trueCamelType's questions

I have an ubuntu 14.04 server running a service, and I'm currently setting up some logging visualization, but I noticed my /var/log/auth.log is empty.

I assumed it wouldn't have much since I've disabled ssh connections other than using an ssh key. But, I did expect there to be sshd logs. Is there somewhere else that I would see the logins using ssh keys, or is there something else happening I'm unaware of?

My ultimate goal is to have a log of every time someone tries to login using the key, or without the key.

EDIT1

I see that there are auth.log backups, but they aren't recording ssh attempts, or successful ssh logins using keys. They only show CRON jobs.

I also elevated the sshd_config logging level to VERBOSE instead of INFO.

I'm using ELK Stack, and I've got it working pretty well for most of my servers. The exception is that I have a gitlab server that has a ping to/from a gitlab-ci server that happens in the gitlab-access log. This happens every second, and I'd like to ignore it. My regex matches these lines in the regex testers I'm using, but it appears to have stopped all logs coming from that file, instead of the expected single lines.

filebeat:
  prospectors:
    paths:
      - /var/log/gitlab/nginx/gitlab_access.log
    input_type: log
    exclude_lines: ['(.*\bPUT\b)(.*\bgitlab-ci-multi-runner).*']
    document_type: gitlab_access

Below is an example of the log file, and I want to block every line that is a PUT from the gitlab-ci-multi-runner.

**192.168.1.105 - - [07/Feb/2018:07:53:36] "PUT /ci/api/v1/builds/1738.json HTTP/1.1" 404 3082 "" "gitlab-ci-multi-runner 1.3.0 (1-6-stable; go1.3.3; linux/amd64)"**
192.168.1.110 - - [07/Feb/2018:07:53:37] "POST /api/v4/jobs/request HTTP/1.1" 204 0 "" "gitlab-ci-multi-runner 9.2.0 (7-2-stable; go1.7.5; windows/amd64)"
**192.168.1.105 - - [07/Feb/2018:07:53:39] "PUT /ci/api/v1/builds/1738.json HTTP/1.1" 404 3082 "" "gitlab-ci-multi-runner 1.3.0 (1-6-stable; go1.3.3; linux/amd64)"**
192.168.1.110 - - [07/Feb/2018:07:53:40] "POST /api/v4/jobs/request HTTP/1.1" 204 0 "" "gitlab-ci-multi-runner 9.2.0 (7-2-stable; go1.7.5; windows/amd64)"
192.168.1.55 - - [07/Feb/2018:07:53:40] "GET / HTTP/2.0" 200 45895 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36"
192.168.1.55 - - [07/Feb/2018:07:53:41] "GET /assets/favicon-075eba763121a0c1f89a89ee81678bcde72e2a47cd3a42.ico HTTP/2.0" 200 1384 "https://gitlab.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.78 Safari/537"
192.168.1.55 - - [07/Feb/2018:07:53:41] "GET /uploads/-/system/user/avatar/21/yodaProfile.jpg HTTP/2.0" 304 0 "https://gitlab.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36"
**192.168.1.105 - - [07/Feb/2018:07:53:42] "PUT /ci/api/v1/builds/1738.json HTTP/1.1" 404 3082 "" "gitlab-ci-multi-runner 1.3.0 (1-6-stable; go1.3.3; linux/amd64)"**
192.168.1.110 - - [07/Feb/2018:07:53:43] "POST /api/v4/jobs/request HTTP/1.1" 204 0 "" "gitlab-ci-multi-runner 9.2.0 (7-2-stable; go1.7.5; windows/amd64)"

I expected the lines that start with ** to be removed, and the rest to go through, but this isn't happening (none of these lines make it through now). If I remove the regex, everything comes through again.

I just updated to the most recent version of gitlab-omnibus (I believe 10.1, but I’m not positive). None of my users can login now, and I'm not seeing anything incredibly useful in the error logs.

I’m not 100% certain which version of gitlab-omnibus I came from, but it hadn’t been more than a month since I updated, so probably a later 9.x version.

The error I’m getting is

Could not authenticate you from Ldapmain because "Ssl connect returned=1 errno=0 state=error: certificate verify failed".

at the login screen when anyone goes to login. When I tail all of the logs using gitlab-ctl tail, I get the following error on login attempt.

{"method":"POST","path":"/users/auth/ldapmain/callback","format":"html","controller":"OmniauthCallbacksController","action":"failure","status":302,"duration":6.6,"view":0.0,"db":0.0,"location":"https://gitlab.mycompany.com/users/sign_in","time":"2017-10-24T01:37:36.538Z","params":{"utf8":"✓","authenticity_token":"[FILTERED]","username":"my.name","password":"[FILTERED]"},"remote_ip":"192.168.0.81","user_id":null,"username":null}

I've checked that nothing was changed with the certs I'm currently using, and nothing in the gitlab.rb file has changed. The last time I had a problem similar to this, gitlab had changed the name of one of the fields in the gitlab.rb file...but that doesn't appear to be the issue this time.

Once I rebuild the server from a backup, I can look up what the last version I had was, and I'll update here.

salt-master: 2016.11.5 (Carbon)
salt-api: 2016.11.5 (Carbon)
salt-minion 2016.11.5 (Carbon)
cherrypy: 10.2.2

After setting up salt-api using this tutorial I've been able to successfully use the API via curl. For example, I can move files. However, salt-api seems to return {"success": true} as long as some command actually went out to the minion.

Is there a way to get any of the output from the instructions sent to the minion (like, in json or any other format as long as it's useful data)? For example, when I try to move a file, if the file doesn't exist, salt-api just silently fails and returns {"success": true}. Is there a way to get the output to tell me whether the actual instructions passed or failed?

I was able to find salt.output.json_out, which seems to only change the output of {"success": true} to another format....which isn't useful to me. Is there some documentation I haven't found that can help me return something other than {"success": true}?

