wolfgangsz's questions

I have successfully configured OSPF on all of our HP ProCurve 7102 routers, and most of our internal Linux routers. Routes get advertised, and all is peachy.

Except for the routes into the subnets handled by various OpenVPN services and other VPN connections around the company. Please consider the picture below, which shows a part of the company network:

The red arrows are VPN connections. The blue area at the bottom depicts OSPF area 0 (the backbone), which comprises routers in all other offices. The pink area depicts OSPF area 177 for one of our offices. The orange rectangle is the OpenVPN network in question, hosted on the Linux router indicated by the blue icon with the arrows.

The 10.177.0.0/16 subnet is properly advertised to all other OSPF areas. However, despite the fact that network 10.180.1.0/24 is included in the OSPF configuration, and interface tun0 is included in area 177(as a passive interface), this subnet does not get advertised.

Is that because this is actually an external route? If so, how would I tell the OSPF daemon to advertise that route?

This question is related to a previous one on OSPF routing.

Based on the advice give to the previous question, I have now made myself a network diagram, identified the backbone area and all other areas and started configuring OSPF on the various routers. All the HP ProCurve 7102dl routers talk to each and that works fine. However, on the intra-area routers, which are all Linux servers, I am using quagga (Version 0.99.10, from debian lenny) and this just won't work at all.

Here are some examples: In one particular area the primary network is 192.168.51.0/24 and both the linux router and the HP router have an interface in that network. The HP router has VPN tunnels to other HP routers and connects the entire subnet to the outside world. Behind the Linux router is another subnet on 192.168.52.0/24. When I look at the OSPF configuration for these interfaces, this is what I get:

Linux router:

uk-swa-bps01# show ip ospf interface eth0
eth0 is up
  ifindex 2, MTU 1500 bytes, BW 0 Kbit <UP,BROADCAST,RUNNING,MULTICAST>
  Internet Address 192.168.51.1/24, Broadcast 192.168.51.255, Area 0.0.0.51
  MTU mismatch detection:enabled
  Router ID 192.168.51.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 192.168.51.1, Interface Address 192.168.51.1
  No backup designated router on this network
  Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters
  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
    Hello due in 6.595s
  Neighbor Count is 0, Adjacent neighbor count is 0

uk-swa-bps01# show ip ospf database
   OSPF Router with ID (192.168.51.1)

            Router Link States (Area 0.0.0.51)

    Link ID         ADV Router      Age  Seq#       CkSum  Link count
    192.168.51.1    192.168.51.1    1335 0x80000016 0xabf6 2

And on the HP router:

bps-test-vpn#show ip ospf interface ethernet 0/2
eth 0/2 is UP, line protocol is UP
  IP address: 192.168.51.254 255.255.255.0, Area: 0.0.0.51
  Router ID: 192.168.51.254, Network type: Broadcast, Cost: 1
  Transmit delay: 1, State: DR, Priority: 1
  Designated Router (ID): 192.168.51.254, Interface Address: 192.168.51.254
  Backup Designated Router (ID): 0.0.0.0, Interface Address: 0.0.0.0
  Timer intervals: Hello: 10, Dead: 40, Retransmit: 5
    Hello due in: 00:00:05
  Number of neighbors: 0, Adjacent neighbors: 0

bps-test-vpn#show ip ospf 0 database 

OSPF router with ID: 192.168.51.254

  Router Link States, Area 0
    Link ID          Adv Router        Age     Seq #         Checksum
    10.10.2.1        10.10.2.1          601    0x80000004    0xECAD
    10.176.1.33      10.176.1.33       1526    0x80000086    0xAAE1
    10.181.1.1       10.181.1.1         826    0x8000009A    0x56EF
    192.168.51.254   192.168.51.254     819    0x8000001D    0x0B13

  Summary Net Link States, Area 0
    Link ID          Adv Router        Age     Seq #         Checksum
    10.171.0.0       10.10.2.1          825    0x80000001    0x2867
    10.171.0.0       10.176.1.33       1520    0x80000001    0x3990
    10.181.0.0       10.181.1.1        1226    0x80000009    0x4989
    10.181.1.0       10.181.1.1        1226    0x80000032    0xD9D1
    192.168.51.0     192.168.51.254     824    0x80000016    0xF915
bps-test-vpn#show ip ospf 0.0.0.51 database 

OSPF router with ID: 192.168.51.254

  Router Link States, Area 0.0.0.51
    Link ID          Adv Router        Age     Seq #         Checksum
    192.168.51.254   192.168.51.254     845    0x80000009    0xFD79

