davidgo's questions

I'm looking at purchasing a 1u (SuperMicro 815 based) server which unfortunately does not have rails - and I need to put this into a standard 19" rack [ I'm not sure of the model of rack, its whatever is at the data center).

I am aware you get universal rails (eg https://www.startech.com/en-us/server-management/unirails1ub).

What worries me is that rack rails can't be infinitely thin - and as these are universal they are not clipping in to the sides of the server. Do 1u cabinets typically have enough free space between U's them so they can work with universal rail kits or how do these things work?

Title says it all.

If I want to use a DL360 gen 8 server with rails labelled 364998-001 (which Google Tells me are for G7 servers), can they be made to work with a G8 server and if so with how much work?

(I don't have easy access to the rails to try them beforehand. My guess is they won't work, but it would be nice if they did - and I can certainly imagine a world where they would fit)

I suspect I can't see the wood for the trees but I am having massive issues trying to test the memory on an HP Proliant DL380 gen8 system and I need help!

When I use an Ubuntu 20.04 install, boot Grub I can select memtest86+ - The problem I have is that it always freezes at the very start of test 7 in the first few seconds of memory testing. If anyone can definitively advise that this means the memory is bad I'd appreciate the advice - however from this reddit post it seems probable to me its an error with Memtest86+ 5.01. Its been less then an hour, but thus far "memtester 60G" under Ubuntu has not failed which would seem to support the Reddit post.

I try download and burn a USB image for Memtest86 5.31b (and burn it to an iso with pv. The iso mounts fine on my desktop) - This fails to boot on the Gen8 server is there any non-obvious trick to booting this?

I believe I can't use memtest86 as it requires UEFI boot which Gen8 servers don't do.

I have been unable to find a .elf binary for memtest86+ 5.31b - and, of-course, trying to boot the .bin file fails.

Absent being able to get memtest86 / memtest86+ to work, how good a stand-in is running "memtester 60G" from Ubuntu 20.04 on a system with 64 gigs of memory?

Is there any way to get memtest86+ working properly on my server, or any good alternative solution which does not require a running that I can use to test the systems memory?

I have a need to replace some CPUs in an HP DL360 server (g8 or g9 I believe). FWIW the new CPU will be V1 or V2 E5-26xx CPU's (most likely E5-2697v2 or similar - something that gives the maximum bang for buck)

I know that I want the CPUs to be the same model, and I've read "the same stepping" - but this does not appear to be commonly specified. Is matching MPN numbers or Ean numbers [ for Intel CPU's ] sufficient to ensure the CPU's will play nice?

I have an HP DL360 g9 server running RHEL8.1 on a P440ar controller running in HBA mode whereby exposing my SSD's to do software RAID under mdadmin.

If I get another server with another HP DL360 g9 server with a B140i controller, will I be able to configure it in HBA mode and, if I want, remove the disks from the current g9 server and plug them into the new server to access the disks? Is there any significant performance difference between the B140i and PR440ar in HBA mode?

I'm trying to do something that should in my mind be simple - I've done this plenty of times on other distros, but can't make any headway.

I'm trying to Install CentOS8 on an LVM partition on software raid using 2 x 2TB SSDs which are seen by the OS as /dev/sdb and /dev/sdc.

I could not find a way to build the software raid in the GUI, so I resorted to doing this at the command line. I created 2 RAID1 devices - a 4gig md0 device (with 0.90 metadata) and the rest of the disk as a second RAID1 device.

I then added LVM on /dev/md1 and created some raw partitions.

Now whenever I attempt an install, I get stuck with a black X windows with a large white pointer.

If I start without the disks installed, the GUI installer boots, but interestingly and confusingly as soon as I insert one of the disks it switches to the black screen with pointer !

How can I go about setting up this kind of install?

Update: I deleted the LVM settings on the RAID1 arrays and was able to boot into the setup menu. Unfortunately the installer showed only the 2 raw disks, and as soon as I rescanned the disks I was back to a black screen with arrow.

I have an R210II (Service tag 8C04HY1), which unfortunately does not have rails that I need.

I've found rack rails at https://www.dell.com/en-nz/work/shop/dell-readyrails-1u-static-rails-for-2-4-post-racks/apd/770-bbif/networking for an R210 server. Does anyone know if these will work with an R210II server?

