tomfanning's questions

I'm trying to block/allow access to a particular vhost based on string matching of the HTTP user agent name.

The version number of the application in the HTTP user agent changes, e.g.

My%20App/1.55.01 CFNetwork/711.5.6 Darwin/14.0.0
My%20App/1.49.03 CFNetwork/711.5.6 Darwin/14.0.0
My%20App/1.35.02 CFNetwork/711.5.6 Darwin/14.0.0

I want to match everything starting with My%20App/ - anything that matches should be allowed access, anything else should get HTTP 403.

I don't want to have to update the nginx config every time a new version of the app comes along.

The following works fine:

if ($http_user_agent !~* "My%20App/1.55.01 CFNetwork/711.5.6 Darwin/14.0.0") {
    return 403;
}

I figure I need a solution that involves hat (^) for "starts with" but I can't get nginx to accept anything I've tried.

Thanks in advance.

Is anyone able to confirm whether the Dell H310 RAID controller will happily live in a PowerEdge 2950 III?

It's a PCI Express 2.0 8x card. I see reports of the H700 in the 2950, which is the same type of card, but no direct reports of the H310.

Given my four disk RAIDZ1, one disk has become physically noisy, not producing errors yet, but not sounding healthy either. So I've chosen to pre-emptively replace it.

I have done:

zpool offline tank0 ad6

Shutdown, remove and replace disk

zpool replace tank0 ad6 ad6

which hangs forever.

zpool status also hangs forever, as does zpool history.

If I reboot the machine with the disk removed, everything works fine, in degraded mode as expected.

What do I do now? Worried because my data is now vulnerable to a single disk failure.

OS is FreeBSD 7.3-RELEASE-p1 - a.k.a. FreeNAS 7.0.2.5226

I have just tried the same operation in a VM, albeit FreeBSD 7.3-RELEASE-p7 (FreeNAS 0.7.2.8191, slightly later version) - works perfectly. Trying with the oldest version of FreeNAS I can find now (7.0.2.5799) and will update later.

Also, does zpool replace require no filesystem usage? There's a possibility that another daemon on the NAS is using the filesystem. I assume this would be OK but this may of course be wrong.

Update, 2012-01-10

I booted the machine with FreeNAS 8 and did the zpool replace - which started, and immediately started throwing piles of data corruption errors and kernel panics - despite a weekly scrub of the pool never finding any issues. I don't think I did anything stupid like tell it to replace the wrong disk. I immediately issued shutdown -h since I know the data was just fine.

Anyhow, I now have a degraded pool, stuck in a state where the replace is suspended, and I am copying my data off to a 3TB external drive, bought at great expense, so I can destroy the pool and start again. Thankfully, the data looks okay - I happen to have md5sums of about 100GB of the files, which so far seem to be intact, and I have managed to recover everything that is truly irreplaceable.

I am now waiting for more RAM to arrive since FreeNAS 8 keeps panicing with kmem_max too small errors, which I don't seem to be able to tune around, and the machine was RAM constrained (1 GB RAM for a 4TB RAIDZ1).

Hard lesson learned about backups, but also confidence in ZFS/FreeNAS/FreeBSD really knocked.

UPDATE 13/1/12

Well my data appears to be safely backed up now.

zpool status -v hangs even with failmode set to continue. Here's the output of zpool status, with the new disk plugged in (ada1)

  pool: tank0
 state: DEGRADED
status: One or more devices has experienced an error resulting in data
        corruption.  Applications may be affected.
action: Restore the file in question if possible.  Otherwise restore the entire pool 
        from backup.
   see: http://www.sun.com/msg/ZFS-8000-8A
 scrub: none requested
config:

NAME                       STATE     READ WRITE CKSUM
tank0                      DEGRADED     0     0     0
  raidz1                   DEGRADED     0     0     0
    ada2                   ONLINE       0     0     0
    ada3                   ONLINE       0     0     0
    ada0                   ONLINE       0     0     0
    replacing              DEGRADED     0     0 3.17K
      6540253751212815210  UNAVAIL      0     0     0  was /dev/ada3/old
      ada1                 ONLINE       0     0     0

errors: 3130 data errors, use '-v' for a list

With the old disk plugged in instead of the new one, ZFS won't import the pool, and zfs status says:

tank0          UNAVAIL insufficient replicas
  raidz1       FAULTED corrupted data
    ada2       ONLINE
    ada3       ONLINE
    ada0       FAULTED corrupted data
    replacing  UNAVAIL insufficient replicas
      ada1     FAULTED corrupted data
      ada1     FAULTED corrupted data

I don't see why ada0 should be FAULTED with the new disk (ada1) plugged in but ONLINE with the old disk plugged in? I don't see how ada0 is even related.

Let's try to recover this pool as a learning exercise.