  Summary Net Link States, Area 0.0.0.51
    Link ID          Adv Router        Age     Seq #         Checksum
    0.0.0.0          192.168.51.254     610    0x80000005    0x15AA
    10.10.1.40       192.168.51.254     835    0x80000001    0x87FF
    10.10.1.44       192.168.51.254     830    0x80000001    0x6919
    10.10.1.52       192.168.51.254     835    0x80000001    0x0F6C
    10.10.1.72       192.168.51.254     844    0x80000001    0x3C2C
    10.10.1.76       192.168.51.254     835    0x80000001    0x1E45
    10.171.0.0       192.168.51.254     830    0x80000001    0xA269
    10.181.0.0       192.168.51.254     830    0x80000001    0x34CC
    10.181.1.0       192.168.51.254     830    0x80000001    0x17EB

Clearly OSPF is enabled on both sides on the interfaces that are in the 192.168.51.0/24 subnet, yet they don't talk to each other, because otherwise I would be getting some OSPF routes on the Linux Box. But I am not. So what am I doing wrong? I have tried all sorts of things, but I am not making any headways. Any advice would be appreciated. If you need additional info, just ask and I'll edit my post.

We have 4 offices in different countries. They are all connected via VPN to each other (i.e. at least one VPN tunnel from each office to all other three). Each office has between 1 and 4 separate subnets, and each office has an OpenVPN server. Two of the offices have a DMZ (because they host public services) and each office has direct routing to the Internet. Plus there is one "virtual" office, which is physically at the same place as one of the others, but logically completely separate and connected via a VPN tunnel. In total there are 16 subnets and at the moment this is all done with static routes, complete with failover routes. There are 12 main routers involved.

It all works fine, but I am beginning to wonder whether I should look into using OSPF. Everytime I need to add a subnet, I have quite a job on hand to make sure that all the routing tables are updated correctly.

So I was wondering whether anybody could offer advice on when to start using OSPF for this?

EDIT: If anybody can provide any pointers to a good tutorial or design guide for OSPF areas, I would be greatful.

Over time our company has acquired a few other companies, and each one of them had their own FTP server. We are now looking into consolidating all the user accounts and data into one, but keeping multiple frontends, spread over Europe, to provide some resilience and also to give better upload/download speed to customers and suppliers. We have high speed Internet connections in all locations, so central storage of all the data isn't an issue (and as we have redundant connections in all locations, an individual line going down isn't an issue either).

I am looking for the best way to have central admin over all the user accounts, for 3 or more frontend servers. In another post here I found a possible solution (proftpd with a mysql backend), but I am wondering whether there are other options.

I have a problem in one of my shell scripts. Asked a few colleagues, but they all just shake their heads (after some scratching), so I've come here for an answer.

According to my understanding the following shell script should print "Count is 5" as the last line. Except it doesn't. It prints "Count is 0". If the "while read" is replaced with any other kind of loop, it works just fine. Here's the script:

echo "1">input.data
echo "2">>input.data
echo "3">>input.data
echo "4">>input.data
echo "5">>input.data

CNT=0 

cat input.data | while read ;
do
  let CNT++;
  echo "Counting to $CNT"
done 
echo "Count is $CNT"

Why does this happen and how can I prevent it? I've tried this in Debian Lenny and Squeeze, same result (i.e. bash 3.2.39 and bash 4.1.5. I fully admit to not being a shell script wizard, so any pointers would be appreciated.

We use Active Directory (2003 and 2008) for all our users (70% Linux, 30% Windows). Normal user authentication works fine. I now have a situation where on a particular server I need to restrict the users that can login to members of a particular group in ADS. So I created the group and added the users in. Then I set in pam_ldap.conf

pam_groupdb cn=<group>,ou=Applications,dc=<domain>,dc=<tld>

and

pam_member_attribute memberOf

However, this does not seem to make any difference. I stopped nscd (just in case), but I can still log in using credentials of a user who is not a member of this group. Does anybody have experience with this?

There are other workarounds, but they are rather ugly and I would prefer not having to use them (e.g. extract all users via ldapsearch in a cron job and then put them into a list of allowed users, etc...). Oh, yes, I can see the members of this group just fine using ldapsearch. And I can see individual user's group memberships just fine, also using ldapsearch. I have put sshd on that server into debug mode, but the logs don't reveal anything useful. Any pointers would be highly appreciated.

We have around 70% linux users, all of which are configured to authenticate against Active Directory through LDAP. In order for this to work, we used the "Windows Services for Unix" under Windows Server 2003, and it all works fine.

We are now at a point where the server running this contraption is getting a bit tired and will be replaced with a newer machine, running Windows Server 2008 (where the relevant services such as user name mapping and password changes, etc., are integrated with the OS).

