Eric J.'s questions

I set up OpenVPN using these instructions with the goal of connecting to the outside world using an AWS IP address rather than my ISP assigned IP.

The connection succeeds. When I ping (from the client) for example google.com while connected to the VPN I get

Pinging google.com [172.217.9.174] with 32 bytes of data:
Reply from 172.217.9.174: bytes=32 time=122ms TTL=45
Reply from 172.217.9.174: bytes=32 time=262ms TTL=45
Reply from 172.217.9.174: bytes=32 time=119ms TTL=45
Reply from 172.217.9.174: bytes=32 time=121ms TTL=45

compared to the somewhat faster pings when not using the VPN connection

Pinging google.com [172.217.6.174] with 32 bytes of data:
Reply from 172.217.6.174: bytes=32 time=84ms TTL=52
Reply from 172.217.6.174: bytes=32 time=85ms TTL=52
Reply from 172.217.6.174: bytes=32 time=89ms TTL=52
Reply from 172.217.6.174: bytes=32 time=82ms TTL=52

However, when I attempt to load a website (e.g. cnn.com) in a browser on the client, the load almost always times out.

I tried adding

sndbuf 0
rcvbuf 0

to the OpenVPN configuration on both client and server, same result.

The client is Windows 10 and the server Ubuntu 16.04 running on an AWS Nano instance. top does not show any significant load on the server during a connection attempt.

The client's connection is 300 Mbps down / 30 Mbps up.

What else can I try to achieve usable speeds over OpenVPN?

I'm trying to configure an Amazon ALB (Application Load Balancer, not "classic" ELB) to use Web Application Firewall (WAF) to reject https requests that contain potential XSS or SQL Injection payloads.

I configured in WAF an XSS rule

• Body contains a cross-site scripting threat.
• Query string contains a cross-site scripting threat after decoding as URL.

and a SQL Injection rule

• Body contains SQL injection threat.
• Query string contains SQL injection threat after decoding as URL.

When I browse to the login form of a web application behind the ALB and submit the username

<script>danger</script>

the ALB intercepts the request as expected and returns an HTTP 403 status.

However, when I submit the username

Robert'); DROP TABLE students;--

I get an error from the web application indicating an invalid username and password, rather than the expected HTTP 403.

Why might the XSS rule work effectively, while the similarly created SQL Injection rule doesn't stop input that is a classic example of SQL injection? Do I need to set that rule up differently somehow? Any known issues applying WAF to ALB (I know the integration is very new, so I suppose there may be some bugs).

I have setup Postfix and Dovecot on an Ubuntu box following these instructions.

I can see that email is being delivered to and accepted by the server, but the email is not available for retrieval via POP3. What could be missing in my configuration? It seems that email is not being properly handed off to Dovecot.

Here are what I believe are the relevant /var/log/mail.log entries for an attempt to send email from another domain (hosted by Gmail) to the domain I have setup:

Logged during SMTP connection:

