Matt's questions

I am exploring the use of HAProxy as a balancer in front of a set of web apis that run on IIS.

• node1.myapp.mycompany.com
• node2.myapp.mycomapny.com

We are currently using Host Headers to correctly resolve the right web application on IIS. For example, we may have otherapp.mycompany.com running on the same server/port, but using Host Headers IIS knows which one to serve up.

My initial attempt at HAProxy left me with 404 errors, because I was not including the host headers in my request, and so IIS was serving back the default site bound to the given IP, and not resolving by host name.

The fix left me with something like this:

frontend localnodes
    bind *:80
    mode http
    default_backend nodes

backend nodes
    mode http
    balance roundrobin
    option forwardfor
    reqirep ^Host: Host:\ node1.myapp.mycompany.com
    server web01 node1.myapp.mycompany.com:80

This works great for a single backend, but I am left scracthing my head on how to include the correct host headers depending on which backend is serving up the request:

backend nodes
    mode http
    balance roundrobin
    option forwardfor
    reqirep ^Host: Host:\ node1.myapp.mycompany.com
    server web01 node1.myapp.mycompany.com:80
    server web02 node2.myapp.mycompany.com:80

The above does not work whenever node2 is used because it doesn't resolve correctly in IIS (node2 in this case is on a different server, and therefore different IP. In fact, if they were running on the same server/ip I suspect the request work "work", but they would all be served by node1 per the host header).

• Is it possible to set the host based on the url of the backend used to serve up the request?
• If so, this implies my checks also need to provide the correct host header based on backend, how would that be done?

Edit: Am using HA-Proxy version 1.7.9 2017/08/18

Let me give this just a little more background. We used to have just myapp.mycompany.com serving up api requests. We need to expand it. Our clients will still call myapp.mycompany.com, but that will just point to the HAProxy, which will balance it out to node1.myapp.mycompany.com and node2.myapp.mycompany.com. Our current server configurations have us binding a single IP address on each server, so we use host headers to resolve.

Absolutely brand new to DSC, so I am really stumbling through things right now. I have a basic configuration that ensures IIS, .NET 4.5, and MSMQ are installed. I am working toward configuring a new Windows 2012 R2 instance to support our applications. Currently our applications are deployed using powershell over Web Deploy (the artifacts are built with PSake/MSBuild in TeamCity).

So the next step I am trying to take with DSC is getting Web Deploy installed on the target server. This is an MSI download, and not a "Windows Feature" that I can simply Ensure is installed.

So I have a custom Script in my DSC that tries to do an un-attended install of an the Web Deploy MSI file. The script

Script InstallWebDeploy
{
    GetScript =
    {
        $false
    }
    SetScript =
    {
        $cmd = "MSIEXEC /a 'C:\Temp\WebDeploy_amd64_en-US.msi' /passive" # have also tried /qn
        (Start-Process -FilePath "msiexec.exe" -ArgumentList "/a 'C:\Temp\WebDeploy_amd64_en-US.msi' /passive" -Wait -Passthru).ExitCode
    }
    TestScript =
    {
        $false
    }
}

The result, after generating the .mof and using it, gives me:

VERBOSE: [CORAPP4]: LCM:  [ Start  Resource ]  [[Script]InstallWebDeploy]
VERBOSE: [CORAPP4]: LCM:  [ Start  Test     ]  [[Script]InstallWebDeploy]
VERBOSE: [CORAPP4]: LCM:  [ End    Test     ]  [[Script]InstallWebDeploy]  in 0.0000 seconds.
VERBOSE: [CORAPP4]: LCM:  [ Start  Set      ]  [[Script]InstallWebDeploy]
VERBOSE: [CORAPP4]:                            [[Script]InstallWebDeploy] Performing the operation "Set-TargetResource"
 on target "Executing the SetScript with the user supplied credential".
VERBOSE: [CORAPP4]: LCM:  [ End    Set      ]  [[Script]InstallWebDeploy]  in 1.0430 seconds.
VERBOSE: [CORAPP4]: LCM:  [ End    Resource ]  [[Script]InstallWebDeploy]
VERBOSE: [CORAPP4]: LCM:  [ End    Set      ]    in  4.4783 seconds.
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 4.214 seconds

However, Web Deploy is no-where in sight on the server. (I realize the Get-Script and Test-Script need fleshing out, but wanted to reduce the number of variables involved here)

Any idea why this is failing? (but without apparent error?)

Is it possible to have multiple FTP sites on Windows Server 2003 R2 that bind the same IPAddress, but resolve based on name? e.g. ftp1.domain.com and ftp2.domain.com bind the same IP, and IIS resolves to correct FTP site using the domain name.

