Using Apache/2.4.54 (Win64)

I have been requested to rewrite from old domain to new like this

• From https://oldtest.mydomain.com/company/customerpage/#/customer/<getThisNumber>/something
• To https://newtest.mydomain.com/company/something/customer/<getThisNumber>

It could have been fine, using regex to grab the number and pass it to the new and then just redirect using [L,R=301].

But ref. this post on StackOverFlow

I know the hashtag is a fragment identifier and that strings after the hashtag aren't something you can process with mod_rewrite, but I was expecting the hashtag itself to show up. So I've tried rules to match like these

So what I have tried is (snippet)

<LocationMatch "^\/company\/customerPage\/">
    LogLevel alert rewrite:trace3
    RewriteCond %{QUERY_STRING} ([0-9]*)\/something$
    RewriteRule ^(.*)$ "https://newtest.mydomain.com/company/something/customer/$1" [L,R=301]

This does not work, question is if I have a minor issue in my code or I am also aware that there might be a risk for this not being doable...but hopefully not.

Part of the work moving from Windows 2012 to 2019 involves upgrading the current install of Postgres from 9.6 to 10. I'm trying to use pg_upgrade and after some struggle with file permissions I have managed to start the process with the command

pg_upgrade.exe -b "c:/Program Files/PostgreSQL/9.6/bin" -B "d:/PostgreSQL/10/bin" -d "D:/PostgreSQL/9.6/data" -D "D:/PostgreSQL/10/data" --old-port=5432 --new-port=5433 -U postgres -v --check

It starts fine, but after a while it fails like this

"d:/PostgreSQL/10/bin/pg_ctl" -w -l "pg_upgrade_server.log" -D "D:/PostgreSQL/10/data" -o "-p 5433 -b -c synchronous_commit=off -c fsync=off -c full_page_writes=off -c vacuum_defer_cleanup_age=0 " start >> "pg_upgrade_server_start.log" 2>&1

connection to database failed: fe_sendauth: no password supplied
could not connect to target postmaster started with the command:
"d:/PostgreSQL/10/bin/pg_ctl" -w -l "pg_upgrade_server.log" -D "D:/PostgreSQL/10/data" -o "-p 5433 -b -c synchronous_commit=off -c fsync=off -c full_page_writes=off -c vacuum_defer_cleanup_age=0 " start

But if I try to run the command by itself, it starts without any issues. I have updated the pg_hba.conf-file so I can issue psql -U postgres -host 5433 without being prompted for password. Other than that I cannot find anything of value in the pg_upgrade*.log files.

Working in an almost Windows only company - and need to set up a syslog server recieving messages from our proxy, firewall and VPN-applicances. For now we have decided to use Kiwi Syslog server, but quickly realized that with the default setting of the proxy and the firewall we are way above the max number of messages for Kiwi pr. hour - which is 2 million messages. So instead of only one server, we need to configure at least one server pr. appliance.

Trying to figure out what throughput we could expect if we where running Linux. If I'm not totally mistaken the Syslog-ng premium delivers way over that - it measures messages pr. second not pr. hour,- but that is anyhow a licensed version. I have not been able to find any numbers for any open source versions.

I want to install the TortoiseSVN-client on a bunch of servers, using Powershell remoting. Basic operations work, but the below command won't work as remoting

Invoke-Command -ComputerName myserver -ScriptBlock {Start-Process "msiexec.exe" -ArgumentList "/i \\fileserver\install\subversionclients\TortoiseSVN-1.14.0.28885-x64-svn-1.14.0.msi  /passive /norestart /qn ADDLOCAL=ALL" -Wait}

On the other hand, logging on to the server and issuing the following

Start-Process "msiexec.exe" -ArgumentList "/i \\fileserver\install\subversionclients\TortoiseSVN-1.14.0.28885-x64-svn-1.14.0.msi  /passive /norestart /qn ADDLOCAL=ALL" -Wait`

...that works. I have not been able to figure out why - no errors are shown, and no return value either. As I have understood Invoke-command it is elevated by default. Trying to add -Verb RunAs does not help either. I do also have the -wait-argument (ref. https://serverfault.com/a/550169/180067) but that did not help either in my case.

