user145837's questions

Ubuntu 18.04 and 20.04, snmptrapd, versions around 5.7.3.

Trap events go into syslog. Great.

How can you make the log files go to a custom location besides syslog?

logoption or logOption as seen in many internet answers and tutorials does NOT work in snmptrapd.conf.

You can put logoption in snmp.conf, but then ALL snmp logs go there, not JUST the traps. For example, error messages when you run snmpwalk. I can find NO way to create a log file of ONLY snmp traps received by snmptrapd.

I thought a sneaky workaround would be an execute and traphandle, and just have a script write to disk. But traphandle doesn't seem to pass arguments?

something like :

authCommunity log,execute trap-dat
traphandle default /usr/local/bin/logger.rb

So you want snmptrapd to DO SOMETHING. How do you pass arguments? How do you make this thing write to a custom logfile?

There is ONE distasteful method to write a custom log file : change or over-ride snmptrapd's startup unit like : /lib/systemd/system/snmptrapd.service or the override in /etc/whatever

like this :

ExecStart=/usr/sbin/snmptrapd -Ln -f -Lf /var/log/snmptrapd.log

I have a windows domain that, at one time, used a WSUS server.

This setup wasn't well maintained, and I wanted to stop using it.

I removed the GPO, but it seems that many machines still think the domain: "specifies target server to host updates"

How can I get the Windows 10 fleet to use normal, default Windows updates?

Windows Upgrade Assistant successfully moves the machine to a current patch level, but the machines in question continue NOT looking to MS for updates.

I have a zabbix 4.2 installation.

I have it currently monitoring a network device via generic SNMP queries with my supplied OIDs. The data is being ingested just fine, graphs are populating as expected.

I would like to make a traffic weathermap, such that the links state the current (or last) bandwidth reading.

Something like this:

But I can't find the macro format that allows what I want to do. Two problems :

1: The link isn't the same as the host. They are different entities. So applying {HOST.NAME} or {HOST.anything} doesn't work. Because the link isn't a HOST. So... HOW do you use a macro that references a host by name? Something like {net-pan-fw.NAME} or {net-pan-fw.HOST} but that doesn't work.

2: How can I reference/call/access a host's member data. The ITEMS or KEYs? Host net-pan-fw has several items, such as net-pan-fw-eth1-310-dmz-bps-in (the name of the "item" and the "key"). How do you make a macro read that data? I've seen references to something like {HOST:ITEM.last(0)} but that doesn't work. I've tried things like {HOST:net-pan-fw-eth1-310-dmz-bps-in.last(0)} and that doesn't work.

So those are my two questions. How can a macro reference a different/specific host; and how can a macro reference/read a specific ITEM or KEY in that host?

I received some phishing emails, and the From: header contained ONLY a display name. Like :

From: Timmy Tester

Postfix then delivered the email, but appended its hostname to FIRST PART of the display name / malformed From header. So the recipient got this phish with a from header like :

From: [email protected]

(Where mail.example.com is my legit mail server's FQDN)

So... isn't a spoofed From: header, more like Postfix spoofed the From: header on behalf of the sender/scammer.

Is there a postfix setting to leave the From: header alone, or even better, to set this value to something else to warn recipients?

Ok, the problem as highlighted by michael-hampton :

The setting : remote_header_rewrite_domain is empty currently.

Postfix always rewrites message headers from local SMTP clients and from the Postfix sendmail command, and appends its own domain to incomplete addresses. The local_header_rewrite_clients parameter controls what SMTP clients Postfix considers local (by default, only local network interface addresses).
Postfix never rewrites message header addresses from remote SMTP clients when the remote_header_rewrite_domain parameter value is empty (the default setting).
Otherwise, Postfix rewrites message headers from remote SMTP clients, and appends the remote_header_rewrite_domain value to incomplete addresses. This feature can be used to append a reserved domain such as "domain.invalid", so that incomplete addresses cannot be mistaken for local addresses. 

I have 2 Ubuntu linux 14.04 servers with Samba4 on them. One is the AD master, the other is the AD backup.

