Peter Nunn's questions

I need to pull files from an ftp server regularly and have found that I can get the files easily enough using wget

wget -m --user=yyy --password=xxxx ftps://host.com.au

and that works really nicely. The problem is, it obviously leaves the files behind on the remote server and the next time I run the script, it gets them all again.

I saw that wget has a --delete-after flag, which on first glance would seem to be ideal, but, as the man page says, it only deletes local files not remote ones.

Is there a way to achieve this end? It needs to be via ftp unfortunately as I don't have shell access or rsync access to the remote server. Should I be looking at something other than wget?

I have what, from my searching so far, seems to be a slightly different problem with site redirections than the norm. I need to redirect one particular route from one domain to another on a different port.

So far I've tried a simple 301 Redirect and a rewrite to no avail.

The code looks like

<VirtualHost *:80>                                                                                                                      
  ServerName blah.hardsoft.nexus.blah2.blah3.au/phpmyadmin                                                                           
  RewriteEngine on                                                                                                                      
  RedirectMatch "^blah.*nexus.*\/phpmyadmin$" "http://10.1.140.1:8080/phpmyadmin"                                                   
  #RedirectMatch ".*nexus.*" "http://10.1.140.1:8080/phpmyadmin"                                                                         

  #Redirect 301 / http://10.1.140.1:8080/phpmyadmin                                                                                     
  </VirtualHost>                                                                                                                          

<VirtualHost 10.1.140.1:8080>                                                                                                            
  ServerName phpmyadmin                                                                                                                  
  DocumentRoot /var/www-8080                                                                                                             
</VirtualHost> 

As you can see I've tried a couple of redirect matches (one very broad) and a 301 redirect, but in all cases what I end up with is it being redirected to

 10.1.140.1/phpmyadmin

without the port being appended (at least I think that's whats happening).

Any idea how I should be doing this? Is it even possible?

I'm trying to use my first playbook with a galaxy role and while I can get the role to run, I can't seem to get it to find the group_vars I've defined.

The role is nickjj.mariadb (not that that probably matters) but in the docs its stated that group_vars should be relative to your inventory directory.

I've tried a couple of different things but so far no dice.

tree                                                                                                                                                             
 .
 ├── group.vars
 │   └── siteservers.yml
 ├── install_maria.yml
 ├── inventory
 │   └── hosts
 └── update-apt.yml

is what I have for the layout and I'm running the playbook with

ansible-playbook -i inventory/hosts -l siteservers install_maria.yml -K

It is finding the ip address of the server from the hosts file happily, but doesn't seem to pick up the variables from siteservers.yml.

Where should this be put? Am I close with the layout or is it all wrong?

I'm trying to set up shorewall to block traffic to one particular IP address that is routed over an openvpn tunnel.

Naively I have the following shorewall rules in place

#Don't allow connection pickup from the net
Invalid(DROP)   net     all     tcp

# Openvpn
ACCEPT  net     $FW     udp 1194

# All out
ACCEPT  $FW     net     all
DROP all net:146.aaa.yyy.xx

#PING
ACCEPT  $FW     loc     icmp
#ACCEPT $FW     net     icmp

But I can still ftp to 146.aaa.yyy.xx.

This traffic is routed through a second client vpn connection to another server that has a connection to the 146.aaa network, net the inbound openvpn connection shown here.

So I assume the vpn routing for the client connection is happening before this rule gets to it (or is my order wrong with the accept outbound being first)?

Am I on the right track here or barking up the wrong tree?

I'm just starting out using icinga2 to monitor some servers. I've managed to set up the hosts I'm monitoring using the node wizard and have the basic stuff working.

I'm now trying to get a test in place where I'm testing a IPSec tunnel on the Satellite host but have hit a knowledge block.

I'm trying to test a ping on a particular address (using the tunnel IP address) to a remote host on the satellite and it looked to me that the fping check was the way to go.

I modified ping4.conf for the particular host in the repositoriy.d/hosts/ directory to be the following

object Service "ping4" {
  import "satellite-service"
  check_command = "dummy"
  host_name = "bh.sol.net"
  zone = "bh.sol.net"
}

object Service "fping4" {
  import "satellite-service"
  check_command = "fping4"
  host_name = "bh.sol.net"
  zone = "bh.sol.net"
  vars.fping_address = "10.143.16.225"
  vars.fping_source_ip = "192.168.221.129"
}

What I'm trying to achieve here is

ping 10.143.16.225 -I 192.168.221.129

which is what I run on the server to test this manually.

