dyasny's questions

First of all, I am not looking for a product recommendation (well, I am, but it's more like me looking for a solution to a problem and not trying to pick something from an existing list)

The environment: I am using Jenkins to run a complex, multi-stage jobs. The job creates and provisions servers, deploys the OS and the application stack on them, populates the stack with demo data, runs standard tests, then some additional negative tests, then scales the stack with some more provisioned servers and runs some more tests.

The problem: At any one of these stages a failure might occur, either just a reporter misconfiguration or a complete failure for a step. Either way, I can do one of two things in Jenkins - exit(1) or keep going, dumping the problem to the console. Both aren't great because I will end up with either a broken incomplete job (if I exit) or with a nice green false positive, where in order to make sure it's actually green I have to read a few megs of log dumps from the console.

What I'm looking for: A way for Jenkins or some other system, to be able to monitor and report the success/failure of each step in a job separately, maintaining the job consistency (e.g. I cannot start a new job for each step), so that I can see, for example, that provisioning and OS deployment worked, stack deployed with errors but completed, and negative tests failed, instead of the current green/red status per run with no detail unless I go in and read the logs

Any suggestions are welcome, whether it's for a plugin for Jenkins I'm not aware of, or to another system, or whatever else.

I have exported an existing certificate+key from an ASA 5510:

asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD

Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to pull the cert and the key into separate files like so:

openssl pkcs12 -in cisco-vpn.pkcs12 -nocerts -out privateKey.pem

The error I receive:

139708630054816:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1319:
139708630054816:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=PKCS12

Same error if I run openssl pkcs12 -info ... or any other command.

I have tried to export the file again and compare using ASDM instead of the CLI, but the file is exactly the same.

Googling for the error only says the encoding of the file might be somehow off, but no specific details.

EDIT (7 years later): I came across the same issue again, having to maintain an ASA and a Zimbra setup using the same certs, and came across my own question as the working answer.

Extra thanks for all the additional input like needing to sanitize the p12 file for empty lines etc.

EDIT 2: PKCS12 export from the ASA encrypts the private key, ZCS isn't happy with that, so the password needs to be dropped, so first extract the key:

openssl pkcs12 -in cisco-vpn.pkcs12.bin -nocerts -out privateKey.pem

And then drop the password:

openssl rsa -in privateKey.pem -out key_no_pass.txt

I have a large-ish AD setup, where one of the already fired admins, for reasons unknown deleted the subject group.

Been googling for a while, but besides explanations what the group is for and warnings not to delete it I couldn't find anything.

The SID is known, so I wonder if I create a new group with the same name and SID, will that be enough to un-break the setup, or could the group deletion cause AD schema wreckage?

A set of steps on fixing this (besides finding the genius who did it and causing severe injuries) is more than welcome

Thanks

I have two Dell R515 servers running CentOS 6.5, with one of the broadcom NICs in each directly attached to the other. I use the direct link to push backups from the main server in the pair to the secondary every night using rsync over ssh. Monitoring the traffic, I see throughput of ~2MBps, which is much less than I'd expect from a gigabit port. I've set the MTU to 9000 on both sides, but that didn't seem to change anything.

Is there a recommended set of settings and optimizations that would take me to the maximum available throughput? Moreover, since I am using rsync over ssh (or potentially just NFS) to copy millions of files (~6Tb of small files - a huge Zimbra mailstore), the optimizations I am looking for might need to be more specific for my particular use case.

I am using ext4 on both sides, if that matters

Thanks

EDIT: I've used the following rsync options with pretty much similar results:

rsync -rtvu --delete source_folder/ destination_folder/

rsync -avHK --delete --backup --backup-dir=$BACKUPDIR source_folder/ destination_folder/

Currently, I'm looking at the same level of bad performance when using cp to an NFS export, over the same direct cable link.

EDIT2: after finishing the sync, I could run iperf and found performance was around 990Mbits/sec, the slowness was due to the actual dataset in use.

I am struggling with an HP machine that has an iLO card that for some reason has gone off the radar. I can ping the card, but that's pretty much everything I can do with it. The host is running a trimmed down version of RHEL5.8, so I can't install the HP native utilities, I can use ipmitool though.

