I've recently installed Wazuh across my estate and I noticed that the curl binary changed for all my servers at roughly the same time.
I don't believe that anybody performed an upgrade at that time.
There is nothing in my syslog around that time that could suggest a reason for this to happen.
What could some of the reasons be for a single binary file to change its checksum?
Is this something peculiar to curl?
I've checked other answers and the problem I'm encountering isn't fixed by changing the remote (or local) temporary directory.
One of my hosts (not all of them) is failing with the message:
fatal: [wazuh_elastic_server]: FAILED! => {"ansible_job_id": "872609276122.14706", "changed": false, "cmd": "/home/ubuntu/.ansible/tmp/ansible-tmp-1567526428.5-44355784464580/AnsiballZ_apt.py", "finished": 1, "msg": "[Errno 2] No such file or directory: '/home/ubuntu/.ansible/tmp/ansible-tmp-1567526428.5-44355784464580/AnsiballZ_apt.py': '/home/ubuntu/.ansible/tmp/ansible-tmp-1567526428.5-44355784464580/AnsiballZ_apt.py'", "outdata": "", "stderr": "", "stderr_lines": []}
The task is:
- name: Linux | Install wazuh-agent
package: name=wazuh-agent state=present
async: 90
poll: 15
tags:
- init
What am I doing wrong here?
I want to use Ansible to add Icinga2 passive monitoring for my hosts with agent monitoring. I have a single master node and am not using satellites yet.
I've had some success in setting up the client side thanks to this answer and this old post on an archived forum.
What commands do I need to run on the master node to add in the remote node?
I'm using Ansible so I specifically want to avoid the wizard they provide.
I'm using the Sonarqube github authentication plugin. I want to make it so that only users in my Github organisation can sign up.
It does not appear to work because even users that are in my organisation are blocked with the reason:
Reason: 'username' must be a member of at least one organization: 'https://github.com/{{organisation_name}}'
The link above is my organisation page on Github. I have used {{organisation_name}} as the configuration value in Sonarqube. The user is definitely a member of the organisation.
What value should I use for the organisation name?
EDIT: I found https://jira.sonarsource.com/projects/SQAUTHGITH/issues/SQAUTHGITH-16?filter=allopenissues which suggests that possibly the org id is required. Using the Github API to get the organisation id for the user and then using that as a config value does not work either.
EDIT: Looking at the flow I think there might be a bug...
This is the url sending the user to github to get a token
https://github.com/login/oauth/authorize?response_type=code&client_id=123abc&redirect_uri=https://example.com/oauth2/callback/github&scope=user:email,read:org&state=123abc
It looks like there is no scope to read the org?
I have dynamic inventory working with a hosts file that looks like this:
[tag_Name_Sonarqube]
[sonarqube:children]
tag_Name_Sonarqube
This is a static group of dynamic groups and is working for me. documentation on working with dynamic inventory doesn't include a YAML example.
I would prefer to use YAML because I find the format neater, but I can't work out from the example in the documentation on inventory how this would look.
Does anybody have any examples?
I have a Cloudfront distribution and two origin domains that are not hosted in AWS.
I want to failover to the second domain if a file is not found in the first domain.
I've created two behaviours, but if the file is 404 in the first behaviour Cloudfront does not continue to check further behaviours.
What I want to happen is if the first behaviour is 404 then Cloudfront tries the next behaviour.
How could I make this work?
I'm trying to use Ansible to deploy to an AWS host that does not have a public IP address. I'm able to reach the host manually by ssh onto a jump box, and on that box ssh onto the private machine like my machine-->bastion-->private server
I don't think that I can use Ansible native support because this playbook uses roles that are shared with other plays. These roles rely on particular inventory groups. If I set up group_vars then this will bork the playbooks for deploying this to non-AWS infra.
My ssh config file looks like this:
# Servers in availability zone A
Host 10.0.0.*
ProxyCommand ssh -W %h:%p bastion.example.com
IdentityFile ~/.ssh/key.pem
# Servers in availability zone B
Host 10.0.1.*
ProxyCommand ssh -W %h:%p bastion.example.com
IdentityFile ~/.ssh/key.pem
# The bastion host itself
Host bastion.example.com
User ubuntu
IdentityFile ~/.ssh/key.pem
ControlMaster auto
ControlPath ~/.ssh/ansible-%r@%h:%p
ControlPersist 5m
Note that the key is the same for the bastion and private servers.
When I try to ssh 10.0.0.175 -F /tmp/aws_bastion_ssh_config -vvv I get the following output:
(venv) andrew@dell:~/projects/ansible-playbooks$ ssh 10.0.0.175 -F /tmp/aws_bastion_ssh_config -vvv
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /tmp/aws_bastion_ssh_config
debug1: /tmp/aws_bastion_ssh_config line 6: Applying options for 10.0.0.*
debug1: Executing proxy command: exec ssh -W 10.0.0.175:22 bastion.example.com
debug1: permanently_drop_suid: 1000
debug1: key_load_public: No such file or directory
debug1: identity file /home/andrew/.ssh/key.pem type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/andrew/.ssh/key.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
Permission denied (publickey).
ssh_exchange_identification: Connection closed by remote host
How can I get this to work?
Do I need the key to be present on the jump box? How do I configure that?
Edit: More info:-
To clarify that I can connect to the private machine from the jump box when I do ssh bastion.example.com -F /tmp/aws_bastion_ssh_config I reach the bastion server. I've copied the key to that server and when I ssh [email protected] -i ~/.ssh/key.pem I connect to the private machine. Ideally I would prefer not to have the key on the jump box, I've only put it there to make sure the networking is running correctly.
