Lisek's questions

I've got PSQL Server (Tried 13 and 14)

A very basic setting. One small DB.

One user with password.

in pg_hba I have configured access from network (md5) to those databases.

When I connect from Server host everything is ok, I can do everything I want. When I connect from remote machines (any) I successfully connected. I can see databases, connection settings. Everything looks fine. But when I just do "\dt" or many different things client hangs.

Nothing is doing, and it's not timing out. I've stopped Server and this client didn't get this.

I'm using this on Ubuntu 20.04 most actual software available today.

Does anyone have idea what is going on?

On server side logs I can only see that client is lost and that is all.

I've got serious issue with otrs 6.

Everything was working fine since yesterday, but today in my timezone we started daylight time saving (added one hour)

And Log was flooded with Errors like this:

[Sun Mar 28 19:36:30 2021][Error][Kernel::System::DateTime::new][154] Error creating DateTime object.

And

OTRS-otrs.Daemon.pl - Daemon Kernel::System::Daemon::DaemonModules::SchedulerCronTaskManager-10 Error creating DateTime object. in GUI/WebUI

TimeZone is ok in OTRSTimeZone and it's ok in OS. When I change OTRSTimeZone to UTC errors dissapear, but I've got messed up hours in tickets ;/

I've seen some topics about this issue, but nothing is working for me ;/

https://community.znuny.org/viewtopic.php?p=161559 https://community.znuny.org/viewtopic.php?f=62&t=41582&p=171775#p171775

Anyone knows what to do with that issue?

I would like to kindly ask for some advice.

I have configuration that looks like this:

Users are in Contact Groups. In Host Folders I have permissions to Contact Groups. And Hosts inherits this setting from folders

That works fine for Global Notification Rules But I Have SMS notifications with different time periods defined.

So in every user with sms notification, I’ve created new custom notification rule for user

It works, and sends sms in proper time periods.

Problem is that it now send notifications for all hosts not for the one that should be send. So it sends sms messages for users even if they are not in Contact Groups of that server.

And I’m stuck. Can someone try to help me?

In Global Notification Rules there is option “Restrict to Contact Groups” that should be ok for me, but it’s not available in custom user Rules. There is option “Match Contact Groups” instead but it doesn’t work like this .

In my configuration, very basic one (Only calico network, no apps yet) I have nginx-ingress running as NodePort - binding on port 30080. This port should be accessible only from localhost, but k8s opened this port for everyone, and since it's binding on 0.0.0.0 it's wide open now.

So I want to force kube-proxy to bind this port to 127.0.0.1 only.

I've tried modifing configmap to nginx-ingress (bind-address) but no luck with that.

Since this port is attached to kube-proxy - i was looking for kube-proxy config, but no luck at all. I've found yaml config file in /var/lib/kube-proxy but modifing it didn't change this.

After restarting pods, they are still binded to 0.0.0.0

I've tried many ways from internet, but still no luck.

Cluster was initialised with: kubeadm init --pod-network-cidr=10.XXX.XXX.XXX/XX --apiserver-advertise-address=X.X.X.X

I'm trying to achieve similar thing to raid6 on ceph.

But When I'm creating erasure coded pools (k=3 + m=2(or k=4) ) I always get inactive pgs.

ceph health details are:

HEALTH_WARN Reduced data availability: 128 pgs inactive
PG_AVAILABILITY Reduced data availability: 128 pgs inactive
    pg 11.a is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.b is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.c is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.d is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.e is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.f is stuck inactive for 107.974251, current state unknown, last acting []
    pg 11.20 is stuck inactive for 107.974251, current state unknown, last acting []

EC profile is:

crush-device-class=
crush-failure-domain=rack
crush-root=default
jerasure-per-chunk-alignment=false
k=4
m=2
plugin=jerasure
technique=reed_sol_van
w=8

also tried with k=3, the same thing happens

Crush rule (for k=4):

{
    "rule_id": 1,
    "rule_name": "r6pool",
    "ruleset": 1,
    "type": 3,
    "min_size": 3,
    "max_size": 6,
    "steps": [
        {
            "op": "set_chooseleaf_tries",
            "num": 5
        },
        {
            "op": "set_choose_tries",
            "num": 100
        },
        {
            "op": "take",
            "item": -1,
            "item_name": "default"
        },
        {
            "op": "chooseleaf_indep",
            "num": 0,
            "type": "rack"
        },
        {
            "op": "emit"
        }
    ]
}

Since everything is fine If not using EC pools, I'm pretty sure I don't understand something, but I'm unable to target my mistake.