postfix/smtpd[14689]: connect from mail-vb0-f50.google.com[209.85.212.50]
postfix/smtpd[14689]: Anonymous TLS connection established from mail-vb0-f50.google.com[209.85.212.50]: TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
postfix/smtpd[14689]: 5782740ACF: client=mail-vb0-f50.google.com[209.85.212.50]
postfix/cleanup[14696]: 5782740ACF: message-id=<CAEjmKcjHnTY4yk=3QXoNrD76=04g-s9utPguTFB02Fx53GMPmw@mail.gmail.com>
postfix/qmgr[14687]: 5782740ACF: from=<[email protected]>, size=1947, nrcpt=1 (queue active)
postfix/smtpd[14702]: connect from mail.destinationdomain.com[127.0.0.1]
postfix/smtpd[14702]: 2940A41AA9: client=mail.destinationdomain.com[127.0.0.1]
postfix/cleanup[14696]: 2940A41AA9: message-id=<CAEjmKcjHnTY4yk=3QXoNrD76=04g-s9utPguTFB02Fx53GMPmw@mail.gmail.com>
postfix/qmgr[14687]: 2940A41AA9: from=<[email protected]>, size=2450, nrcpt=1 (queue active)
amavis[21309]: (21309-02) Passed CLEAN, [209.85.212.50] <[email protected]> -> <[email protected]>, Message-ID: <CAEjmKcjHnTY4yk=3QXoNrD76=04g-s9utPguTFB02Fx53GMPmw@mail.gmail.com>, mail_id: W52ZB8FAAA+8, Hits: -0.101, size: 1946, queued_as: 2940A41AA9, [email protected], 784 ms
postfix/smtpd[14702]: disconnect from mail.destinationdomain.com[127.0.0.1]
postfix/smtp[14698]: 5782740ACF: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.1, delays=0.29/0.01/0/0.79, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 2940A41AA9)
postfix/qmgr[14687]: 5782740ACF: removed
dovecot: lda([email protected]): msgid=<CAEjmKcjHnTY4yk=3QXoNrD76=04g-s9utPguTFB02Fx53GMPmw@mail.gmail.com>: saved mail to INBOX
postfix/pipe[14703]: 2940A41AA9: to=<[email protected]>, relay=dovecot, delay=0.08, delays=0.02/0.02/0/0.04, dsn=2.0.0, status=sent (delivered via dovecot service)
postfix/qmgr[14687]: 2940A41AA9: removed

Logged during POP3 retrieval attempts:

dovecot: pop3-login: Login: user=<[email protected]>, method=PLAIN, rip=209.85.220.135, lip=10.195.83.10, mpid=14706
dovecot: pop3([email protected]): Disconnected: Logged out top=0/0, retr=1/2557, del=1/1, size=2540
postfix/smtpd[14689]: disconnect from mail-vb0-f50.google.com[209.85.212.50]
dovecot: pop3-login: Login: user=<[email protected]>, method=PLAIN, rip=209.85.212.31, lip=10.195.83.10, mpid=14708
dovecot: pop3([email protected]): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0

I setup Postfix and Dovecot on a new Ubuntu box following these directions.

From a client machine, I validate that POP3 seems to be working

telnet mydomain.com 110
+OK Dovecot ready.
USER [email protected]
+OK
PASS mypassword
+OK Logged in.
quit
+OK Logging out.

However, when trying to configure Gmail on the same client to retrieve email via POP3, I get the error

Server denied POP3 access for the given username and password.
Server returned error: "Login failed."

I carefully confirmed that Gmail is configured to use the same POP Server, Port, Username and Password I used when checking the connection with telnet.

What could be causing Gmail to get a "Login failed" message?

I'm a mostly-Windows guy tasked with setting up email on an Ubuntu 12.04 instance at AWS and hit the following error:

When I browse to Horde, after entering my administrative credentials, I get the error message:

A fatal error has occurred

imp is not activated.

Details have been logged for the administrator.

I am following the following, quite detailed guide

http://www.exratione.com/2012/05/a-mailserver-on-ubuntu-1204-postfix-dovecot-mysql/

This is happening at Step 20, at the text Now fire up you web browser and navigate to your server at http://mail.example.com/ to verify that you can log in as the configured administrative mail user. (of course I used my actual domain).

Questions

• Where is Horde logging the "details"?
• Any thoughts on why this might happen? I found Google hits suggesting that php5-mcrypt might be missing, but I verified it is installed and up-to-date in my case.

