Matthew Iselin's questions

Our network contains a growing number of iOS devices, all of which with very similar configurations. All Internet access is via a transparent proxy.

We've found that iOS updates and some free apps cache fine on the proxy, but any paid apps fail to cache properly (as they seem to be encrypted to the Apple ID (?)).

I'm just wondering if there's any way forward with this where we could cache the paid apps so that they are purchased n times, but downloaded from the proxy cache instead of from the Internet each time. Bandwidth caps aside, the download direct from the Internet slows everything down for everyone, regardless of fairness queueing and related 'fixes'.

I know this is quite unlikely, but I figured there's nothing to lose and everything to gain before I look into other solutions (eg, QoS).

We have a group of students that need to be able to switch keyboard layout in order to complete coursework (Chinese, but this really applies to any layout).

All of these students share a single mandatory profile and this profile has been updated with the correct registry settings to set up the keyboard layouts available to the student. Students can now see the Language Bar and can see the various keyboard options.

When a student selects one of the various options, the Language Bar visually updates to indicate the language has been changed, but no related tools for the selected language appear and the input language remains in English.

What are we missing? Is there something we need to toggle in Group Policy for these students?

Update: the machines in question are all running Windows 7, and we are running a Server 2008 R2 domain.

Update 2: Teachers are able to switch keyboard layouts without a problem, it's only students (who are highly restricted users) that have trouble with this. I'm not sure what could be causing this issue though.

We are deploying desktop icons across our network to Windows 7 machines via Group Policy Preferences (Registry, User Shell Folders) and have found that for most users this works great - the "Common Desktop" icons configured under HKEY_LOCAL_MACHINE merge correctly with the HKEY_CURRENT_USER icons and all is well.

However, for a particular group, there is no merge - none of the "Common Desktop" icons show.

Permissions and such are all set correctly and there is no difference in the registry changes applied to a group working and a group that does not work.

The Common Desktop key is under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, and the usergroup-specific desktop key is under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.

They are being redirected to a network drive, mapped at logon. I have tried using UNC paths instead, but this caused all users to lose "Common Desktop" icons.

Further Background

So, our menu system is stored on our file server. For the purposes of explanation, let's say it's at \\dfsroot\menus. Each category of user has a sub-directory here - \\dfsroot\menus\finance, \\dfsroot\menus\sales, and each sub-directory contains a Desktop and Start Menu folder containing shortcuts to be placed on each, respectively.

There is also a folder, \\dfsroot\menus\Common which are shortcuts common to all users (eg, Microsoft Word).

Common menus are controlled by HKEY_LOCAL_MACHINE User Shell Folders configuration.

Group-specific menus are controlled by HKEY_CURRENT_USER User Shell Folders configuration.

Both are applied without errors for all users in the domain via Group Policy Preferences.

This allows us to manage icons quickly and easily, as we can drop a new icon into one of these UNC paths and update several hundred desktops immediately.

However, the Common directory seems to fail to apply for one group of users. There are no errors in the event log and even looking at the registry with regedit shows the correct value for the registry keys. There just aren't any icons showing from Common. Only the group-specific menus.

I am happy to provide further clarification if it is needed.

Background

• We have a Server 2008 R2/Win7 domain.
• We have teachers and students using Windows 7 workstations, deployed via SCCM.
• Students all refer to a shared profile (\\dfsroot\\profiles\student, containing ntuser.dat and all other files and directories set with permissions and ownership set to allow all students access).
• We are using roaming profiles.
• Offline files are disabled.

Problem

We have found a subset of our students are unable to login to Windows 7 workstations, with the error "Group Policy Client failed the login: Access is denied". This ceases if the workstation is moved to a different organisational unit with less policy applied, but this also messes around with targeting for printers and other such preferences. As far as we can tell by doing group policy modelling, there are essentially no group policy differences between a student account that can always login, and a student account that will always fail.

We've checked permissions over and over again, but it seems odd to me that only a subset would be deterministically affected if permissions were in fact wrong.

Teachers and other non-student accounts have no problems at all, but they also have one profile per account.

I'm really at a bit of a loss as to what to do next. Any ideas?

We need to publish some network directories via WebDAV on our internal network for some mobile devices (mainly iPads).

The intended layout is something like:

http://webdav/username/ points to D:\homes\username (names & paths changed)

So far we have access to the webroot working and logging in with domain credentials works fine as well. We just need to provide access by username now.

Short of creating a WebDAV rule for every possible username, is there a way to do this automatically?

I am currently troubleshooting an issue where some users on Windows 7 and XP systems cannot access an SSL website on our network. The same site works fine on our servers (Server 2003, completely up-to-date, and a Ubuntu Server box) and all of our OSX machines. Our gateway is a machine running ISA 2003, which provides firewall and NAT services to the network.

So far I have narrowed it down to an MTU issue - when I force a Windows 7 box to an MTU of 1100 (for example) the site works fine, but when I change the MTU back up to 1500, the site refuses to load. When doing a "ping test" with "Don't Fragment" and a specific size specified, the MTU can be determined - but it has also changed several times over the past few hours...

At the networking level, when the site refuses to load the remote server sends a TCP reset directly after (or very close to the end of) the SSL handshake.

Is there a way to force an MTU for a specific IP address? Alternatively, is there any explanation for this behaviour (perhaps a method for verifying automatic path MTU discovery is working)?

We have recently implemented (native) IPv6 in our network. Everything is working very well so far, but our IPv4 network passes all HTTP traffic through Squid (2.7.STABLE6 on Ubuntu Server) + SquidGuard for filtering purposes. This is all managed via a redirect rule on the firewall (via Shorewall).