We have an issue with some .Net applications getting connection timeouts when doing SQL requests to Db2. The code have been updated to improve logging when such timeout occurs. But, since we are not able to reproduce the errors and they only occur in production we need to "force" timeouts.

Is it possible to configure Windows firewall on Windows 2016 to enforce timeouts for all connections to ip-adress:portnumber?

As part of the upgrade from Win 2008 to Win 2016-project, we have introduced the use of DNS-aliases (way overdue) for all IIS-sites in all enviroments. We now use IIS with ARR installed as a proxy server in order to "hide" the servername:portnumber for the clients. All this is straight forward except for a service that is protected using Windows Authentication (NTLM, Negotiate). This is causing problems for all clients of that service that uses the DNS-alias (other services, Clickonce applications

• For all other clients than Internet Explorer on my laptop the cs_username field is empty in the logs.
• Accessing the service using Internet Explorer - cs_username contains my username and I'mlogged in (http 401, followed by http 200)
• Accessing the service using Chrome, I get a pop up requesting username password
• On a server logged on as my admin-id and adding the alias to "Local Intranet" it did not help for Chrome, but on a server where I was logged on with my admin userid - it did enable IE to log on without uid/pwd.

Being all new to IIS and not being a developer, but an operations guy, I'm a bit lost at the moment on where I need to change stuff - in the Clickonce app, on the IIS ARR-server or on the server hosting the service?

Topology

Our IIS setup has a IIS Application Request server in front of three types of IIS servers (ruleengine, Microfocus Cobol on IIS and "the rest of the applications". All the basic setup of each server is done by a common script (Configure IIS and more). The DNS-aliases is "served" by the IIS ARR (port 80), and then it redirects the request to the server hosting the application with another port number.

When accessing http://myapp.test.mycorp.com/TheApp/theService.svc on the default page it shows

svcutil.exe http://myapp.test.mycorp.com/TheApp/theService.svc?wsdl

which is very fine, but on the two other servers - with the same basic setup - it will show

svcutil.exe http://theservername:theportnumber/TheApp/theService.svc?wsdl

Both sites are only bound to the port number, not the DNS-alias as well (did try that, but then it will show DNS-alias:portnumber and also prevent testing on the server using localhost and also using the severname)

What other settings / configurations on IIS can be different that would explain why the url is shown different on the different servers?

Update

And now - noticed that for the .svc?wsdl is shows DNS alias and no ports. Nothing done for fixing the issue. Hoping that it has solved all problems, but checking .asmx?wsdl, it uses DNS-alias, but adds the port number. So then checking yet another service, a second .svc - all three on the same server. The last service shows the server name and port number (not the DNS-alias).

So now, it does not seem to be related to server configuration, but the services itself.

I think I have reached the end of Google, but still not able to find the part number I need to download the license file for IBM Data Server Client 11.5. Not listed here https://www.ibm.com/support/pages/db2-version-111-activation-key-part-numbers and I start to get tired of the message

LIC1407N You are trying to register an invalid license certificate file

Update

The client will be serving a set of .Net applications hosted on IIS. They are dependent on the db2 catalog konfig 'test' (and 'prod'). The db2 catalog commands is successfully, but when I want to verify the connection to db2 using command

db2 connect to TEST user TESTUSER

I get (when applying the valid password)

SQL1598N  An attempt to connect to the database server failed because of a
licensing problem.  SQLSTATE=42968

If I type a password I know is wrong I get

D:\IBM\SQLLIB\BIN>db2 connect to TEST user TESTUSER
Enter current password for CFFSAFI:
SQL30082N  Security processing failed with reason "24" ("USERNAME AND/OR
PASSWORD INVALID").  SQLSTATE=08001