EDIT

To clarify, my end goal is to have a program in C# that can make calls to the salt-api, and have it return whether or not the command on the minion was successful.

I know from the output of salt-master -l debug that a retcode with an actual boolean value exists, but I have no idea how to reach it.

This question has been asked plenty, but none of them resolve the issue for me.

I have a hypervisor (Hyper-V 2012). When I go to add a new VM from this .iso, which is the Microsoft SQL Server 2012 Evaluation.

When I create a new VM, and make it a Generation 2, then start it, I get this error:

Here's what I've tried.

1. Pressing a key to retry the boot sequence... (same results)

2. Retrying as Generation 1 (gave me an error which meant it wanted to be Gen 2)

3. Downloaded the ISO again to make sure there were no issues with that, and rebuilding.

4. Unchecking Secure Boot in the Hyper-V Bios settings.

5. Several places said to hold down any key during boot, and before boot, and that didn't do anything.

6. Used restroom, to see if a solution came to me. It didn't.

I have a Dell PowerEdge R710 with PERC H700 Integrated BIOS Configuration Utility 2.02-0025.1

I have a raid 5 setup, and recently I noticed one of the hard drives blinking amber/green, which according to this documentation means the HDD was getting near end of life.

I bought a new drive, powered down the machine, and replaced the failing drive. When I powered the machine back on, it recognized that there was a new drive, and booted normally. Now the new drive is steady green, and the rest of the drives are blinking like normal.

My question is, how do I tell if it is currently rebuilding, or if it's waiting for me to do something?

When I went into the PERC H700 Config Utility, the Disk Group, Raid 5, looks normal, but I'm a little worried. Can someone give me some ideas on how I check if this is actually rebuilding? I found an old post that had instructions on how to add it to the Hot spares group first, before it would rebuild, but I've found others saying that it auto rebuilds. Just trying to ease my mind. Thanks,

More Info.

It looks like, to answer my question, it does not automatically rebuild. I needed to mark the drive as the Global Hotspare. However, I noticed one of my drives is already labeled "Rebuilding". I have no idea what to think now. So, the situation is, I have one drive that I just replaced, that is new, and I just labeled it as Hotspare in the below picture. Does the final drive say "Rebuild" because it's rebuilding the Hotspare? Or is something else entirely happening?

I have a bit9 server, and I'm fairly new to the environment, as well as certs. The area to upload the cert says "Import Server Certificate From PKCS12 File"

I'm going to just use a self signed cert (I'm hoping it's ok with that), and I'm running the below command to do so.

openssl req -x509 -newkey rsa:4096 -keyout bit9.pem -out cert.pem -days 365

Is that what I should have done, and if so, how do I get this to a PKCS12 File?

I've been looking around, and found the below command:

Convert a PEM certificate file and a private key to PKCS#12

openssl pkcs12 -export -out <certificate.pfx> -inkey <privateKey.key> -in <certificate.crt> -certfile <CACert.crt>

Since I only have a pem file...I'm not sure how to do this.

I'm very new to SharePoint administration.

Here's my scenario.

I have a sharepoint, that I'm migrating. I'll call the current sharepoint "oldsharepoint", and the one I'm migrating to, "newsharepoint".

The oldsharepoint is currently accessible from inside and outside our environment by going to sharepoint.mydomain.com. I eventually want that URL to go to our newsharepoint, but for now, I just want to set up an alternate URL to our oldsharepoint. For example, I want to be able to go to sharepoint.mydomain.com and oldsharepoint.mydomain.com and they both go to my oldsharepoint.

I've already added the NS records to my external DNS as well as my internal DNS, but they just spin, which makes sense. I found the Alternate Access Mapping, and here's what it looks like (except the port isn't actually 120):

https://externalsite1.mydomain.com | Default | https://externalsite1.mydomain.com
https://externalsite2.mydomain.com | Default | https://externalsite2.mydomain.com
https://sharepoint.mydomain.com:120| Default | https://sharepoint.mydomain.com:120
https://sharepoint.mydomain.com    | Default | https://sharepoint.mydomain.com

I'm guessing if I just added another two lines, like these below, it would work, but I really don't want to break our current setup, just add another URL that goes to the same thing.

https://oldsharepoint.mydomain.com    |Default| https://oldsharepoint.mydomain.com
https://oldsharepoint.mydomain.com:120|Default|https://oldsharepoint.mydomain.com:120

Is that correct, assuming that I have the DNS records set correctly? Or will this break my current setup?

This question has been asked several times on other forums, but most answers I've found are for Windows 7, Windows Vista, or don't apply to my situation at all.

My issue is that when I go to the Properties section of any object in Active Directory, I get only 5 tabs, shown below:

The most common solution for this seems to be installing Remote Server Administrative Tools. Which I have done, and it is the newest version.

After that, the most common problem seems to be that you have to enable the AD services in Programs and Features, which is done, and shown below:

I have also already enabled the Advanced features. Which adds tabs, but not the missing ones. Just extra ones I don't need.

After this step, I've seen lots of answers for Windows 7 and Vista (It may also apply to 10, I'm not sure), where they copied files name tsuserex.dll and tsuserex.dll.mui from their server, to their local computer. I haven't done this yet, because it seems pretty weird to me. I'm a junior/mid level person in the IT world, but moving around dll's to get some tabs to appear seems odd to me. If that really is the next step I'll do it, but can someone explain to me why I'd need to do that, if that's the case?

I'm more than happy to try anything else though.

Extra Info.

• The AD server is Windows Server 2012 Standard

• I have also gone through the steps shown here. Which is basically just making sure the Remote Desktop Services - Extensions has the correct checkboxes checked. And it was all as it should be.

• To be thorough, the RSAT I downloaded was KB2693643

• I have also uninstalled and re-installed the server tools.

TL;DR

How do I tell, on the server, which documents are protected by AD-RMS

I inherited a small environment where Active Directory Rights Management Services is in use. The server is near end of life, and we don't want to replace it, and no longer need RMS. The issue, is that there are hundreds of documents with RMS protection on them, and I don't know how to check which documents, without opening every single one.