I assumed that this new test would be pushed to the satellite server but I can't see any sign of it when I list the objects there, and it has a status of PENDING in the web interface.

I've read through the documentation (or at least started to) and it seems that I'm probably trying to run this test on the icinga host itself not the satellite server (?).

Any pointers on how I run a test on the satellite server like this?

I'm attempting to set up icinga2 and icingaweb2 on a Ubuntu 16.04 system using mariadb as the database. I seem to have icinga set up OK (no errors in the icinga.log, apache error log or syslog) but when I try and navigate to the icinga2 web page I just get a blank page with the following code

<!--?php /*! Icinga Web 2 | (c) 2014 Icinga Development Team | GPLv2+ */ require_once '/usr/share/php/Icinga/Application/webrouter.php'; -->
<html>
    <head><head/>
    <body><body/>
</html>

I get the same code regardless of navigating to /icingaweb2 or /icingaweb2/setup. I have tried to configure the system manually using the instructions on the git documentation, but still the same behaviour.

Any ideas what might be going on here?

Peter.

There seems to be a fair bit of information about running pfsense as a virtual machine on another hypervisor of some sort, but I am wondering if I can do the reverse and use a pfsense install as the host to run some linux vm's.

pfsense seems to be really good at handling multiple wan's etc, but I need to run same linux vm's for other tasks within the firewall.

It seems I might be able to run virtualbox or bhyve.

Any other options? Any pointers?

Peter.

I'm trying to set up an openvpn server on a raspberry pi to act as an endpoint for road worrier connections but the device is sitting on the network, not as the gateway of any of the machines on the network and I suspect this is the problem.

I've looked at MANY tutorials and have the vpn connection up correctly, and the client routing is OK as I can connect to the raspi via the tunnel, but if I ping anything else on the network I get request timeout's. My only difference is that I'm using a tcp connection, not a UDP one, but have adjusted the firewall rules to suite.

I have tried a number of different iptables rules, have forwarding enabled and have even installed a static route on the cyberoam to try and make this work.

My configs are as follows.

server...

local 192.168.1.84
port 1194
proto tcp
dev tun

ca      /etc/openvpn/ca.crt    # generated keys
cert    /etc/openvpn/folkarch.crt
key     /etc/openvpn/folkarch.key  # keep secret
dh      /etc/openvpn/dh2048.pem

server 10.8.0.0 255.255.255.0  # internal tun0 connection IP
ifconfig 10.8.0.1 10.8.0.2
ifconfig-pool-persist ipp.txt
push "route 10.8.0.1 255.255.255.255"
#route 192.168.1.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
#push dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
keepalive 30 240

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

status log/openvpn-status.log

verb 3  # verbose mode
client-to-client
duplicate-cn

client config to match, nothing much in it..

firewall.sh

#!/bin/bash

#/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.84


/sbin/iptables -A INPUT -i tun+ -j ACCEPT
/sbin/iptables -A OUTPUT -o tun+ -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
/sbin/iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -d 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
/sbin/iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -d 10.1.0.0/8 -m conntrack --ctstate NEW -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT
/sbin/iptables -A FORWARD -i tun+ -j ACCEPT
/sbin/iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

The first commented line is another attempt to make it work.. and this is called in /etc/network/interfaces as a pre-up.

The static route is 10.8.0.0/24, gateway 192.168.1.84, PortA on the cyberoam.

I'm really stuck here, as I said, I can happily get to the 192.168.1.84 device, but nothing else on the lan.

Any ideas??

Peter.

Additional information... route table from a connected client (mac in this case).

% netstat -rn                                                                                                                                    pnunn@Peters-MacBook-Pro
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.0.1        UGSc           68        5     en0
default            10.8.0.5           UGScI           3        0   utun0
10.8/24            10.8.0.5           UGSc            1        0   utun0
10.8.0.5           10.8.0.6           UHr             7        0   utun0
10.8.0.5/32        link#19            UCS             1        0   utun0
127                127.0.0.1          UCS             1        0     lo0
127.0.0.1          127.0.0.1          UH              6  1179613     lo0
169.254            link#4             UCS             1        0     en0
192.168.0          link#4             UCS             4        0     en0
192.168.0.1/32     link#4             UCS             2        0     en0
192.168.0.1        c0:3f:e:e4:c:c     UHLWIir        70      902     en0    375
192.168.0.4        link#4             UHLWIi          1        7     en0
192.168.0.5/32     link#4             UCS             2        0     en0
192.168.0.5        34:36:3b:cd:ca:20  UHLWIi          1        7     lo0
192.168.0.6        link#4             UHLWIi          1        0     en0
192.168.0.255      link#4             UHLWbI          1      894     en0
192.168.1          10.8.0.5           UGSc            2        5   utun0
255.255.255.255/32 link#4             UCS             2        0     en0
255.255.255.255    link#4             UHLWbI          1       13     en0