I have some lines appended to /etc/init.d/boot.local on a OpenSuse 11.1 server. They are some scripts I want run at boot. Who do these get execute as? In particular, I have one script that needs elevated privileges, as it binds ports 80 and 443. On command line, I use sudo, but for scripting I'm not sure if I have to include sudo in the bool.local file, or not.

As full disclosure, no I did not use visudo. Had forgotten such a utility existed. Lesson learned.

I was trying to edit my /etc/sudoers to allow password-less command execution for a specific script that will run on cron. I tried to add the 'visiblepw' defaults entry, but apparently mucked it up.

The box is running openSUSE 11.1, on kernel 2.6.27.7-9. It's throwing the following error on any sudo command:

sudo: unknown defaults entry `visiblepw' referenced near line 22
sudo: parse error in /etc/sudoers near line 21

What are my options for fixing the sudoers file? The root password on file does not appear to be working.

I have an EC2 instance running the Ubuntu 12.04 32bit AMI (available in the first page the Classic wizard for launching a new instance). The root device is an EBS volume. I then follow these steps:

• Stop the server
• Right click on volume from Volumes tab -> Create Snapshot
• Right click on said snapshot from Snapshots tab -> Create Image from this Snapshot
• From AMI tab, I right click on the newly created AMI and select "Launch Instance"

During the 3rd step of the wizard, I notice this line for "Storage Device Configuration"

Root    /dev/sda1   snap-xxxxxx 8GiB    standard    true

This seems to indicate to me it is using the snapshot as the root volume for the new instance (it is, in fact, the only volume).

I then launch the instance. However, it fails the "status checks" during the "initialization" step. If I right click the instance and "Get System Log", this is the tail of the log:

Using IPI No-Shortcut mode
XENBUS: Timeout connecting to devices!
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.

EXT3-fs: sda1: couldn't mount because of unsupported optional features (240).
EXT2-fs: sda1: couldn't mount because of unsupported optional features (244).
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,1)

What am I doing wrong here? My concern is 2 fold:

• If I can not boot from a snapshot, this makes the snapshot utility much less useful
• If I can't create an AMI from a Snapshot for creating a new instance, this not only reduces the usefulness of snapshots but makes we wonder how I can "duplicate" instances easily.

The script is fairly straight forward. Simply tries to start a bunch of windows services. Execution locally works fine when on the target machine. The script is actually executing fine as well when done via PsExec, it just never returns until I hit the "enter" key on my CMD prompt. This is a problem, because this is being called from TeamCity, and it makes the Agent hang waiting for PsExec to return.

I've tried the following:

• Adding an exit and exit 0 at the end of the Powershell script
• Adding a < NUL to the end of the PsExec call, per the answer in this SF question
• Adding a > stdout redirect

This is how I am actually calling psexec:

psexec \\target -u domain\username -p password powershell c:\path\script.ps1

No matter what I do, it hangs until I the locally on the cmd prompt. After I hit enter, I get the message:

powershell exited on target with error code 0.

We have a networked computer on a different subnet (192.168.100., where as I am on a 10.100 ip address). The target computer is not bound to a domain, unlike our 10.* computers which our bound to ourdomain. I am able to browse, with Windows Explorer, any computer bound to the domain. However, I am unable to do so with the target computer that is not.

A colleague added his username and password to the target computer, and is able to browse to it just fine (i.e., if his login is normally \ourdomain\username, he created a local account on the target computer that is just named username, and set it's password to be identical). I attempted the same trick, but still am unable to browse to the network location.

The computer is most certainly reachable - I can remote-desktop to it just fine. But I'd like to be able to browse to it with Windows Explorer, e.g. \\target\d$\. Any idea what must be done?

My computer is Windows 7 32bit, target is Windows 2008R2. My collegue (who has it working), is also on Windows 7, but 64bit.

I logged into a Windows 2008 R2 server as a domain user that is part of the Administrators group on the target computer. Executing the following command, I get access is denied errors:

$> sc stop ServiceName
[SC] OpenService FAILED 5:
Access is denied.

What is strange is, as the very same user, I can open up the Services GUI (Administrative Tools > Services) and start/stop the very same service no problem. This appears to be happening for all services that I try to start/stop, and it happens as any "Administrative" user on this computer (with the exception of the local admin user, which I don't have the creds for in order to test). Command line fails, but GUI works.

I also know that spelling of the service name is correct, because if I alter it to be something else, I get a different error ("The specified service does not exist..."). I do notice that I can change the casing of the service name (ServiceName vs SERVICENAME) and get access denied errors on both.

I get similar access denied messages when using "net start ServiceName" instead of the sc command.

Any idea what is going on here? Needing this to work for scripting purposes. The same scripts are working fine on a Win2003 server.

This is simply a question placed out of curiosity. When you execute a traceroute, and get some time durations back for the latency/travel time, how are those calculated? It would seem more than likely that the 'current time' on each stop in the route would be variable, and you can't exactly ask a server for what current time it has to figure out the offset, because you don't know how long it takes to make/receive that request.

