jamboNum5's questions

I'm having a little trouble working with the Global Variables in Foreman. I have a global variable called ALLOW_AD_USERS which I can see in the facts section against the host. I'm trying to use this variable with in the YAML config associated with a host. It just seemed to copy this in like-for-like.

After reading the manual, I would have thought I could add "${$foreman::ALLOW_AD_USERS}" and it auto file the names I have defined within the global variable.

Any help would be great here.

sssd:
  domains: example.com
  config_file_version: 2
  services:
  - nss
  - pam
domain/example.com
  ad_domain: example.com
  krb5_realm: EXAMPLE.COM
  realmd_tags: manages-system joined-with-adcli
  cache_credentials: true
  id_provider: ad
  access_provider: simple
  simple_allow_users:
  - "${$foreman::ALLOW_AD_USERS}"
  ignore_group_members: true
  dyndns_update: true
  ad_gpo_map_permit: "+polkit-1"

Having issues with the adcli on ubuntu 18.04 which was updated recently with the ldaps option.

It can't seem to find the shortname for AD and also doesn't manage to connect to LDAP even when the CA is specified in the command and with /etc/ldap/ldap.conf

Have also tried to configure the ldap_uri in the SSSD config with no luck there either.

me@lnx-node-1:~# LDAPTLS_CACERT=/usr/local/share/ca-certificates/domain-ca.pem adcli join -U me-admin --domain=ad.somewhere.com -v
     * Using domain name: AD.SOMEWHERE.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Calculated domain realm from name: AD.SOMEWHERE.COM
     * Discovering domain controllers: _ldap._tcp.AD.SOMEWHERE.COM
     * Sending netlogon pings to domain controller: ldap://[####:650:###:d314::dc1]
     * Sending netlogon pings to domain controller: cldap://####.###.160.19
     * Sending netlogon pings to domain controller: ldap://[####:630:###:d314::dc4]
     * Sending netlogon pings to domain controller: cldap://###.###.160.59
     * Sending netlogon pings to domain controller: ldap://[####:630:###:e010::dc2]
     * Received NetLogon info from: itsdc-1.ad.somewhere.com
     * Wrote out krb5.conf snippet to /tmp/adcli-krb5-H8CKiH/krb5.d/adcli-krb5-conf-vv3c80
    Password for [email protected]: 
     * Authenticated as user: [email protected]
     * Using GSS-SPNEGO for SASL bind
     * ! Couldn't lookup domain short name: Can't contact LDAP server
     * Using fully qualified name: lnx-node-1.ad.somewhere.com
     * Using domain name: AD.SOMEWHER.COM
     * Using computer account name: LNX-NODE-1
     * Using domain realm: AD.SOMEWHER.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Generated 120 character computer password
     * Using keytab: FILE:/etc/krb5.keytab
     ! Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server
    adcli: joining domain AD.SOMEWHERE.COM failed: Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server

UPDATE : Managed a temporary workaround downgrading the adcli packages apt install adcli=0.8.2-1, still need a fix.

I have a virtual machine running with the warning below.

vmsvc[895]: [ warning] [guestinfo] Too many partitions
vmsvc[895]: [ warning] [guestinfo] Failed to update VMDB

I believe this could be linked to the great number of quota mounts that are listed in the fstab but unsure.

Very little found on this error when searching the internet.

I'm looking to create a script that logs into a machine and pulls back files to a NAS server. The files will be put into a compressed file as it downloads.

Because the script will be looking to download files with varying owners and permissions, it will need to run as root to make sure it captures everything in the home directory.

I have edited my visudo file to allow the backup user to sudo tar without a password. But there is something stopping the command from running successfully:

backup ALL=NOPASSWD: /usr/tar

Command ran from the NAS:

ssh -t [email protected] "sudo tar -zcf - /home/" > /var/backup/server1.tar.gz

Any help would be great, thanks

Update: It would of been good to know why I was down voted for this question.

Is there a way in which nginx/php can be configured so it creates files with a specific user.

For example when a drupal/wordpress site uploads a file the user is assigned like: john:www-data

nginx.conf does have a user, but from what I understand this only changes the user nginx uses on the system.

We had feedback from our pentest report saying we should turn off server tokens. This is stop people being able to see which version of PHP we are using, and limit their ability to target the specific PHP version.

I have added the following to nginx.conf, under the http block:

server_tokens off;

But what tools can I use to check this change has taken affect?