My fear is that the server will die, and I will find out which documents were protected, because no one will be able to open them anymore. Is there a way to quickly/easily determine which files query AD-RMS when they open, from the server?

I have an nginx reverse proxy, and I would like to have it forward traffic on to several sites, and listen on port 443 for all of these services. I've seen this done several places, and seems like the normal way to have a reverse proxy setup...it listens on a single port, and forwards based on URL.

However, I have some settings that I consider to be a little weird because I have a site that uses NTLM validation through an IIS site, and because of that I am using nginx Stream

Here's my current config files:

/opt/nginx/nginx.conf

stream {
    upstream backend {
        hash $remote_addr consistent;
        server mysite.domain.com:80 weight=5;
        server 192.168.0.5 max_fails=3 fail_timeout=30s;
    }

    server {
        listen 192.168.0.2:443 ssl;
        ssl_certificate /usr/local/nginx/conf/mycert.crt;
        ssl_certificate_key /usr/local/nginx/conf/mykey.key;
        ssl_session_cache shared:SSL:10m;

        ssl_session_timeout 5m;

        proxy_connect_timeout 1s;
        proxy_timeout 3s;
        proxy_pass backend;
    }
}

http {
    include mime.types;
    default_type application/octet-stream;

    sendfile on;
    keepalive_timeout 65;

    server {
        listen       80;
        server_name  localhost;

        location / {
            root   html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

    }
    include /opt/nginx/sites-enabled/*;
}

/opt/nginx/sites-available/default

server {
        listen 80 default;
        server_name _;
        return 301 https://$host$request_uri;
}

server {

        listen 192.168.0.2:443 ssl;
        server_name myothersite.domain.com;

        ssl_certificate /usr/local/nginx/conf/mycert.crt;
        ssl_certificate_key /usr/local/nginx/conf/mykeykey;

        ssl_session_timeout 5m;

        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
        ssl_prefer_server_ciphers on;

        location / {
                proxy_pass http://192.168.0.6:80;
                proxy_set_header Host $host;

                proxy_redirect http:// $scheme://;

        }
}

When I go to restart nginx, I get the error

bind() to 127.0.0.1:443 failed (98: Address already in use)

I thought that under each server you could have it listen on the same port, but this seems to not be working.

If I remove the stream all together, and just use two other sites that don't use stream, this seems to work fine with multiple server sections.

I have an nginx reverse proxy, and I'm trying to get an IIS website with login to work behind it. I've found this question asked several times, but each answer appears to be different, and some of the problems deviate a bit from the problem I'm having.

With my current config, I am able to get to the login, but I'm getting a 401 error, and it keeps asking for credentials.

My current config:

/etc/nginx/sites-available/default

server {
    listen 80 default;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name server2.mydomain.com;

    ssl_certificate /usr/local/nginx/conf/mydomain.com.crt;
    ssl_certificate_key /usr/local/nginx/conf/mydomain.com.key;
    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://192.168.0.20:80;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_redirect http:// $scheme://;

    }
}

My question is, what is the correct way that this is supposed to work?

Here's what I've researched so far:

This link, says it isn't possible.

This link, says I should use keepalive on upstream. That may be the answer, but whenever I add an upstream server2.mydomain.com with any configuration in it, nginx fails to restart. I'm sure I have some syntax incorrect, but I've tried several things. I'd post everything I've tried, but I'm not even certain this is the correct approach, and I've tried so many things, I figured it would be easier just to ask the general population how this is done.

This link, says you can just add a proxy_pass_request_headers on; line, and it will somehow work...but it doesn't for me.

This link, seemed the most likely to work, but after trying to figure out how to encode to base64 using this link, I was getting nowhere.

Any help is greatly appreciated. Here's a previous question I've asked, that are related to this, but are different questions.

EDIT1

I apologize for this being so late, was gone for a bit.

Here are my access logs for the nginx reverse proxy server. 192.168.0.5 is my client FYI.

These logs are from me accessing the site, getting a login prompt, trying the login once (without success), and exiting the login prompt.

/var/log/nginx/access.log

192.168.0.5 - - [09/Feb/2016:14:04:14 -0600] "GET / HTTP/1.1" 401 1293 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"
192.168.0.5 - - [09/Feb/2016:14:04:31 -0600] "GET / HTTP/1.1" 401 341 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"
192.168.0.5 - - [09/Feb/2016:14:04:31 -0600] "GET / HTTP/1.1" 401 1293 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"
192.168.0.5 - - [09/Feb/2016:14:04:34 -0600] "GET /favicon.ico HTTP/1.1" 401 1293 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"

/var/log/nginx/error.log

This file is empty

IIS Logs

2016-02-11 19:39:22 192.168.0.20 GET /login - 80 - 192.168.0.10 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Ubuntu+Chromium/45.0.2454.101+Chrome/45.0.2454.101+Safari/537.36 401 2 5 125
2016-02-11 19:39:28 192.168.0.20 GET /login - 80 - 192.168.0.10 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Ubuntu+Chromium/45.0.2454.101+Chrome/45.0.2454.101+Safari/537.36 401 1 21480424 0
2016-02-11 19:39:36 192.168.0.20 GET /login - 80 - 192.168.0.10 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Ubuntu+Chromium/45.0.2454.101+Chrome/45.0.2454.101+Safari/537.36 401 1 21480724 0
2016-02-11 19:40:16 192.168.0.20 GET /login - 80 - 192.168.0.10 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Ubuntu+Chromium/45.0.2454.101+Chrome/45.0.2454.101+Safari/537.36 401 1 21407424 15
2016-02-11 19:40:22 192.168.0.20 GET /login - 80 - 192.168.0.10 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Ubuntu+Chromium/45.0.2454.101+Chrome/45.0.2454.101+Safari/537.36 401 1 21480742 0

There are no security errors for logins, so it's never actually submitting the login to the system I guess. It simply gives me the login popup again every time I hit "login".

