Arthur Ulfeldt's questions

As part of diagnosing a different problem were trying to add a bridge filter rule that will stop all traffic from forwarding between two interfaces on a bridge.

The router has two interfaces ether1 and ether2 on a bridge.

we then added a rule with this

/interface bridge filter
add action=drop chain=forward in-interface=ether1

i had expected this to stop all traffic that arrived on ether1 from being forwarded across the bridge and going out ether2. However traffic continues to flow and this rule has no effect.

I have a gpg key I use through a smartcard (yubikey neo) to ssh to many hosts. Some of these hosts use certificates as well as keys to authorize logins. For normal keys that are stored locally there are three files involved:

• id_rsa
• id_rsa.pub
• id_rsa-cert.pub

I cause ssh to use the .pub and -cert.pub files together to authenticate by specifying the private key file -i ~/.ssh/id_rsa. this causes it to offer woth the public key and the certificate. like so:

debug1: Authentications that can continue: publickey
debug1: Offering RSA-CERT public key: /home/user/.ssh/id_rsa
debug1: Server accepts key: pkalg [email protected] blen 1086
debug1: ssh_rsa_verify: signature correct

when the private key is stored on the smart card there is no such file to offer, and the certificate is not sent even though the RSA key signed by the certificate is being offered:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: cardno:000XXXXXXX2

Which is rejected for lack of a signature.

/etc/resolv.conf is dynamically generated from the contents of /etc/network/interfaces, which on my system contains a line like this:

dns-servers 8.8.8.8

How do I include the default search domain with this configuration? If it matters, I'm running a pure Ubuntu Server configuration, with no X server installed.

I'm trying to set up the SPNs and create a keytab file for tomcat kerberos spnego Single sign on.

the server running tomcat7 is ubuntu-ad1.wad.eng.hytrst.com the KDC is kerberos.wad.eng.hytrust.com the domain is WAD.ENG.HYTRUST.COM im using my ad user name of [email protected] the machiene's AD account is [email protected]

first i create the spn to associate with a user name ( would love an explanation on why I need to do this?):

setspn HTTP/ubuntu-ad.wad.eng.hytrust.com [email protected]

Then I create a keytab to copy to the web server:

ktpass /out tomcat.keytab /mapuser [email protected] /crypto ALL /pass * /ptype KRB5_NT_PRINCIPAL 

then i copy it to the web server and use ktutil to merge it with /etc/krb5.keytab.

when I try to test this with kinit i can't make it successfully read from the key table:

hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab http/[email protected]
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab HTTP/[email protected]
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab [email protected]
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab ubuntu-ad1.wad.eng.hytrust.com
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab [email protected]
kinit: Key table entry not found while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab [email protected]
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit  [email protected] for [email protected]: 
kinit: Preauthentication failed while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit  [email protected]

Password for [email protected]: hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$

how does "Client not found in Kerberos database" differ from "Client not found in Kerberos database"? what do these errors really mean?

I have an ovf template sitting on an esx's local datastore and am looking to deploy it to that same data store. can I do this directly?

Had a brief outage on the NFS server which has been fixed. One of the ESX hosts cant access VMs stored on that shared volume and appears not to have it mounted.

What is the command to remount an NFS backed esx datastore without rebooting the ESX host?

How can I rename a VM on KVM+libvirt?

I would like it to change the name in the 'inventory' as well as change the name of the storage etc.

I have two scripts that watch a directory (postgres warm-standby)

one script copies compressed files into the directory and then uncompresses them.

the other script watches for the uncompressed files and then ingests them into postgres.

Im wondering if i could his a case where the ingestor script could read teh output of gunzip while it was writing it?

in short: does gunzip

1. decompress and then change name
2. copy into new name as it uncompresses
3. something else

UFW is working really well for me except in the cases where it doesn't...

I want to be able to add another rule manually that will be applied on boot?

• where should i put this rule?
• how should I make it start at boot?
• how do I make it play nicely with UFW?

I'm looking for a 'one liner' for a script that needs to:

• disable eth0.
• make it not start on boot.
• take away its IP address
• ensure that it does not try to use this address again.

I have an Ubuntu server (10.04) running nat and I understand how to forward ports using iptables which works fine and is only mildly painful. What is "the easy way" of doing this? Is there some nice wiz-bang-network-tool (like ufw) that makes simple port forwarding super simple.

when i ssh to DOMAIN\user@localhosts-name authentication works fine through gssapi-with-mic:

debug3: remaining preferred: gssapi,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 112 bytes for a total of 1255
debug1: Delegating credentials
debug3: Wrote 2816 bytes for a total of 4071
debug1: Delegating credentials
debug3: Wrote 80 bytes for a total of 4151
debug1: Authentication succeeded (gssapi-with-mic).

when I connect to a different machine It just seems to stop half way through the gssapi-with-mic authentication:

debug1: Next authentication method: gssapi-with-mic
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 112 bytes for a total of 1255
debug1: Delegating credentials
debug3: Wrote 2816 bytes for a total of 4071  <----- ????
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive

How should I go about finding out what happened differently the second time. How can I find out if/why the auth was rejected by kerberos?

for a development test bed I need to attach ANY linux machiene to a test AD Domain and do single sign on through it. Is there a Linux Distro that is easy to connect to AD?

I see lots of documentation on how to manually set up a network bridge and then manually add vm's tun devices to these bridges and then write a shell script that glues it all together. lots of work, very manual, and not impressive.

On the other hand if you want to use NAT to KVM+libvirt VMs to the network you just click the new network button in the virt-manager gui and relax.

Am I missing "the easy way" of causing a VM to share the physical network with the host?

More specifically I'm looking to get single-sign-on to work so that people on the rest of the domain can connect to this box over ssh without having to enter another password.

disclaimer: I'm a complete noob when it comes to all things Windows.

I would like to set some Ubuntu Server VM's to always pull updates (nightly) with out asking?

I'm having trouble with the title on this one, please edit.

• When users connect to a VM with VNC/NX/RDP/other-tla they get a persistent desktop in a window .

• When they connect using ssh -X forwarding they get a local window managed by the local windo-manager that is not persistent.

  1: is there a way to run a program on the VM and have it managed locally AND have it persistent?
  2: can the client be on windows or OS-X?

ps: in this case the vm's are running Ubuntu

Oooops i just typed "ip link set eth0 down" while i was sshed into a server. that ssh session is now stuck for the timeout. Is there a key I can press to kill the ssh session with out waiting for the timeout?

can I set the default GW to be the Link Local address of the next hop router. I understand this is a strange thing to do, I'm mostly wondering it is possible?

From the shell and without root privileges, how can I determine what Red Hat Enterprise Linux version I'm running?

Ideally, I'd like to get both the major and minor release version, for example RHEL 4.0 or RHEL 5.1, etc.