I'm attempting to setup OpenSSH on Ubuntu 12.04 to allow the following

• User can only SFTP (no shell access)
• User can write (upload) files
• Access is secure such that no user can view another user's files and cannot compromise the server

To that end I attempted to setup Chroot following

https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

http://www.serverubuntu.it/SFTP-chroot

Unfortunately I seem to have hit a brick wall summarized by the following:

It's ChrootDirectory ownership problem, sshd will reject sftp connections to accounts that are set to chroot into any directory that has ownership/permissions that sshd doesn't consider secure. sshd's apparently strict ownership/permissions requirements dictate that every directory in the chroot path must be owned by root and only writable for the owner. So, for example, if the chroot environment is in a user's home directory both /home and /home/username must be owned by root and have permissions along the lines of 755 or 750 ( group ownership should allow user to access ).

https://wiki.archlinux.org/index.php/SFTP-chroot

"must be owned by root and only writable for the owner" seems to translate to "only writable by root"

That would seem to limit the utility of chroot to users that only need to download files.

I attempted to

• Change the home directory group ownership to sftpusers (a group I created, of which the user is a member)
• Change file permissions from 755 to 775 to allow the group to write

When I did that, I could no longer log in with SFTP.

Changing the ownership and permissions back restored the ability to log in.

Question

How do I setup SFTP in a secure manner, such that users can upload files to their own home directory?

I followed the documentation on installing Zabbix from source and it is working great, except that zabbix_server and zabbix_agentd do not automatically start when the system is booted.

I found that the following entries were made for me

/etc/services

zabbix-agent    10050/tcp                       # Zabbix Agent
zabbix-agent    10050/udp
zabbix-trapper  10051/tcp                       # Zabbix Trapper
zabbix-trapper  10051/udp

When I issue the commands

zabbix-server

zabbix-agentd

from a shell, both start just fine.

What is the correct procedure to ensure that zabbix_server and zabbix_agentd automatically start when the Ubuntu server is booted?

A number of non-technical users currently manage secure data with FileZilla on Windows. The SFTP credentials are broadly shared in the organization as a result.

I would like to centrally manage credentials so that users cannot directly view them. With FileZilla, the credentials are stored in a non-encrypted file, Settings.xml.

Is there an approach using any user-friendly, Windows SFTP client to centrally manage SFTP credentials and prevent users from directly having access to the credentials?

Most of the servers I RDP to support cut-and-paste file transfer (from my Win7 64 machine). One does not, and I can't figure out what configuration step is missing.

I followed the steps outlined here:

http://support.microsoft.com/kb/313292

but do not see the local file system on the remote server (or vice versa for that matter), and I cannot cut and paste files from the local to the remote system.

If I try to cut and paste from the remote system to the local one, I get the error

Cannot copy FILENAME: Windows cannot find '%1!ls!'. Check the spelling and try again, or try searching for the item by clicking the Start button and then clicking Search.

The remote server is Windows Server 2003 Standard Edition.

Is it feasible to lock down a user account on a Windows 7 or Windows Vista laptop so that it's not possible to copy files off of it? (e.g. disable all internet access, disable USB ports or at least ensure drives can't be mounted to them, etc).

Is there a published procedure to do that?

Also, if the files are encrypted on disk using Windows encryption, is knowledge of the guest user password on the laptop enough to access those files if the hard drive is plugged into another computer?

I do realize that a sophisticated hacker can probably counter pretty much any security measure. The intent is to prevent copying files off of the laptop by power users, not by hackers.

I have a website running under IIS 7.0 on Windows Server 2008. It's just being used by 2-3 people at any point in time under very light load.

It runs fine for about 30 minutes, but then fails with the error:

Server Error in '/' Application.

Dynamic view compilation failed. c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\61a09567\0ee17e160a294837a9b42f8e66a8d2c9-1.cs(6,7): error CS0246: The type or namespace name 'MvcReCaptcha' could not be found (are you missing a using directive or an assembly reference?)

MvcReCaptcha.dll is present in the bin directory, and is certainly used by the application while it's running (functionality provided by that DLL is referenced).

The application can be reliably restarted by:

1. Stopping that site
2. Deleting c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\61a09567
3. Restarting that site

The Application Pool is set to recycle every 1740 minutes (no other conditions).

Thoughts on what might be causing the crash?