I'm wondering now if it's possible to do the same thing with IPv6 at all. If it's any help we're using Shorewall6 for IPv6 traffic.

We have just added a few iMacs to our system and we've found that they all want to download about 1.6 GB of updates... not so great when we only have limited monthly bandwidth!

All of our Windows machines just use WSUS, which works great in our environment. It'd be nice if we could do the same for the iMacs without purchasing an additional Mac for a server role.

So is it possible to run Apple's Software Update Server on a Windows server? Or do we need to look at purchasing a Mac in order to distribute updates across our clients?

Alternatively, could we set up one of the iMacs to run the update server for the other iMacs whilst it is being used as a standard machine (ie, not installing OSX server, and keeping it available for staff to use)?

I'm planning a network design "upgrade" so to speak to utilise VLANs across the campus, and as such trying to figure out and research the best VLAN solution for our network of around 300 machines.

The current layout looks a bit like this (simplified) - every machine and switch is on VLAN1, the default:

Servers ----> Core Switch (3Com 5500G-EI 24-port) <---- Edge switches (all 3Com 4200G and 4500s) <---- Workstations & Printers

Every edge switch is in a unique building on the campus, and they won't move around at all.

I would think the simplest solution would be to have a single VLAN per building (and additional ones for wireless or security cameras as we build that infrastructure). The only traffic needed on the network is from clients to servers - there is no need for machines in one building to communicate with machines in another building. Without a router though this might be difficult.

What would be the best solution for VLAN-ing with the infrastructure I have? It would be preferable to avoid purchasing additional switches or new routers where possible, and avoiding IP reconfiguration across the network would be nice too (although I realise that's very much wishful thinking!).

Update: Our network at this stage runs on a single subnet; there is little segregation between workstations, servers, switches, and printers.

We've run into a number of issues on our system where students are unplugging devices from workstations without safely removing them first. Whilst the results are often a very good learning experience (corrupted USB disks) it would be nice if it was possible to enforce the "no write cache" policy for removable drives through group policy.

A quick search through the available administrative templates shows nothing for this purpose though. Are there any solutions to this problem apart from locally configuring each machine?

Our domain controller is running Server 2003 R2 and the workstations all run XP SP3.

We have a Linux-based router which is currently working fairly well, but our network only has a 1.5 mbps incoming connection. The network is small, but during high load periods some systems can end up dominating the bandwidth. For example, a client downloading a file can easily saturate the connection leaving everyone else with barely any access to the outside world.

Naturally, I'd like to fix this. I believe a combination of iptables rules and tc is in order, but I have no idea how to go about distributing the bandwidth evenly across the clients.

It would be nice if there was a way to divide the bandwidth only across clients that are actually utilising the connection as well, rather than hard limit each connection to (bandwidth / number of clients).

Using proftpd, is there a good way to automatically synchronise uploaded files from the upload directory to some other directory?

Our layout ends up a bit like this:

~/ftp/some/path <-- Files are uploaded here
~/some/other/path/not/accessible/via/ftp <-- But also need to be here after uploading

Is there a good way to do this automatically, or do I have to tell anyone uploading files to upload twice, and open up an additional directory (containing data we cannot redistribute)?

I'm working with IPv6 and have run into an issue configuring ip6tables on our main router in order to control what can come into the network. A default DROP rule in the FORWARD section has worked well (obviously leaving ESTABLISHED,RELATED as ACCEPT) to keep internal clients' open ports from being accessed.

However, running an ip6tables command for every little change is unwieldy. Whilst we are able to continue creating rules manually, I'm wondering if there's some sort of management interface we could use to create the rules quickly and easily. We're looking to be able to save time working on our firewall as well as providing a simple method for modifying rules for those who will eventually replace us.

I know webmin (heavily locked down on our network, naturally) has support for modifying iptables rules, but seemingly no support for ip6tables. Something similar would be fantastic.

Alternatively, suggestions for a firewall solution apart from iptables/ip6tables which can be managed remotely wouldn't be out of order. A web interface for management is certainly preferable, even if it is just a wrapper with shiny buttons over the raw config files.

I've been working on getting IPv6 support into my network, and had everything working properly for a short while. The server is running Ubuntu Server 8.10.

Now however whenever I attempt to do anything related to IPv6 on the server, I get "Operation not permitted". This is coming from things like wide-dhcpv6-client (when trying to get an IPv6 address from the ISP) and radvd - both log errors of this type into syslog.

Even pinging the loopback interface fails:

xxx@gordon:~$ ping6 ::1
PING ::1(::1) 56 data bytes
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- ::1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2014ms

xxx@gordon:~$ sudo ping6 ::1
sudo: unable to resolve host gordon
PING ::1(::1) 56 data bytes
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- ::1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2014ms

As you can see, I have attempted pinging as root, as most of the material I've found on the internet points to a permission problem. However, that has not helped.

Any hints to getting unstuck would be appreciated.

I have a CentOS installation which is running fairly smoothly.

Today I ran ifconfig mainly to see what sort of usage has been coming across the ethernet interface, and to also check my link speed.

This is what I ended up seeing for the loopback device:

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:10301085132061223274 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13981054163812689233 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11783901785008000095 (0.6 EiB)  TX bytes:10333501021200548281 (0.9 EiB)

This just feels completely wrong - almost an EiB of data?

Any assistance in tracking down the source of these statistics would be greatly appreciated.