palehorse's questions

I have a server running CentOS 6 with Bind 9.8.2 which is not resolving DNS for 1 particular host which isn't even one of the zones that this server hosts. All other querys work fine, including querys for other hosts in the domain that I'm having issue with.

From the problem server

$ dig www.example.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> www.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6139
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.example.com.             IN      A

$ nslookup -debug www.example.com
Server:         x.x.x.x
Address:        x.x.x.x#53

------------
    QUESTIONS:
        www.example.com, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
** server can't find www.example.com: SERVFAIL
Server:         x.x.x.x
Address:        x.x.x.x#53

$ dig en-es.example.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> en-es.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4755
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 1

;; QUESTION SECTION:
;en-es.example.com.           IN      A

;; ANSWER SECTION:
en-es.example.com.    600     IN      A z.z.z.z

From other servers (both on the same network and outside)

$ dig www.example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> www.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58315
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.example.com.             IN      A

;; ANSWER SECTION:
www.example.com.      324     IN      CNAME   my.cname.net.
my.cname.net        . 20      IN      A       y.y.y.y

How do I track down why this query results in a SERVFAIL allowing the next logical step, fixing the issue.

On our CentOS 6 servers, I've used information from this article to reduce the brute force ssh attempts on our servers, specifically the rate limiting / logging section. Is there a way to do the same thing using firewalld in CentOS 7? I'd prefer to avoid switching back to iptables since it seems firewalld is the direction that the OS is going.

For reference, here's the basic configuration in iptables that we're using (some values are different)

/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -j LOG
/sbin/iptables -A LOGDROP -j DROP
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent  --update --seconds 60 --hitcount 4 -j LOGDROP

I've implemented simple rate limiting using HaProxy in a similar fashion to the way StackExchange does it with HaProxy. I'm trying to make it a bit more advanced so that there are multiple thresholds of rate limiting.

For example, limit clients that request:

• 15/minute

• 60/hour

• 360/day

It seems like I need multiple stick-tables to store the same data with different sample rates. The documentation states:

There is only one stick-table per proxy. At the moment of writing this doc, it does not seem useful to have multiple tables per proxy. If this happens to be required, simply create a dummy backend with a stick-table in it and reference it.

Unfortunately I'm having a devil of a time trying to figure out how to store the data into the dummy backend tables.

I'm also open to other methods, HaProxy simply seemed like a promising road and since we already have it in the environment it made sense. Any suggestions are appreciated.

I'm having difficulty creating a GPO that will be applied only to certain computers and security groups. Here is what I would like to do.

I have an OU with several computers in them. I would like to apply a GPO that causes remote sessions that have been idle for x amount of time disconnect and for disconnected sessions to log out after y amount of time. I need this to apply to only users in a specific security group.

I have created the GPO and changed the 2 settings in Computer Configuration -> Policies => Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits.

Next I Link the GPO to my target OU and turn on the Enforce check box. I change the Scope Security Filtering to remove Authenticated Users (because if I don't it gets applied to everyone) and then I add in my security group. I also add in the Domain Computers group (because if I don't it doesn't get applied to anyone)

The problem is that the GPO still gets applied to users that are not part of the security group. If I change the GPO from Computer Configuration to User Configuration then the GPO does not get applied to any users at all.

I have also tried moving the security group to a separate OU and linking the GPO to that OU instead, but that did not work either.

It seems like my configuration should work, but I cannot figure out why it's applying it to users not within the group. Any help is appreciated!

We have been using Microsoft's DHCP server on our domain for years with success. One of the options we are pushing to the client is the default gateway. In the Scope Options dialog it reads:

003 Router   Array of router addresses ordered by preference

Currently we have 2 routers assigned, our primary and a backup which uses a different (slower) internet connection. All has been fine with Windows XP running under this setup.

We recently began testing Windows 7 (RTM) clients as there is pressure to begin deploying the new OS when it is available. The problem is that it does not respect the "preferred order" pushed in DHCP. While the routing table shows that it is set up just like the routing table on the XP clients, it uses the second gateway instead of the first. So far the only way to make it use the first is to manually run the route CHANGE command to set the metric for the first gateway to a lower value. Since this has to be done as an elevated user, this will be problematic.

Is this just a bug in Windows 7, or is there some other DHCP option that we are unable to find that will also let us push a metric out with each gateway?

We have Exchange 2003 running on a Windows 2003 server. For some reason, the backup job (using NTBackup) usually fails to work by itself. If I right click on the job and run it, it works fine, the files are backed up and the transaction logs for Exchange are removed.

I have verified multiple times that the user the task is scheduled to run as has the appropriate permissions. I've even set it up to run as an administrative account to rule that out. It does not matter if the console is left logged on and locked or if it is logged out, the darn thing simply will not work.