To get this error on completely good 8 OSD Cluster I'm just doing:

ceph osd erasure-code-profile set raid6 k=3 m=2
ceph osd pool create r6pool 128 128 erasure raid6

and ceph -s shows this:

ceph -s
  cluster:
    id:     7635eaf1-df47-4bed-9cef-a3152cb4fa5f
    health: HEALTH_WARN
            Reduced data availability: 128 pgs inactive

  services:
    mon: 3 daemons, quorum CephMon1,CephMon3,CephMon2
    mgr: CephClient(active)
    osd: 9 osds: 8 up, 8 in

  data:
    pools:   2 pools, 256 pgs
    objects: 0 objects, 0B
    usage:   8.13GiB used, 31.8GiB / 40.0GiB avail
    pgs:     50.000% pgs unknown
             128 active+clean
             128 unknown

I'll be very gratefull for any help. Thanks.

I'm installing Ceph using Ansible with ceph-ansible project, branch static-3.2. There is a problem with iSCSI Gateway installation.

If you are using iscsigws name in inventory file - it shows that This is available only for RHEL. (Still doesn't work Out of the Box on Centos7, since missing yum packages, but maybe this works better in newer branch of ceph-ansible). What is needed to make it work on Ubuntu?

What I'm trying to do is to set zimbra properly. I'm using on my server multiple domains. All on one IP address.

But for one new domain, I want it to be visible differently. What I want to achieve is to prepare special IP address for this one domain on zimbra server, and configure zimbra to use it for sending and receiving e-mails.

So - postfix must be listening on this IP address.

If I connect to this IP, I should have HELO with my "new" domain

And if I send e-mail from zimbra - it should be sent from this new IP.

So what I did:

I tried VirtualIPAddress on zimbra (just to be proper everywhere - this will not help me - I know - it's for webmail certs only, until SNI will be deployed in Zimbra 9)

And tried configure domain like this:

http://forums.zimbra.com/administrators/58056-how-set-different-outgoing-ip-each-domain.html

So I've got sender dependent regexp to:

/@domain\.com$/ domain_com

and in master.cf.in i've got:

    domain_com unix - - n - - smtp
    -o smtp_bind_address=1.1.1.1 (my new IP)
    -o smtp_helo_name=domain.com
    -o smtpd_banner=domain.com ESMTP
    -o syslog_name=postfix-domain_com

So what I've got here - Seems like Zimbra 8.6.0 is not loading this file, since there is no errors (It should be I think - Since default zimbra is listening on all ports - there should be conflict)

So how should I properly configure zimbra to use separate IP address for just one domain?

Also - Will this files be archived while update of zimbra? Or they will be overwritten while updating?

I'm trying to set up a new pacemaker/corosync stack of 2 machines.

I was using it before with corosync1, but on Ubuntu 14.04 I've got corosync 2.3.3 OK - I said, and tried to use this version of software.

When i Prepare basic configuration with one ring - everything is ok. nodes are visible, and everything works super fine.

What i want to do is to enable encryption between nodes. Documentation is not very helpful ;/ or maybe i'm just too stupid ;)

. How to enable cipher on corosync ?

In manual We can read:

          crypto_hash
          This specifies which HMAC authentication should be used to authenticate all messages. Valid values are none (no authentication), md5, sha1, sha256, sha384 and sha512.

          The default is sha1.

          crypto_cipher
          This specifies which cipher should be used to encrypt all messages.  Valid values are none (no encryption), aes256, aes192, aes128 and 3des.  Enabling crypto_cipher, requires also enabling of crypto_hash.

          The default is aes256.

Superb! So let's try to use it: So in config, I've changed:

    crypto_cipher: none
    crypto_hash: none

to

    crypto_cipher: sha1
    crypto_hash: aes256

And What I've got?

Restarting corosync daemon corosync
error   [MAIN  ] Invalid cipher type
error   [MAIN  ] Corosync Cluster Engine exiting with status 8 at main.c:1158.

Whaaat? But It was said, that this is default. I can successfully use option secauth, but it is deprecated.

Every setting available for crypto_cipher is not recognized by corosync. WTF?

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana.

Everything was working ok, but i've found something strange in rsyslog.

I've found that i've got missing data in kibana. The reason is rsyslog.

Queue on disk was held and stopped for some days

So I've got missing data from weekend, but yesterday and today - all is ok.

Rsyslog now gets data and put them in logstash, but he seems to forgot about data stored in his own queue (I think he sees that they are old, and ignore them there is parameter for that, and maybe some default value is used? )

Right now, logstash is idle, i can force to him many additional data from rsyslog queue

So What i want to do is to :

Temporarly try to flush this queue (like postfix flush) or if this is not possible, what should i try to do?

My rsyslog config is:

$ActionSendTCPRebindInterval 500
$ActionQueueType LinkedList
$ActionQueueFileName kibana
$ActionQueueMaxFileSize 100m
$ActionQueueMaxDiskSpace 100g
$ActionQueueTimeoutEnqueue 0
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on

What I'm trying to do and I've got stuck is:

I've got apache server that will catch certain url's and for some of them, he will use ProxyPass (or mod_rewrite) to pass something as reverse proxy to another apache instance.