FYI, according to the Parts list on my server, the rails my server originally shipped with were described as:

770-11333 : 2-Post/4-Post 1U Static Rails, Short Part Number Description Quantity HKNKW MOD,RCKRL,2/4PST,1U,STAT,SHT 1 JWFR6 KIT,RCKRL,2/4PST,1U,STAT,SHT 1

I am 99.99% sure this rule set of rules used to work fine, but has started throwing up errors if the meta rule at the end is uncommented. This appears to be engine related, as it happens in multiple places.

The resulting error when I lint is:

Sep 10 09:42:41.113 [3984] warn: config: Strange rule token: 0.01039
Sep 10 09:42:42.031 [3984] warn: lint: 1 issues detected, please rerun with debug enabled for more information

Can anyone help tell me why?

body            DG_CHINAREGSCAM2a       /we.received.an.application/i
describe        DG_CHINAREGSCAM2a       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2a       0.01040

body            DG_CHINAREGSCAM2b       /their internet keyword/i
describe        DG_CHINAREGSCAM2b       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2b       0.01041

body            DG_CHINAREGSCAM2c       /China(.*)domain name/i
describe        DG_CHINAREGSCAM2c       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2c       0.01042

body            DG_CHINAREGSCAM2d       /necessary.to.send.email.to.you/i
describe        DG_CHINAREGSCAM2d       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2d       0.01043

body            DG_CHINAREGSCAM2e       /company is associated with your company or not/i
describe        DG_CHINAREGSCAM2e       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2e       0.01044

body            DG_CHINAREGSCAM2f       /conflicts.with.your.company/i
describe        DG_CHINAREGSCAM2f       Words commonly used by China Scammers
score           DG_CHINAREGSCAM2f       0.01045

#meta           DG_CHINAREGSCAM2        (( DG_CHINAREGSCAM2a + DG_CHINAREGSCAM2b + DG_CHINAREGSCAM2c + DG_CHINAREGSCAM2d + DG_CHINAREGSCAM2e + DG_CHINAREGSCAM2f) > 0.01039 )
#score          DG_CHINAREGSCAM2        3
#describe       DG_CHINAREGSCAM2        Email identified as China Registry Scam

I have worked around this rule problem in this particular case by changing the + / score model to using "||" for a match of any rules, but this wont work in all cases.

Is there a fix for this, or an obvious cause I can't see?

I am wanting to conditionally load VirtualHosts depending on the existance of the appropriate key files required for SSL for that virtualhost (or failing which, have a generic certificate I can fall back to), and I've been unable to find a way to get Apache to do this.

I have come across the directive, which would appear to be what I'm looking for, but it keeps on complaining "Invalid command '

I'm using Apache 2.4.29 (Ubuntu) as packaged with Ubuntu 18.04.

I've tried configuring outside the directives, and also within it, bracketting the SSL configuration files.

It occurs to me that I might be missing a module, but according to my reading of the documentation this should be included in the core of Apache.

Can anyone shine light on why I IfFile is failing for me?

My question would seem to be the opposite of How to setup postfix to check SPF record only for domains that i want to check -

How would I go about modifying my Postfix server so that it checks SPF for incoming emails by default, but allows me to retain a whitelist of domains that can bypass the check?

My main.conf file includes a stanza :

smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10031,
                permit_mynetworks, 
                permit_sasl_authenticated,
                reject_unauth_destination,
                check_policy_service unix:private/spfpolicy

(10031 is policyd, btw)

My master.conf file includes a stanza :

spfpolicy       unix    -       n       n       -       -       spawn
        user=nobody argv=/usr/bin/perl /usr/sbin/postfix-policyd-spf-perl

My mailserver is receiving spam with an empty Subject line, and I want to modify the subject line to have some text in it so applications can filter on it - however I am struggling to do this.

One of the things I've attempted, unsuccessfully, is to use a header_checks directive to do this - can anyone provide advice why this may not be be working.

main.cf has a line:

  header_checks = regexp:/etc/postfix/header_checks

/etc/postfix/header_checks includes:

  /^Subject:$/          REPLACE Subject: No Subject Line
  /^Subject: $/         REPLACE Subject: No Subject Line

I've restarted postfix after making this change.

I do note I have an entry in master.cf for AV filtering as follows (but don't think its relevant - I only mention it because it is the only place the phrase "header" exists in that file :

  127.0.0.1:10026 inet  n -       n       -       16      smtpd
    -o content_filter=
    -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
    -o smtpd_helo_restrictions=
    -o smtpd_client_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks_style=host
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8

When I look at copies of the spam, it appears as best I can tell that the subject line reads

  Subject:

(With no space after the colon.)

Is there a best practice with respect of where to set up a VPN server which is designed to facilitate access to a corporate network, and why?

