SFTP has an option "-i" to set the private key to use for public key authentication. However, there does not appear to be an option for which matching public key to use. Surely it must need this to tell the server which public key to use for the challenge.
Why is this and how does it work?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something similar?
I used to be able to edit /etc/sysconfig/clock, but now I need to use timedatectl, which I believe is a systemd command.
What has that got to do with booting the system?
I am setting up OpenLDAP for the first time, on RHEL6 and using Puppet to do the initial install/configuration.
I believe the configuration uses the slapd.d rather than slapd.conf method.
Basically, I believe Puppet has successfully created a Database which I want to use as the root of my configuration tree. This is the output of slapcat that shows this database created:
dn: olcDatabase={3}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {3}hdb
olcDbDirectory: /var/lib/ldap/
olcSuffix: dc=corp.f7
olcRootDN: cn=root,dc=corp.f7
structuralObjectClass: olcHdbConfig
entryUUID: 8fce2bda-78b8-1033-80d2-f79b693c6963
creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
createTimestamp: 20140526002936Z
olcAccess: {0}to * by * read
olcRootPW:: e1NTSEF9MGkzazlZdldwMVNpU1FNVjhnNDQ4MHJBNFUra0FUdTI=
entryCSN: 20140526010102.566286Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20140526010102Z
Then following an example I found online, I am trying to feed the following ldif file into this command:
ldapadd -cxWD cn=root,dc=corp.f7 -W -f /tmp/static.ldif
# User account
dn: uid=jsmith,dc=corp.f7
cn: John Smith
givenName: John
sn: Smith
uid: jsmith
uidNumber: 10000
gidNumber: 10000
homeDirectory: /home/jsmith
mail: [email protected]
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
loginShell: /bin/bash
userPassword: {CRYPT}*
However, I simply get the following error output:
adding new entry "uid=jsmith,dc=corp.f7"
ldap_add: No such object (32)
I am not really sure what object it can't find...is it the dc=corp.f7?
How do I go about setting up groups and users in this database I created?
Thanks
I am planning a migration from Solaris/x86 to RHEL6. Part of this migration will be migrating services from SMF to the RHEL6 equivalent, which appears to be upstart. While init.d scripts still seem to be supported, I want to take advantage of a more sophisticated init daemon, especially for features like job supervision (restarting etc). I would like to gather some thoughts on a few points:
1) Is upstart an adequate job supervisor, i.e. does it preclude the need for stand-alone managers like daemontools/supervise?
2) Upstart scripts seem very bare-bones compared to a typical init.d script. If I was porting an init.d script to Upstart, is it OK to just "exec /etc/init.d/myjob start"? This include RHEL installed programs like httpd.
3) Does upstart do anything is regards to pid files, and what are it's expectations in regards to the forking model of the process?
4) Are there any straightforward guides to the process management aspect of Upstart...and by that I mean the conditions around controlling restarting? e.g. how many times to restart the process before it goes into a maintenance state, or to ignore errors/core dumps in child processes of the supervised process.
Any other relevant ideas or guides would be appreciated.
TIA
I have been creating Solaris packages for application deployment for some time, however recently I became aware that deployed files had the same timestamp of when the package was created. Looking through the various manpages (pkgproto, prototype, attributes, etc) I cant seem to find any option to instruct pkgproto/pkgmk to preserve file timestamps.
Anyone know how to ensure file timestamps are preserved within Solaris packages?
I am running an apache2 instance behind an nginx reverse-proxy, with nginx performing basic authentication and apache2 serving up Nagios cgi scripts.
I am able to send the authenticated user from nginx to apache (currently using X-Forwarded-User header set to $remote_user) - but I am struggling to get apache2 to recognize this header and set the REMOTE_USER env variable before it executed the CGI script.
I believe mod_rewrite might be able to do this, but all the examples I have seen relate to the reverse scenario, where apache2 is sending REMOTE_USER downstream to another backend server.
Is it even possible to set REMOTE_USER within apache to something outside the realm of apache's own mod_auth module?
I am using SMF to manage a service under Solaris10.
This service is itself a process manager, and forks off many child processes, some of which die occasionally (or are killed for various reasons). The service process itself is very robust and never dies however.
The problem I have is that when I manually kill one of these child processes using the KILL signal, SMF will restart the main service:
[ Aug 27 08:07:06 Stopping because process received fatal signal from outside the service. ]
Is there a way I can configure SMF or the service manifest such that SMF will not kill the service if one of the service sub-processes gets killed?
TIA
I have started running cfengine3, using cf-execd to schedule runs of cf-agent at the default interval of every 5 minutes.
cf-execd captures the output of cf-agent (which is run with the --inform option), storing the output in the $WORKDIR/outputs directory, and also emailing the result (but only if it differs to the last run). As you might imagine, with an output file every 5 minutes, this directory will quickly fill up with a large number of files, and it is expected that the user cleans up this directory.
I created a rule which will delete these output files that are more than 3 days old, however the problem this creates is every output will be different to the previous one (as a new file will be deleted each time), hence an email will be sent. So I go from lots of files in the outputs dir, to lots of emails in my inbox!
What I would really like is to suppress messages when certain promises are repaired, particularly the one which deletes files in the outputs directory. It would essentially negate the -I option for that promise only. Alternatively, if I could change the time boundary from being from 'now' to a fixed point (say every Wednesday), I could at least restrict the number of emails down to one a week.
I am using the 'digest' copy method for all file copy promises, because of the way we package and deploy software, I cant rely on mtime for the criteria for updating files. For various reasons, I am not employing the client-server approach with a central configuration server: rather we package and deploy our entire configuration module to each server, so from cf-engine's perspective, the source and target are local on the server it is running.
The problem I am having with this approach is that the source will always update the target when they differ - which is what I want most of the time, usually because the source has been updated.
However, like many other cfengine users, we are running an operational environment, where occasionally emergency fixes have to be applied immediately - meaning we don't have time to rebuild and redeploy a configuration module, and the fix will often be applied by deploying a tarball with specific changes. Of course this is problematic if cf-engine comes along 5 mintues later and reverts the changes.
What we would like is to be able to make small, incremental changes to our servers, without them being reverted, until the next deployment cycle at which time the new source files would be copied. We do not consider random file corruption or mistaken changes to involve enough risk to warrant having cfengine constantly revert deployments to their source copy - the ability to deploy emergency fixes and have them stay that way until the next deployment would be of much greater value and utility.
So, after all that, my question is this: is cf-engine capable of detecting whether it was the source or target that changed when the files differ, and if so, is their a way to use the 'digest' copy method but only if the source side changed? I am very open to other ideas and approaches as-well, as I am still quite new to this whole configuration management thing.