I have a zpool (pool verion 13, FS version 3, called tank0) with about 2.5TB of data in the root of the pool (i.e. directly in /mnt/tank0). OS is FreeBSD, actually FreeNAS version 0.7.2.

I would like to move all of that data to a child filesystem (i.e. one created with zfs create tank0/work) in line with best practice (that I know now).

Not too bothered about keeping the snapshots, but I am bothered about ensuring continual data integrity. I am also space constrained - not enough disk space to just backup and restore to the new location.

Is this possible? Guidance appreciated.

Going to completely rephrase this question since it's still an outstanding production issue several months later.

I have a FreeNAS 0.7.2 box, based on FreeBSD 7.3-RELEASE-p1, running ZFS with 4x1TB SATA drives in RAIDz1.

I appear to have lost 1TB of usable space after creating and deleting a 1TB sparse file. This happened months ago.

This table lays out the situation as it stands.

command         actual             expected           ok/not ok

du -c           1.47TB used        1.47TB used        ok

zfs list        used 2.48TB        used 1.47TB        not ok
                avail 206GB        avail 1.2TB        not ok

zpool list      size 3.64TB        size 3.64TB        ok
                used 3.31TB        used 1.95TB        not ok
                avail 334GB        avail 1.69TB       not ok

Windows right   Disk size 2.67TB   Disk size 2.67TB   ok
  click disk,   Used 2.47TB        Used 1.47          not ok
  properties    free 206GB         free 1.2TB         not ok

Windows select  total file size    total file size
  all files,      1.48TB             1.48TB           ok
  right click, 
  properties

• No snapshots anywhere in the pool
• Compression is off
• De-dupe is off
• ZFS pool verion is 13
• ZFS FS version is 3
• Using the "embedded" version of FreeNAS
• File was created with dd using /dev/zero as input, deleted using rm, all as root
• File has definitely been deleted
• Windows can see the folder via SMB
• Windows version is 7
• Not sure how to determine whether the bug suggested by an answerer below has been resolved in the ZFS pool and FS versions in the FreeBSD I am using

Ask away any questions you like, I can get shell on the box from anywhere.

Really appreciate any advice or thoughts. Tom

I am trying out FreeNAS 0.7.2 Sabanda (revision 5226) with 4x1TB disks, single parity ZFS RAID.

While the email reports built into FreeNAS are good, I was wondering if there was a way I could get it to email me immediately if a disk fails or does anything suspect, since I can only tolerate a single disk failure.

Any ideas gratefully received.

(note: reposted from superuser.com on the recommendation of a commenter over there)

I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant.

Specifically, this involves disabling all SSL protocols other than TLS 1.0.

I have set the following registry keys:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server

to Enabled(DWORD) = 0 as per this KB, but SSL Labs' checker says "SSL 2.0+ Upgrade Support" is enabled. (Everything other than that and TLS 1.0 is not available, so we're getting somewhere). It also says "FIPS ready - no" - presumably because SSL 2.0+ Upgrade Support is still enabled.

serversniff.net says SSL 2.0 is turned off, and doesn't say anything about SSL 2.0+ Upgrade Support. Could this be an anomaly with SSL Labs' checker?

I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only.

I have come up with the following list of cipher suites which I have deduced are TLS 1.0.

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA

I have put that list in the box in the following policy: Computer Configuration | Administrative Templates | Network | SSL Configuration Settings | SSL Cipher Suite Order

Is that sufficient? Are any of the suites in my list not TLS 1.0? Are there any other TLS 1.0 suites supported by IIS7 that aren't in the list?

The server, by the way, is Windows Server 2008 R2.

Thanks

I am running Ubuntu Server, pretty recent, which is set up as a NAT router.

I have an iptables script that runs during boot to set up NAT, port forwarding etc.

I am trying to diagnose an unrelated problem with the box, but /var/log/messages, /var/log/syslog and /var/log/kern.log are all flooded with messages from iptables like this:

Oct 21 11:25:27 skip kernel: [39380.812663] INPUT packet died: IN=eth1 OUT= MAC=00:40:63:d9:7c:5b:00:03:fa:a9:d7:4a:08:00 SRC=24.207.21.237 DST=94.192.123.123 LEN=111 TOS=0x00 PREC=0x00 TTL=54 ID=16494 PROTO=UDP SPT=48865 DPT=20663 LEN=91

I can't find any documentation that makes it clear how to change the way iptables logs output. What I ideally want is for NONE of the iptables stuff to go to any of the above files, but instead to /var/log/iptables.

I need to create an NS record for a domain that is a CNAME, for the purpose of having two domains pointed at one IP, and not having to maintain the current IP address in two different places.