I have an account on a shared host running FreeBSD 5.5-STABLE. I was compiling my own version of Ruby today, and encountered this anomaly: If I tried to execute 'make', I get a "permission denied" error. However, if I execute:

cd .

And then

make

Everything work just fine. Any clue why this happens? It obviously isn't causing me problems as I am eventually able to execute make just fine, but I am very curious what is going on here.

I have been poking around Amazon EC2, and am a little confused on some of the terminology. Specifically with regard to AMI, snapshots and volumes, and an EBS

Please correct me if I am wrong, or fill in any serious gaps in my following statements:

• An AMI (Amazon Machine Image) is a full 'disk' capture of an operating system and configuration. When you launch an instance, you launch it from an AMI

• An EBS (Elastic Block Storage) is a way to persist the state of any modifications you made once booting from a given AMI. In my mind, this is sort of like a diff on the final state of your instance vs the AMI.

• A snapshot is ... well, I'm not sure. I can only assume it is a snapshot of a specific instance, but it is not clear to me how this differs from the state stored in an EBS. How is a snapshot different from creating an EBS AMI from an existing instance?

• A volume is ... it would seem mounted disk space into which an AMI/EBS pair is loaded? I'm not sure on this one either. I can see (from the AWS Console) that you can create a volume from a snapshot, and that you can attach/detach volumes, but it isn't clear to me why or when you would do that.

I am in the process of installing the latest debian stable on VirtualBox (3.1.4), and got to an installation step asking to installing GRUB to the MBR of the disk. I assume that since this is a "virtual" disk created by VirtualBox, that the MBR for it is isolated from the MBR of the primary disk on the host. Is this correct? I had previously been under the (possibly incorrect?) impression that there was 1 MBR per physical primary disk.

I am attempting to configure an openSuse 11.1 box to send outgoing email for a domain that the same server is hosting. I don't understand enough about smtp servers and the like to know what needs to be in place and working.

The system already had Postfix installed, and I confirmed it was running via a

> sudo /etc/init.d/postfix status

I examined the Postfix config file in /etc/main.cf and configured a couple of items regarding the domain/host name and such, but left it largely default.

I attempted to send an email from the command line with the following command:

> echo "test 123" | mail -s "test subject" [email protected]

Where differentdomain.com was not the same domain as the one best hosted on the server. However, the email never reaches the target account.

Any suggestions?

EDIT:

In the postfix log, (/var/log/mail.info, there's nothing in .err) I see that postfix is trying to connect to what appears to be a different smtp server on our network, with a connection refused:

connect to ourdomain.com.inbound15.mxlogic.net[our ip address]:25: Connection refused

However, I can't figure out why it is 1) trying to connect to that server and 2) not just sending the messages itself... I mean, isn't postfix an smtp server?

I did a grep -ri on ourdomain from /etc and see no configuration files anywhere telling it to do this. Why is it?

We have a production machine running IIS6 with a wildcard SSL certificate. The certificate that was installed is not exportable.

We want to upgrade the system to IIS7. As part of this venture, we're creating a backup/failover server that will serve the exact same websites - when we take the primary down for upgrade, the secondary will take over. As such, the secondary also needs the SSL certificate.

However, since the certificate was not exportable, this means re-keying it from Go Daddy.

Per http://help.godaddy.com/article/867, I know that by re-keying the certificate the original will stop working.

I'm still pretty new to SSL certificates, so are there any problems I should anticipate when installing the same SSL certificate on 2 different machines?

We have a production server with a wildcard SSL certificate. I'm in the process of creating a backup/failover server that will host the same domains, and therefore will also need the SSL certificate.

The certificate on the primary server was installed with the private key non-exportable, so I am unable to export the certificate for installation on the failover server.

My question then is - if I re-key the certificate from Go Daddy, does the original certificate installed on the primary server cease to be valid?

As an aside, the original (primary) server is IIS 6, the failover is IIS 7 (once the failover is operational, we'll likely upgrade the primary).

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at http://support.godaddy.com/help/article/4801/installing-an-ssl-certificate-in-microsoft-iis-7 for installing the certificate. I get to the IIS step, where I:

• Click on "Security Certificates" feature when the server is selected in the left pane
• Click on "Complete Certificate Request"
• Navigate to the .crt file on the file system
• Give it a "friendly" name, click finish

The cert gets listed on the main pane now of this "Server Certificates" panel. But, if I refresh the page, or navigate away and come back, it's gone. And the cert is not listed as a viable binding when trying to bind a site to https.

This seems like a pretty straight forward process, but clearly I'm missing something here. Any ideas?

