel 1: callback start
debug1: Requesting authentication agent forwarding.
debug2: channel 1: request [email protected] confirm 0
debug2: fd 3 setting TCP_NODELAY
debug2: client_session2_setup: id 1
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 1: request env confirm 0
debug1: Sending env LC_TERMINAL = iTerm2
debug2: channel 1: request env confirm 0
debug1: Sending env LC_TERMINAL_VERSION = 3.3
debug2: channel 1: request env confirm 0
debug1: Sending env LC_CTYPE = en_US.UTF-8
debug2: channel 1: request env confirm 0
debug1: Sending command: git ls-remote [email protected]:projects/project_name.git
debug2: channel 1: request exec confirm 1
debug2: channel_input_open_confirmation: channel 1: callback done
debug2: channel 1: open confirm rwindow 0 rmax 32768
debug2: channel 1: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 1
debug2: exec request accepted on channel 1
debug1: client_input_channel_open: ctype [email protected] rchan 2 win 65536 max 16384
debug2: fd 8 setting O_NONBLOCK
debug1: channel 2: new [authentication agent connection]
debug1: confirm [email protected]
debug2: channel 2: rcvd eof
debug2: channel 2: output open -> drain
debug2: channel 2: obuf empty
debug2: channel 2: chan_shutdown_write (i0 o1 sock 8 wfd 8 efd -1 [closed])
debug2: channel 2: output drain -> closed
debug1: channel 2: FORCE input drain
debug2: channel 2: ibuf empty
debug2: channel 2: send eof
debug2: channel 2: input drain -> closed
debug2: channel 2: send close
debug2: channel 1: rcvd ext data 38
Permission denied, please try again.
debug2: channel 1: written 38 to efd 7
debug2: channel 1: rcvd ext data 38
Permission denied, please try again.
debug2: channel 1: written 38 to efd 7
debug2: channel 1: rcvd ext data 41
Permission denied (publickey,password).
debug2: channel 1: written 41 to efd 7
debug1: client_input_channel_req: channel 1 rtype exit-status reply 0
debug1: client_input_channel_req: channel 1 rtype [email protected] reply 0
debug2: channel 1: rcvd eow
debug2: channel 1: chan_shutdown_read (i0 o0 sock -1 wfd 5 efd 7 [write])
debug2: channel 1: input open -> closed
debug2: channel 1: rcvd ext data 126
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
On the GitLab server itself (hostname2.tld) with ssh logging turned up to DEBUG, the following can be seen in the auth.log:
gitlab sshd[8053]: debug1: Forked child 8075.
gitlab sshd[8075]: debug1: Set /proc/self/oom_score_adj to 0
gitlab sshd[8075]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
gitlab sshd[8075]: debug1: inetd sockets after dupping: 3, 3
gitlab sshd[8075]: Connection from hostname1.tld port 38412 on hostname2.tld port 22
gitlab sshd[8075]: debug1: Client protocol version 2.0; client software version OpenSSH_7.4
gitlab sshd[8075]: debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
gitlab sshd[8075]: debug1: Enabling compatibility mode for protocol 2.0
gitlab sshd[8075]: debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8
gitlab sshd[8075]: debug1: permanently_set_uid: 108/65534 [preauth]
gitlab sshd[8075]: debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
gitlab sshd[8075]: debug1: SSH2_MSG_KEXINIT sent [preauth]
gitlab sshd[8075]: debug1: SSH2_MSG_KEXINIT received [preauth]
gitlab sshd[8075]: debug1: kex: algorithm: [email protected] [preauth]
gitlab sshd[8075]: debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
gitlab sshd[8075]: debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
gitlab sshd[8075]: debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
gitlab sshd[8075]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
gitlab sshd[8075]: debug1: rekey after 134217728 blocks [preauth]
gitlab sshd[8075]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
gitlab sshd[8075]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
gitlab sshd[8075]: debug1: SSH2_MSG_NEWKEYS received [preauth]
gitlab sshd[8075]: debug1: rekey after 134217728 blocks [preauth]
gitlab sshd[8075]: debug1: KEX done [preauth]
gitlab sshd[8075]: debug1: userauth-request for user git service ssh-connection method none [preauth]