255.255.255.255/32 link#19            UCSI            1        0   utun0

I've been given a CISCO ucs server to use (for a job a raspberry pie could do) with a LSI MegaRaid card in it (4 sas drives) and I'm having no luck at all getting Linux to boot off the RAID thing. It can find no boot sector on the raid devices, just loops through the nics looking for a pxi raid.

I can install happily (both Ubuntu and CentOS) but nothing will boot. The BIOS sees the virtual drive (tried raid 1 and raid 5 on the card).

The server has an SSD slot and an internal USB connector, both of which are enabled in the bios, but neither are seen by the installer (nor the bios by the looks of things). The internal USB connector seems to corrupt the data. I get no post and crazy stuff on the monitor when I plug anything in there. I have now managed to get it to boot by putting the usb drive in the rear usb connector, installing /boot on it and setting it as the boot device. Not ideal, but guess it will have to work.

Any one managed to get one of these machines to work with Linux?

got a really strange one for you all.

I have a network setup using a linux machine as a gateway between various network segments (on seperate nic's) and virtual machines (one of which is a mail server) all managed by shorewall and bind9.

This has all been running happily for ages, but on the weekend the servers went down and were rebooted. Since then, the windows machine (ONLY) are having problems opening anything of any size on the network. For example, email has a web page that will open to the point of login, and then hang. The mail clients can download the headers of messages, but not the body of the messages. Opening shared documents is no issue, but saving them is VERY VERY slow and usually times out. However, Mac and Linux machines have no issues at all. This is windows only, and only on the internal network. Access to all of this from outside, on any platform, is no problem.

I see this same behaviour from a windows machine running as a virtual box client on a linux host that has no issues.

I'm out of ideas. I've done packet sniffing, and apart from a bunch of retries from the windows machines that I don't see on Linux, no issues that jump out at me.

How would you suggest I try and fault find this? What does the windows stack do differently to the linux/mac stack?

We have several sets of app servers in a clients network running different code. Each set has Dev, UAT and Prod and we are developing outside the network.

At the moment I'm manually pushing the various code updates from my dev box (the default master I guess) via citrix to a shared directory on the dev server of each set, based on date changed, and from there to each of the other servers in turn as the code cycle progresses.

This was OK for one set, but is now becoming painful and error prone.

I'm wondering what people think is a viable alternative. We have limited or no outside access from the app servers (so something like Chef hosted would be difficult), and there are no nix boxes of any description in the network that I could use as a master unfortunately for either Chef or Puppet.

What are others using? Any suggestions?

Peter.

Just wondering if anyone else has had issues installing Windows 2K3 server under KVM.

I have tried a few times tonight and keep getting "not a supported platform" when the installation first boots.

I've used i686, had acpi and apic off and on, given it 4GB ram, 200GB hard disk and it fails every time.

I've done some hunting around, but can't find anything conclusive on google. It is listed as a supported client on the KVM site.

Host is Ubuntu 10.04 64Bit, qemu-kmv hypervisor. Drivers, I'm not sure what your asking for there, but the disk is a standard (I believe) 32 bit Win2K3 server. I'm trying to install a bulk standard server install. I've done it with win2K8 no problems, but this 2k3 install is failing every time.

I'm trying to work out how to migrate a Xen based windows server guest to a KVM host.

I've grabbed a copy of the Xen image and run an image conversion on it.

kvm-img convert -O raw 8345617d-0654-4cac-b92f-e29f6b0e1005.vhd win2K3.raw

Unfortunately when I try and run kvm with this raw image, it can't find a bootable device.

Has anyone managed this translation? I'm guessing its a bit simplistic given that I can't find much on the great search engine in the cloud to suggest this as an option.

Ta Peter.

I must be missing something here, but can someone clue me in on how to persist changes (such as software installs etc) on machines in the cloud (either EC2 or my own Eucalyptus cloud).

I have instances running.. can attach extra disks to them etc., but every time I terminate the instance, all of my changes are lost the next time I run them.