So I've got url like this:

/index.php/info?format=xml&token=SOMENUMERICTOKEN&token=SUMENUMERICTOKEN

I've tried :

PassProxy /index.php/info?format=xml https://1.2.3.4:567/index.php/info?format=xml

and relevant ProxyReverse but it's not working

Also tried Rewrite with same lines and [P] ending for proxying.

Non of them work.

They would work if i end with /index.php but I cannot allow access to index.php

Is it possible, to force apache to ask for password only if user don't have client-certificate installed?

I'm almost sure, that this is possible, but I'm not able to find any confirmation anywhere.

Is it possible to configure apache to act like this:

If user will have client-certificate - apache will allow connection to webpage without any problem or question. If user-certificate on the client-side will not be available, it will ask for basic auth authentication - so it will ask for password?

How to configure it? I'm fighting this since morning without any solution even to just stick to it.

I need help with my nginx configuration.

In this config I've got /svn location, that comes to apache http.

Apache is password protected (Basic Auth) When accessing https://my.server.com/svn it shows the apache login prompt, but in it, I can see that it's trying to access http://127.0.0.1:81/ - I need to hide this information.

Also, when I click on Cancel button, it redirects me to http://127.0.0.1:81/ displaying 403.

So what I need, is to serve everything over https, and not show anybody what port I use for internal communication.

After a successful login it is also on http url and port 81, but when I add https manually, and remove port 81 it also works ;)

upstream subversion_hosts {
    server 127.0.0.1:81;
}

server {

        listen   80; ## listen for ipv4
        listen   [::]:80 default ipv6only=on; ## listen for ipv6

        # Set appropriately for virtual hosting and to use server_name_in_redirect
        server_name server.name.com;
        server_name_in_redirect off;

        location / {
                rewrite ^(.*) https://server.name.com$1 permanent;
        }
}

server {

        listen   443; ## listen for ipv4
        listen   [::]:443 default ipv6only=on; ## listen for ipv6

        # Set appropriately for virtual hosting and to use server_name_in_redirect
        server_name  server.name.com;
        server_name_in_redirect off;

        access_log  /var/log/nginx/server.name.com.access.log;
        error_log  /var/log/nginx/server.name.com.error.log;

        include /etc/nginx/proxy_opts;
        proxy_redirect off;

        # Note:  Adjust ssl_certificate{,_key} to custom SSL cert, if not
        #        using ssl-cert package
        ssl on;
        ssl_certificate /etc/ssl/xxxx;
        ssl_certificate_key /etc/ssl/xxxx;

        ssl_protocols        SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers RC4:HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        keepalive_timeout    60;
        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout  10m;


        # Note:  Must match the prefix used in thin configuration for redmine
        #        or / if no prefix configured
        location / {
                root   /usr/share/redmine/public;
                error_page 404  404.html;
                error_page 500 502 503 504  500.html;
                try_files $uri/index.html $uri.html $uri @redmine_thin_servers;
        }

        location /svn {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                set $fixed_destination $http_destination;
                if ( $http_destination ~* ^https(.*)$ )
                {
                    set $fixed_destination http$1;
                }

                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Forwarded-Ssl on;
                proxy_set_header Destination $fixed_destination;
                proxy_pass http://subversion_hosts;
        }

        }
}

I need help with Samba configuration.

What I want to achieve is configuration, where windows user on share see only his files. This is simply achived With configuration like this:

Users are authorized by Windows AD Server

[BACKUP]
  comment = BACKUP STORAGE LOCATION
  path = /storage/BACKUP
  read only = no
  browseable = yes
  writable = yes
  create mode = 0600
  directory mode = 0700
  force directory mode = 0700
  force create mode = 0600
  access based share enum = yes
  hide unreadable = yes
  valid users = "@DOMAINNAME+SOMEUSERGROUP"

It works ok but... On the server side, everything in directory /storage/BACKUP keeps files of every user.

So I would like to create directory here for every user (I Can't use [home], because it's already used)

So i Would like to keep it like this:

/storage/BACKUP/username/

So when i change path, and add %U at end, everything is almost ok.

The problem is that i need to manually create directory /storage/BACKUP/username.

So what i need is somehow force Samba to create this directory before user to access this share.

I've tried adding add user script = /path/to/mkdir /storage/BACKUP/%U But this is not working because:

1. I don't know why ;)
2. I've already have users logged in before
3. It should start for new created users, this will be ok for me, but it not works.

I'm not creating users in linux, after they login, so i'm not using add user/machine script anywhere else.

So i want to force Samba to create directory for user, when this user tries to connect. I'm searching google from couple of hours, and didn't find a way to do it that will work for me.

I need to keep /server/BACKUP location for everyone, but on the server side, Need to keep files in separated directories per user, so creating a new share is also not a solution.