Live HTTP Headers plugin output

https://server2.mydomain.com/

GET / HTTP/1.1
Host: server2.mydomain.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

HTTP/1.1 401 Unauthorized
Server: nginx/1.4.6 (Ubuntu)
Date: Tue, 09 Feb 2016 19:21:04 GMT
Content-Type: text/html
Content-Length: 1293
Connection: keep-alive
WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
X-Powered-By: ASP.NET
----------------------------------------------------------
https://server2.mydomain.com/

GET / HTTP/1.1
Host: server2.mydomain.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Authorization: NTLM TlRNTVMTUAAAB4IIAAAAAAAAAAAAACDAFGAAAAAAAAAAAAAAAAA=

HTTP/1.1 401 Unauthorized
Server: nginx/1.4.6 (Ubuntu)
Date: Tue, 09 Feb 2016 19:22:00 GMT
Content-Type: text/html; charset=us-ascii
Content-Length: 341
Connection: keep-alive
WWW-Authenticate: NTLM TlRMTVNTUAACAAAAGgAaADgAAuzKir6ADucAAAAAAAAAAL4A&%$DSDADvgBSAAAABgGxHQAAAA9HAEUARQBLAFMAQQBOAEQATgBFAFIARABTAAIAGgBHRQBLAFMAQQBOAEQATgBFDFAFIARABTAAEADABLAEUATABWAEkATgAEACIAZwBlAGUAawBzAGEAbgBkAG4AZQByAGQAcwAuAGMAbwBtAAMAMABLAEUATABWAEkATgAuAGcAZQBlAGsAcwBhAG4AZABuAGUAcgBkAHMALgBjAG8AbQAFACIAZwBlAGUAawBzAGEAbgBkAG4AZQByAGQAcwAuAGMAbwBtAAcACAABRuM1b2PRAQAAAAA=
----------------------------------------------------------
https://server2.mydomain.com/

GET / HTTP/1.1
Host: server2.mydomain.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Authorization: NTLM TlRMTVNTUAADAAAAGAAYAHAAAADqAOoAiAAAAAAAAAAGgAaAEAAAAAWABYAWgAAAAAAAAAAAAAABYIIAGEAbQBhAG4AZABhAC4AYgBsAG8AdQBuAHQAVwBPAFIASwBTAFQAQQBUAEkATwBOAHorEf/j46zta4wONTUAADAA-98uH//ZL0Am16vGzdWutoAAAAGAAYAHQAAAAAAAACFdzVEB9QHmLWLCuQQAAAAAAgAaAEcARQBFAEsAUwBBAE4ARABOAEUAUgBEAFMAAQAMAEsARQBMAFYASQBOAAQAIgBnAGUAZQBrAHMAYQBuAGQAbgBlAHIAZABzAC4AYwBvAG0AAwAwAEsARQBMAFYASQBOAC4AZwBlAGUAawBzAGEAbgBkAG4AZQByAGQAcwAuAGMAbwBtAAUAIgBnAGUAZQBrAHMAYQBuAGQAbgBlAHIAZABzAC4AYwBvAG0ABwAIAAFG4zVvY9EBAAAAAA==

HTTP/1.1 401 Unauthorized
Server: nginx/1.4.6 (Ubuntu)
Date: Tue, 09 Feb 2016 19:22:00 GMT
Content-Type: text/html
Content-Length: 1293
Connection: keep-alive
WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
X-Powered-By: ASP.NET
----------------------------------------------------------

EDIT2 - For clarity, here is the setup by IP.

Client machine

192.168.0.5

Ubuntu 14.04 desktop

Reverse proxy server

192.168.0.10

nginx 1.4.6

Ubuntu 14.04 server

Server 2

192.168.0.20

server2.mydomain.com

apache2

Ubuntu 14.04 server

EDIT3 - Maybe this works and I'm doing it wrong,....maybe not

From this post, the answer written by Fizz.

I tried this below

/etc/nginx/sites-available/default

server {
    listen 80 default;
    server_name _;
    return 301 https://$host$request_uri;
}

upstream server2.mydomain.com {
        server 192.168.0.20:80
keepalive 16;
}

server {
    listen 443 ssl;
    server_name server2.mydomain.com;

    ssl_certificate /usr/local/nginx/conf/mydomain.com.crt;
    ssl_certificate_key /usr/local/nginx/conf/mydomain.com.key;
    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://192.168.0.20:80;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_redirect http:// $scheme://;

    }
}

Same results. Based on the other answers....maybe apache2 is the better way to go?

EDIT4 - Edit based on answer from Maxim Dounin

I'm trying to use Nginx 1.9.9 now, and the stream proxy method mentioned in Maxim Dounin's answer.

I compiled from source, so my file locations are different now.

/opt/nginx/nginx.conf

worker_processes 1;
events {
    worker_connections 1024;
}

stream {
    upstream backend {
       hash $remote_addr consistent;

       server server2.mydomain.com:80 weight=5;
       server 192.168.0.20:80            max_fails=3 fail_timeout=30s;

    }

    server {
        listen 443 ssl;        #Line 27
        server_name server2.mydomain.com;

        ssl_certificate /usr/local/nginx/conf/mydomain.com.crt;
        ssl_certificate_key /usr/local/nginx/conf/mydomain.com.key;
        ssl_session_cache shared:SSL:10m;

        ssl_session_timeout 5m;

        proxy_connect_timeout 1s;
        proxy_timeout 3s;
        proxy_pass backend;
    }

#    server {
#        listen [::1]:12345;
#        proxy_pass unix:/tmp/stream.socket;
#    }
}

I commented out the last recommended server line, because I had no idea what to do with that, but my config file doesn't get there anyway due to other errors. Right now my /opt/nginx/logs/error.log is having problems with line 27

the "ssl" parameter requires ngx_stream_ssl_module in /opt/nginx/nginx.conf:27

I definitely compiled with the ngx_stream_ssl_module because when I do a nginx -V I get configure arguments: --with-stream

Hopefully I'm on the right track.