The DNS provider for this domain is DynDNS, but they block this operation:

CNAME cannot be created with label that is equal to zone name

I can do this with another domain whose DNS is served by 1and1:

root@srv-ubuntu:~# dig myseconddomain.co.uk

; <<>> DiG 9.4.2-P1 <<>> myseconddomain.co.uk
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61795
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;myseconddomain.co.uk.             IN      A

;; ANSWER SECTION:
myseconddomain.co.uk.      71605   IN      CNAME   myfirstdomain.co.uk.
myfirstdomain.co.uk.     59      IN      A       www.xxx.yyy.zzz

;; Query time: 298 msec
;; SERVER: 10.0.0.10#53(10.0.0.10)
;; WHEN: Tue Aug 18 14:17:26 2009
;; MSG SIZE  rcvd: 78

Is this a breach of the RFCs or does DynDNS have a legitimate reason for blocking this action?

Followup Thanks to the two answers already posted I now know that 1and1 IS breaching RFCs to do this. However it does work and they seem to support it. For a company that hosts so many domains it seems very odd that they get away with doing this on such a massive scale without objection.

More followup

The output of "dig myseconddomain.co.uk ns" as requested.

root@srv-ubuntu:~# dig myseconddomain.co.uk ns

; <<>> DiG 9.4.2-P1 <<>> myseconddomain.co.uk ns
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18085
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
; myseconddomain.co.uk.             IN      NS

;; ANSWER SECTION:
myseconddomain.co.uk.      4798    IN      NS      ns67.1and1.co.uk.
myseconddomain.co.uk.      4798    IN      NS      ns68.1and1.co.uk.

;; ADDITIONAL SECTION:
ns67.1and1.co.uk.       78798   IN      A       195.20.224.201
ns68.1and1.co.uk.       86400   IN      A       212.227.123.89

;; Query time: 59 msec
;; SERVER: 10.0.0.10#53(10.0.0.10)
;; WHEN: Wed Aug 19 12:54:58 2009
;; MSG SIZE  rcvd: 111

I am trying to set up a proof-of-concept demo for deploying applications via RemoteApp, the application-streaming-over-RDP stuff in Windows Server 2008.

The TS Gateway server (call it srv-web) and the box hosting the applications (call it srv-app) are two different boxes.

The connections need to come through a TS Gateway server over HTTPS, as srv-app is on an internal LAN behind NAT.

Only srv-web is exposed to the internet, and only port 443 (HTTPS) is open.

If I ignore/accept the various warnings, the connection works perfectly well.

The object here is to get things working as smoothly as possible for our clients.

I have an SSL certificate installed on both srv-web and srv-app. srv-web is set up to use it for TS Gateway, and that works fine. The CN of the certificate matches the external public hostname.

The warning I am getting is as follows (I have doctored the real hostname out of the screenshot)

My question, I suppose, is how to I choose the SSL certificate srv-app uses to provide proof of its identity to connecting clients?

EDIT: I found where to set this - it's in Remote Desktop Session Host Configuration -> RDP-Tcp properties, general tab at the bottom.

However I have another problem, somewhat predictably I now have a mismatched server name:

I suspect this is going to require a topology change somewhere. Feedback from someone who's already done this would be great.

EDIT 2: I have worked around this by setting the following option in Custom RDP Settings.

authentication level:i:0

However this isn't a satisfactory solution as it is just disabling the check. I would still appreciate any more feedback on this.

Many thanks.

So - we have an internal company database, the usual kind of stuff: manages clients, phone calls, sales deals and client agreements/schemes.

It's an Access 2000 front-end, and an SQL Server 2000 Standard back-end. Single server, dual Xeon 3.2GHz, 2GB RAM, Windows Server 2003, gets about 40% CPU load all day, spread across the 4 cores visible to the OS (HT).

The back-end database is poorly designed, and has organically grown over 10+ years, maintained by less-than-skilled individuals. It is badly normalised, and some of the obvious problems include tables with tens of thousands of rows with no primary key or index, which are also used heavily in multi-table joins for some of the most heavily used parts of the system (e.g. a call manager application that sits on everyone's second monitor for 8 hours a day and runs a big inefficient query every few seconds).

The front-end is not much better, it's the typical mess of hundreds of forms, nested saved queries, poorly written embedded SQL in the VBA code, dozens of "quirks" etc, and whenever a change is made something unrelated seems to break. We have settled on one MDB that works "well enough" and now have a no-change policy on that as we have no Access heavyweights in-house (and no plans to hire one either).

The company is now slowly growing, increasing numbers of clients, calls etc, as well as a modest increase in the number of concurrent users, and performance has been getting noticeably worse just recently (waiting to move between forms, waiting for lists to populate etc)

Perfmon says:

• Disk transfers per second: between 0 and 30, average 4.
• Current disk queue length: hovers around 1

SQL Server's profiler sees hundreds of thousands of queries every minute. CPU usage on the clients is pretty much zero, indicating it's waiting on server-side queries to execute. I have put this workload through the DB Engine Tuning Advisor, applied its suggestions to a test backup, but this hasn't really made much difference.