Before the Samba 3.8.4 update, my Postfix+Dovecot servers were able to do user lookups and authentication lookups. Now they cannot.

postfix says

warning: dict_ldap_connect: Unable to bind to server [redacted] (Strong(er) authentication required)

dovecot says

auth: Error: LDAP: ldap_start_tls_s() failed: Can't contact LDAP server

TLS is enabled on the Dovecot configuration. It seems to be an issue with the self-signed certificate in the Samba AD setup.

ldapserch ... -Z gives

ldap_start_tls: Connect error (-11)
    additional info: (unknown error code)
ldap_result: Can't contact LDAP server (-1)

openssl s_client -connect [ip and port of AD server] -showcerts actually hands me the cert as expected.

...
Server certificate
subject=/O=Samba Administration/OU=Samba - temporary autogenerated certificate/CN=DC-01.[redacted]
issuer=/O=Samba Administration/OU=Samba - temporary autogenerated certificate/CN=DC-01.[redacted]
---
Acceptable client certificate CA names
/O=Samba Administration/OU=Samba - temporary autogenerated certificate/CN=DC-01.[redacted]
/O=Samba Administration/OU=Samba - temporary autogenerated certificate/CN=DC-01.[redacted]
....
Verify return code: 18 (self signed certificate)
....

Looking at : https://access.redhat.com/articles/2243351 I tried :

tls verify peer = no_check
ldap server require strong auth = no

This successfully allows plain-text LDAP loookups on port 389. (edit from previous)

Ubuntu 14.04 cert parts are in : https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_%28LDAPS%29_on_a_Samba_AD_DC

I've tried importing the CA .pem file from the DC to the mail server, but it doesn't seem to correct dovecot or postfix'es TLS LDAP connection problems.

In our last TW PCI scan, one of our flags was "DNS Amplification Denial of Service".

Right now, the DNS server is running Bind 9.8.1-P1. It seems like the CVEs are for a much older version: CVE-2006-0988, CVE-2006-0987.

Given as evidence was: Finding: A 26 byte ANY query for [my domain] resulted in a much larger answer, at 283 bytes in size.

So, from the outside world I run a dig:

taco $ dig -t NS . @[my domain]

For which I get back:

; <<>> DiG 9.8.1-P1 <<>> -t NS . @[my domain]
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 54954
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;.              IN  NS

;; Query time: 47 msec
;; SERVER: [my ip address]#53([my ip address])
;; WHEN: Mon Nov 25 15:53:24 2013
;; MSG SIZE  rcvd: 17

So to ME it seems like my BIND server is doing the right thing and refusing. But the scan is right in that for a small input it got back a much larger output. Even if it wasn't allowing recursion from the outside.

Is there a way to make BIND not answer at all, or send a shorter response? Is there something else entirely I need to do to make TW PCI scan happy?

I'm trying to build a Ubuntu 12.04 mail server as such.

Must: Auth against an existing Open-LDAP server. Storage in Maildirs on an existing NFS server, everything owned by 8:8 (mail:mail). Auth is required for smtp and imap.

Should (I think): Postfix using Dovecot SASL.

Things work ok except, when I am using ldap for userdb:

userdb {
driver = ldap
args = /etc/dovecot/ldap-userdb.conf.ext
}

... then the maildir files are read/written as the UID:GID from LDAP. But the mail has to be owned by 8:8 (because of other mail servers) I get errors like:

Error: open(/var/mail/...) ...
 failed: Permission denied (euid=1193(<...>) egid=555(<...>) missing +r perm
.... dir owned by 8:8 ...

but if I use static userdb:

userdb {
 driver = static
 args = uid=8 gid=8 home=/var/mail/%u
}

...then when sending mail from one ldap user to another ldap user on the new mail server then i get an error: (emailing to [email protected])

postfix/local[32371]: C6F7561735: to=<[email protected]>, 
 relay=local, delay=0.04, delays=0.02/0.01/0/0.01, dsn=5.1.1, 
 status=bounced (unknown user: "timmytester")

...but emailing to outside the local domains works fine.