I have a gzipped file that Ubuntu reports is 2,119,952,848 bytes in size. When I try to gunzip on a mount with 12GB free space, I get the error "No space left on device".

Here's where it gets really strange... the file is a compressed mysqldump so should be highly compressible. However, gzip reports a large negative compression ratio:

ubuntu:/mnt/tmp$ gzip -l my.sql.gz
         compressed        uncompressed  ratio uncompressed_name
         2119952848          1471106218 -44.1% my.sql

Any idea what might be going on with this?

I'm experimenting with creating a software RAID 0 device from 4 EBS volumes on Ubuntu 9.10 running at Amazon AWS following this guide:

http://alestic.com/2009/06/ec2-ebs-raid

The device appears (and according to SysBench is 3.5x faster than a regular attached EBS volume).

Problem is, when I reboot the instance, all files on the RAID device are gone. The device is available and mounted where expected, but contains no files. I am able to write new files to it, which survive until the next reboot.

EDIT:

Here's the script I use to setup the RAID. It writes to /etc/fstab and /etc/mdadm.conf

#!/bin/bash
# Create RAID 

volumes=4
devices="/dev/sdj /dev/sdk /dev/sdl /dev/sdm"
devicearray=($devices)
volumeids="vol-11111111 vol-22222222 vol-33333333 vol-44444444"

yes | sudo mdadm          \
  --create /dev/md0       \
  --level 0               \
  --metadata=1.1          \
  --raid-devices $volumes \
  $devices

echo DEVICE $devices | sudo tee /etc/mdadm.conf 
sudo mdadm --detail --scan | sudo tee -a /etc/mdadm.conf
sudo mkfs.xfs /dev/md0

mountpoint=/mnt/raid
echo "/dev/md0 $mountpoint xfs noatime 0 0" | sudo tee -a /etc/fstab
sudo mkdir $mountpoint
sudo mount $mountpoint

/etc/fstab

# /etc/fstab: static file system information.
# <file system>                                 <mount point>   <type>  <options>       <dump>  <pass>
proc                                            /proc           proc    defaults        0       0
/dev/sda1                                       /               ext3    defaults        0       0
/dev/sdb                                        /mnt            ext3    defaults        0       0
/dev/md0 /mnt/raid xfs noatime 0 0

/etc/mdadm.conf

DEVICE /dev/sdj /dev/sdk /dev/sdl /dev/sdm
ARRAY /dev/md0 level=raid0 num-devices=4 metadata=01.01 name=ip-10-194-5-235:0 UUID=67392a94:553fddec:4bc8e5c7:8d25c3ca

My cron jobs are trying to mail their results using the local mail feature of Ubuntu (not internet email, the kind of mail you can read with mutt). However, /var/log/syslog reports

/USR/SBIN/CRON[19212]: (speedtax) MAIL (mailed 52 bytes of output but got status 0x0006 )

I would like to setup local mail (so that cron can deliver the output successfully) but do not want to setup internet email. Everything I find on google is about the latter.

I have a small SQL Server 2005 DB (one data partition 21MB, one log file 10MB initial size).

Users are getting an error that the log file is full. Upon checking, it is full and currently 10MB even though it's set to auto-grow in 10% increments with no max size limit.

When I try to manually increase the size of the log file in MSMS Express, I get the error:

MODIFY FILE encountered operating system error 112(There is not enough space on the disk while attempting to expand the physical file. (Microsoft SQL Server, Error: 5149).

However, there are currently 117GB of free disk space on the C: drive (where the log file is written), waaay larger than the DB and the log file combined. There are no disk space user quotas.

Is something restricting the max amount of disk space available to SQL Server? Other thoughts?

UPDATE:

I deleted an old database that resided on the same drive (freeing up around 20MB) and this did not change the situation.

SOLUTION:

Found a solution.

I have setup an IIS 6 server to act as a file server. For some of the files, though, clients receive a 404 error.