By the way, we have a mix of 100MB and gigabit ethernet, all on one subnet, 40 ish users across two floors.

To the question.

As I see it we have two choices to resolve/improve this situation.

• We can scrap it and replace it with an entirely new CRM system, either bespoke or part bespoke
• We can extend the life of this system by chucking hardware at it.

We can build an Intel i7 system with crazy performance numbers for an order of magnitude less cost than replacing the software.

When a new system is eventually developed, it can be hosted on this box, so there's no wasted hardware. A new CRM system keeps getting put off, and off, and off - I don't see that happening for at least a year.

Any thoughts on this situation, especially if you've been here yourself, would be most appreciated.

Thanks

I am deploying Outlook Web Access on Exchange 2003 with forms-based authentication without SSL (management requirement - they have accepted the risk, and this will not be changed)

I have got everything running fine apart from the change password functionality. I have followed all of the "standard" documentation out there on the web:

• created the IISADMPWD virtual directory
• set the DisablePassword=0 registry entry
• set the AllowRetailHTTPAuth registry entry
• set the PasswordChangeFlags=1 metabase entry

The only remaining problem is that the Change Password button on the Options page in OWA is trying to redirect to a URL starting with HTTPS, not HTTP, and the user gets a server timeout error (we're not even listening on the HTTPS port).

https://ourdomain.com/iisadmpwd/aexp2b.asp?http://ourdomain.com/exchange/whois/?Cmd=close

This needs to redirect to the same address, but without SSL

http://ourdomain.com/iisadmpwd/aexp2b.asp?http://ourdomain.com/exchange/whois/?Cmd=close

Any takers? What have I missed?

Thanks Tom

EDIT: I have since discovered that while this appeared to work, having PasswordChangeFlags set to 1 causes the app pool for Outlook Web Access to crash with Connection_Abandoned_By_AppPool in the HTTPERR logs. Therefore I've had to abandon this and I wouldn't recommend anyone else tries the same.

Just gone live with a new Postfix mail server, sat in front of an Exchange box for inbound mail only.

It's set up to reject email for unknown recipients, which works fine, but I want to get a log of exactly what destination email addresses have been rejected, just to be sure no domains/recipients have been missed.

I've had a Google but come up blank. Is there a decent simple way to do this?

Thanks.

I am trying to get a Windows Server 2003 (not R2) DFS root to replicate to Server 2008 Standard.

My research so far suggests that adding the File Replication Service role service in the File Services role on Server 2008 should allow DFS replication with Server 2000/2003:

File Replication Service (FRS) supports synchronizing folders with file servers that use FRS instead of the newer DFS Replication service. To enable a server to synchronize folders with servers that use FRS with the Windows Server 2003 or Windows 2000 implementations of Distributed File System, install File Replication Service.

That's from Server Manager in Server 2008.

However when I right click our root target in DFS on Server 2003 and run through the New Root Target wizard, I get all the way to the end, but when I click Finish I get the following error:

The following error occurred while creating DFS root on server srv-file:
The Distributed File System service cannot be contacted on the specified server. Possible causes include the service is not started, the server is offline, network problems are preventing access to the server, or a firewall is blocking port 445 on the server.

The NTFRS service is running on the 2008 server and there are no firewalls enabled.

Any ideas?

I have a client who gets a TON of spam to their public IP.

I have put a Linux box running exim and spamassassin in front of it, and a bunch of Outlook rules to move mail into the Junk Email folder when spamassassin thought it saw spam. This worked well enough.

Now I've migrated them to Exchange 2007, is there a better way to "enforce" these Outlook rules for everyone, at the server side?

(Spamassassin works by inserting headers into incoming email. Here's some details.)

Thanks
Tom

EDIT: Title changed (as sensibly suggested) from "Spamassassin / exim in front of Exchange 2007"

I'm in the middle of a "swing" migration from Windows SBS 2003 to Server 2003 Standard.

It's going okay so far but we're getting event 1058 on client machines:

Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=Edgebyte,DC=local. The file must be present at the location <\ourdomain.local\sysvol\ourdomain.local\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (The system cannot find the path specified. ). Group Policy processing aborted.

Logon works fine but no group policies are being applied anywhere.

Looking back at the original SBS box, if you go into Group Policy Management you get "file not found" messages whenever you try to right click on a GPO and click Edit. I suspect this has been broken for a long time (part of the point of the migration is to replace the hardware, which is suspect).

We don't care about keeping any of the group policies (there aren't that many anyway) - so I just need to know how to remove all the group policies from Server 2003 standard, and regenerate the contents of the Policies folder in sysvol, so we can start again with a clean slate.

Any takers?

Tom