I'm trying to set up an NTP timeserver for hosts on my internal network to synchronise against.
I need to use authorisation in order to comply with PCI standards.
I've created a set of keys using ntp-keygen -M and added the below snippet to my /etc/ntp.conf file on the server.
enable auth
keys /etc/ntp.keys
trustedkey 1 7 17
I'm unable to connect to the server from a client. When I run "ntpq -c as" on the client I can see that auth is "bad" for my server. I have copied the key file that was generated on the server to the client and added the trusted key lines to the client too, like this:
server timeserver key 17
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1
keys /etc/ntp.keys
trustedkey 1 7 17
Looking at the server logs I can see that I'm getting a permission denied fault when trying to read the file, as below.
Jan 30 12:38:01 ip-10-0-1-103 systemd[1]: Starting LSB: Start NTP daemon...
Jan 30 12:38:01 ip-10-0-1-103 ntp[28084]: * Starting NTP server ntpd
Jan 30 12:38:01 ip-10-0-1-103 ntpd[28094]: ntpd [email protected] Wed Oct 5 12:34:45 UTC 2016 (1): Starting
Jan 30 12:38:01 ip-10-0-1-103 ntpd[28094]: Command line: /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 112:116
Jan 30 12:38:01 ip-10-0-1-103 ntp[28084]: ...done.
Jan 30 12:38:01 ip-10-0-1-103 systemd[1]: Started LSB: Start NTP daemon.
Jan 30 12:38:01 ip-10-0-1-103 ntpd[28096]: proto: precision = 0.182 usec (-22)
Jan 30 12:38:01 ip-10-0-1-103 ntpd[28096]: authreadkeys: file /etc/ntp.keys: Permission denied
I have used ntpdate from the client machine to set the date from the server so I'm pretty confident that the networking is up and running. I've actually disabled iptables on both servers while I'm busy trying to set this up.
The key file is 600 on the server, like this:
-rw------- 1 root root 1066 Jan 30 12:29 ntpkey_MD5key_timeserver.3694768152
lrwxrwxrwx 1 root root 35 Jan 30 12:33 ntp.keys -> ntpkey_MD5key_timeserver.3694768152
I've tried changing the config to point to the actual file and not the symlink.
Can anybody help me work out what the error in the syslog means and how to resolve this?
EDIT: Looking at the source it looks like the "Permission denied" part of the error is coming from the OS.
I'm using ssl-cert-check to track a list of my domains certificates.
In my crontab I set it to run quietly and email me expiring domains, but the command that I'm using to debug is:
ssl-cert-check -f ssldomains.txt -x 21 -i
It is correctly reading the file and retrieving the certificates for the entire list, but it does not appear to be getting the correct expiry date for certificates issued by LetsEncrypt.org
Other certificate providers do not seem to be affected by this problem.
For example a certificate that is expiring on 24 March 2017 when I inspect it in my browser is reported to be expiring on 15 Jan 2017.
I'm serving with nginx.
Why would the CLI tool be retrieving the wrong expiry date and how can I correct this?
I keep getting
Uncaught exception: Could not open extension /etc/hhvm/extensions/pgsql.so: /etc/hhvm/extensions/pgsql.so: undefined symbol: _ZN4HPHP13PDOConnection5sweepEv
When I try to start up HHVM. It was working prior to a HHVM which I applied (yesterday) as part of the standard upgrade process.
Rebuilding the pgsql.so fails with the bulk of the problem seeming to rest in the file
hhvm-pgsql-master/pdo_pgsql_statement.cpp
Is there a patch for this, or how would I be able to revert to a version of HHVM that does support this postgres extension?
All of a sudden my XAMPP installation is playing silly buggers when I try to Cake bake.
I get a recurring error:
SQLSTATE[HY000]: General error: 6 Error on delete of 'C:\xampp\tmp\#sql...MYD' (Errcode: 13)
Where the file name changes between attempts. I have tried reinstalling Xampp to no avail. I have also tried baking projects that were completed and are known to work but stil get the error (so I do not think it is my database schema).
The error also popped up in phpmyadmin once but I cannot replicate it. It only happens all the time when I try baking with CakePHP 2.1.3-18
I'm used to serving sites from Apache, but I am now forced to use an IIS server.
A number of my PHP pages are returning error 500 and I can't debug because IIS is suppressing the error messages. I've tried ini_set('display_errors',1); in code but to no avail.
Errors are shown on some sites but not the one in particular that I want to debug so I don't think it is a global PHP setting, but rather something to do with the site settings for that site.
I can't find a clear answer as to how to enable the displaying PHP errors.
I've found this link but am not sure where to find "system.webServer->httpErrors".
How can I enable the displaying errors in PHP under IIS?
I'm using a Ubuntu box to host my bare Git repositories for developers to work off.
At the moment I'm creating a user account for each developer on the box because it doubles as a filestore and local testing server.
When somebody pushes to the bare repository other developers are unable to work on the files which change in the objects folder as a result. The new files are created with the user of the developer who pushes.
I have placed all the developers into a dev group but the umask doesn't allow the group to edit.
I've never had to set up a Git repository so haven't had experience in working with the permissions. I do want each developer to have their own user account on the test server, and I would prefer them to do actions on the server using that account. I don't mind giving them sudo rights.
Is setting the umask for each developer the way forward?