And here's the rub: If a new user is configured through the Win2k3 server, then it all works fine. If the same thing is done through the Win2k8 server, then :

1. The ADS plugin on the 2k3 server does not recognize it and behaves as if the UNIX attributes were never set.
2. The user cannot authenticate against ADS using LDAP.

Has anybody encountered this problem? If so, how did you overcome this?

If you need any additional information to provide further help, just ask and I shall provide it.

We run a news server for our engineering teams, which is also linked to the code repositories (so that all engineers can subscribe to any changes in the repos or just the projects they are interested in). On quite a regular basis (several times a day) I (as the sysadmin for that server) receive bounces from innd with the above as the first line. The news server simply rejects these messages and the articles don't get posted. Here is an example:

inews failed: inews: cannot send article to server: 441 437 No colon-space in "X-MS-TNEF-Correlator:" header inews: article not posted


-------- Article Contents

Path: aminocom.com!ctaylor
From: [email protected] (Cameron Taylor)
Newsgroups: amino.qa.reports
Content-Language: en-US
Content-Type: multipart/alternative;
 boundary="_000_A2AB95742ADD524795C13EDE8F8CCD201A798C0Eukswaex01_"
MIME-Version: 1.0
Subject: [QA REPORT] MDK 400 release 3.4.33 **PRE-RELEASE**
Message-ID: 
Date: Thu, 9 Sep 2010 16:15:16 +0000
X-Received: from uk-swa-ex02.aminocom.com (uk-swa-ex02.aminocom.com [10.171.3.10])
 by theoline.aminocom.com (8.14.3/8.13.8) with ESMTP id o89GF8tx019494
 for ; Thu, 9 Sep 2010 17:15:08 +0100
X-Received: from uk-swa-ex01.aminocom.com ([10.171.3.9]) by uk-swa-ex02
 ([10.171.3.10]) with mapi; Thu, 9 Sep 2010 17:15:18 +0100
X-To: QA Reports 
X-Thread-Topic: [QA REPORT] MDK 400 release 3.4.33 **PRE-RELEASE**
X-Thread-Index: ActQOjBdms0CSJsORNSxRIMSZ4H3Ow==
X-Accept-Language: en-US, en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
X-Auto-Response-Suppress: DR, OOF, AutoReply

--_000_A2AB95742ADD524795C13EDE8F8CCD201A798C0Eukswaex01_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

SQA Test Report

[QA REPORT] MDK 400 release 3.4.33 **PRE-RELEASE**


Status

.... (rest of the message is not important)

And yes, quite clearly this header doesn't have anything after the colon. The man page for innd doesn't specify why it rejects these messages, it just says it rejects them.

So far I have found out these headers are linked to messages in RTF format (coming from Outlook clients), where normally the formatting information would be stored in a winmail.dat attachment. The clients all use MS Exchange 2010 servers to send their mail (identified above as uk-swa-ex02.aminocom.com) which forwards the message to the news server.

Does anybody know what advice I need to give these users to avoid their articles getting bounced? Or can I change the behaviour of innd? Or do I need to filter these headers out before innd processes the articles?

I know this is almost embarrassing, but it happened to me anyway.

I have a server here running Fedora 10, with sendmail (8.14.3) on it. The MTA is only used to send messages from the localhost to a smarthost. This used to work fine, except I needed to change that smarthost, as it has been replaced by another machine with different IP address and different DNS name (during the course of an internal streamlining effort).

I followed some instructions I found on a forum somewhere and added a line to the mailertable, like this:

aminocom.com ESMTP:[mail.aminocom.com]

Then I used the m4 utility to create new .cf files and restarted sendmail. And bang, I get the following error:

service sendmail restart
Shutting down sm-client:                                   [FAILED]
Shutting down sendmail:                                    [  OK  ]
Starting sendmail:                                         [  OK  ]
Starting sm-client: No local mailer defined
QueueDirectory (Q) option must be set
                                                           [FAILED]

I have googled this, but I come up mostly with forum posts that nobody responded to.

According to sendmail.cf, the QueueDirectory is defined. And there seems to be next to no information available anywhere as to how to define a local mailer???? Plus: when I use the m4 utility to also re-create submit.cf, the resulting file is not accepted and throws an error like this:

Starting sm-client: /etc/mail/submit.cf: line 0: invalid argument to V line: "ERSIONID(linux setup"

And this, even though the submit.mc file is exactly the same as on another server (also running Fedora 10 with sendmail), where everything works perfectly fine.

Ideally I would love to just ditch sendmail altogether and use exim, but in this particular case I haven't got that choice. So, could anybody please point me in the right direction?

