Sunny's questions

I have an ubuntu server, running apache2. I'm trying to set it to serve git repository over http.

After reading tens of samples, I ended with very simplified config file, removing all of the authentication for simplicity.

My git_conf file in conf.d looks like this:

SetEnv GIT_PROJECT_ROOT /srv/repos/git/
SetEnv GIT_HTTP_EXPORT_ALL

ScriptAlias /git/ /usr/lib/git-core/git-http-backend/

<Location /git>
</Location>

I created an empty git repository like this:

# git --bare init myrepo
# cd myrepo
# git --bare update-server-info
# cd ..
# chown -R www-data:www-data myrepo

Now, the fun begins. I was able to clone the repo on the local machine:

# cd ~/tmp
# git clone /my/repo/path/myrepo test1

But, whenever I try to clone from a remote machine like this:

$ git clone http://myserver/git/myrepo test1

I receive:

fatal: http://cfs-int-redmine/git/iosdemo/info/refs not found: did you run git update-server-info on the server?

If on the server I create a symlink to the repo like:

# ln -s myrepo myrepo.git

And then I try to clone http://myserver/git/myrepo.git, it works.

So, what's going on? Should I aways use ".git" in order to be able to use the repository? How do I make it to work without .git?

In IIS I have web site with .Net application, accessible like this:

http://site1.example.com/myapp

The site requires authentication, so when I access it, it redirects as expected to http://site1.example.com/myapp/login.asx

I exported the configuration, and then used the file to create a new site under the same server. Now, when I access the new site at http://site2.example.com/myapp, it redirects to http://site2.example.com/MYAPP/login.aspx. Note the upper case for the app name.

Before I imported the xml configuration file, I edited it to set different root directory for the application (where I placed a copy of the existing one), so this is not the problem.

When I look in MetaBase.xml, the AppRoot for the virtual directory in the newly created site was set to /LM/W3SVC/1584782141/Root/MYAPP, while in the exported xml file, as well as in Metabase.xml but for the original virtual directory its lowercase, as it should be.

I edited the MetaBase.xml (in IIS the online edit of metabase is allowed) and saved it. No change at all. I reloaded the Metabase, the correction is in place, but it just don't work - it always redirects to the capitalized version of the URL.

This happens only when redirecting to login.aspx. If I hit directly the login page - i.e. I type the url in the browser, it stays as I typed it.

Also, if I hit a "not protected" page in the directory, it keeps the case as it should.

Any idea where else I can look to fix that issue?

I can easily crate a directory structure like c:\temp\mywww\my\custom\path, and then create virtual directory to \mywww and place my files in path subfolder, and I'll be able to access it like:

http://my.exmple.com/my/custom/path

The question is, can I place my files mywww, and then create a virtual directory in such a way, so I access them using the above mentioned url. I.e. somehow the virtual directory alias to be "my/custom/path".

Thanks

I have a redmine server running on ubuntu. I also host an svn repository on the same server.

The svn virtual directory has authorization restrictions per user, but I want to allow the redmine application to be able to access it without providing username.

So, I have put: "Allow from 10.10.10.10", which is the external IP of the server, and it works OK.

But I would like to put the real host name there, and not the external IP.

 
# dnsdpmainname
mydomain.com
# hostname
myserver.mydomain.com
# ping myserver
PING myserver.mydomain.com (10.10.10.10) ... works

BUT ..

# ping myserver.mydomain.com
PING myserver.mydomain.com (127.0.1.1) ... also works, but different IP

I have tried to use both myserver and myserver.mydomain.com in the "Allow from" directive, but none of this works.

I guess the problem is somewhere in the fact that myserver and myserver.mydomain.com resolve to different IPs - one to the external IP, and one of some internal.

Any idea how to fix this? I'd prefer to use a hostname in the Allow directive, and not the IP address (which in theory may change).

Thanks

I have 2 standalone servers (not in any domain/AD) - Windows 2003 and Windows 2008.

When connecting to shares on them, using the UNC path from Windows 2000 pro, or Samba (under linux), if I make a mistake typing the password, these servers will lock the account on first attempt.

It works OK, when connecting from Windows 2003, Windows 2008 and Vista.

On all the connecting machines, it'll report auth failure, and will ask for credentials again. But from Windows 2000 and Samba it'll continue to fail on the second attempt even if the password is correct. Trying to log to these machines will report account locked.

The policy set is to lock account on 10 failures, and it behaves correctly when the connection attempt is done from W2008 or W2003 - i.e. even if the first attempt fails, the next one will succeed.

