C-Otto's questions

I run ftp.halifax.rwth-aachen.de, which is a public mirror serving (among other projects) Debian Linux files. Debian regularly checks mirror servers, and often experiences DNS issues for this host. I don't see what could be wrong with the DNS setup. The server is very active and I haven't received any other DNS related issue report. Sadly, I don't have any more details than that.

• Hostname ftp.halifax.rwth-aachen.de
• IPv4 / A record 137.226.34.46
• IPv6 / AAAA record 2a00:8a60:e012:a00::21
• ftp2.de.debian.org is an alias / CNAME for ftp.halifax.rwth-aachen.de

Errors reported by Debian: https://mirror-master.debian.org/status/mirror-info/ftp.halifax.rwth-aachen.de.html

Previous discussion: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021002

$ dig ftp.halifax.rwth-aachen.de

; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> ftp.halifax.rwth-aachen.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40623
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;ftp.halifax.rwth-aachen.de.    IN  A

;; ANSWER SECTION:
ftp.halifax.rwth-aachen.de. 366 IN  A   137.226.34.46

;; AUTHORITY SECTION:
halifax.rwth-aachen.de. 885 IN  NS  dns-2.dfn.de.
halifax.rwth-aachen.de. 885 IN  NS  dns-1.dfn.de.
halifax.rwth-aachen.de. 885 IN  NS  zs2.rz.rwth-aachen.de.
halifax.rwth-aachen.de. 885 IN  NS  zs1.rz.rwth-aachen.de.

;; Query time: 0 msec
;; SERVER: 185.12.64.1#53(185.12.64.1) (UDP)
;; WHEN: Sat Jan 20 22:51:35 CET 2024
;; MSG SIZE  rcvd: 154

What's wrong with the DNS setup and what kind of issue could trigger the warnings seen in Debian's system?

I have a Dell PowerEdge R730xd which I can only access using the iDRAC 8 web interface. I'm unable to launch the Java (JNLP) virtual console, which might be necessary to fix the issue. I'm also unable to access the SSH feature of the iLOM due to some firewall issue I can't fix myself.

The server does not boot, as the first disk failed and doesn't have a valid boot sector, anymore. I'm unable to select another device in the web interface, apparently I require more permissions do do so (I am able access most other settings, though).

I have 12 disks in the system, and grub should be configured for most of them. The internal RAID controller is not in use (i.e., the disks are managed by Linux).

1. How can I select another disk to boot from using the web interface?
2. How can I access the console (via the Java virtual console) using Debian 10?

I tried running the JNLP using Java 6 to 11, and I also tried running avctKVM.jar directly (resulting in "access denied").

EDIT (Post Mortem): Everything is fine using the HTML 5 console (see answer below). Bug your admin to enable it before you need it. I've been unable to use the Java console, but won't need it anymore. Selecting another boot disk seems to be a premium feature which mere mortals cannot use. I don't know why.

My best attempt for running the Java console (giving "access denied", though):

1. Take host, user, and password out of the JNLP file
2. Download the JAR files mentioned in the JNLP file
3. Put the two libs into ./lib (and unzip, place .so files alongside)
4. Fiddle with the security settings in jcontrol ("advanced" tab)
5. Run:

/usr/lib/jvm/java-1.8.0-openjdk-amd64/bin/java -Djavax.net.debug=all -Dcom.sun.net.ssl.checkRevocation=false -cp avctKVM.jar -Djava.library.path=./lib com.avocent.idrac.kvm.Main ip=HOST kmport=5900 vport=5900 user=XXX passwd=YYY apcp=1 version=2 vmprivilege=true "helpurl=https://HOST:443/help/contents.html"

(To work around the "is a duplicate" issue: I don't see many requests. The number is rather small. Instead, each request downloads a lot of data.)

The server I'm talking about has 2x10 GBit/sec of Internet connectivity, with a backend of 40 GBit/sec. It serves around 20 TByte of data to the public, using nginx/vsftpd/rsyncd on a Debian Stable system. In addition, apache2 is used to serve some non-static content, but this can be disregarded.

The hardware is beefy enough to serve up to around 18 GBit/sec (as observed once), and traffic is free. As the server is a mirror of open source software and other public software, there's also not an issue of downtime being a critical problem.

However, I observe a specific pattern of DDoS attack I'd like to stop affecting the server. Whenever the attack is ongoing, most of the DVD ISOs of Debian (around 300 GByte, so way more than what fits in RAM) are downloaded by multiple hosts, with downloads per file repeating. Depending on how organized the attack is, this causes the bandwidth to increase quite a lot, and of course puts some stress on the hardware, while limiting the experience for legitimate users of the server at the same time.

In these attacks, typically 2-3 networks are coordinated in the attack, each downloading files as described. Most of the times it seems one click hosters or file caches of some sort are abused, tricked into downloading the same file over and over - and this being automated to download a number of different files as part of the attack.

Is there any way I can configure nginx to auto-ban certain IP ranges? Or limit traffic rates to, say, 1 GBit/sec for these networks (for some time)?

I don't want to impose a general limit, as the server actually should be used, even for high-speed transfers (mirror to mirror, most likely).

As a remark, a clever attacker, whatever the motivation might be, could start to abuse FTP/RSYNC instead of HTTP, working around the solutions this question might produce.

Currently, when I realize an DDoS attacks is going on, I scan the log files, identify the abusing networks, and ban them manually.

I'd like to setup a two node high availability cluster using corosync/pacemaker/drbd. For that, of course, I need fencing. As far as I understand, all IPMI/iLO/... solutions do the job, but only as long as the chassis has power. In the case that node B loses power, node A does not have any chance of using STONITH against node B.

What kind of hardware solves this problem? Is there a (standard rack) server which provides IPMI/iLO/... hardware running on battery? Should I use a network-connected UPS?

I am installing a simple Corosync/pacemaker/drbd high availability cluster using Centos 7 and would like to provide fencing/STONITH using custom hardware (power switches using USB connections). As such, I need to add these devices as STONITH resources in my cluster. Is there a simple dummy script I can start with? I found several files in /usr/sbin/fence_*, but these seem to connect via some sort of network and only accept pre-configured options.

I am interested in the two features named "Fault Tolerance" and "App High Availability" which are part of some VMware products. As far as I understand the vCenter Server instance is needed to perform administrative tasks. Therefore, a crash of the vCenter Server makes it impossible to modify certain aspects of the VMs, but the VMs still run.

I also found out that the "HA" feature still works (with some minor limitations) even when no vCenter Server is running.

Now, my questions:

What happens to a VM which is configured to use FT if the vCenter Server is offline and the host of the primary VM is offline? Ideally, FT would take care to seamlessly continue the VMs operation on the secondary host.

What happens to a VM which is configured to use App HA if the vCenter Server is offline and the app inside the VM crashes? Ideally, the app crash would be detected and depending on the configuration the app or the whole VM would be restarted.