So the first error with correct password and the last one with the wrong, to my knowledge it confirmes that I'm able to connect to db2

Which is explained here https://www.ibm.com/support/pages/sql1598n-error-connecting-mainframe-db2-ibm-data-server-driver-even-though-db2-connect-license-file-exists-license-directory-install-path (I do not have a license file in the path)

D:\IBM\SQLLIB\BIN>db2licm.exe -l
Product name:                     "IBM Data Server Client"
Product identifier:               "db2client"
Version information:              "11.5"

Trying to create a virtual host proxying to an application hosted on Openshift with a really nasty url. When trying to do this I find the following error in the log file

AH01997: SSL handshake failed: sending 502

and in the browser the following is shown

Proxy Error The proxy server could not handle the request GET /. Reason: Error during SSL Handshake with remote server

Which I first thought had something to do with the cipher, but...I do not think so now. So I must admit that I am really not sure what the root cause can be.

Apache info

Server version: Apache/2.4.38 (Win64)
Server built:   Jan 17 2019 19:32:38

Apache config

<VirtualHost *:443>
SSLEngine on
SSLCertificateFile      ${cert_file}
SSLCertificateKeyFile   ${cert_key}

DocumentRoot "${SRVROOT}/htdocs/mattermost/443"

ServerName mattermost.mycorp.com
ServerAlias mattermost.mycorp.com

LogLevel trace6
ErrorLog d:/logs/prod/prod_error_443_mattermost.mycorp.com.log
CustomLog d:/logs/prod/prod_access_443_mattermost.mycorp.com.log mycorpdirect env=!forwarded
CustomLog d:/logs/prod/prod_access_443_mattermost.mycorp.com.log mycorpproxy env=forwarded


SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off
SSLProxyCheckPeerCN Off
SSLProxyProtocol -all +TLSv1.2
SSLProxyCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

ProxyPreserveHost On
ProxyRequests Off
ProxyVia On

#RewriteEngine on
#RewriteRule ^(/.*)  https://mattermost-kalypso.cloudappsk2.11913.2016.dcs.mycorp.com/ [P]
ProxyPass / https://mattermost-kalypso.cloudappsk2.11913.2016.dcs.mycorp.com/

ProxyPassReverse / https://mattermost-kalypso.cloudappsk2.11913.2016.dcs.mycorp.com/

Apache error log

[Thu May 09 15:05:02.694205 2019] [ssl:info] [pid 5668:tid 1836] [remote yy.yy.yy.yy:443] AH02003: SSL Proxy connect failed
[Thu May 09 15:05:02.694205 2019] [ssl:info] [pid 5668:tid 1836] [remote yy.yy.yy.yy:443] AH01998: Connection closed to child 0 with abortive shutdown (server mattermost.mycorp.com:443)
[Thu May 09 15:05:02.694205 2019] [ssl:info] [pid 5668:tid 1836] [remote yy.yy.yy.yy:443] AH01997: SSL handshake failed: sending 502
[Thu May 09 15:05:02.694205 2019] [proxy:error] [pid 5668:tid 1836] (20014)Internal error (specific information not available): [client yyy.yy.y.yyy:65148] AH01084: pass request body failed to yy.yy.yy.yy:443 (mattermost-kalypso.cloudappsk2.11913.2016.dcs.mycorp.com), referer: https://mattermost.mycorp.com/
[Thu May 09 15:05:02.694205 2019] [proxy:error] [pid 5668:tid 1836] [client yyy.yy.y.yyy:65148] AH00898: Error during SSL Handshake with remote server returned by /favicon.ico, referer: https://mattermost.mycorp.com/
[Thu May 09 15:05:02.694205 2019] [proxy_http:error] [pid 5668:tid 1836] [client yyy.yy.y.yyy:65148] AH01097: pass request body failed to yy.yy.yy.yy:443 (mattermost-kalypso.cloudappsk2.11913.2016.dcs.mycorp.com) from yyy.yy.y.yyy (), referer: https://mattermost.mycorp.com/

OpenSSl s_client output

Not all, but the most important stuff ref. my vhost config - tlsv1.2 and the cipher suite

SSL-Session:
Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384

Also verified that Apache has the suite

openssl.exe ciphers "TLSv1.2"

TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
.....