Historically I've set the VPN up on the gateway/core router, however I understand it is now common practice to set up a VM for the server.

Looking at the security aspect of and risk of a compromise, is it reasonable to assume that site-to-site VPNs which share the same level of access can be on routers using a preshared key while user to site VPNS should be on aVM using public/private key technogy?

If it makes a difference the preferred VPN technology is OpenVPN.

I run a mail server which appears to correctly handle emails with SPF set - however I've started receiving fake emails purporting to be from a bank - with the From address set as the bank - but which definitely do not originate from the bank.

The relevant headers of the email are as follows:

Delivered-To: [email protected]
Received: from mail.mydomain.org (localhost [127.0.0.1])
    by mail.mydomain.org (Postfix) with ESMTP id AD4BB80D87
    for <[email protected]>; Thu, 13 Oct 2016 20:04:01 +1300 (NZDT)
Received-SPF: none (www.tchile.com: No applicable sender policy available) receiver=mydomain.org; identity=mailfrom; envelope-from="[email protected]"; helo=www.tchile.com; client-ip=200.6.122.202
Received: from www.tchile.com (www.tchile.com [200.6.122.202])
    (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by mail.mydomain.org (Postfix) with ESMTPS id 40F6080B9F
    for <[email protected]>; Thu, 13 Oct 2016 20:03:57 +1300 (NZDT)
Received: from www.tchile.com (localhost.localdomain [127.0.0.1])
    by www.tchile.com (8.13.1/8.13.1) with ESMTP id u9D73sOG017283
    for <[email protected]>; Thu, 13 Oct 2016 04:03:55 -0300
Received: (from apache@localhost)
    by www.tchile.com (8.13.1/8.13.1/Submit) id u9D73smu017280;
    Thu, 13 Oct 2016 04:03:54 -0300
Date: Thu, 13 Oct 2016 04:03:54 -0300
Message-Id: <[email protected]>
To: [email protected]
Subject: CANCELLATION_PROCESS.
From: KIWI BANK <[email protected]>
Reply-To: 
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=029F3E3270D5187AA69203962BF830E3
X-Virus-Scanned: ClamAV using ClamSMTP

The key thing here is that kiwibank.co.nz is a legitimate, reputable bank where I am from, and have an SPF record which reads:

kiwibank.co.nz.     13594   IN  TXT "v=spf1 include:_spf.jadeworld.com ip4:202.174.115.25 ip4:202.126.81.240 ip4:202.12.250.165 ip4:202.12.254.165 ip4:66.231.88.80 include:spf.smtp2go.com include:spf.protection.outlook.com -all"

So, after some reading - it appears that the Envolope-From is correct, but the "From" has been faked. Is there any way I can correct/mitigate this without breaking "general" email ? I note that I use Postfix, Spamassassin and policyd (postfix-policyd-spf-perl) - and if its really so easy to bypass, whats the point of SPF?

I have acquired a number of mail users, and I'm wanting to transition them away from their current mail server and onto mine. I've set up perdition as a proxy which will allow me to proxy IMAP and POP connections - and I have control of the DNS used to direct them to the appropriate mail server. I do not have access to the old mail server.

The mail proxy server is running Linux

Unfortunately I suspect a lot of people are using the same server for POP3 and SMTP.

I am wanting to set up an SMTP proxy so I can seemlessly provide SMTP services to the customers during the transition - without an open mail relay. It does not appear that Perdition offers this solution natively.

Is anyone aware of a solution which either proxies SMTP requests (including AUTH requests) - ideally with the ability to map which requests go to which backend ? [ I've not tried an IPTables DNAT rule - I suspect this might work, but I loose the ability to do authentication to different servers on a per domain / client basis, which makes migration substantially harder ].

EDIT

I have tried configuring Dovecot as a director / proxy in place of Perdition. This works fine for IMAP and POP, but not for SMTP - Specifically it will authenticate based on username or domain name - it does not check the actual credentials against the SMTP server.

I have a WAN and I'm trying to use Nagios to check that a DHCP server in a subnet not directly visible to the Nagios box is up and handing out IP addresses, and I've been unable to make this work.

I have 3 places I can monitor DHCP from, but none seem to be working. The ideal would be to have Nagios monitor DHCP directly, failing which I would like to ssh to the DHCP server and check it from that box, failing which check its working from a core router with an interface on the DHCP server.

The DHCP server is used exclusively to dynamically assign static IP addresses to servers.

The DHCP server is on 192.168.254.1, and is running ISC DHCPD.