I'm trying to get an nginx reverse proxy setup working. I have two web servers set up, once with nginx, and one with apache2. I'm currently not able to get it working with just the nginx server, so that's all I'm trying for right now, but I added that I'm eventually trying with two, in case that effects the setup.

I have four machines in this setup.

1. Client machine

192.168.0.5

Ubuntu 14.04 desktop

2. Reverse proxy server

192.168.0.10

nginx 1.4.6

Ubuntu 14.04 server

3. Server 1

192.168.0.15

server1.mydomain.com

nginx 1.4.6

Ubuntu 14.04 server

4. Server 2

192.168.0.20

server2.mydomain.com

apache2

Ubuntu 14.04 server

On my client machine, I have set my hosts file to point to the reverse proxy server for each of the web servers, like below

/etc/hosts On client 192.168.0.5 127.0.0.1 localhost 192.168.0.10 server1.mydomain.com 192.168.0.10 server2.mydomain.com

I have ssl certs for server1 and server2, that I have put on the reverse proxy server (192.168.0.10). We'll call them server1.crt, server1.key, and server2.crt, server2.key.

I believe that I have to have this setup with the certs working like this:

client(192.168.0.5) ---https---> reverseProxy(192.168.0.10 holds ssl certs) ---http---> server1 or server2 

I have both servers working now, with http, and I just need to fix the nginx reverse proxy settings on 192.168.0.10.

Here's something I've tried, but it isn't correctly redirecting. Once again, I'd like an https connection to the reverse proxy server, and then an http connection between the reverse proxy and the servers.

/etc/nginx/nginx.conf

user www-data;
worker_processes 4;
pid /run/nginx.pid;

events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # nginx-naxsi config
    ##
    # Uncomment it if you installed nginx-naxsi
    ##

    #include /etc/nginx/naxsi_core.rules;

    ##
    # nginx-passenger config
    ##
    # Uncomment it if you installed nginx-passenger
    ##

    #passenger_root /usr;
    #passenger_ruby /usr/bin/ruby;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

/etc/nginx/sites-available/default

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ =404;
            # Uncomment to enable naxsi on this location
            # include /etc/nginx/naxsi.rules
    }

server {
    listen 443;
    server_name server1.mydomain.com;

    ssl on;
    ssl_certificate /usr/local/nginx/conf/server1.crt;
    ssl_certificate_key /usr/local/nginx/conf/server1.key;
    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_prefer_server_ciphers on;

    location / {
            proxy_pass http://192.168.0.15:80;
            proxy_set_header Host server1;

            proxy_redirect http:// https://;
    }
}

I'm assuming that something is incorrect in my /etc/nginx/sites-available/default file, but I've been reading through several tutorials, and this seems pretty close. This setup, is obviously only trying with server1, and ignores server2, but I assumed that if I could get one work, I could add as many others as I wanted. I have found similar questions, such as this one, but I still haven't been able to get this configuration working with a single server.

What's currently happening

Currently, when I go to server1.mydomain.com, I get the standard "Welcome to nginx!" page from the reverse proxy server (192.168.0.10). There's no forwarding going on.

Am I getting close? Thanks in advance

EDIT1

After trying the solution posted by Capile, I ran into another problem (which may have been expected, by someone with more web knowledge than myself).

When I changed my /etc/nginx/sites-available/default file to this:

/etc/nginx/sites-available/default (On reverse proxy)

server {

        listen 80 default_server;
        listen 443 ssl default_server;
        server_name server1.mydomain.com;

        ssl on;
        ssl_certificate /usr/local/nginx/conf/server1.com.crt;
        ssl_certificate_key /usr/local/nginx/conf/server1.com.key;
        ssl_session_cache shared:SSL:10m;

        ssl_session_timeout 5m;

        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
        ssl_prefer_server_ciphers on;

        location / {
                proxy_pass http://192.168.0.15:80;
                proxy_set_header Host server1;

                proxy_redirect http:// https://;
        }
}

With this config I get a

400 Bad Request

The plain HTTP request was sent to HTTPS port

I thought maybe I should try https://server1.mydomain.com, but that just spins.

Also, I don't mind using the same ssl cert for both servers. I don't think that will be an issue.

EDIT2

First of all, thank you for all of the help.

I removed the ssl on; line as recommended by Capile, and changed the proxy_redirect http:// https://; line to proxy_redirect http:// $scheme://; as recommended by Richard Smith.

This fixed the bad request for the http traffic. So now, if I go to http://server1.mydomain.com I am successfully redirected to the site (yaay!)

If I try to go to https://server1.mydomain.com I am also redirected, which is great, but I'm getting an Unable to connect error. This makes sense if the reverse proxy is forwarding http traffic to http, and https traffic to https since there is no https configuration for the backend server.

My goal is that if I go to http://server1.domain.com that it connects to the reverse proxy using https, and then it forwarded on to the backend server using http. That doesn't appear to be happening...it looks like it's just forwarding it without ever using https.

On the other hand, if I go to https://server1.domain.com it should connect to the reverse proxy using https, and then forward on to the backend server using http.

So I never want an http connection from the client to the reverse proxy server.

The curls are acting as expected though. When I curl the http, or https site, I get this:

curl -i https://server1.mydomain.com or curl -i http://server1.mydomain.com

HTTP/1.1 302 Found
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 21 Jan 2016 16:34:29 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 92
Connection: keep-alive
Cache-Control: no-cache
Location: http://test1/users/sign_in
Set-Cookie: session=336e109ad711; path=/; expires=Thu, 28 Jan 2016 16:34:36 -0000; HttpOnly
Status: 302 Found
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Request-Id: ad65f-f6ds204-9fs8d-bdsdfa43-df5583266sdf87
X-Runtime: 0.005358
X-Xss-Protection: 1; mode=block

<html><body>You are being <a href="http://test1/users/sign_in">redirected</a>.</body></html>

So, the redirect is definitely happening for either type of connection, but I don't THINK that the SSL certs for the https connection between the client and reverse proxy server are ever being used.