gitlab sshd[8075]: debug1: attempt 0 failures 0 [preauth]
gitlab sshd[8075]: debug1: PAM: initializing for "git"
gitlab sshd[8075]: debug1: PAM: setting PAM_RHOST to "hostname1.tld"
gitlab sshd[8075]: debug1: PAM: setting PAM_TTY to "ssh"
gitlab sshd[8075]: debug1: userauth-request for user git service ssh-connection method password [preauth]
gitlab sshd[8075]: debug1: attempt 1 failures 0 [preauth]
gitlab sshd[8075]: Failed none for git from hostname1.tld port 38412 ssh2
gitlab sshd[8075]: debug1: userauth-request for user git service ssh-connection method password [preauth]
gitlab sshd[8075]: debug1: attempt 2 failures 1 [preauth]
gitlab sshd[8075]: Failed password for git from hostname1.tld port 38412 ssh2
gitlab sshd[8075]: debug1: userauth-request for user git service ssh-connection method password [preauth]
gitlab sshd[8075]: debug1: attempt 3 failures 2 [preauth]
gitlab sshd[8075]: Failed password for git from hostname1.tld port 38412 ssh2
gitlab sshd[8075]: Connection closed by hostname1.tld port 38412 [preauth]
gitlab sshd[8075]: debug1: do_cleanup [preauth]
gitlab sshd[8075]: debug1: monitor_read_log: child log fd closed
gitlab sshd[8075]: debug1: do_cleanup
gitlab sshd[8075]: debug1: PAM: cleanup
gitlab sshd[8075]: debug1: Killing privsep child 8076
gitlab sshd[8075]: debug1: audit_event: unhandled event 12
It appears that it's failing at this error above: Failed password for git
Any idea of what's happening here or how to troubleshoot further?
I have a scenario where I'm using a shared mail server (cPanel) for SMTP on multiple domains for several clients. I hit an issue where Ruby's OpenSSL library complains that the hostname "smtp.domain2.tld" does not match the server certificate.
In this case I think the issue is that the main CN for the certificate is "domain2.tld" and while "mail.domain2.tld" is an accepted DNS SAN, it is not the main CN and if no SNI is requested it fails...
For example: if I connect with openssl without a "servername" directive, the certs I get back are for the server itself are server.main-domain.tld:
$ openssl s_client -connect mail.domain2.tld:587 -starttls smtp -showcerts | grep CN=
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
250 HELP
0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=server.main-domain.tld
i:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
1 s:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=server.main-domain.tld
issuer=/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
Note that the certificate is for server.main-domain.tld instead of domain2.tld or mail.domain2.tld.
However, if we specify the SNI name with -servername:
$ openssl s_client -connect server.main-domain.tld:587 -servername mail.domain2.tld -starttls smtp -showcerts | grep CN=
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
250 HELP
0 s:/CN=domain2.tld
i:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
1 s:/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
subject=/CN=domain2.tld
issuer=/C=US/ST=TX/L=Houston/O=cPanel, Inc./CN=cPanel, Inc. Certification Authority
It appears that some tests (such as swaks) is not forcing an SNI lookup (and thus it sends out emails via SMTP just fine), but perhaps Ruby's OpenSSL library handles this a bit differently...
What should I do to set up the certificates or server properly so as to not create this issue?
I'm looking to solve the following problem in the cleanest most succinct way. I would prefer to use a single device / server to accomplish this, but realize that I might need to pull together some additional tools to accomplish it. I thought it might be best to start here to get some feedback as to what's feasible. It looks like perhaps ClearOS or Untangle's solution might work, but I'm not entirely solid on the details of what may be needed yet.
Effectively I want to accomplish this (diagram):
As far as verbalizing it goes, I'll take a stab here and anyone can feel free to correct me or my thought process or terminology as I go.