I've created a batch file to try to capture what's going on which writes out to it's own log file and calls the ntbackup.exe with the job parameters. It shows that the process starts and that ntbackup runs returning an exit code of 0 (normally a success) however, nothing is backed up.

Now here's one more oddity. We had to reboot the server a few weeks ago for an update. After that reboot, the task would work as scheduled as long as the console was logged in! Last weekend we unfortunately had a couple of huge thunderstorms, one of which resulted in an extended power outage in which the server had to be shut down. Now it will not work as it should.

I cannot find anything in any log (event log, backup log) that indicates there is a problem. Is there any way to troubleshoot this?

[EDIT] Here are the parameters requested by Nick

ntbackup.exe backup "<path to the .bks" /n "<path to the .bkf>" /j "Nightly Backup" /v:yes /r:no /rs:no 

We were looking at a possible way to organize public folders and created a public store for a specific segment of our organization. It turns out that the idea did not work the way we wanted it to so now we are trying to clean up.

We've removed the folders that were created in it and now we're trying to delete the store. Each time we do the following message:

You cannot delete this public folder store because it contains folder
replicas.  To avoid data loss, right click the public folder store and
use Move All Replicas to move the replicas to a different server.  It
may take several hours until the content is replicated to the new server
and the local replicas are removed.

We only have one Exchange server in our organization so there is no way to do what is requested. How can this store be deleted?

We have a Windows 2003 server acting as a print server for our Konica/Miolta 7222 Biz Hub, among others. Recently the driver was updated on the server to the incorrect version (Why Konica has a "special" driver for something is beyond me). That was caught fairly quickly and the correct driver was then installed.

On some XP clients, the incorrect driver was updated causing a password prompt (part of the driver) to be displayed. After the second update they password box went away. On a few clients; however, the password prompt continues, signifying the incorrect driver is still installed even though it is days and several reboots later.

We have tried removing the printer from the affected clients and adding them back, but that has not worked. Attempting to delete the driver from the clients also fails with the message "The files may be in use". This occurs even right after a clean boot. We cannot do it in safe mode because the drivers will not come up without the spooler service running, and that is one service that will not run in safe mode.

Any help or suggestions would be greatly appreciated.

We have a fair number of public folders in our Exchange system. When we create new folders, we assign them an email address and turn off the "Hide from address list" option in order to allow users to copy messages directly to the folder.

The two recent folders that were added are not appearing for Outlook clients. Normally the test is to open a new message, type in the folder name (or enough of it that there is not a "quick entry"), then hit Ctrl+K to resolve the address. It usually works. Now, it does not.

In Exchange manager, viewing the properties of both the All Address Lists/Public Folders and the Global Address List objects (under recipients) and then clicking the Preview button, the two items show up as expected; however, 24 hours later the issue still is not resolved for the Outlook clients.

Both cached and non-cached Outlook clients have been tested. We have also tried the "Update" option on the recipient policies (they have not been changed) and are thinking about the "Rebuild" option, but it always gives the message that it could take a day to perform which is a bit worrisome. I do not know if that means the GAL will not be fully available to users during the rebuild or not.

If anybody has some ideas, I would be most appreciateive.

Is it possible to allow a user (or group of users) permission to view and edit websites settings using the IIS Manager snap-in without giving them administrative privileges on the Windows 2003 server? Ideally it would be nice to give that user/group permission to only selected websites and/or application pools.

Is there a way to connect to an ssh session that was disconnected? We are having problems with our network connection to a remote site that we are working on separately; however, in the mean time we experience a large number of disconnects due to lost packets while connected to servers at the remote location. Many times the session stays active for a while, and sometimes it happens to be in the middle of some action (file editing, running some process, etc...) that I need to get back to rather than restart if possible.

We have a Dell PowerEdge 2950 running Windows Server 2003 R2, Enterprise x64 with Service Pack 2 installed.

Recently, we've been experiencing multiple STOP errors occurring with that server. Fortunately it is in place as a fail over machine so it is not currently affecting our production environment. The error that shows up in the server log is this:

Event Type: Error
Event Source:   System Error
Event Category: (102)
Event ID:   1003
Description:
Error code 000000000000009c, parameter1 0000000000000004, 
parameter2 fffffadf90881240, parameter3 00000000f2000000, 
parameter4 0000000000060151.

So far the best I've been able to track down is that the 9C error is some sort of generic hardware problem. The other parameters have been no use in narrowing this one down.

There have been no hardware changes since the machine was brought into service last year. It has a twin box that is identical (the primary that this one acts as a fail over for) that is not experiencing the behavior. The last software change was on 4/16/2009 when several security updates were applied. The blue screens started happening on 5/9/2009.

Are there any diagnostics that may help with tis problem?