It SEEMS to me that using static userdb interferes with Dovecot providing SASL. So I tried to just slip in the 8:8 to the ldap userdb config: (I use the same config file for passdb and userdb for ldap, symlinked)

uris = ldap://ldapserver.domain.com
 dn = cn=admin,dc=domain,dc=COM
 dnpass = secretPW
 auth_bind = no
 ldap_version = 3
 base = ou=Users, dc=DOMAIN, dc=COM
 pass_attrs = uid=user,userPassword=password

 user_attrs = uid=8,gid=8 # <--- here i tried to cheat.

 pass_filter = (&(objectClass=mailUser)(|(mailDestination=%u)(uid=%n)))
 default_pass_scheme = SSHA

... and this replicates the static userdb problem. Unknown User. But at least it seems I CAN do static-like assignments here.

If my mail could be owned by the real uid:gid then I would be good. Postfix virtual users, virutal domains, all that stuff seems to be fine. Just when Dovecot goes 8:8, then postfix gets bad SASL answers? To be clear, the file access problem goes away when I go static uid:gid. And the unknown user problem goes away when I go normal ldap userdb. I can even chmod 777 a maildir and be fine until a new mail gets processed by the old mail server and stored as 600.

Do I need to use a different SASL package? Or can I get dovecot to do file access 8:8 while still making postfix happy?

This network:

I have a samba server in the main office LAN.

I have multiple satellite offices, 3 hops away. Wins and netbios work fine, using both windows servers and samba servers. Such as:

[ main ] -- [office a]
[office]
[ lan  ]  -- [office b]

I tried to move one office to be one hop PAST another office. Such as:

[main office lan] -- [office a] -- [office b]

... and the routing, pinging, and porning all work great.

But the machines in office B can't SMB connect to any machines in the main LAN.

As far as I can tell, it is because netbios isn't making it between main and B.

net view ip.of.samba.server gives "cannot find path".

nbtstat -A ip.of.samba.server shows nothing.

The routers are Procurve 2800-series Layer 3 switches with ip routing enabled.

Do I need to enable udp broadcast forwarding?

   ip routing
   ip udp-bcast-forward

....

  ip forward-protocol udp .....255 netbios-ns
  ip forward-protocol udp .....255 netbios-dgm

if so, which way? Do I need to enable that on each routing switch along the way? for every vlan? and what about TCP?

Hopefully someone here has run into this before.

I am trying to get rid of VLAN 20, send all the traffic for Office B thru 19 then 18. This all works for normal pinging, surfing, etc. so the routes are good.

I have a pfSense box acting as my public facing router and stateful firewall.

There is 1 WAN interface and several LAN interfaces using private IPs behind NAT.

I EXPECT to see portscans or all kinds of things with Snort on the WAN interface.

I don't expect to see this SNORT alert on one of the LAN interfaces.

Attempted Information Leak
PSNG_UDP_PORTSCAN
SRC: 165.98.148.2  (some Nicaraguan IP)
DST: 192.168.5.15  (a linux file sever on the LAN)

I have no port forwarding going to 192.168.5.15. In fact, nothing on the pfSense box at all should be forwarding/routing/NATing/PATing anything to that internal address.

I could understand if my internal machine was communicating TO the Nicaraguan ip, but how in the world do UDP datagrams make it from the WAN interface to the LAN interface with no forwarding?

I want a paravirtualized ZFS server for Xenserver 6.1 supporting a 6+ TB zpool.

The old templates for Xenserver 6.0.2 and FreeBSD 9 don't work.

I have been unsuccessful ("Not a Xen-ELF image...") at making my own FBSD9, XS6.1 paravirtual combo, even though I've tried every "step by step" tutorial I've found on the intarwebs. Without PV and Xentools, you are stuck at max 3 VHDs, and with a max VHD of 2TB, I can't make a 6TB zpool since 1 VHD is the VM disk image.

The Solaris 10 template for Xenserver 6.1 is "experimental" and I'm not even sure it would work for us.

ZFS on Linux and ZFS Fuse, while I have tried them both and they work, aren't nearly as fast as FreeBSD's ZFS.

So I ask you this: What is the best option for ZFS on Xenserver 6.1?

Has anyone no-kidding gotten FBSD 9 or 9.1RC fully paravirtualized for Xenserver 6.1? If so: why has no one released a pre-baked virtual appliance for template file?

Thanks all!