I've done the experiment to unlock the account, the from W2000 box I intentionally try to log with bad password, and even without second attempt I can see that the account is locked.

Any idea what I may change, so I avoid this problem? It usually happens when I'm in a hurry (of course :) ), so dealing with logging on the machines to unlock the account is really frustrating.

I have the following install:

PROD net (10.88.88.0/24)

OFFICE net (192.168.2.0/24)

on PROD I have openvpn server (vpnprod), so OFFICE can connect.

on OFFICE I have openvpn machine (vpnoffice) which runs both openvpn server to allow external users, as well as client to connect to PROD.

Both vpnprod and vpnoffice are running linux.

All works OK, i.e. from OFFICE (any machine), I can make connection to PROD (any) - with some restrictions.

I have all routing set properly.

Also, I can connect clients to OFFICE, and they can access OFFICE machines - no problem.

What fails is if a client (remote, connected to OFFICE) tries to access some PROD machine. It times out.

I have run tcpdump on both tun interfaces on vpnoffice, and it shows the packets sent by the connected client. I would guess that this means that the routing there is OK.

But on tun0 on vpnprod I do not see these packets at all - they do not get there at all.

So, to recap:

officemachine -> vpnoffice -> vpnprod -> prodmachine - WORKS
remote -> vpnoffice -> officemachine - WORKS
remote -> vpnoffice -> vpnprod -> prodmachine - FAILS!!!

My knowledge of tcpdump or similar tools is not very good. Any idea how to approach this problem and how to investigate it?

What else I need to check?

I have checked the firewall rules (IPTABLES), and each and every rule, which would drop any request writes in the log. But I do not see any entries for this particular requests made from a remote client trough vpnoffice to vpmprod.

As requested by @Andrew McGregor (I have put in brackets some explanations):

ip addr (vpnprod):

> ip addr
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2(DMZ): eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:60:cf:20:bb:54 brd ff:ff:ff:ff:ff:ff
    inet 10.88.8.1/24 brd 10.88.8.255 scope global eth2
    inet6 fe80::260:cfff:fe20:bb54/64 scope link
       valid_lft forever preferred_lft forever
3(internal): eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:10:18:02:30:c4 brd ff:ff:ff:ff:ff:ff
    inet 10.88.88.1/24 brd 10.88.88.255 scope global eth1
    inet6 fe80::210:18ff:fe02:30c4/64 scope link
       valid_lft forever preferred_lft forever
4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:25:94:7d brd ff:ff:ff:ff:ff:ff
    inet MY_EXT_NET/28 brd EXT_IP_BCAST scope global eth0
    inet EXT_IP_1/28 brd EXT_IP_BCAST scope global secondary eth0:FWB1
    inet EXT_IP_2/28 brd EXT_IP_BCAST scope global secondary eth0:FWB2
    inet EXT_IP_3/28 brd EXT_IP_BCAST scope global secondary eth0:FWB3
    inet EXT_IP_4/28 brd EXT_IP_BCAST scope global secondary eth0:FWB4
    inet6 MY::PROD:EXT:NET:XXXX/64 scope link
       valid_lft forever preferred_lft forever
5(OTHER_INT_NET): eth3: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:b0:d0:b0:bd:94 brd ff:ff:ff:ff:ff:ff
    inet 172.19.2.193/27 brd 172.19.2.223 scope global eth3
    inet 172.19.2.194/27 brd 172.19.2.223 scope global secondary eth3:FWB5
    inet 172.19.2.195/27 brd 172.19.2.223 scope global secondary eth3:FWB6
    inet6 fe80::2b0:d0ff:feb0:bd94/64 scope link
       valid_lft forever preferred_lft forever
6: sit0: <NOARP> mtu 1480 qdisc noop
    link/sit 0.0.0.0 brd 0.0.0.0
7(PRODVPN server): tun0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/[65534]
    inet 10.136.136.1 peer 10.136.136.2/32 scope global tun0

So, tun0 is the vpn server on prod, its bound to EXT_IP_1 ip address.

ip route prodvpn:

