Michael's questions

I want to open a Powershell session from CentOS 7 to a Windows Server 2019 using a domain account but I can't get it working.

What I've done so far:

• Enabled WinRM on Windows (verified connection from another Windows Server 2019)
• Installed Powershell 7.1.3 on CentOS
• Installed gssntlmssp to enable NTLM authentication

Connection is done like this:

$sesopt = New-PSSessionOption -SkipCACheck -SkipCNCheck
Enter-PSSession -ComputerName 192.168.10.85 -Credential $cred -Authentication Negotiate -UseSSL -SessionOption $sesopt

gives me the error:

Enter-PSSession: Connecting to remote server 192.168.10.85 failed with the following error message : Authorization failed For more information, see the about_Remote_Troubleshooting Help topic.

On Windows eventlog I can see a authentication error with error code 0xC000035B. It looks like Powershell on Linux is trying NTLMv1 which is unsupported on modern Windows Server I think.

How to get a Powershell session working from CentOS 7 to Windows Server 2019 using WinRM and a domain account?

I have an older setup using Terraform and Openstack. Via Terraform there will be keypairs injected to Openstack instances:

resource "openstack_compute_instance_v2" "bamboo_agent" {
  name               = var.agents[count.index].name
  image_name         = "${var.image}"
  flavor_name        = "${var.flavor}"
  key_pair           = "${openstack_compute_keypair_v2.bamboo_ssh[0].name}"
  user_data          = "${file("scripts/init_instance.cfg")}"
  network {
    port             = "${openstack_networking_port_v2.bamboo[count.index].id}"
  }
  count= length(var.agents)
}

And in scripts/init_instance.cfg there will be keys added:

ssh_authorized_keys:
  - ssh-rsa ...

AFAIK both methods are doing the same, right? Do I need both? Wouldn't it be enough to remove one of it?

I want to remove the keypair and add the keys via ssh_authorized_keys to the default account and via users: to further accounts in cloud-init.

I want to install some RPM packages using Ansible and the installed rpm package manager. yum is not installed.

Using command module with rpm -i {{package}} causes the task to fail if the package is already installed. I'm searching for an idiomatic way to install the packages like yum or apt modules does it.

For long time I'm using Let's encrypt for all my encrypted services (HTTPS, IMAPS, SMTPS, FTPS). Now I want to add DKIM signature for my mail server. But is this possible using Let's Encrypt? I have to add the public key in the DKIM DNS entry. But the Let's Encrypt certificate is newly created every 30 days.

How can I use my Let's Encrypt certificate for DKIM?

(I know how to set up DKIM in the mail server. My question focus is on the DNS entry for DKIM)

I'm migrating our Icinga 2 from Debian 8 to Ubuntu 18.04. The old server had NRPE plugin 2.15. The new server has NRPE plugin 3.2.1.

If I try to connect with the new plugin to old NRPE servers (v2.15 too), I get these errors:

$ /usr/lib/nagios/plugins/check_nrpe -H some.server
CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 1.2.3.4: 1

$ /usr/lib/nagios/plugins/check_nrpe -H some.server -n
CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected).

$ /usr/lib/nagios/plugins/check_nrpe -2 -H some.server 
CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 1.2.3.4: 1

$ /usr/lib/nagios/plugins/check_nrpe -2 -H some.server -n
CHECK_NRPE: Receive header underflow - only -1 bytes received (4 expected).

The NRPE server always logs this:

Error: Could not complete SSL handshake. 1

The KB entry says, this should work. How to make the new plugin work with the old NRPE servers?

The OS uses SSSD to authenticate users via LDAP. It has no X server running. I can run id <username> to get the uid of the user. And the users can login to the system and their full name is displayed.

Is there a way to get the full name or display name of a specified user via a shell command?

I already have a working configuration to redirect all non-existent subdomains to a specific domain. Now I want to add a configuration that redirects all HTTP requests to HTTPS on the same domain.

This config file does the subdomain redirects:

# redirect any non-existent subdomain (blah.domain.de -> domain.de)
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://domain.de$request_uri;
}

And this is the config I try to use for HTTP->HTTPS:

# redirect any HTTP request to its HTTPS address (http://domain.de/blub -> https://domain.de/blub)
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name domain.de mail.domain.de admin.domain.de;
    return 301 https://$server_name$request_uri;
}

But this doesn't work because the default_server is defined twice. How can combine these two functions?

Do I really have to add the second config to every single subdomain config?

In our network I have several PCs which sync files from an rsync server (without encryption) to their local hard disk. Often (not always) it is really slow. In sum it took 33 min for 2 GB to transfer on a GBit network. The whole package of ~8 GB / 300000 files took more than an hour (I didn't measure the whole thing).

The server is on 10 GBit network. The clients and everything between is on an 1 GBit network. The server's and the client's CPU and RAM usage is low.

I setted up a virtual machine doing the same and sniffed the traffic using Wireshark. It came up there is a huge amount of TCP Dup ACK packets. Nothing happens in the transfer but the TCP stack is sending continuous Dup ACK packets with the same sequence numbers. The sequence number graph shows it.