So far, I have been able to reconfigure ther card's IP address usinf ipmitool set 2 ipsrc static and the rest of the commands to configure the IP, gateway, netmask etc, and the card is now pingable. Here's what it looks like:

# ipmitool lan print 2
Set in Progress         : Set Complete
Auth Type Support       :
Auth Type Enable        : Callback :
                        : User     :
                        : Operator :
                        : Admin    :
                        : OEM      :
IP Address Source       : Static Address
IP Address              : 10.1.0.36
Subnet Mask             : 255.255.0.0
MAC Address             : 78:e7:d1:62:4e:c0
BMC ARP Control         : ARP Responses Enabled, Gratuitous ARP Disabled
Default Gateway IP      : 10.1.255.254
802.1q VLAN ID          : Disabled
802.1q VLAN Priority    : 0
Cipher Suite Priv Max   : Not Available

So I go ahead and try to configure access like so:

# ipmitool lan set 2 auth ADMIN MD5
# ipmitool lan set 2 access on
Set Channel Access for channel 2 failed: Unknown (0x83)

Has anyone experienced this before? What can I do to reset the iLO and get back to having access to it?

Thanks, /me

EDIT:

# nmap -p0 10.1.0.36

Starting Nmap 5.51 ( http://nmap.org ) at 2013-11-18 03:35 CET
Nmap scan report for host-ilo.mydomain.com (10.1.0.36)
Host is up (0.00017s latency).
PORT  STATE    SERVICE
0/tcp filtered unknown
MAC Address: 78:E7:D1:62:4E:C0 (Hewlett Packard)

Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds

I have a strange issue on an Exchange 2010 Version: 14.03.0158.001 (latest to date). The receive connector is set up correctly, with anonymous users checked, but still, I can receive mail from some servers (like gmail and some hosts I have access to) both plaintext and TLS, but from some other hosts, that are perfectly legit and support TLS and plaintext too, I get the error in $subject. The logs show the same things I can see if I try to send email manually via telnet.

The only thing that changed recently was a DST switchover yesterday, but the host is set to UTC-7 and seems to be bang on

here's a set of failed and passed comms:

"220 mail.exchange.ca Microsoft ESMTP MAIL Service ready at Mon, 4 Nov 2013 15:44:28 -0700",
EHLO cantsend.com,
250-mail.exchange.ca Hello [1.2.3.4],
250-SIZE 10485760,
250-PIPELINING,
250-DSN,
250-ENHANCEDSTATUSCODES,
250-STARTTLS,
250-AUTH LOGIN,
250-8BITMIME,
250-BINARYMIME,
250 CHUNKING,
MAIL FROM:<[email protected]> SIZE=1095 BODY=7BIT,
530 5.7.1 Client was not authenticated,

"220 mail.exchange.ca Microsoft ESMTP MAIL Service ready at Mon, 4 Nov 2013 15:46:04 -0700",
EHLO cal1-mh747.smtproutes.com,
250-mail.exchange.ca Hello [192.69.16.69],
250-SIZE 20971520,
250-PIPELINING,
250-DSN,
250-ENHANCEDSTATUSCODES,
250-STARTTLS,
250-AUTH,
250-8BITMIME,
250-BINARYMIME,
250 CHUNKING,
MAIL FROM:<[email protected]> SIZE=78604,
08D0A7BE5BCEFE28;2013-11-04T22:46:04.886Z;1,receiving message
250 2.1.0 Sender OK,
RCPT TO:<[email protected]>,
250 2.1.5 Recipient OK,
DATA,
354 Start mail input; end with <CRLF>.<CRLF>,
Tarpit for '0.00:00:31.033' due to 'DelayedAck',Expired;Timeout
250 2.6.0 <[email protected]> [InternalId=18696] Queued mail for delivery,
QUIT,
221 2.0.0 Service closing transmission channel,

Here's the background: A company has a CAO user, that gets taken over by a new CAO. Basically - a name on the account was changed in AD, while the login "CAO" and the email addy "cao@..." remained the same. Old CAO's name was Theresa, the current guy is called Brian. Software: Exchange 2010, Outlook 2010, Win7pro, standard settings for everything.

Everything works great except for two very annoying things in outlook 2010:

1. In sent items, the name above a shown sent email is Theresa and not Brian (see screenshot)
2. When printing email from outlook, the name in bold letters above the printout is also Theresa's.

When I hover above "Theresa" in the outlook sent items view, the info box shown is actually saying "Brian".

So far I have done the following:

• Checked through OWA - no issue there
• Rebuilt a new offline address book and made it default
• recreated the outlook profile
• wiped the entire local user profile and rebuilt that from scratch

The fact that OWA doesn't have this problem, tells me it's got to be a local or offline issue, but I have rebuilt the local profile with only the data outlook can possibly get from exchange, no local PSTs, and while it showed up properly for a few minutes at first, we've got Theresa back in out face shortly after.