To diagnose the issue, I enabled directory browsing. I can browse directly to one of the files in question, click on the file, and get the 404.

The website is configured for basic authentication. I verified that the user in question has read permission at the file system level for the desired file.

The IIS log entries for that file access attempt are:

2009-10-26 23:23:38 W3SVC882002786 192.168.1.10 GET /path/to/myfile.war-0.2.45.M.war - 8889 - 72.162.134.92 Mozilla/5.0+(Windows;+U;+Windows+NT+6.0;+en-US)+AppleWebKit/532.0+(KHTML,+like+Gecko)+Chrome/3.0.195.27+Safari/532.0 401 2 2148074254
2009-10-26 23:23:38 W3SVC882002786 192.168.1.10 GET /path/to/myfile.war-0.2.45.M.war - 8889 - 72.162.134.92 Mozilla/5.0+(Windows;+U;+Windows+NT+6.0;+en-US)+AppleWebKit/532.0+(KHTML,+like+Gecko)+Chrome/3.0.195.27+Safari/532.0 401 1 0
2009-10-26 23:23:38 W3SVC882002786 192.168.1.10 GET /path/to/myfile.war-0.2.45.M.war - 8889 MYDOMAIN\myuser 72.162.134.92 Mozilla/5.0+(Windows;+U;+Windows+NT+6.0;+en-US)+AppleWebKit/532.0+(KHTML,+like+Gecko)+Chrome/3.0.195.27+Safari/532.0 404 3 50

So it looks like there are two 401 (access denied) followed by a 404.

Interestingly, .jar files in the same directory can be accessed and downloaded.

Is there somewhere I need to configure IIS to allow other file types to be downloaded?

Is it possible to setup IMail with a distribution list, i.e. [email protected] would forward to a list of sales people?

I have an IIS 6 server running FTP on the standard port with basic authentication.

If I connect from a Vista machine (command line FTP client) that is not on the corporate network, all works well.

If I connect from an Ubuntu machine also not on the corporate network, I can connect but not do anything else:

230 User MyUser logged in. 
Remote system type is Windows_NT.

But then any other commands fail:

ftp> ls
500 Invalid PORT Command.
ftp: bind: Address already in use
ftp>

Any idea what might be causing this?

At the end of the day I'm trying to get Maven to perform a release using FTP to the IIS server. Solving this is a step down that path.

Suddenly, for the last few days, it takes a very long time (up to 30 seconds) to establish a SSH connection to most, but not all, of my Amazon EC2 instances. The issue has been raised with Amazon to see if it's environmental with them, but I wonder if there's anything I can check on the instances themselves.

Most of that time is spent at the step:

Authenticating with public key "imported-openssh-key"

Once on the instance, changing users via

su - newusername

hangs indefinitely.

Other commands (ps, top, find) run fast as ever.

My application running on the instances (a web service) is very responsive. CPU, IO and disk load on the instances is not very high.

EDIT:

Last few lines of output from strace su - myusername as suggested by Dave:

connect(4, {sa_family=AF_INET, sin_port=htons(389), sin_addr=inet_addr("W.X.Y.Z")}, 16) = -1 EINPROGRESS (Operation now in progress)
poll(

This line keeps recurring in 10 second intervals... it hangs at poll( for 10 seconds then repeats the same output.

The IP address referenced is the public IP address of our LDAP server.

The problem was that the instances were attempting to resolve the LDAP server via the public IP address rather than the private one. Opening the public IP to the other instances resolved the issue.

One Vista PC in our small office fails to initialize networking about 1 reboot in 3. Vista's diagnostics are never able to repair the issue. However, the problem can be consistently resolved (until the next reboot) by disabling and then enabling the network adapter in Device Manager.

This is a wired connection to a router. The network adapter is the onboard NVIDIA nForce 10/100 Mbps Ethernet with the current drivers available from Windows Update, and is the only network adapter in the system.

Has anyone seen this issue and hopefully know how to resolve it?