EDIT: I found this post, which seems to imply this behavior happens when you try to use the intermediate certificate. When I downloaded the files from GoDaddy, there were 2 in a zip file. 1 was the gd_iis_intermediates, the other was named for the domain. I installed the domain one (extension .crt). There didn't seem to be any other option - installing the other from IIS gives an error "Cannot find the certificate request that is associated with this certificate file. A certificate request must be completed on the computer where the request was created".

That being said, there doesn't appear to be any other download I can use.

There was also mention, in the comments (and elsewhere after googling) of "exporting" the cert as a pfx, and installing that. But I can't figure out how to export it - even through certmgr.msc.

I should also mention this cert is installed on another computer running IIS6 (this IIS7 installation is meant to be a failover, plus the primary while we upgrade the IIS6 to IIS7). But I can't figure out how to export it from that computer either.

I am running Windows 7 Ultimate. If I open up IIS Manager, I see a list of "connections" on the left hand side. In previous versions, I would be able to select an option to "connect to another server" or "connect to another machine", but there is no such option visible anywhere here. The only thing in the list is my local machine.

Even in the address bar, if I manually type in the server location (\servername, even tried just servername), nothing happens (it just reverts back to my current local computer)

The documentation at http://technet.microsoft.com/en-us/library/cc732466%28WS.10%29.aspx seems to imply the very same steps... but there is just no button or menu option anywhere to do this. Am I missing something? I'm not even seeing a grayed out menu option.

EDIT: Under the "File" menu, I see 2 options:

• Save Connections (grayed out)
• Exit

Under the "Connections" pane, I see 1 button, grayed out. When I hover the mouse, it simply says "Up", appears to be usable if I browse into an element in my local computers IIS settings

If I right click inside the pane itself, I see

• Refresh
• Add website (to the current host)
• Start
• Stop
• Rename
• Switch to Content View

UPDATE: I downloaded and installed the Remote Server Administration tools from http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en, and I enabled everything listed under "Remote Server Administration Tools" under "Turn Windows Features On or Off". Still nothing.

I am working from an openSuse 11.1 box, from an essentially clean install. I'm trying to do an SVN export onto the box over http (via apache). Our SVN server is running on port 8080 on the network, and is up and working fine (can reach it from my windows box, and from an Ubuntu VM on my windows box).

The Suse box can ping the SVN server just fine, and can wget off of port 80. But it cannot reach it on SVN over HTTP on port 8080. And a basic wget against a a web page running on 8080 on the same server fails as well.

I assume there is some sort of network or firewall configuration I am missing, but I'm not familiar enough with these things on *nix to know where to start. Any ideas?

EDIT: I checked from yast2, the firewall isn't even turned on...

UPDATE: Running tcpdump while I try wget a website on port 8080, I get the following:

13:51:55.486329 IP mysusebox.56489 > mysvnserver.http-alt: S 1456704340:1456704340(0) win 5840 <mss 1460,sackOK,timestamp 42587871 0,nop,wscale 6>

And that is the only item in the list after a second or to of trying the wget. The wget eventually fails with a "connection timed out"

UPDATE: Resolved. Turns out there was a hardware firewall between the two. Thanks though, learned something new with tcpdump!

We had a web app running on an OSX server backed by mysql. The server is running Darwin kernel 9.8.0. Mysql version is 5.0.67.

It was working fine previously, and we're not entirely sure what might have changed. The computer has since been rebooted to see if it would start mysql. Unfortunately, this means that I can't tell you if it was erroneously rebooted by another user before that, and that caused the problem.

The errors I am getting are:

/usr/libexec/mysqld: File './mysql-bin.124367' not found (Errcode: 13)
090826 14:42:50 [ERROR] Could not use mysql-bin for logging (error 13). Turning logging off for the whole duration of the MySQL server process. To turn it on again: fix the cause, shutdown the MySQL server and restart it.

That file it couldn't find really does exist ... So, I turned off logging in the my.cnf to see what else might be happening. Now the error I get is:

090826 14:52:16 [ERROR] Can't start server: Bind on TCP/IP port: Can't assign requested address
090826 14:52:16 [ERROR] Do you already have another mysqld server running on port: 3306 ?

I did a ps -Aef | grep mysql and found no other running daemons. With ifconfig I saw that the loopback device was in fact up. I tried binding mysqld to a different port (3307), but got the same error (but for 3307).

I've tried starting mysqld as root. I've tried starting it passing in the arguments --user=_mysql.

I can't figure out what else to try. Any suggestions?

EDIT: @nambuls: netstat -n -p tcp | grep 3306 returns nothing.

EDIT2: the error log also shows warnings - I didn't post before since they were just "warnings", but it might help.

090826 15:16:02 [Warning] Can't create test file /var/mysql/tanglewood.lower-test
090826 15:16:02 [Warning] Can't create test file /var/mysql/tanglewood.lower-test

I'm not sure why it can't create the test file - /var/mysql is 775 for _mysql:admin, and I started the process as admin.