I already have a squid reverse proxy working for two test sites.

My two sites are www.test1.com and www.test2.com

My current working config file looks like this

/etc/squid3/squid.conf

acl test1_acl dstdomain www.test1.com
acl test2_acl dstdomain www.test2.com

aclSSL_ports port 443

acl Safe_ports port 80
acl ​Safe_ports port 21
acl ​Safe_ports port 443
acl ​Safe_ports port 70
acl ​Safe_ports port 210
acl ​Safe_ports port 1025-65535
acl ​Safe_ports port 280
acl ​Safe_ports port 488
acl ​Safe_ports port 591
acl ​Safe_ports port 777

acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !Safe_ports
http_access allow localhost manager
http_access deny manager
http_access allow pi1_acl
http_access allow pi2_acl
http_access allow localhost
http_access deny all

http_port 80 accel defaultsite=127.0.0.1

cache_peer 192.168.1.x parent 80 0 proxy-only name=test1
cache_peer 192.168.1.y parent 80 0 proxy-only name=test2
cache_peer_access test2 allow test2_acl

coredump_dir /var/spool/squid3

refresh_pattern ^ftp:    1440    20%    10080
refresh_pattern ^gopher:    1440    0%    ​1440
refresh_pattern -i (/cgi-bin/|\?)    0    20%    2880
refresh_pattern .    0    20%    ​4320

As I said, this configuration works, but I wanted to add a couple of https sites. I did my best to follow the example here, but it's already set up a little bit different than their recommended config format (or at least the format that it comes in by default).

More information on the https site that I want to forward to:

• It already has a .key and .crt file, and https works fine on it.

• I copied the .key and .crt file onto the squid box, and reference the location of those files in the config file. (not sure if I'm supposed to leave the .crt and .key file on the server, but I did)

• I haven't made any other changes on the server...so if I was supposed to, I haven't seen that anywhere.

Here is my new config file.

/etc/squid3/squid.conf

#new lines
https_port 443 accel defaultsite=127.0.0.1 cert=/path/to/myCert.crt key=/path/to/myKey.key

acl newServer_acl dstdomain www.newserver.com
http_access allow newServer_acl
cache_peer 192.168.1.z parent 443 0 proxy-only name=newserver ssl sslcafile=/path/to/myCert.crt
#end new lines

acl test1_acl dstdomain www.test1.com
acl test2_acl dstdomain www.test2.com

aclSSL_ports port 443

acl Safe_ports port 80
acl ​Safe_ports port 21
acl ​Safe_ports port 443
acl ​Safe_ports port 70
acl ​Safe_ports port 210
acl ​Safe_ports port 1025-65535
acl ​Safe_ports port 280
acl ​Safe_ports port 488
acl ​Safe_ports port 591
acl ​Safe_ports port 777

acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !Safe_ports
http_access allow localhost manager
http_access deny manager
http_access allow pi1_acl
http_access allow pi2_acl
http_access allow localhost
http_access deny all

http_port 80 accel defaultsite=127.0.0.1

cache_peer 192.168.1.x parent 80 0 proxy-only name=test1
cache_peer 192.168.1.y parent 80 0 proxy-only name=test2
cache_peer_access test2 allow test2_acl

coredump_dir /var/spool/squid3

refresh_pattern ^ftp:    1440    20%    10080
refresh_pattern ^gopher:    1440    0%    ​1440
refresh_pattern -i (/cgi-bin/|\?)    0    20%    2880
refresh_pattern .    0    20%    ​4320

This is my first time setting up a reverse proxy with squid, or with an https site, so I'm sure it's a small mistake, but I've looked through other config files, and can't seem to find a problem.

Any help is appreciated.

I'm using the saltstack documentation here to install RVM on my salt-minions

salt 2015.5.2 (Lithium)

On an Ubuntu 14.04 system

Here is my init.sls file for ruby.

gpg-import-D39DC0E3:
  cmd.run:
    - user: rvm
    - require:
      - user: rvm
    - name: gpg --keyserver hkp://keys.gnupg.net:80 --recv-keys D39DC0E3; echo '409B6B1796C275462A1703113804BB82D39DC0E3:4:' |gpg --import-ownertrust
- unless: gpg --fingerprint |fgrep 'Key fingerprint = 409B 6B17 96C2 7546 2A17  0311 3804 BB82 D39D C0E3'

rvm-deps:
  pkg.installed:
    - pkgs:
      - bash
      - coreutils
      - gzip
      - bzip2
      - gawk
      - sed
      - curl
      - git-core
      - subversion

rvm:
  group.present: []
  user.present:
    - gid: rvm
    - home: /home/rvm
    - require:
      - group: rvm

mri-deps:
  pkg.installed:
    - pkgs:
      - build-essential
      - openssl
      - libreadline6
      - libreadline6-dev
      - curl
      - git-core
      - zlib1g
      - zlib1g-dev
      - libssl-dev
      - libyaml-dev
      - libsqlite3-0
      - libsqlite3-dev
      - sqlite3
      - libxml2-dev
      - libxslt1-dev
      - autoconf
      - libc6-dev
      - libncurses5-dev
      - automake
      - libtool
      - bison
      - subversion
      - ruby
jruby-deps:
  pkg.installed:
    - pkgs:
      - curl
      - g++
      - openjdk-6-jre-headless

ruby-2.0.0:
  rvm.installed:
    - default: True
    - user: rvm
    - require:
      - pkg: rvm-deps
      - pkg: mri-deps
      - user: rvm

jruby:
  rvm.installed:
    - user: rvm
    - require:
      - pkg: rvm-deps
      - pkg: jruby-deps
      - user: rvm

jgemset:
  rvm.gemset_present:
    - ruby: jruby
    - user: rvm
    - require:
      - rvm: jruby

mygemset:
  rvm.gemset_present:
    - ruby: ruby-2.0.0
    - user: rvm
    - require:
      - rvm: ruby-2.0.0    

The gpg-import-D39DC0E3 is from a fix that should work (but isn't) found here

My end goal is to have a salt deployment of redmine from this fantastic tutorial.