I need to set up a gateway / firewall server that takes a primary ISP in and a secondary ISP as a backup (failover, but not always plugged in unless it's needed). I then need to serve an OpenVPN connection to the main network. This will also have a DNS server and provide DHCP to the LAN.
All traffic will pass over this OpenVPN connection, but I also need to provide a proxy service that will allow certain clients on the LAN to use the direct ISP(s) for connectivity instead of the VPN if they so choose. (ie. some machines may want all their traffic to pass over the ISP and those that do will have a SOCKS proxy server to meet their needs.)
QoS will likely be part of the equation at some point, but it is not yet fully determine. It's likely that the wireless router that provides direct ISP traffic will be rate limited.
Finally if the VPN occasionally has connectivity issues. I'll need to connect to a different node if one experiences a problem and then if it does, it will try to connect to the next in a round robin fashion until it has a connection. I suspect I can handle that from a tertiary server that will have a script or daemon that I can build that will trigger the OpenVPN reconnect and round robin'ing if needed as I doubt anything has such functionality at present built in.
Any thoughts on what options exist to accomplish this? As I noted, I suspect I'll have to tie a few different services or servers together ultimately, but would prefer to keep this as simple and clean as possible. XenServer with a couple virtual machines has worked "ok" up to this point, but I haven't been able to pull all of the pieces in the diagram together.
I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.
I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any definition of the interface identifier (eth0, eth10, br4, etc.)
Is there a way to instruct tcpdump to include interface info with each packet per line?
I'm dealing with a scenario with a service that's saying the following:
"... [this service] uses multicast address 239.170.165.207 on port 49838 to find host computers, so your network must allow this."
First, what does this actually mean? It appears that 239.* is a reserved address for multicasting, but I'm not groking what this translates into for application on our network office since we're hitting walls wherein the service is not being recognized.
To be specific, we're attempting to develop some software with Google Daydream Instant Preview as per this. When using the WiFi mode, and while
"running the Unity editor with Instant Preview, it should be discoverable by an Instant Preview app running on a phone connected to on the same WiFi network. Tap the drop down field under “Preview via…” to see available computers to stream from.
"Tap on a computer name to connect to it. Instant Preview should operate the same way as if you were connected via USB."
This doesn't work and I'm not seeing where the problem may be. We're running a Linux server that acts as a firewall and gateway with some some switches and a wireless router that bridges the traffic over (acting as a wireless switch effectively). Nothing should really be doing anything peculiar, however I've not really dealt with multicasting situations before on our network and thus I suspect I'm missing some detail here.
Thus I'm hoping I can understand what is supposed to be going on here to perhaps get to the bottom of what may be preventing this from occurring properly on our network.
Is there a method for scanning all of the devices in a raid-z array for bad sectors (blocks) simultaneously or must this be performed on a device-by-device basis with a separate drive testing application?
So far scrub just doesn't seem to scan everything since there's effectively no data.
On macOS I am attempting to set up an automount for a mount point with spaces.
/etc/auto_master contains:
#
# Automounter master map
#
+auto_master # Use directory service
/net -hosts -nobrowse,hidefromfinder,nosuid
/home auto_home -nobrowse,hidefromfinder
/Network/Servers -fstab
/- -static
/- auto_afp -nosuid
and /etc/auto_afp contains:
'/mnt/mount point' -fstype=afp 'afp://username:passwd@hostname/share%20name`
When I execute: sudo automount -vc, I get the error noted:
automount: dir '/mnt/mount point' must start with '/'
automount: /net updated
automount: /home updated
automount: /Network/Servers updated
automount: no unmounts
It has also failed if I use %20 without quoting (in that case it includes %20 in the mount point name).
How does one properly add spaces in a mount point?
I have a tape backup from a defunct server that was created via Symantec Backup Exec version 10.1.5629 on Windows.
Is it possible to extract the backup from this using some standard or open source tools on Linux rather than resorting to a copy of Backup Exec?
I presently have been able to use dd if=/dev/st0 ibs=64K of=tape_contents, but am now unable to actually extract the data.
