JCCyC's questions

A customer says they want to park a domain with us. In theory, they should have registered that domain already. But when I look it up with whois, I get this:

jcastro@localhost:~$ whois notactuallythedomaininquestion.br

% Copyright (c) Nic.br
%  The use of the data below is only permitted as described in
%  full by the terms of use at https://registro.br/termo/en.html ,
%  being prohibited its distribution, commercialization or
%  reproduction, in particular, to use it for advertising or
%  any similar purpose.
%  2017-11-07 09:26:29 (BRST -02:00)

% blocked_word:  CG

% Security and mail abuse issues should also be addressed to
% cert.br, http://www.cert.br/ , respectivelly to [email protected]
% and [email protected]
%
% whois.registro.br accepts only direct match queries. Types
% of queries are: domain (.br), registrant (tax ID), ticket,
% provider, contact handle (ID), CIDR block, IP and ASN.

What does it mean? A truly nonexistent domain doesn't give me that blocked_word line, instead it gives:

jcastro@localhost:~$ whois randomwordsalad.br
.
.
.
% No match for randomwordsalad.br
.
.
.

I have a Squid 3.5.23 running on Debian Stretch, recompiled from the deb source and configured as a transparent proxy. I changed the configuration in order to allow SSL proxying and it seems to be running OK when I install the generated Squid certificate as a trusted root authority. Facebook, Google, Kernel.org and most other HTTPS sites pass through OK, and the browser correctly thinks those sites' certificate authority is the proxy's. Now, SOME sites give me a certificate warning and then an error if I accept it as an exception.

https://elpais.com ->

The following error was encountered while trying to retrieve the URL: https://2.16.189.72/*

    Failed to establish a secure connection to 2.16.189.72

The system returned:

    (71) Protocol error (TLS code: SQUID_ERR_SSL_HANDSHAKE)

    Handshake with SSL server failed: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

This proxy and the remote host failed to negotiate a mutually acceptable security settings for handling your request. It is possible that the remote host does not support secure connections, or the proxy is not satisfied with the host security credentials.

https://wiki.squid-cache.org/ (Now that is ironic) -> The following error was encountered while trying to retrieve the URL: https://master.squid-cache.org/*

    Failed to establish a secure connection to 104.130.201.120

The system returned:

    (71) Protocol error (TLS code: X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)

    SSL Certficate error: certificate issuer (CA) not known: /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3

This proxy and the remote host failed to negotiate a mutually acceptable security settings for handling your request. It is possible that the remote host does not support secure connections, or the proxy is not satisfied with the host security credentials.

I generated the certificate with the following commands:

openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 \ -keyout mycompany.pem -out mycompany.pem openssl x509 -in mycompany.pem -outform DER -out mycompany.der /usr/lib/squid/ssl_crtd -c -s /etc/squid/certs/ssl_db -M 4MB chown -R proxy.proxy ssl_db

Clues?

I would like to administer my firewall by good, old-fashioned iptables commands saved by iptables-save instead of ufw or firewalld. For RHEL, there is a neat little package called iptables-services that does just that. (See here) For Debian, there doesn't seem to be one.

I just could slap iptables-restore </etc/default/iptables into /etc/rc.local and leave it at that, but I'd like a cleaner setup. If it can come as a systemctl unit it'd be ideal.

I have Zabbix 3.0 managing a couple dozen or so Linux servers. All of them have the "Template OS Linux" template, which has a warning trigger of "Too many processses running" if there are more than 30 processes running. But for a handful of these machines, I decide that it's OK to have more than 30 running processes, and I would like the trigger to be, say, 50 or 60. The other machines should stay with a threshold of 30. What would be the best course of action to implement that?

Could I create an additional template which only has the altered-threshold triggers, and have it apply to the host? Relatedly, if there are two templates for a host that have different triggers for the same item, would I necesssarily have to disable the "old" trigger for each host manually?

I reiterate that "Number of processes running" is only an example. The same problem can apply to any item.

I'm using (and am new to) Zabbix 3.0 on CentOS 7. I successfully created an action that sends e-mail to one user. When a condition (e.g. a filesystem more than 80% full) happens, an e-mail gets sent to that user. But now I want the e-mail to go to two users, not just one.