Please help :)

A basic Centos6 setup, SElinux and iptables completely off. In a small office network, where the samba share is used to share documents between 10 users and their windows 7 machines.

No AD in place, just samba based users set for all the windows folks. No DNS in the network, all the users have a static mapping to \\IP\share of the samba host.

This works fine as long as there is internet access, however, when the router goes down, suddenly none of the users can reach \\IP\share - it simply times out.

All IPs are given out by the DHCP server in the router, with very long leases, the centos IP is static. All the stations, including the samba host use the google DNS IPs, however, I don't see why it should matter, when I use naked IPs for smb access, but it seems like this is where things fail when I have no internet in place.

I wonder if anyone has had this issue, and there's some option in smb.conf hidden away, to disable DNS checks or whatever

Thanks

I am working on enhancing a BI platform, plugged into a bunch of stats gathered from a virtual datacentre (based on Jasper, but this shouldn't really make a difference).

So far, I have 4 hypervisors and a few TB of storage, so I can bring up probably up to 100 (more or less) beefy VMs.

what I want to do is basically simulate a heterogenous DC with different Linux and Windows servers that are puffing away at their daily routines, with monday morning effects and incidental peaks, and idle time too of course. All that, to gather enough pseudo-live data in the BI server, so I can start working on what data is missing, what reports make sense to develop and so on.

I would like to gather some opinions on how to simulate a real working DC, from what services I would require, to how to properly stress them, and what to expect from these stress tests (so I can verify it in the stats later on)

So far I have an email server, directory (AD and IPA), DHCP, monitoring (nagios). I will want a couple of DB servers (postgres and MSSQL probably), maybe a dozen VDI desktops of various kinds...

Any ideas you throw my way would be great, both in terms of the servers that it would make sense to have in this demo lab, and in terms of how to stress them in a measurable way.

I am planning to deploy a ZCS machine in a remote DC on colocation. Using the latest Community edition Hardware:

• 2x SAS disks for OS in raid1,
• 8x SAS disks in raid10 for Zimbra,
• 32Gb RAM 8 CPU cores

Requirements:

• Normal system functionality
• Everyting must be encrypted (currently considering the standard LUKS)
• Backup to another machine in the same DC, not using 3rd party software
• The possibility of a fast restore to another machine in case of failure. Replication to a standby machine would be even better

Questions:

• Any comments on the hardware?
• How much of a performance hit would the encryption mean?
• Which of the existing backup scripts is preferable? I need the possibility to restore up to 1-2 months back, weekly full, and daily incrementals would be grand. Brick level - extra plus
• What other DR options are available? What about HA?
• How is the installation done in this case? Simply use /opt as the mountpoint for the raid10, or..?
• Which of the supported OS is the most stable and easy to maintain with a large number of mailboxes? I am kind of disappointed in CentOS, anyone aware of how SL performs?

Any additional comments or anything I might have missed also welcome

This is more of a theoretical question and request for advice and pointers than a question about specific software.

I have a distro-agnostic Linux machine (meaning I don't really care what to put in there atm), which I intend to place in a DC somewhere, where the location is not very secure (long story why), and where there is a risk of the server being physically removed and opened up for data extraction.

Is there a way to make life hard for the hackers even if they have the option of pulling the hard drives out, and basically doing whatever they want to them? The software in question is some locked down websites, user files, mysql db etc, all pretty standard stuff for a LAMP machine.

All that comes to mind is to encrypt the entire FS (no problem to add better spindles and more CPU muscle for that), but is there anything besides that?

Running ESXi4.1 on an HP machine, with only remote access to the host ssh shell and the vmware console (no iLO), is there a way to gather a hardware report from the server? I am specifically interested in finding out whether the disks are SAS or SATA, and whether the p410i controller is equipped with NVRAM and a battery.

Obviously, this being a VM host, rebooting is the last resort (especially since I'm remote to the machine).

I'd also appreciate a pointer to a LiveCD I could use with this machine (in case I do have to restart it) which I could pass on to the person local to the host, so they can boot the system with the CD, gather a report, and send it over to me.

Thanks

UPD: here's a screenshot of what things look like atm:

I guess this means this ESXi has no HP-specific packages, and I need to look for another way? Or am I looking in the wrong place?

A user has a set filter, not to show already read mails in outlook. The filter is mandatory for the user. The user also can access the mailbox using his blackberry (the BES is at the mercy of the mobile provider, and it connects to my Exchange using sPOP3)

When the BB phone connects, the emails are automatically marked as "read" which of course means the user will never see them in the Outlook inbox.

