jornane's questions

I want to replace one ZFS filesystem (volume in a pool) with another ZFS filesystem (another volume in the same pool). Rebooting is okay, but I'd like to avoid single user mode.

When I try to set mountpoint=none on the old filesystem, ZFS tries to unmount it, which fails due to files being in use. Consequently, I can't sent mountpoint=/data on the new filesystem due to something being mounted there. The mountpoint properties are also not written to the filesystems.

If I reboot, the old filesystem is still mounted, services will start using files on there and I can't unmount it anymore. Is there a way to write the mountpoint properties on the filesystems without actually changing anything that's mounted, and then reboot so that the new filesystem is in use when the system comes up again?

RFC6761 states about example domains (such as example.com):

Application software SHOULD NOT recognize example names as special and SHOULD use example names as they would other domain names.

Currently, these example domains are set up with a webserver that explains their purpose. The domains lack any MX records; it doesn't have a null MX record either. Because of this, an MTA will try to deliver mail to the A record, which is the IP of the web server, which doesn't accept mail, causing mail to be queued on my MTA until it eventually expires.

Clearly, following RFC6761 doesn't work so well if you're a postmaster.

Are there disadvantages to rejecting all mail to example addresses? Are there any sources that have a recommendation about this?

EDIT For context: We automatically check queue size and if it gets too big someone has to manually check why that is happening. Lately this happens because of one application sending to example domains. Naturally, it should not do that and the correct solution is to fix the application, but that's not going to happen for reasons I won't get into. Since that is the situation, I feel rejecting mails in our mail filters is a better solution than ignoring mails in our alerting software.

FWIW: I agree with the "you should not need to do this" sentiment, but sometimes the world is not perfect.

Using smtp_tls_security_level or smtp_tls_policy_maps I can make Postfix deliver outgoing mail via STARTTLS. However, the log file doesn't seem to tell me whether the mail was sent using TLS.

Jul  9 13:54:07 outgoing.example.com postfix/smtp[1337]: ABCDEF123: to=<[email protected]>, orig_to=<[email protected]>, relay=mx.example.org[192.0.2.25]:25, delay=1.4, delays=0.01/0/0.34/1, dsn=2.6.0, status=sent (250 2.6.0 Yum yum munch munch)

Is there a way to log per outgoing mail whether it was delivered using plain SMTP or STARTTLS?

We've just installed a fresh Windows Server 2016 without IPv4 connectivity. I can confirm that IPv6 works, but I am unable to install updates through Windows Update. The update process stops with the following error message:

We couldn't connect to the update service. We'll try again later, or you can check now. If it still doesn't work, make sure you're connected to the internet.

We do not run any local WSUS, but I was under the impression that Microsoft made their Windows Update service available on IPv6 as well. Am I mistaken and should I enable IPv4 in order to update, or is something else going on?

I have a Dell DSC6005/C6105 server (it says DSC6005 in the firmware, but according to the internet it's actually called C6105). EDIT: The DCS6005 is an unofficial OEM that uses the same chassis as the C6100.

One of the nodes had trouble with its IPMI interface, so I attempted to reset it. That was clearly a wrong move, because the IPMI interface came in a boot loop. When I am pinging it, I observe it answering 62 times, then going down for about 46 seconds and the story repeats itself.

Remote ipmitool commands time out with Error: Unable to establish LAN session and the BIOS reports BMC: Not working. Luckily it doesn't stop the node from booting, it just takes a couple of minutes more. Taking out the power and removing the CMOS-battery do not change this.

According to the Dell support forums, one can attempt a System reset, which at this point is the only way out I can think of, apart from replacing the node. But from this thread I don't understand which jumper I need to set. My hardware matches the photo in that thread, not the drawing. From what I understand, this should be some jumper, but I simply can't find it. My searches to documentation for this board also came up short.

I want to set up a Samba domain controller on a FreeBSD hosts that uses ZFS for file storage.

When I try to run samba-tool domain provision as documented on the Samba Wiki article on setting up a domain controller, I get an error telling me that I need POSIX ACLs enabled. According to FreeBSD's page on ZFS, ZFS on FreeBSD only supports NFSv4-style ACLs, which by now is fully implemented, but incompatible with POSIX-style ACLs.

Then I came along an unofficial guide for setting up a Samba domain controller on FreeBSD, where the solution is to simply provide the --use-ntvfs flag when calling samba-tool, which I can confirm works. However, according to the feature status of AD DC on Samba, the NTVFS-feature has been deprecated in 2010, which doesn't look promising.

Now i'm at a crossroads. I can think of two ways to set up this DC, namely by using --use-ntvfs or by creating a volume and formatting it with UFS. But I am unable to forsee the pros and cons of these solutions.

What are the consequences of using --use-ntvfs? Is it something that can be changed afterwards, or am I stuck with the choice until I provision an entirely new domain?

I want to enable SElinux on Debian Jessie. In order to do this, I followed the guide on https://wiki.debian.org/SELinux/Setup. However, when I run the apt-get command, the selinux-policy-default package appears to be missing.