I tried that in two ways. First, I created a "Notifications Receiver" group in Zabbix, set that group's read permisssion to all entities, then made the first user a member of that group. That was my initial setup, with only user 1 being a member. That worked. But when I include the second user in that group, Zabbix ignores me and new notifications still get sent only to the first user.

I edited the action so, instead of that group, notifications are sent to the two users individually:

But Zabbix ignores me. Everything STILL gets sent only to the one user, the first one. It doesn't even try. This screeenshot for the dashboard shows it only sends e-mail to the first user:

Soon after that, the status of the status changed to "Sent" and one e-mail arrived. But it didn't even try to send to the second user even though its media is set correctly, just like the first one:

I'm at the end of my rope. I'm probably misssing something stupidly obvious.

Some GNU/Linux distros (CentOS comes to mind) have a neat Authentication Config tool, in which you may specify which auth methods (files, NIS, Winbind etc) to use. You specify the needed parameters (e.g. realm, server address) and it does everything for you under the hood. Linux Mint Debian Edition doesn't seem to have one.

I'm trying to have LMDE Betsy clients login against a Samba classic PDC (not AD) which is already working just fine for Windows clients. It seems I'd have to do a fair amount of pitfall-ridden config editing. Worse, the Samba Wiki has instructions only for joining an AD, not a PDC.

Is there an easier, already-scripted way to do this in this distro? Did I fail to find some tool that's right in front of my nose?

[EDIT] Progress: I got to the point where wbinfo -u lists domain users but getent passwd doesn't, and I can't login with domain users. The only changes I made to non-Samba files were to include winbind in nsswitch.conf:

passwd:         compat winbind
group:          compat winbind

Here's my smb.conf:

[global]
   netbios name = MAQUINA128
   workgroup = PCOMLAB
   realm = PCOMLAB.INTRANET
   security = domain
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = member server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
[homes]
   comment = Home Directories
   browseable = no
   read only = yes
   create mask = 0700
   directory mask = 0700
   valid users = %S
[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no

Basically, what I did is:

mysqldump -uroot -pxxx <some_options> --result-file Backup.sql --databases mysql customappdb

Is it sane to later do

mysql -uroot -pxxx < Backup.sql

Or do I need to take special precautions? I'm running 5.1.73-community.

I want to set up a download area within a site, (FTP or HTTP, doesn't matter) and I would like to have at least a handful of mirrors scattered around the world. I would like the download links to choose a mirror transparently for the user. It may be random, round-robin, or it may have some smart IP proximity logic. Is there some good package (e.g. a Python or PHP library) I could use for that end?

I'm studying a "good practices" document for Cisco IOS, and one of its controls tells me to disable ICMP Redirect packets in the router. Sounds reasonable. So I go test it in Cisco Packet Tracker (a nifty little network emulator program). In my virtual router's IOS CLI, I type the following:

jcios01#config term
Enter configuration commands, one per line.  End with CNTL/Z.
jcios01(config)#interface GigabitEthernet9/0
jcios01(config-if)#no ip mask-reply
                          ^
% Invalid input detected at '^' marker.

I'm puzzled. That's what the document told to do. enable, "config term", "interface " and then "no ip mask-reply". Am I forgetting something?

Yes, I'm a Cisco newbie.

So. I have a binary in /opt/freeware/bin in an AIX PPC machine whose origin I don't know. It could be an RPM -- most open-source AIX RPMs install in /opt/freeware. But no such luck. It must have been from an installp package (.bff). How can I discover which of the installed packages, if any, contains this file?

This should be mind-numbingly simple and basic, and yet I couldn't find how to do it, either in "man ifconfig", in the OpenSolaris docs site, or Googling in desperation. I'm using OpenSolaris 2009.06.

When I try ifconfig e1000g0:0 10.10.10.1 netmask 255.0.0.0 up all addresses go kablooie instead. This happen whether the network is in "automatic" or "manual" mode.

Alternatively, I could use a way to set up two static IP addresses too.

This question was kinda, sorta, already asked, but there's a security issue with the NFS+NIS setup that still bugs me: if you know somebody's username/uid, you can setup a *nix computer, create a user locally with the same name/uid, and presto, you can mount the server FS and it'll give you access to the user's files.