I am busy configuring some new gateway servers, using exim 4.69, complete with spamassasin, ClamAV and greylisting. The essential issue is that the ACL for the greylister refers to a file, which should list all the whitelisted mail servers. Each entry is either a single host or a subnet definition, like this:

10.160.0.0: \
217.10.144.0/24: \

According to the exim4 manual, this should work. However, when the list is used, Exim throws error messages like this:

8878 host in ": +relay_from_hosts : /etc/greylistd/whitelist-hosts"? no (malformed IPv4 address or address mask)

As soon as I remove the "/24" from the above line, it all works like a charm. If I escape the "/24" with a backslash, the error doesn't show up, but the addresses are not matched correctly. either. If I need to use the form without the network masks for everything, I would have to write endless lists of IP addresses.

I have tried to google this, but no luck at all (only somebody who was using a dodgy text editor). Maybe it's worth mentioning that this runs on a DELL R310, under Debian. In order to get the OS installed and running, we had to use a special backport which identifies itself as "2.6.32-trunk-686", as the normal lenny kernel doesn't have the drivers for the mobo hardware. But I cannot see how this would impact on parsing of text files? Has anybody seen this before? Or am I just not seeing the wood for the trees here?

I have a number of DNS servers, all running bind9 (9.5.1, to be specific) under fedora. 4 of them are slaves, fed by a common master for our public DNS. These are all located on the public gateways of our various offices. One of them has tons of messages in its log files similar to these:

Jul 21 17:26:18 gateway named[3487]: client 10.171.3.8#52500: view internal: error sending response: host unreachable

I wonder where that comes from. The firewall is open on port 53 between the two machines (10.171.3.8 is an internal DNS server located on a Windows Domain Controller). The internal domains do NOT list the gateway as a name server (so there should not be any attempts of replicating the domains), and the gateway does not handle any internal DNS. The clients in these messages vary between the two domain controllers on the internal network and a third internal name server (running bind9 on debian in a different segment of the network). Any pointers are highly welcome.

In response to the first reply:

The issue with this really is that tcpdump doesn't show any problems. Here is an extract from "tcpdump -i any port 53"

09:13:38.283308 IP valine.aminocom.com.61815 > ns-pri.ripe.net.domain: 14075 PTR? 166.225.58.95.in-addr.arpa. (44)
09:13:42.007410 IP gateway-eng.aminocom.com.37047 > alanine.aminocom.com.domain: 35410+ PTR? 12.3.172.10.in-addr.arpa. (42)

At the same time, the DNS log shows:

Jul 22 09:13:38 gateway named[3487]: client 10.171.3.6#61300: view internal: error sending response: host unreachable
Jul 22 09:13:40 gateway named[3487]: client 10.172.3.12#56230: view internal: error sending response: host unreachable
Jul 22 09:13:40 gateway named[3487]: client 10.171.3.8#55221: view internal: error sending response: host unreachable
Jul 22 09:13:49 gateway named[3487]: client 10.171.3.8#51342: view internal: error sending response: host unreachable

So clearly at 09:13:40 there were two unsuccessful attempts to connect to internal machines (10.172.3.12 and 10.171.3.8, both are DNS servers), but nothing in the tcpdump output.

We have a very mixed network, with most clients being Debian Lenny, the rest Windows XP/Vista/7. The network itself is split into two segments (for technical reasons) called "corporate" and "engineering". On the "corporate" side all clients get their IP addresses from a Windows DHCP server and the dynamic updates into the Windows DNS work just fine. On the "engineering" side, clients get their IP addresses from a linux machine running the standard ISC DHCP server. Although this server is configured to do dynamic DNS updates, they actually don't work. Anybody got any advice on how to fix this?

Please note: dynamic updates from the clients directly into the DNS would work, but are not an option for us. So this is strictly on how make this work from an ISC DHCP server to a Windows DNS server.

We have a Debian file server, configured to serve up samba shares, using winbind and kerberos. This is configured to authenticate against a Windows2003 DC.

All worked fine until recently when I did a maintenance update on all packages. Since then, all attempts to connect to any of the shares (and also to just log into the box) fail. The logs contain this message, which seems to be at the root of the evil:

[2009/09/14 12:04:29, 10] libsmb/clikrb5.c:get_krb5_smb_session_key(685)
  Got KRB5 session key of length 16
[2009/09/14 12:04:29, 10] libsmb/clikrb5.c:unwrap_pac(280)
  authorization data is not a Windows PAC (type: 141)
[2009/09/14 12:04:29, 3] libads/kerberos_verify.c:ads_verify_ticket(430)
  ads_verify_ticket: did not retrieve auth data. continuing without PAC

From there on it fails to find the user account on the DC, subsequently remaps the user to user nobody and then (rightly) refuses to grant access to the share.

However, the following works just fine:

wbinfo -a user%password

I was wondering whether anybody has had this problem and could provide some insight. I would be happy to provide neutralised config files.