10.136.136.2 dev tun0  proto kernel  scope link  src 10.136.136.1
EXT_NET/28 dev eth0  proto kernel  scope link  src EXT_NET_IP0
172.19.2.192/27 dev eth3  proto kernel  scope link  src 172.19.2.193
10.136.135.0/24 via 10.136.136.2 dev tun0
192.168.2.0/24 (office_int) via 10.136.136.2 dev tun0
192.168.1.0/24 (office_DMZ) via 10.136.136.2 dev tun0
10.39.3.0/24 via 172.19.2.222 dev eth3
10.88.88.0/24 dev eth1  proto kernel  scope link  src 10.88.88.1
10.39.12.0/24 via 172.19.2.222 dev eth3
10.88.8.0/24 dev eth2  proto kernel  scope link  src 10.88.8.1
10.136.136.0/24 via 10.136.136.2 dev tun0
10.176.0.0/16 (OTHER_INT_NET) via 172.19.2.222 dev eth3
169.254.0.0/16 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via EXT_IP_ISP_GATEWAY dev eth0

ip addr officevpn:

1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
2: eth0(officeDMZ): <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:d0:b7:84:ab:a2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
3: eth1(office external IPs): <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:06:5b:39:c4:21 brd ff:ff:ff:ff:ff:ff
    inet OFF_EXT_IP1/29 brd 216.17.90.95 scope global eth1
    inet OFF_EXT_IP2/29 brd 216.17.90.95 scope global secondary eth1:FWB1
    inet OFF_EXT_IP3/29 brd 216.17.90.95 scope global secondary eth1:FWB2
    inet OFF_EXT_IP4/29 brd 216.17.90.95 scope global secondary eth1:FWB3
4: eth2(office_internal): <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:50:da:d7:14:77 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.254/24 brd 192.168.2.255 scope global eth2
11: tun1(officevpn_server): <POINTOPOINT,MULTICAST,NOARP,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
    link/[65534]
    inet 10.136.135.1 peer 10.136.135.2/32 scope global tun1
12: tun0(officevpn-client-to-prod): <POINTOPOINT,MULTICAST,NOARP,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
    link/[65534]
    inet 10.136.136.6 peer 10.136.136.5/32 scope global tun0

tun1 is bound to OFF_EXT_IP1 to serve connecting clients.

ip route officevpn:

10.136.135.2 dev tun1  proto kernel  scope link  src 10.136.135.1
10.136.136.5 dev tun0  proto kernel  scope link  src 10.136.136.6
10.136.136.1 via 10.136.136.5 dev tun0
EXT_IP_NET/29 dev eth1  proto kernel  scope link  src EXT_IP1
172.19.2.192/27 via 10.136.136.5 dev tun0
10.135.137.0/24 via 10.136.135.2 dev tun1
10.136.135.0/24 via 10.136.135.2 dev tun1
192.168.2.0/24 dev eth2  proto kernel  scope link  src 192.168.2.254
10.39.3.0/24 via 10.136.136.5 dev tun0
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
10.88.88.0/24 via 10.136.136.5 dev tun0
10.39.12.0/24 via 10.136.136.5 dev tun0
10.88.8.0/24 via 10.136.136.5 dev tun0
10.176.0.0/16 via 10.136.136.5 dev tun0
169.254.0.0/16 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via EXT_IP0(ISP GW) dev eth1

To sum up: on prod env I have 4 external IP addresses, bound to one interface. I have 1 internal networks (bound to 2 interfaces), and a DMZ (fourth interface):

• PROD_INT_ZONE1 - 10.88.88.x
• PROD_INT_ZONE2 - 172.x.x.x (and 10.176.x.x behind it - it has its router)
• PROD_DMZ - 10.88.8.x
• EXTERNAP_IPs - EXT_IPxx
• openvpnserver (bound to EXT_IP) - tun0

on office:

• OFFICE_INT_ZONE - 192.168.2.x
• OFFICE_DMZ - 192.168.1.x
• OFFICE_EXT_IPs - OFF_EXT_IPx
• openvpn server - tun1
• openvpn client (to connect to prod) - tun0

One of my SSL certificates (simple domain verification only) is about to expire on windows 2003 IIS 7.0 server.

I got better offer from another vendor, and the guys who originally issued my certificate do not want to negotiate lower prices.

Anyway - going trough the certificate wizard in IIS, I have the option to "renew" or to "uninstall" and then install a new certificate.

So - can I use the "renew" option to create a certificate request and pass this to the new vendor, or I need to start with "new" request? Will it matter for the new vendor, that the previous certificate was issued by another signer?

The problem is, that I do not want to stop the server (the secured part at least) because of removing the old certificate and creating new CSR, and wait for the new certificate to install.

Or, is there an option to prepare a new CSR without removing the old certificate?