Ping times are good (< 1 ms). What can cause this behavior? How to fix it?

EDIT 1:

I also tested it with a client from the same subnet. TCP Dup ACK occurs too but only a few times. The transfer is much faster. I got 1,5 GB in only 1:45 min. So I think it must be a network related problem. Maybe a tcp setting in the OS or a router problem(?)

When using autoindex on; in NGINX, is it possible to show a readme.txt file right under the directory listing? Apache does it with the ReadmeName option.

Is it possible to mix some configuration settings in Nginx? For example there is the auth_basic, which should work everywhere. And there is some other configuration spefic for one directory. Or there is the PHP interpreter...

# conf A
location / {
    try_files $uri $uri/ =404;
    auth_basic $auth;
    auth_basic_user_file /var/www/admin/.htpasswd;
}

# conf B
location /awstats/classes/ {
    alias /usr/local/awstats/wwwroot/classes/;
}

# conf C
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
}

So what happens here: If the request ends with .php, the auth_basic doesn't work. On any request to /awstats/classes/ the auth_basic doesn't work.

Is there a way to cascade or mix different configurations? So Nginx uses conf A AND B for example?

I want to use PHP 7 with newer apps and PHP 5.6 with apps, that doesn't work with PHP 7. So I try to configure Nginx to enable different PHP versions for different pathes. But it doesn't work:

 # should enable PHP5 for all PHP-scripts under /vexim/ path
 location ^~ /vexim/.*\.php$ {
     include snippets/fastcgi-php.conf;
     fastcgi_pass unix:/var/run/php5-fpm.sock;
 }

And the default for anything else should be PHP 7:

location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
}

With this configuration PHP scripts under /vexim/ are not parsed at all. How to get this working with different pathes and PHP versions?

(Using Debian 8.3 Jessie, Nginx 1.8.1 (dotdeb), PHP 5.6, PHP 7 (dotdeb))

I'm trying to migrate from Apache to Nginx. I'm using Nginx 1.8.1 and PHP 5.6

Apache accepts URLs like this:

domain.com/site/index.php/something

and calls index.php script with the parameter /something. This is how my Wordpress works but there are other scripts that rely on.

For example I can do this:

domain.com/path/script.php/someparameter

How can I get this working in Nginx?

EDIT: I found the solution for Wordpress:

location /blog/ {
    try_files $uri $uri/ /blog/index.php?$args;
}

But what is a general solution for all scripts?

OTRS supports PostgreSQL and MySQL databases. I'm using PostgreSQL 9.1 for my OTRS 3.2 but I want to migrate to MySQL 5.5. Is this possible? How?

In VMware View Admin Console I can view the System Health with View components, vSphere components and Other components.

How can I monitor this status via an API? (Powershell, Remote REST or something?)

The problem is about OTRS customers. I can't use an external customer backend, so I want to update the customer DB via CSV files. I already wrote a script to add new Customers via otrs.AddCustomerUser.pl.

But how can I mass disable old customers via a script?

We're using Microsoft System Center Configuration Manager 2012. And I have issues installing the SCCM Client on a Windows XP Prof SP3 PC. The Log on the XP machine says:

Failed to query BITS 2.5 interface with error 0x80004002    ccmsetup    22.10.2014 15:46:34 268 (0x010C)  
This operating system does not contain the correct version of BITS. BITS 2.5 or later is required.  ccmsetup    22.10.2014 15:46:34 268 (0x010C)  
A Fallback Status Point has not been specified.  Message with STATEID='321' will not be sent.   ccmsetup    22.10.2014 15:46:34 268 (0x010C)  
CcmSetup failed with error code 0x80004002  ccmsetup    22.10.2014 15:46:34 1448 (0x05A8)

BITS service is running and as far as I can see it is the correct version (qmgr.dll and qmgrprxy.dll are version 6.7.*). Windows Update (which uses BITS) does work without problems.

Some sites are telling to install KB923845 but this update says, there is already a newer version installed.

Does someone know how to fix it?

I do a silent deployment of Adobe Reader XI and the setup doesn't set Adobe Reader as default PDF Reader.

I can set the default Reader manually but it has to be done automatically.

I tried:

msiexec /i  "AcroRead.msi" /q TRANSFORMS="TransformFile.mst" 
msiexec /i  "AcroRead.msi" /q TRANSFORMS="TransformFile.mst" IW_DEFAULT_VERB=Read
msiexec /i  "AcroRead.msi" /q IW_DEFAULT_VERB=Read

Adobe Reader installs fine but it doesn't set itself as default Reader. I have to open the Reader manually and set it in settings again. But this is impractical.

The same problem is described by another user here. Does someone know how to fix it?

When I query installed services from a remote Windows 7 PC it's very slow. With a remote Windows XP PC it's always fast.

For example, from my Windows 7 PC the command

sc \\pc1 query type= service

takes 21s with Windows 7 remote PC. With a Windows XP remote PC it's instantly. I can reproduce this behavior with any of our PCs. And it happens with other tools too (e.g. Hyena) Has someone an idea what makes the request so slow or how to make it as instantly as with Windows XP?