Package selinux-policy-default is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source

Am I doing something wrong or is this a problem with Debian?

I run a custom service with a classic init script on Debian Jessie. Debian Jessie uses systemd. The reason that I use an init script is that I also use the same service on Debian Wheezy, which does not have systemd.

Since the service may crash occasionally, I want it to be relaunched when it stops. My understanding is that systemd will take care of this. However, when I manually kill the service (without systemctl stop service), systemctl status will report the service as active (exited).

It is my understanding that this means that systemd simply considers the service to be one that can be "running" without having an process. The documentation mentions RemainAfterExit as a way to configure this behaviour, but this is a flag for use in a unit-file, I only have an init script.

Is there a way to let systemd know that an init service needs a process to be considered active? In other words, let it know that active (exited) is an undesired state?

I have an ESXi 6 hypervisor (esx.ad.example.com) that I want to join into an AD domain (ad.example.com) with one DC. Both domain controller (dc.ad.example.com) and hypervisor have an IPv6 address and working DNS. The domain is resolvable globally and thus no custom DNS server is set. This setup works fine for Windows workstations or guests on the same ESXi joining the same domain.

The real domain name does not end with example.com, but is substituted for privacy reasons. Dig output with the same substitution follows, this output is consistent over multiple locations in the world:

$ dig NS ad.example.com. +short
dc.ad.example.com.
$ dig AAAA ad.example.com. +short
2001:db8::ad:dc:1
$ dig AAAA dc.ad.example.com. +short @dc.ad.example.com
2001:db8::ad:dc:1
$ dig PTR 1.0.0.0.c.d.0.0.d.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. +short
dc.ad.example.com.

To make things clear: The domain ad.example.com uses AD-integrated DNS, but the Windows DNS server on the DC is non-resolving. A normal resolver, without any forwarders explicitly configured, will still forward all requests for *.ad.example.com to 2001:db8::ad:dc:1, because NS records are in place, as illustrated by the dig commands mentioned. If I would add @8.8.8.8 to the commands, the output would be the same. According to this Technet article, this means that the domain uses AD-integrated DNS.

In ESXi, under Configuration -> DNS and Routing, I have set Name to esx and Domain to ad.example.com. Then under Authentication Services I set Directory Services Type to Active Directory. I enter the domain ad.example.com, click Join and enter credentials. Within a second, the following message appears:

The host does not have a suitable FQDN.

The only non-standard thing in my setup is that there is no IPv4 connectivity (and non-trivial to set up), otherwise i'd say everything is done by the book. There is no packet filter between the hosts, apart from the default firewall ESXi has, which I have not changed from its defaults. Can it be that the ESXi AD implementation requires IPv4, or is something else wrong?

I want to run a DNS setup where the zones are managed on an internal Active Directory DNS server. There is a slave DNS server on the edge on the network which runs BIND (I am open to switching this, I read that Unbound may be better?). What I want to do is to run the DNS server on the edge in split-DNS; towards the internal network it should be a slave to the AD DNS, towards the internet it should act as being master and make some changes to the zone (namely removal of A records pointing to RFC1918 IPs).

I made a diagram to illustrate. IP addresses and names are fictive. 10/8 is local, 192.168/16 and 172.16/12 are publicly routable for the sake of this example. EXAMPLE.COM and EXAMPLE.ORG represent two different organisations:

              LOCAL NETWORK      PUBLIC INTERNET

           +------------------+
           |                  |
           |     10.0.0.1     |
           |  AD.EXAMPLE.COM  |
           |                  |
           |   EXAMPLE.COM    |
           |     (master)     |
           |                  |
           +------------------+
                    |
+--------+ +------------------+------------------+
| CLIENT |-|                  |                  |
+--------+ |     10.0.0.2     |  192.168.200.1   |
+--------+ | BIND.EXAMPLE.COM | NS1.EXAMPLE.COM  |
| CLIENT |-|                  |                  |
+--------+ |   EXAMPLE.COM    |   EXAMPLE.COM    |
+--------+ |     (slave)      |     (master)     |
| CLIENT |-|    (resolver)    |                  |
+--------+ +------------------+------------------+
                                        |
                              +------------------+
                              |                  |
                              |   172.16.100.1   |
                              | NS1.EXAMPLE.ORG  |
                              |                  |
                              |   EXAMPLE.COM    |
                              |     (slave)      |
                              |                  |
                              +------------------+

Some key points:

• I do not want to keep zones on the BIND server updated by hand; zones should be transferred from the AD server and modified/rewritten automatically.
• From the public internet, AD.EXAMPLE.COM is not mentioned in SOA or NS records. As far as the internet is concerned, it is not a DNS server. NS1.EXAMPLE.COM is the only master towards the internet.
• Other internet-facing servers can be slave for NS1.EXAMPLE.COM, so zone transfers from BIND must be possible (I don't expect any problems here).
• The BIND server is authoritative-only towards the internet, but an open resolver towards the local network.
• DNSSec (if applicable) is terminated on the BIND server.