Ryaner's questions

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups

+ : @hostname-granted : ALL

Putting tuples in ldap work for usernames

(,test_user,)

Meaning 'test_user' would be granted access into the host.

nisNetgroups also support memberNisNetgroup for nested netgroups. This works too and will find users in the subgroups.

The issue we have is if we specify another ldap backed posixGroup, the lookups fail to find any users as they are looking for a netgroup and don't find the group.

We are using sssd, these are the debug logs of the lookup from it

(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_attrs_add_ldap_attr] (0x2000): Adding original DN [cn=hostname-denied,ou=host access policy,ou=Groups,dc=demonware,dc=net] to attributes of [hostname-denied]
.
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_attrs_add_ldap_attr] (0x2000): Adding netgroup triple [(,test_user,)] to attributes of [hostname-denied].
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_attrs_add_ldap_attr] (0x2000): Adding original members [test_group] to attributes of [hostname-denied].
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_attrs_add_ldap_attr] (0x2000): Adding members [test_group] to attributes of [hostname-denied].
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_save_netgroup] (0x0400): Storing info for netgroup hostname-denied


(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_netgroups_next_base] (0x0400): Searching for netgroups with base [dc=example,dc=com]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_print_server] (0x2000): Searching 192.168.1.2
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(cn=test_group)(objectclass=nisNetgroup))][dc=example,dc=com].
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberNisNetgroup]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nisNetgroupTriple]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 3
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x2245480], connected[1], ops[0x2251ca0], ldap[0x22683f0]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Fri Oct  2 11:42:08 2015) [sssd[be[LDAP]]] [sdap_get_netgroups_process] (0x0400): Search for netgroups, returned 0 results.

Is there any way to get pam_access to lookup the users in the posix groups when the groups are set in the nisNetGroup? I know I can add the posix groups directly into the pam_access referenced file, but that isn't a workable option.

We have some scripts that run to detect long running processes. It works using ps and etime

e.g

ps -eo uid,pid,etime

This part works fine except that occasionally we get an etime back with an invalid format

2000 20453 1158050441-07:00:15 sh

All of the processes this happens to are short lived so I haven't caught one to investigate.

I'm very interested to why the format is coming out like this and why that epoch.

In case it helps, its a Debian Linux system running a 2.6 kernel.

I'm looking at have exim redirect a subset of mail to one of our smarthosts based on the looked up mx record. Currently I can do this by specifying all of the domains and using a manualroute router, but I'd like it to be automatic going forward.

Example:

DNS => Domain1.com in mx 10 subhost.outdomain.com

Exim would then need to have a condition in the manualrouter based on that mxdomain.

Anyone know how to do this without an external script? Exim already knows the mx_domain while processing so it should be about to do it.

Since we are looking at migrating our domain admins to use non domain-admin accounts and runas for admin tasks a discussion has begun.

How do others use RSAT with runas? I know you can Shift+RightClick run as other user to launch it with admin rights, but it looses the icon on the taskbar.

The question also has been put, why do Microsoft release the RSAT tools if they recommend admins to run using non-domain accounts.

Edit: Further to this, some of the initial testing with RSAT via the run as other user command hasn't worked out well. Few of the options don't function in the Hyper-V and Failover Cluster Manager.

Some background information first. We run a split horizon dns setup. So publicly entry.ourdomain.com goes to 123.123.123.123 (Public Address) and internally, entry.ourdomain.com goes to 10.1.1.1 (Internal Address). The zone for ourdomain.com is integrated into AD for replication. For this problem, we have two sites, siteA and RemoteSiteB. The two are connected via a site-to-site vpn so users can access both internal and external addresses.

What we want is to have users in RemoteSiteB go to the public address for particular entries on our domain, but only in that site.

Is there any way to achieve this without putting the zone back to an non integrated AD one? Doing so looses all the replication features.

Servers are all 2008R2 in case that makes any difference.

Edits for clarity. This is the DNS responses I'm looking to achive

SiteA DNS:
entry.ourdomain.com -> 10.1.1.1
entry2.ourdomain.com -> 10.1.1.2

RemoteSiteB DNS:
entry.ourdomain.com -> 123.123.123.123
entry2.ourdomain.com -> 10.1.1.2

First let me state that the mail server is working fine and users can connect and send email.