I was initially told that this backup was created with the Windows Server 2003 Backup software, however when I attempted to use mtftar, I received the following output:
mtftar -v < tape_contents Output:
MFT Generator: Symantec Backup Exec 10.1.5629 Tape Name: Media created
4/2/2015 9:00:08 PM Tape Label: MTF Media
Label|1.0|VERITAS|PVL|2006/11/18.03:00:11|LTO000003|1|{938BB24D-60F6-45B0-ABB5-E66AE4C1EB72}||
MTF out of order (files before directory saw 1701079382 while
expecting limit of 0) Segmentation fault (core dumped)
I have a scenario where I have to recover a backup from an Ultirum 448 tape medium that was made on Windows 2003 server. The only system that I have available for recovery is a Linux server with comparable hardware.
Is there a way to use tape accessibility software available on Linux to recover tape data in such a scenario?
I am performing some custom routing with a VPN in the mix that is requiring me to add each Google Gmail SMTP server IP to the routing table so that they pass over another gateway than the VPN's default gateway.
As per this, I can ascertain Google's general address ranges, however I can't seem to isolate the SMTP servers directly. Curiously, I made an inquiry to a VPN company at one point and they replied with all of the specific Gmail SMTP servers, but did not and would not explain how to ascertain these IP addresses.
How can I isolate these IP addresses via shell incantations? A standard GNU Linux or OS X method would be fine for this.
I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. I don't believe that this is possible with netstat from everything I've explored so far and so I was thinking that I would have to write a script to process the output of netstat and then pass the pids into ps and then prettify the output to show the ip+port and full command line.
Is there a better way of doing this or is this about the only option?
Having an odd problem here with regards to pound reverse proxy no longer directing traffic properly on a CentOS based distro (ClearOS 6.2.x).
I believe that it's an iptables issue or something else in that I see nothing to even indicate inbound traffic in my /var/log/messages or /var/log/system.
How can I increase iptables logging verbosity and verify what is going on with it (in terms of certainty as to where the logging data is being kept)?
rsync can be coaxed into moving folders very similarly and superiorly to traditional mv with the following options:
rsync -axvvES --remove-source-files source_directory /destination/
However one thing I cannot yet seem to get it to do is to remove original directories. The --remove-source-files flag does just that, removes the source files, but not also source directories. I wish there were a --remove-source-directories flag as well, but there's not.
How can I deal with this? I suppose I can just issue an rm -fr after the move, however I'd prefer to keep the procedure all in one process vs introducing a potential for mistakes.
I have a situation where I'm testing a new filesystem that has an issue with some metadata. All of the files are intact, however I ultimately have to effectively move every single file off to another volume and then immediately back in place.
Obviously mv won't do the trick since it's not able to preserve all attributes (particularly all timestamps). I was thinking something more along the lines of a find command whilst exec'ing cp -p /original/path/to/file /tmp/location/file, rm /original/path/to/file, cp -p /tmp/location/file /original/path/to/file, rm /tmp/location/file. Perhaps all of these commands in a script that is passed to the find exec?
I'm not sure of the most efficient approach here, but would like some quick input in order to make sure I cover all of my bases and have a precise command that will not leave me mourning some kind of data attribute loss when it's all said and done. I have many hundreds of gigabytes to shift back and forth so I need to be both as careful and as efficient as possible.
Here's the solution I've come up with so far and would love some input:
Shell script safe_move.sh:
#!/usr/bin/env bash
SRC_FILE_AND_PATH="$1"
SRC_BASENAME=`basename "$1"`
DESTINATION_PATH="/mnt/tmp"
cp -a ${SRC_FILE_AND_PATH} ${DESTINATION_PATH}/${SRC_BASENAME}
rm -f ${SRC_FILE_AND_PATH}
cp -a ${DESTINATION_PATH}/${SRC_BASENAME} ${SRC_FILE_AND_PATH}
rm -f ${DESTINATION_PATH}/${SRC_BASENAME}
And this will be called with:
find /path/to/move -type f -exec safe_move.sh {} \;