Any help is appreciated.

My Current Output

----------
          ID: rvm
    Function: group.present
      Result: True
     Comment: Group rvm is already present
     Started: 
    Duration: 
     Changes:   
----------
          ID: rvm
    Function: user.present
      Result: True
     Comment: User rvm is present and up to date
     Started: 
    Duration: 
     Changes:   
----------
          ID: gpg-import-D39DC0E3
    Function: cmd.run
        Name: gpg --keyserver hkp://keys.gnupg.net:80 --recv-keys             D39DC0E3; echo                         '409B6B1796C275462A1703113804BB82D39DC0E3:4:' |gpg --import-ownertrust
      Result: True
     Comment: unless execution succeeded
     Started: 
    Duration: 
     Changes:   
----------
          ID: rvm-deps
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed.
     Started: 
    Duration: 
     Changes:   
----------
          ID: mri-deps
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed.
     Started: 
    Duration: 
     Changes:   
----------
          ID: jruby-deps
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed.
     Started: 
    Duration: 
     Changes:   
----------
          ID: ruby-2.0.0
    Function: rvm.installed
      Result: False
     Comment: Could not install ruby.
     Started: 
    Duration: 
     Changes:   
----------
          ID: jruby
    Function: rvm.installed
      Result: False
     Comment: Could not install ruby.
     Started: 
    Duration: 
     Changes:   
----------
          ID: jgemset
    Function: rvm.gemset_present
      Result: False
     Comment: One or more requisite failed
     Started: 
    Duration: 
     Changes:   
----------
          ID: mygemset
    Function: rvm.gemset_present
      Result: False
     Comment: One or more requisite failed
     Started: 
    Duration: 
     Changes:   

Summary
------------
Succeeded: 6
Failed:    4
------------
Total states run:    10

I'm running GitLab 7.9.2 c46d4f5 (Omnibus) on Ubuntu 14.04

On a little over half of our commits when someone navigates to a commit gitlab returns

500 We're sorry, but something went wrong

Also, on commits that don't return 500, they take anywhere from 5 to 20 seconds to show the page. I'm watching all of the logs as this is happening, and nothing that stands out as an obvious problem is happening.

When i go to a commit that returns a 500 error, the nginx logs return:

192.168.1.x - - [27/May/2015:09:35:44 -0500] "GET /project/module/commit/6876452e1df1d2846dhd1b2eb7d907e6ae8hf7d5 HTTP/1.1" 500 349 "https://gitlab.company.com/project/module/commits/staging" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/41.0.2272.76 Chrome/41.0.2272.76 Safari/537.36"

Something else that's been happening, that I'm not sure if it's normal or not is that every 3 to 5 seconds in the nginx logs I get:

192.168.1.y - - [27/May/2015:09:40:06 -0500] "POST //api/v1/builds/register.json HTTP/1.1" 404 27 "-" "-"

192.168.1.y is a gitlab ci runner, and I assumed that the 3-5 seconds of contact was some form of keep alive, but I definitely don't know.

Any help is appreciated, none of the other logs are showing any errors, or anything odd. I've checked unicorn, sidekiq, nginx, and postgresql.

As a side note, I can still access all of the stats that the UI provided via terminal, but I have a lot of users who prefer using the UI.

Another side note, is that this is a VM running on Hyper-v 2012, and the linux tools have been installed from these instructions. Having said that, I really don't think it's an issue with anything other than gitlab.

I used this method to install redmine

I installed redmine in /opt/redmine, and i checked my log in /opt/redmine/current/log/production.log

I recently upgraded from 2.5.2.stable.13345 to 2.5.3.stable.14266

My install info. Environment: Redmine version 2.5.3.stable.14266 Ruby version 2.0.0-p481 (2014-05-08) [x86_64-linux] Rails version 3.2.19 Environment production Database adapter Mysql2 SCM: Subversion 1.8.8 Git 1.9.1 Filesystem
Redmine plugins: redmine_agile 1.3.2 redmine_graphs 0.1.0 sidebar_hide 0.0.7

My tail of production.log

Completed 500 Internal Server Error in 42.6ms

ActionView::Template::Error (cannot load such file -- tzinfo/definitions/Europe/London):
1: <%= labelled_fields_for :pref, @user.pref do |pref_fields| >
2: <p><= pref_fields.check_box :hide_mail ></p>
3: <p><= pref_fields.time_zone_select :time_zone, nil, :include_blank => true ></p>
4: <p><= pref_fields.select :comments_sorting,[[l(:label_chronological_order), 'asc'],[l(:label_reverse_chronological_order), 'desc']] ></p>
5: <p><= pref_fields.check_box :warn_on_leaving_unsaved ></p>
6: < end %>
lib/redmine/views/labelled_form_builder.rb:42:in `time_zone_select'
app/views/users/_preferences.html.erb:3:in `block in         app_views_users_preferences_html_erb__1218068006107140812_70264432515560'
app/helpers/application_helper.rb:1050:in `labelled_fields_for'
app/views/users/_preferences.html.erb:1:in     `_app_views_users__preferences_html_erb__1218068006107140812_70264432515560'
app/views/my/account.html.erb:43:in `block in     app_views_my_account_html_erb_373455605642633520_70264429441020'
app/helpers/application_helper.rb:1043:in `labelled_form_for'
app/views/my/account.html.erb:9:in       `_app_views_my_account_html_erb__373455605642633520_70264429441020'

Everything seems to be working except for "My account" page.