The question is how I can prevent this marking as read, so no email is missed in Outlook, without access to the BES (and the provider refuses to make any changes there). A way to mark anything pulled out via POP as unread will also work for me of course. I couldn't find a setting in the BB phone itself to prevent marking everything as read.

Versions: Outlook 2007 / Exchange 2010

UPD: after opening up IMAP the issue is resolved. Thanks to everyone who responded

I need to find a way to autotest a small RDS deployment for ~50 users, working in a set of RDS session hosts. The users are going to be mainly running MS Office 2007 - Excel, Word, Outlook (connected to Exchange 2010)

Is there a known set of scripts or software I can freely use?

Thanks

I have a central setup with EX2010 and with a separate system as an edge transport, serving email addresses for aa.domain.com and domain.com. For some reason, this means I am unable to send email to another domain, hosted externally for now, called bb.domain.com

I'd be grateful for any pointers, whether on how to troubleshoot this, or how to configure this properly

VERBOSE: Connecting to EXCHANGE01.domain.com [exchange01.domain.com]
Connecting to remote server failed with the following error message : The WinRM client can not process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid. For more information, see the about_Remote_Troubleshooting Help topic.
+ CategoryInfo : OpenError:
(System.Manageme....RemoteRunspace:RemoteRunspace)
[], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailed

This is what I get in the shell, something similar I see when I try to login to the GUI googling provides a lot of information, mosly irrelevant. For example http://msexchangeteam.com/archive/2010/02/04/453946.aspx has a lot of info, but the described options do not appear in my system at all (the powershell part in IIS has no KerbAuth option at all)

UPD: fixed by removing and installing the WinRM feature

I have purchased BE 2010, an SQL agent, an Exchange 2010 agent and 12 server agents. Symantec gave me a link to their website, but no matter with which serial number I log in, I get the same download page, for a DVD image (or a set of divided part-files to assemble a DVD image).

Any idea if all I need is on there, or am I missing something?

Thanks

I ave already gone through How to prevent Windows from safely removing hardware? and it has a registry based solution for WinXP, however what I am after is: 1. a GPO based solution
2. windows 7, 2003 and 2008 as well

thanks

UPD: tried

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MYDEVICE] 
"DisableRemovable"=dword:00000001 

doesn't work for me

I am using a RHEL server with a few hard drives, and tgtd as the iscsi target software. I a looking for a way to allocate and deallocate space and targets with that space, without restarting my system, or harming other LUNs.

Currently, all my HDDs are PVs in a single VG, and I lvcreate/lvremove as required, and then export the allocated LVs using a tgt script:

usr/sbin/tgtadm --lld iscsi --op new --mode target --tid=1 --targetname iqn.2001-04.com.lab.gss:300gb
/usr/sbin/tgtadm --lld iscsi --op new --mode logicalunit --tid 1 --lun 1 -b /dev/mapper/iscsi_vg-iscsi_300Gb
/usr/sbin/tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL

/usr/sbin/tgtadm --lld iscsi --op new --mode target --tid=2 --targetname iqn.2001-04.com.lab.gss:200gb
/usr/sbin/tgtadm --lld iscsi --op new --mode logicalunit --tid 2 --lun 1 -b /dev/mapper/iscsi_vg-iscsi_200Gb
/usr/sbin/tgtadm --lld iscsi --op bind --mode target --tid 2 -I ALL

/usr/sbin/tgtadm --lld iscsi --op new --mode target --tid=3 --targetname iqn.2001-04.com.lab.gss:100gb
/usr/sbin/tgtadm --lld iscsi --op new --mode logicalunit --tid 3 --lun 1 -b /dev/mapper/iscsi_vg-iscsi_100Gb
/usr/sbin/tgtadm --lld iscsi --op bind --mode target --tid 3 -I ALL

tgtadm --mode target --op show

So in order to remove a LUN, I stop the tgtd service, lvremove the lv, and remove the entry from the iscsi target script
When I add a lun, I run lvcreate, and then add an entry to the script and run it.

This is not quite optimal, since restarting the service is a bad idea while other LUNs are busy, so I am looking for a more scalable and safer way.

Thanks

I am installing a large number of Linux systems (RHEL5), from a preconfigured image. If I run sys-unconfig in that image before I distribute it, upon the first run of the imaged system, I get asked a lot of questions - hostname, IP, etc.

My question is how to pass the answers to those questions automatically, the way I would pass an answer file to a fresh sysprepped windows build