My dhcpd.conf file (currently) reads as follows:

# Long Lease times - 1 month, 1 year !
default-lease-time 2678400;
max-lease-time     31622400;
authorative;

subnet 192.168.224.0 netmask 255.255.224.0
{
    range 192.168.225.1 192.168.225.2;

    option domain-name-servers 192.168.200.254, 192.168.100.254, 8.8.8.8;
    option routers 192.168.254.254;
    range   192.168.253.0 192.168.253.0;

    host web.mydomain.co.nz
    {
            hardware ethernet 52:54:00:F3:80:32;
            fixed-address 192.168.242.2;
    }

    host nagiostest.mydomain.co.nz
    {
            hardware ethernet 52:54:00:00:00:01;
            fixed-address 192.168.254.250;
    }
}

web.mydomain.co.nz is working fine - ie DHCP is correctly assigning it an IP address.

When I run (from the DHCP server) any of the following commands I get a "no answer" reply -

dhcping -v -h 52:54:00:00:00:01 dhcping -v -s 192.168.254.1  -h 52:54:00:00:00:01 
dhcping -v -c 192.168.254.250  -h 52:54:00:00:00:01 
dhcping -v -c 192.168.254.250 -s 192.168.254.1 -h 52:54:00:00:00:01

When, from the server, I do a tcpdump -n -i eth0 port 68 I don't get any kind of response.

When I do something similar from a machine on another part of the network (located 2 hops away at 10.10.10.11) or when I try similar commands from the gateway I see the request coming in to the router, but no response - TCPDump running on the DHCP server shows -

   tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
08:53:28.103926 IP 192.168.254.254.bootpc > 192.168.254.1.bootps: BOOTP/DHCP, Request from 52:54:00:00:00:01, length 250

This happens even when I drop the firewall on the DHCP server altogether.

Using the check_dhcp plugin for nagios fairs no better.

How can I check to see the DHCP server is up and handing out leases ?

I use SSH extensively to administer a number of systems. Everything was working perfectly until a short while ago when I discovered I could not SSH into some servers (but others work perfectly).

I did recently upgrade to the latest Ubuntu 14.04, and wonder if thats the cause, but more to the point - how can I fix the issue.

In each case I'm sshing across a VPN using public/private keys. In each case if I manually telnet to port 22 I get the SSH banner. There is very little to help track down what the problem is, but when I ssh with "-v" the systems I'm trying to access fail after outputing

debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

When SSH succeeds on the other network I get the following

debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA d9:a7:23:9e:93:da:fe:15:54:5c:a3:01:54:b7:0c:be
debug1: Host '114.23.35.78' is known and matches the RSA host key.

I can confirm that it appears to be all the hosts behind the 1 network which are failing - and there is a fair number of them spanning different versions of CentOS. (Where I can SSH in the network is using CentOS and Ubuntu based boxes - I can reach both). All the connections behind the other network appear to work.

In both cases I am trying to use SSH protocol 2 (if I try and force protocol 1 I get "Protocol major versions differ: 1 vs 2)

I've tried clamping MTU on the OUTPUT, but that does not seem to have made a difference.

In

Any ideas how (without local access to the server) I can work out whats going on ?

EDITS WITH MORE INFO:

• When I try and SSH from my cellphone (going through the same router and similar VPN), access works fine.

• When I try to SSH from my computer via the cellphone via the Cellular Data connection it works fine.

• Regardless of whether I connect my computer to the router via a cable or access point it does not allow me to connect. (I can't connect my computer via my cellphone to my AP, but that would be because I can't use the AP as an AP Client and AP at the same time)

• There is a rather large number of entries in my routers ARP cache (over 1000) due, I suspect, to P2P activity earlier in the day. The modem is using "PPP extensions", so of-course the MAC address of the IP's is all the same, being that of the modem. I do not have the option of terminating the PPP session on the router with this modem. (Also not sure how relevant this is - I would assume its not relevant as the traffic is tunneled using OpenVPN, bypassing the router in a traceroute and also I get a Telnet banner.

• Problem does not seem to be IPTABLES related as I dropped iptables on the router of the network causing problems. I can connect to the external interface of the router no problems (no VPN), but as soon as I try the internal interface I get the problems described.

• Upgrading SSH and OpenVPN did not make any difference, neither did allowing password authentication.

I took a snapshot of a (live) luks encrypted block device, copied it to another system and am now trying to open it, but am unable to do so. Any help with solving this problem would be much appreciated.

