On Linux (specifically, RHEL derivatives CentOS and Fedora), is there a difference?
echo b > /proc/sysrq-trigger
"Immediately reboot the system, without unmounting or syncing filesystems," according to Wikipedia.
reboot -n
"Don’t sync before reboot or halt. Note that the kernel and storage drivers may still sync," according to man 8 reboot. Is there actually any difference in this behavior?
In virtually every FreeBSD network tuning document I can find:
# /boot/loader.conf
net.inet.tcp.tcbhashsize=4096
This is usually paired with some unhelpful statement like "TCP control-block hash table tuning" or "Set this to a reasonable value." man 4 tcp isn't much help either:
tcbhashsize Size of the TCP control-block hash table (read-only). This may be tuned using the kernel option TCBHASHSIZE or by setting net.inet.tcp.tcbhashsize in the loader(8).
The only document I can find that touches on this mysterious thing is the Protocol Control Block Lookup subsection beneath Transport Layer in Optimizing the FreeBSD IP and TCP Stack, but its description is more about potential bottlenecks in using it. It seems tied to matching new TCP segments to their listening sockets, but I'm not sure how.
What exactly is the TCP Control Block used for? Why would you want to set its hash size to 4096 or any other particular number?
The DNS Manager administrative tool doesn't seem to have an option for configuring TTL for an individual record. I can set the TTL per-zone by right-clicking -> Properties -> SOA. Where is the equivalent for each record?
These two paths are equal:
\\myhostname\c$\temp
c:\temp
Is there a performance difference between them? Specifically, long sequential reads and writes.
I've replaced Exchange 2007 with Google Apps, but now am facing the obtuse Exchange removal process. It seems that I need to go in and tear everything out manually (to uninstall I have to first remove the databases, to remove the database I have to first delete the mailboxes, shared address books, shared folders, etc) before uninstalling Exchange from the server, then I still have more work to do to clean Exchange out of AD.
This seems silly. Aside from general good hygiene, is there a compelling reason to uninstall Exchange properly rather than just wiping and repurposing the hardware?
When using the Worker MPM in Apache, you can fiddle with the number of child processes and the number of server threads per child process.
What are the advantages and disadvantages of each? Under what circumstances would you increase one or the other?
For network apps that create one thread per connection (like Pound), threadcount can become a bottleneck on the number of concurrent connections you can server.
I'm running FreeBSD 8 x64:
$ sysctl kern.maxproc
kern.maxproc: 6164
$ sysctl kern.threads.max_threads_per_proc
kern.threads.max_threads_per_proc: 1500
$ limits
Resource limits (current):
cputime infinity secs
filesize infinity kB
datasize 33554432 kB
stacksize 524288 kB
coredumpsize infinity kB
memoryuse infinity kB
memorylocked infinity kB
maxprocesses 5547
openfiles 200000
sbsize infinity bytes
vmemoryuse infinity kB
pseudo-terminals infinity
swapuse infinity kB
I want to increase kern.threads.max_threads_per_proc to 4096. Assuming each thread starts with a stack size of 512k, what else do I need to change to ensure that I don't hose my machine?
When I reboot a Windows 2003 or Windows 2008 server via a Remote Desktop connection, the server comes back up and will not accept any RDP connections: the RDP client errors out with "Connection Refused."
The Terminal Services service is running on the server and restarting it has no effect. No errors are logged on the server.
The only way I've found to fix this is to login at the console or via the DRAC and reboot the machine again, which is an ugly solution for obvious reasons.
Has anyone run into this before?
How do 2.5" 10k RPM SAS drives perform compared to 3.5" 15k RPM SAS drives?
Specific areas of comparison:
Is it possible to access Puppet master configuration variables (like confdir, masterport, etc) from within a Puppet manifest?
Other questions have touched on this, but let's get a complete answer down:
What specific permissions are necessary for a generic IIS 7 site with a domain user as the app pool identity?
What specific permissions are necessary for an ASP.NET IIS 7 site with a domain user as the app pool identity?
Every time an SSL cert comes up for renewal, my provider tries to sell me an Extended Validation certificate. The big difference is the green address bar in FireFox and Safari for quadruple or quintuple the cost.
Supposedly, the benefit (and reason for the green bar not shown in IE8 or Chrome) is deeper authentication of the requesting party. But I can detect little actual difference between Verisign's own minimum requirements (from their CPS) for all SSL certs (section 3.2.2):
At a minimum VeriSign shall:
• Determine that the organization exists by using at least one third party identity proofing service or database, or alternatively, organizational documentation issued by or filed with the applicable government agency or competent authority that confirms the existence of the organization,• Confirm by telephone, confirmatory postal mail, or comparable procedure to the Certificate Applicant certain information about the organization, that the organization has authorized the Certificate Application, and that the person submitting the Certificate Application on behalf of the Certificate Applicant is authorized to do so. When a certificate includes the name of an individual as an authorized representative of the Organization, the employment of that individual and his/her authority to act on behalf of the Organization shall also be confirmed.