Now, this sort of makes sense in that the instances are virtual, but, there must be some way to make these changes persist. I'm just missing how its done.

Thanks.

Peter.

I'm trying to get a Eucalyptus system up and running and have managed to get the cloud controller and node controller running fine, with an instance running in the cloud system, but without any persistent storage.

When I try and create a volume I get

euca-create-volume -s 10 -z cluster1 VOLUME vol-5F5D0659 10 creating 2010-05-31T09:10:11.408Z

but when I try and see the volume I get

euca-describe-volumes VOLUME vol-5F5D0659 10 cluster1 failed 2010-05-31T09:10:11.408Z VOLUME vol-5FE9065E 10 cluster1 failed 2010-05-31T09:02:56.721Z

I've dug all over the place, but can't seem to turn up a reason the creation would fail or where to start looking to see what the issue might be. Anyone have any ideas where to even start looking for the answer to this?

Ta

Peter.

we are trying to setup apache (apache 2 in this case, although apache does the same thing) and html pages display just fine, however, any php pages linked into buttons on the front page are offered for download rather than being displayed.

Any ideas what we have missed? Its proving difficult to search on this in google as the terms are so heavily used elsewhere.

I know this is a bit general, but we have tried adding types to the to the apache.conf (or httpd.conf for apache1) are having no joy at all.

Thanks.

Peter.

I'm trying to download some files from an ftp dump site (one of our clients) and then remove the files once downloaded (using linux).

After some digging around I've come up with lftp to do the task and have the following script successfully getting the files

lftp -u  uname,pwd -e "mirror --Remove-source-files --verbose Recordings /OSQA/recordings" 203.zzz.fff.xxx

When the download completes, I get a message saying

158 bytes transferred in 4 seconds (891b/s) To be removed: 0 directories, 4 files, 0 symlinks

but nothing is deleted.

Any ideas what I'm doing wrong here? I need this to be in a script, so its a pain not to be able to get rid of the source files.

Thanks heaps

Peter.

is there a way to convince mssql server 2003 to allow me to backup to an external (NAS) drive rather than the current slow USB disk.

According to the docs (and certainly in practice it seems) your not able to select a device not physically attached to the server.

Any ideas on how to get around this?

Ta

Peter.

I'm sorry if this is a repeat post, seems my first attempt failed...

A little context first.

Firstly, I have inherited one of the classic networks from hell. Amongst a number of other things, I discovered that the majority of the clients data, including a heap of compliance data, is currently stored on one up USB drives being shared via Samba to the rest of the clients (and not being backed up).

To help me sleep at night, I've thrown together a linux files server with two raid 5 arrays to put this data on, and to avoid having to remap all of the client machines thought it should be OK to unmount the USB disks, after rsyncing the data to the file serve, and nfs mounting the new mount points in their place.

This seemed to work Ok with some quick testing, however, today I discovered that my users are having terribly trouble opening files across this arrangement with the file transfer rate being very very slow.

I don't see any problem with direct nfs mounting of the disks (from my linux box) but via the samba shares it is totally unusable.

I did use the default setting in both export and mount points no will play tonight with some of the options I have found on google, but am thinking I'll have to roll back for tomorrow at least.

Should I be able to do this? I can't see why not, as I'd guess it would be the sort of thing that would be done for a NAS system anyway.

Any advice? Please?

not sure if hardware questions are the go on here or not, but here goes anyway.

I have just picked up an old intel SC5200 rack chassis with an intel SE750CW2 motherboard and dual Xeon processors. It was cheep, due to its age I guess.

My intention was to use it to get a handle on server hardware (only been using desktop stuff in anger until now) and to try and setup some virtual machines on it to have a play.

Now, I discovered early on that its only a 32 bit system and doesn't have any virtual layer in hardware (my bad).. and I should have checked the specs a bit more (not that there were any in the auction) before putting my money down as neither ESXi nor Zen will work on it (atleast current versions).

I tried the 32 bit version of ESXi but found that it doesn't like the scsi controllers (LSI something.. don't have that detail at my finger tips).. but anyway, I can see the array in a normal linux, but not in the ESXi install.

So.... my question is.. can I put a different mother board into the chassis? I'm thinking that I should be able to pick up either a desktop MB or perhaps a different server MB to drop in and hopefully get it all happening with some more modern hardware.

I'm not sure about the drive bays or the front panel buttons however, these look to me like potential problems.

Thanks in advance.

Peter.