All from openssl

CONNECTED(00000134)
---
Certificate chain
 0 s:CN = *.cloudappsk2.11913.2016.dcs.mycorp.com
   i:CN = openshift-signer@1552839230
 1 s:CN = openshift-signer@1552839230
   i:CN = openshift-signer@1552839230
 2 s:CN = openshift-signer@1552839230
   i:CN = openshift-signer@1552839230
---
Server certificate
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
subject=CN = *.cloudappsk2.11913.2016.dcs.mycorp.com
issuer=CN = openshift-signer@1552839230
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3089 bytes and written 480 bytes
Verification error: self signed certificate in certificate chain
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: FB52D3CDAC5F480496BC3E0F98973AE6C13632C8E861EC19884297167067D019
Session-ID-ctx:
Master-Key: 69EF2D7DE36E00753847C99431478828A7E1F55E756E0D282472AB251F85E43404C1940175C2BD0B12EE2537CD7FB148
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
Start Time: 1557334640
Timeout   : 7200 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
Extended master secret: no
---
HTTP/1.0 408 Request Time-out
Cache-Control: no-cache
Connection: close
Content-Type: text/html
<html><body><h1>408 Request Time-out</h1>
Your browser didn't send a complete request in time.
</body></html>
closed

Apache 2.4.38 on Windows

We are just about to start using a new content management system, Enonic, hosted in the cloud. I am now trying to configure an internal alias for the test instance to point to the instance in the cloud. This is quite straight forward using proxypass/proxypassrevers

ProxyPass "/"  "https://xptest.enonic.cloud/wwwt/"
ProxyPassReverse "/"  "https://xptest.enonic.cloud/wwwt/"

Problem is that there are several sites on the instance https://xptest.enonic.cloud and therefore we cannot expose the site using the root / - therefore www is added. Problem is that the CMS adds www as a prefix for all relative url's created by the cms. Meaning https://wwwt.mycorp.com/wwwt/corporate, but wwwt should not be there, it should be https://wwwt.mycorp.com/corporate

I did try this serverfault.com:Apache URL rewriting in reverse proxy but no luck either, urls still contains the /wwwt/

Any ideas on how to get around this issue?

My company uses a CMS system hosted in the cloud. We want to create internally DNS-aliases to make it easier for developers to remember. Reading the documentation for mod_proxy_connect I do think it should be possible to do something like

<VirtualHost *:443>
 ServerAdmin [email protected]
 ServerName test-cms.mycorp.no

 AllowCONNECT
 ProxyPass /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/mycorp
 ProxyPassReverse /  https://mycorp-xpqa-lb-8qh7ip0n.cms.cloud/mycorp
</VirtualHost>

Until now I have not been able to get this to work, worth mentioning is

• I do not have access to the certificate/key of the CMS-system, other than the public vert.

Is this possible to do using Apache?

I'm running Jenkins, currently 2.89.3 on Windows, and have managed to configure SSL (...hooray!...).

Problem now is that I want to encrypt the -httpsKeyStorePassword defined in jenkins.xml, but despite all my Google-skills, I have not been able to figure out how to do it. Actually it might be that the answer is "no can do", ref. JENKINS 38090 - Configure encrypted password for java keystore in /etc/sysconfig/jenkins which seems related and says:

It is not possible to enter encrypted or hashed passwords for java keystore. Variable: JENKINS_HTTPS_KEYSTORE_PASSWORD in /etc/sysconfig/jenkins only able to read "plain text" password!

Anyone able to either confirm that the above Jenkins issue is still valid, but most hopefully point to some documentation (which I should have found) explaning how to do it.