I have found this problem other places, but no solutions

here

and here

The file it's looking for doesn't exist, but I am lost as to the solution. Any help is appreciated.

EDIT 1

After following the instructions below I have a new problem.

Web application could not be started

Cannot execute "/home/$USER/.rvm/gems/ruby-2.0.0-p481/gems/passenger-4.0.45/buildout/agents/SpawnPreparer": Permission denied (errno=13)

Application root
/opt/redmine/current
Environment (value of RAILS_ENV, RACK_ENV, WSGI_ENV, NODE_ENV and  PASSENGER_APP_ENV)
production
Ruby interpreter command

/home/$USER/.rvm/gems/ruby-2.0.0-p481/wrappers/ruby

User and groups

Unknown

Environment variables

Unknown

Ulimits

Unknown

I have looked all over for a solution to this, and I've checked my permission and owners on every file/directory involved. Everything is owned by the same user, and I've moved everything to 777 and nothing works.

A very similar version of this question is asked here , but it's completely different since the person had their top file in the wrong directory.

I have 3 projects, that I'll call project1, project2, and project3. My goal was to create a master/minion setup where my srv/salt directory looked like this:

/srv/salt
        |top.sls
        |/project1
                 |__/postgresql
                         |__init.sls
                         |__config.sql
                 |__/iptables
                         |__init.sls
                         |__config.sh
        |/project2
                 |__/tomcat
                         |__init.sls
                         |__config.sh
                 |__/java
                         |__init.sls
                         |__config.sh
        |/project3
                  |__/serverconfig
                         |__init.sls
                         |__config.sql
                 |__/conky
                         |__init.sls
                         |__config.sh

To accomplish this I edited /etc/salt/master to read

#/etc/salt/master
file_roots:
  base:
    - /srv/salt
  project1:
    - /srv/salt/project1
  project2:
    - /srv/salt/project2
  project3:
    - /srv/salt/project3

I also wanted to have nodes set up since I have static servers that will be involved in each project, and that's a very intuitive way for me to organize them.

I started by editing /etc/salt/master to show my nodegroups

#/etc/salt/master
nodegroups:
  project1: 'L@project1_server1,project1_server2,project1_server3'
  project2: 'L@project2_server1,project2_server2,project2_server3'
  project3: 'L@project3_server1,project3_server2,project3_server3'

When running the once this was set up, I tried applying the project1 state to its servers by using the following command:

salt -N project1 state.highstate

This completes correctly for project1_server2, project1_server3, but fails on project1_server1.

The error for project1_server1 is "No Top file or external nodes data matches found"

I'm open to suggestions for how this setup could be more easily implemented, but I'd like to know the reason behind this not working. Thanks for any help.

EDIT1

adding my top.sls file

#/srv/salt/top.sls
project1:
  project1:
    - match: nodegroup
    - postgresql
    - iptables
project2:
  project2:
    - match: nodegroup
    - tomcat
    - java
project3:
  project3:
    - match: nodegroup
    - serverconfig
    - conky

EDIT2

Output from salt -N project1 grains.item id

project1_server1:
    ----------
    id:
        project1_server1
project1_server2:
    ----------
    id:
        project1_server2:
project1_server3:
    ----------
    id:
        project1_server3:

EDIT3

The correct answer was provided by ChrisV

The syntax errors for the node in /etc/salt/master were the problem. I needed to change that, and then restart salt-master

pkill salt-master
salt-master -d

I have several Amazon AWS EC2 virtual machines that I created on AWS EC2. They were not imported, they were created there. I would like to export these machines in order to achieve local backups, and a local testing environment.

I have looked a lot of places, and found tons of information that says you can only export a VM from EC2 if you imported into EC2 originally. I have also found information that says you can only import into EC2 if the machine was originally exported from EC2.

My question is, is it possible to export a VM that was built on EC2, and somehow get it locally. I have read that you have to back it up to an S3 Bucket, and then download it, but Amazon's documentation says that you can only export it from there if it was originally imported.

Here are the links on serverfault that I found this question asked, but not answered.

Copy an Amazon EC2 Instance to use locally

Archiving Amazon AWS instances

I installed gitlab-ci using this guide and everything has gone pretty well. I got to the end of the tutorial and when I go to the ip address of the server I only get a Welcome to nginx! screen. I'm using Ubuntu 12.04 server, and I have seen a similar question answered, on stack overflow, but the answer doesn't apply to me (or I don't fully understand it) since I'm not using localhost. I can't use a browser on this server (to the best of my knowledge) since I'm ssh'ing to it.

Here is my /etc/nginx/sites-enabled/gitlab_ci

# GITLAB CI
# Maintainer: @randx
# App Version: 2.0

upstream gitlab_ci {
  server unix:/home/gitlab_ci/gitlab-ci/tmp/sockets/gitlab-ci.socket;
}

server {
  listen 192.168.1.151:80;         # e.g., listen 192.168.1.1:80;
  server_name git-ci 192.168.1.25;     # e.g., server_name source.example.com;
  root /home/gitlab_ci/gitlab-ci/public;

  access_log  /var/log/nginx/gitlab_ci_access.log;
  error_log   /var/log/nginx/gitlab_ci_error.log;

  location / {
    try_files $uri $uri/index.html $uri.html @gitlab_ci;
  }

  location @gitlab_ci {
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect     off;

proxy_set_header   X-Forwarded-Proto $scheme;
proxy_set_header   Host              $http_host;
proxy_set_header   X-Real-IP         $remote_addr;

proxy_pass http://gitlab_ci;
  }

  # adjust this to match the largest build log your runners might submit,
  # set to 0 to disable limit
  client_max_body_size 10m;
}

I think my problem is in the server_name field, but my ip address is all I have for the server. I don't have an actual name for the server set up via DNS yet, so I'm not sure what I should put for the server_name and source.example.com for the server_name field. I've tried a few combinations, but nothing has worked. Thanks for any help.