The copied image is currently sitting on its own LVM partition

When I attempt to open the device with the command, and after entering the password

cryptsetup -v luksOpen /dev/hdd/luksCrypted blockname

I receive the response back "Cannot use device /dev/hdd/unenc_mail_dev which is in use (already mapped or mounted). Command failed with code 16: Cannot use device /dev/hdd/unenc_mail_dev which is in use (already mapped or mounted). "

I suspect there is something on the luks Device which says its mounted because it was a snapshot, but don't know what or how to clear it. I've tried looking for traces of this as a mounted filesystem by doing a df, losetup -a and grepping "luksCrypted" in the output of lsof with no luck.

When I run either of "crytpsetup status /dev/hdd/luksCrypted" or "cryptsetup status blockname" I get a response /dev/mapper/[luksCrypted|mailblock] is inactive.

Any ideas how I can open the volume ?

I have attempted to set up a read-only user in Postgres, but they are unable to log on. I am unsure the next step to take to solve the problem.

When I try and log on as user XXXX I get an error - psql: FATAL: password authentication failed for user "XXXX"

Looking at the log file I see the following lines:

< 2014-05-20 10:22:24.830 NZST >FATAL:  password authentication failed for user "XXXX"
< 2014-05-20 10:22:24.830 NZST >DETAIL:  Connection matched pg_hba.conf line 104: "host DATABASENAME        XXXX           10.0.0.0/8              md5"

I have, of-course, tried resetting the password - multiple times, to no avail. I have tried changing from md5 to password which did not work. Interestingly enough, setting the authentication mechanism to "trust" did work.

I am using Postgres 9.3.

I am unable to delete this user to reset it - I get an error "ERROR: role "XXXX" cannot be dropped because some objects depend on it DETAIL: privileges for database DATABASENAME"

If I create a new user, that new user has no problems connecting to the database. (I duplicated the appropriate line in pg_hba.conf and modified the username of-course)

Issuing the command "grant all on DBNAME to XXXX" does not seem to make any difference.

When I do a \ddp command I get

    Default access privileges
  Owner   | Schema |   Type   | Access privileges 
----------+--------+----------+-------------------
 postgres | public | sequence | XXXX=r/postgres
 postgres | public | table    | XXXX=r/postgres

I'm not entirely sure why this should stop me dropping the user altogether and recreating them - or how to [safely] fix this.

Any insite into what is going on or how to further debug the login problems would be much appreciated.

(I've posted this on Serverfault as I suspect it a bit to technical for Superuser. If I'm wrong please move it where appropriate)

I am remotely looking at a device which identifies as ReadyNAS ProUltra2 V1.4. It appears this device has 2 disks in it and runs a variant of Debian. I have noticed something concerning about the RAID array - It reports as follows

ReadyNAS:~# cat /proc/mdstat 
Personalities : [raid0] [raid1] [raid10] [raid6] [raid5] [raid4] 
md2 : active raid5 sda3[0] sdb3[1]
      972040704 blocks super 1.2 level 5, 64k chunk, algorithm 2 [2/2] [UU]

md1 : active raid1 sda2[0] sdb2[1]
      524276 blocks super 1.2 [2/2] [UU]

md0 : active raid1 sda1[0] sdb1[1]
      4193268 blocks super 1.2 [2/2] [UU]

Of concern is that md2 (which appears to be most of the space) is configured as RAID5 but with only 2 disks. From doing some reading I understood that mdadm requires a minimum of 3 disks for redundancy in a RAID5 configuration. I have no idea if this understanding is wrong, if the ReadyNAS is doing something non-standard or if this was incorrectly set up by whoever set it up - although I don't know why RAID5 would be enabled on a box like this one appears to be, and the person who set it up must have used a gui based setup process of some sort as they are not technical.

Anyone know if MD2 actually has redundancy or how this setup may have come into being ?

I want to compare two large binary files which are stored on different Linux machines with limited bandwidth between them and then back up only the blocks which differ – on the command line. To simplify the task, we can assume the files are not going to change during the comparison process, and the files are the same size.

This is almost like what I believe rsync does, only I don't want to modify the target file – I want to keep diffs which I can apply to the base image so I can recreate a copy at various points (ie when the diffs are taken).

I'm also aware of xdelta, but that appears to only compare files on the same machine.

The "process" I roughly envisage (hopefully all done by a script/program) might be -

1. (On each machine) produce a list of hashes for each block.
2. Compare the 2 sets of hashes.
3. Produce a file which pulls only the changed blocks in the source in such a way as they can be "merged" back with the target file.

Is anyone aware of a program, script or elegant method to do this without me having to cut code?