So my question is specific: is there an alternative setup that'll give no access to server files, no way, no how, unless you have a valid username AND password, even if you setup your own computer and place it on the network?

Users still need to be able to log on to their workstations and work with their server files without having to give their password all the time. It's OK if it only works in a Linux GUI like Gnome.

Joe, Jack and Jill use IM as a communication medium among themselves in Company A, where they work, and with customers and partners around the world. No goofing off here -- it's a legitimate work tool.

                                      +-----+
+-----+                               |Mary |
|Joe  |--------+                      +-----+
+-----+        |                        /
            +------+       ____________/
+-----+     |      |      /            \
|Jack |-----|Server|-----| The Internet |
+-----+     |      |      \____________/
            +------+                   \
+-----+        |                        \
|Jill |--------+                      +-----+
+-----+                               |Paul |
                                      +-----+

I'd like if, when the Internet connection dies, Joe, Jack and Jill are still able to IM each other within the company. After all, network connectivity between them hasn't been compromised. Can any of the popular IM networks do this transparently? Perhaps installing a proxy-like program in a company server?

These three
still see
each other
v v v v v v
                                        +-----+
+-----+                                 |Mary |
|Joe  |--------+                        +-----+
+-----+        |                          /
            +------+         ____________/
+-----+     |      |   D    /            \
|Jack |-----|Server|-/ E /-| The Internet |
+-----+     |      |   A    \____________/
            +------+   D                 \
+-----+        |                          \
|Jill |--------+                        +-----+
+-----+                                 |Paul |
                                        +-----+

What I want is a quick, reliable command to ascertain that the Linux I'm running in is Debian-based. The following command seems to work. It also returns the Debian version:

dpkg -L base-files 2>/dev/null | grep '^/etc/debian_version$' >/dev/null 2>&1 && cat /etc/debian_version

My previous idea was to use dpkg -S /etc/debian_version to see if it belonged to some package, regardless of name. But dpkg -S is slow.

I only have a lingering doubt: are there older Debian-derivated distros where my assumption doesn't hold? Is there a better way?

This is a followup to this question.

I eventually got my hands on a Slackware 12.1 machine with a dynamically-assigned IP address. It turns out it uses neither dhclient nor pump to get the address, it uses dhcpcd.

I can't for the life of me find where in the filesystem it stores the lease information. Anyone knows?

Firstly, parsing configuration files isn't really correct. And not nearly distro-independent either.

My first idea was to search for running dhclient processes, but each distribution uses a different esoteric command line. Even the binary name itself varies. In Fedora, it's dhclient. In Ubuntu, it's dhclient3.

Is there something in /proc or /sys that indicates that an IP is dynamic?

I know that, for 32-bit Intel Linuces, it returns i[3-6]86. For 64-bit Intel, it says x86_64. But what about other, exotic architectures? (PowerPC, Alpha, SPARC...) Is there an authoritative list somewhere?

Bonus points if there's info about other non-Linux Unices too.

Consider the output of a typical ip addr show on Linux:

# ip addr show
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,NOTRAILERS,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet nnn.nnn.nnn.nnn/n brd nnn.nnn.nnn.nnn scope global eth1
    inet6 nnnn::nnnn:nnnn:nnnn:nnnn/nn scope link
       valid_lft forever preferred_lft forever

Look at the first field of the second line of each interface output: it says "link/loopback" for the loopback interface and "link/ether" for the physical NIC.

My question is: What OTHER values can I expect in this field? "link/bluetooth"? "link/ppp"? Is there an authoritative list for these link type strings?

Not everybody uses POSIX ACLs on Linux. In fact, most users olympically ignore them, even when they're aware of what they are and what they do. But most distributions come with support for them. Some leave them enabled for the default filesystems; some don't.

My question is, is there an efficient way to search for files that use POSIX ACLs in a filesystem -- that is, ACLs other than the so-called minimal ACLs, the familiar rwx for user-group-other -- except painstakingly parsing the output of getfacl ran through find?

I'm exploring environment variables via the WMI class Win32_Environment. According to the documentation, a variable that's not of a specific user can be either a "System" variable or a "Default User" variable. My question is, what's the difference, and how I would use one or the other?

Exploring a Windows 2008 machine that's being used as a workstation, I find System variables, but no Default User variables.