Basically there is a local web script connecting into the mail server trying to send mail every few minutes. It has the wrong password. Problem is we don't know what script is connecting in so we are looking for a way to get the username which is being tried.

UGFzc3dvcmQ6 - decodes to Password: so isn't much help. A full log line is below.

Dec 11 20:15:37 HOST postfix/smtpd[642]: warning: HOST[x.x.x.x]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Server is running Debian/Postfix/Dovecot.

I need to expose Active Directory, or at least the address book functions on the internet for some mail clients and other devices. The standard response is to simply not or vpn in, however VPN isn't an option for us with some of the hardware devices.

A number collages expose their setups out to the internet so I'm assuming there has to be a safe way of doing it. Best option I've come up with to install a linux ldap host, then hourly sync over the relevant contact information however that seems like major overkill.

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones.

Is there someway to see when the last time a machine logged onto the network? Either via dhcpd or a user login event or something else.

We are trying to get one of our users connected to our Exchange 2003 server using the HTTP method as they already have an existing Exchange account on another server.

The setup goes through and they appear to get connected fine however none of the subfolders are listed. Instead we get one folder of "Error-Pls file a Bug". The usual Google search just throws up nothing useful.

Does anyone know how to fix this? Or has anyone actually gotten Outlook (2003 or 2007) to connect to an Exchange 2003 server?

Basically I need to be able scan the process tree and find processes that match a certain name and started running more than a week a go. Once I have them, I need to kill them. All the processes are still seen as in a running state by the system, just not using any system time. They'll usually sit forever in this state too.

Ideally I'd like something similar to find, but for processes.

System is Debian linux and this will be scripted and run by cron so I've no real issues with something large but understandable.

One one of our file servers I keep getting delay write failures to the OS disk array. Its built on a Raid1 array using an on-board raid card.

So far I've verified both harddisks are ok by pulling from the machine and doing full disk checks. (Obviously not at the same time) The write failures still happen with only one disk present and will not complete a check disk when in the server.

How do I go about checking that it definitely is the raid card or is what is done enough to safely say it is the card? Bare in mind that a faulty card means a motherboard swap.

Thanks

We have and Rsync server install on one of our fileservers and we pull nightly backups from it to a linux based machine that does archiving and backup rotation stuff.

Recently I've noticed that the Rsync user can not access certain files on the server. The service is running as a local user which is part of the backup operators group. I had thought that anyone in this group got full access to everything however recent results are telling me this isn't the case.

Is there anyway around this to get the rsync full access? Changing file ownership isn't an option. Adding permissions issue an option unless it can be done to all files without affecting other existing permissions.

We have all our computers currently in the root OU for computers. I'd like to start cleaning this up so I can track changes going forward. (Currently too many people have the admin password but that's another issue)

If I create a sub OU for say servers, and then move all the server into it, another for users that I know exist, another for very old system machines etc will there be anything noticeable from the user side of things?

We currently have no working GPO's assigned to the groups and the remaining ones are being checked and removed so I don't think that'll cause any issues.

We custom build up our PHP installs due to some historic reasons and it gets installed into our custom compile of Apache.

We are now trying to get Fileinfo to load into the PHP build and have tried the usual Pecl install fileinfo and enabling it in the php.ini but it hasn't worked.

Even stranger is that fileinfo shows in phpinfo() output just doesn't list any versions. Trying to run the base finfo functions gives the following error

Fatal error: Class 'finfo' not found

System is Debian Linux. PHP is 5.2.10. We are unable to move to 5.3.0 due to Joomla not working with it.

If anyone can direct us to what could be causing this it'd be much appreciated.

I'm looking at giving my users the ability to reboot their virtual machines but no power them off. GPO does allow me to remove the shutdown but this then hides the reboot option too.

If this isn't possible, how do you handle people powering off their virtual machines accidentally? (Exclude the fact that I'm letting people manage their own machines, I'm IT for 90+ users across 5 countries by myself so have to cut some corner)

Is there an easy way to delete multiple tables in the database without dropping the database and recreating it? In this case we have over 100 to remove.

I am happy enough to remove all user tables and reimport the needed data but can't touch any of the database security settings.