Where a domain name or e-mail address is included in the certificate VeriSign authenticates the Organization’s right to use that domain name either as a fully qualified Domain name or an e-mail domain.
and EV requirements (Appendix F14C):
(C) Business Entities
To verify a Business Entity’s legal existence and identity VeriSign verifies that the Entity is engaged in business under the name submitted by Applicant in the Application. VeriSign verifies that the Applicant’s formal legal name as recognized by the Registration Authority in Applicant’s Jurisdiction of Registration matches Applicant’s name in the EV Certificate Request. VeriSign records the specific unique Registration Number assigned to Applicant by the Registration Agency in Applicant’s Jurisdiction of Registration. Where the Registration Agency does not assign a Registration Number, the Applicant’s date of Registration will be recorded. In addition, the identity of a Principal Individual associated with the Business Entity is verified in accordance with Section 14(b)(4) of the EV Guidelines.
So:
1) Do EV certificates actually inspire more trust among users?
2) Do EV certificates actually help fight phshing/fraud/any of the things vendors list?
3) If they actually performed the minimum requirement, doesn't that include all the EV stuff? What am I missing?
How do I setup spamtraps with Postfix so clients that send to trapped addresses are prevented from sending me more spam?
As of 0.24.8, can a Puppet template call a Puppet function?
I can get similar functionality by calling the function in my manifest, assigning the return value to a variable, and then using the lookupvar('variable') in the template, but I'd like to cut out the middle man.
We all have a lot of internal services that need encryption and authentication to be provided by some sort of PKI.
Do the security gains of using a different private/public key pair for each service justify the extra work entailed?
Or is using a single key pair per server Good Enough?
For instance, all of my *nix servers have rsyslog, Bacula, and Puppet running on them. Does using a common, server-specific key pair across all three services open up an attack vector I'm overlooking?
How would you explain LDAP to a sysadmin who's heard of it and maybe interacted with it, but never really grasped it?
Analogies are fine, but please include some salient technical details to help ground them.
Asked in the spirit of Active Directory explained
Active Directory is one of the best features of Windows Server, but it's also a big shiny target. If compromised it gives the attacker your Windows network.
In an environment with externally facing Windows servers (web servers in my case), what steps are necessary to protect Active Directory from attack? How do you reduce the damage potential if a domain member is compromised? Finally, is there any way to reduce the damage potential if a domain controller is compromised?
I'm looking for info that relates specifically to Active Directory (2003 and 2008). Universal best practices (read your logs, secure Administrator passwords, etc) should be a given.
Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well.
How can I authenticate OpenBSD against Active Directory?
Our QA team requires Vista VMs for testing (installers, features, performance general compatibility, etc.). Physical PCs with Vista installed don't cut it since they make it difficult to roll back to specific points in the process.
The problem is that Vista's activation model is completely incompatible with this model. I haven't traced down exactly what causes Vista to deactivate itself, but it seems related to moving VMs between workstations. This happens a lot for us. It also seems to deactivate if we upgrade VMWare Workstation (unconfirmed).
We are an MSDN partner so we have plenty of product keys for Vista, but it's a huge pain to keep reactivating it. Even moreso since we make heavy use of snapshots (ie, reactivate it in one snapshot, then roll back to a different one and you have to reactivate again).
Has anyone found a way around this, or does VMWare have some tool I'm overlooking to keep Vista from panicking every time the desktop machine changes?
Finally, has anyone had this issue in ESX 3+?
The Remote Desktop client on Windows XP x64 (SP2) sometimes gets into a state where it can't find certain remote computers by name. For instance:
dc.example.local = 10.123.0.27
Attempting to RDP to dc.example.local yields the error message:
This computer can't connect to the remote computer.
Remote Desktop cannot find the remote computer. Type the computer name or IP address again, and then try connecting. If the problem continues, contact the owner of the remote computer or your network administrator.
If I use the IP address, I can connect fine.
"nslookup dc.example.local" resolves correctly. "ipconfig /flushdns" does not change the situation. I can connect to other computers by name with no problem.
Rebooting temporarily corrects the issue. When this occurs, it's not always the same machine that's broken. Before my last reboot, I couldn't hit sql3.example.local. Everything worked perfectly for a while, now I can connect to sql3 but not to dc.
I am not running any firewall software on this client, and there are no suspicious messages in my event logs. Other workstations are unaffected by this problem.
Anybody have an idea?