Natalie Adams's questions

We have Oracle running on a Windows server and a couple of Linux clients. Windows clients work just fine. However, running tnsping on a Linux (running RHEL 6.9) client has an interesting issue. Take for example:

tnsping <IP> 100

This will eventually fail on a Linux client with:

TNS-12535: TNS:operation timed out

Keeping in mind - ping does not show any dropped packets. I did some testing with tcpdump and when I loaded it in wireshark the only thin that I could see that was weird was TCP retransmissions. Every Linux client I try this one exhibits this behavior. I tried tweaking some OS level TCP timeouts/keep alives and still didn't resolve it.

I did do an strace on tnsping and the only thing it showed was a timeout which didn't help.

The systems in question are VMs running on VMWare.

Edit:

I created a trace file and ran tnsping again. It did succeed for many connections then eventually timed out:

nttcni: Tcp conn timeout = 60000 (ms)
nttcni: TCP Connect TO enabled. Switching to NB
nttctl: entry
nttctl: Setting connection into non-blocking mode
nttcni: trying to connect to socket 5.
ntt2err: entry
ntt2err: exit
ntctst: size of NTTEST list is 1 - not calling poll
sntpoltst: No of conn to test 1, wait time 60
sntpoltst: fd 5 need 1 readiness events
sntpoltst: exit
nttcni: TImeout or Error on this socket
nttcni: exit
nttcon: exit
nserror: entry
nserror: nsres: id=0, op=65, ns=12535, ns2=12560; nt[0]=505, nt[1]=0, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=0
nsopen: unable to open transport
nsiocancel: entry
nsiofrrg: entry
nsiofrrg: cur = 24eff18
nsbfr: entry
nsbaddfl: entry
nsbaddfl: normal exit
nsbfr: normal exit
nsiofrrg: exit
nsiocancel: exit
nsvntx_dei: entry
nsvntx_dei: exit

I did find this article which is similar to my issue but not quite. In their example tnsping was able to connect and send data it looks like - my tnsping doesn't even establish a TCP connection.

https://ardentperf.com/2010/09/08/mysterious-oracle-net-errors/

If I add the following options to the connection in tnsnames.ora file:

(RETRY_COUNT=3)
    (TRANSPORT_CONNECT_TIMEOUT=10)

Then it will work without a timeout but will result in a high latency:

OK (10 msec)
OK (0 msec)
OK (0 msec)
OK (10 msec)
OK (0 msec)
OK (0 msec)
OK (10020 msec)
OK (0 msec)
OK (0 msec)
OK (0 msec)
OK (10 msec)
OK (0 msec)

This "fix" is the equivalent of bubble gum and duct tape but it does work.

I've been scratching my head for a day or so trying to learn FIM.

I attempted to walk through this tutorial which is one of the things I want to use it for - but I couldn't get it to work (users don't show up in FIM).

I am following this other tutorial which uses a simple CSV to popular users in FIM - which I also can't get to work.

I think part of my problem is that I don't seem to have any users in FIM (this is from a fresh install): http://i.imgur.com/0ONOP.png

I have read from many sources that you should at least have administrator in there.

Also I get export errors from the CSV tutorial that say "The endpoint could not dispatch the request."

I am looking to develop a solution that eliminates potential spammers. The way this system will work is that it will watch connections and requests. Going into the specifics is more for stackoverflow, But, what I am interested in is if it is possible to tell Apache to pass the request over to my application first and give it the ability to accept/deny the request. Sure, it will make requests slower, but I think that is a trade off I am willing to take. I still want, however, Apache to run the request through any interpreters (such as PHP).

The idea is that one wouldn't have to implement anti-spam measures on a per app basis but have an "umbrella" of spam protection.

I am running Microsoft Hyper-V Server 2008 R2 and have 2 Linux guests running. I have noticed that if I increase the number of processors that are available to the Linux guest networking doesn't seem to work when booted into the OS. It does look like it was able to get an IP address from DHCP, but if I try to renew with dhclient ethx then it timesout saying that a DHCP server hasn't responded.
However, once I set the number of processors to one then it works perfectly.

Specs:
Legacy network adapter
Ubuntu 10.04

Am I doing something wrong?

I have a question that probably seems kind of stupid but I can't find a definitive answer from google.

In Microsoft's DHCP Server service, and if you are running AD, you can "authorize" a DHCP server.

I'm guessing that means that if a DHCP server is not authorized, and joined to the domain, it won't respond to DHCP requests correct?

Also, does it need to have it's name in DNS for it to actually function properly? For example dhcp.example.com -> 192.168.1.2
I know it's recommended, but what are the ramifications if you don't have it?

I have 2 Linksys WRT54GL routers flashed with DD-WRT. On each I have a different ISP, and thus a different private network. I would like to be able to talk to either network regardless of what network I am on.

Example:

ISP1 -> Router1 -> Client

ISP2 -> Router2 -> Client

What I would like to do is something like:

ISP1 -> Router1 -> Client
             ^
             |
             v
ISP2 -> Router2 -> Client

This would be ideally because then I don't need to introduce another device in the mix, unless I have to.

But I guess the first question is - is this even possible?

Edit: Both routers are in the same office right next to each other.

Among my several years of running servers there seems to be a pattern with most spam activity. My question/idea is that is there a way to tell Apache to run a script when POST data is detected?
What I would want to do is perform a reverse DNS lookup on the client's IP address, and then perform a DNS lookup on the hostname in the PTR record. Afterwards, perform some checks, excuse the pseudo-code:

if PTR does not exist:
     deny POST request
if IP of PTR hostname = client's IP
     Allow POST request
else
     deny POST request

Though I don't care about GET requests, even though they can be just as malicious, this idea is targeted towards spam comments which use POST data to send the comment data to the web server. In order to make sure there isn't much of a time delay, I would run my own recursive DNS server.

Please do note, this isn't meant to be a sliver bullet to spam, but it should decrease the volume.

Possible or impossible?

Lets say we have a default formatted ext3 filesystem, I run under the assumption that folders take 4K of space on the disk.

But, what does it mean when a folder is bigger than 4K?

Here is a pic of one such folder: http://datanethost.net/stuff/puttysh.png
The only file was an .htaccess file that was a couple of bytes. I created a new directory, moved the .htaccess file into the new folder and delete the other weird folder and everything is fine again...but I just find it weird.

Can anyone explain this?

Here is a question that I can't seem to find a good answer to.

Under Windows/DOS we have been "taught" that it is ok for use to be able to launch programs from the current directory without having to prefix the path.

However, the default behavior for Linux is that you must prefix ./ for applications/scripts in the current directory.

People say that it is a bad security practice to allow programs/scripts to execute without prefixing the directory. There a lot of "bad security practices", but this one doesn't make sense to me. For example, I am not going to enter /some/unfamiliar/directory and start executing programs like ls. I would cd (to get to my home directory), then type ls -la /some/unfamiliar/directory. Of course, on a bad day I would.

I can see the "threat" if someone puts a program with the name of ls in a directory, and a bad sysadmin cds to that directory and runs ls as root and the ls adds a backdoor user and other evil things. Fine. But, usually in that case a user would complain "oh ls isn't working can you check into that?". I would sudo su "user" and try ls as him.

Unless I am completely missing something, is adding "." to your PATH really that bad?

Edit:

All the answers so far are fine for pointing out the security risks - however - everyone is missing the arguments for Windows. Under Windows the current directory is NOT in your path, so there is no way to disable the ability to just run program.exe afaik. However, the command prompt does accept the ability to prefix the command with .\ (.\ does seem to work, however, you should use \ otherwise you could end up with an escape sequence of some kind). Under Windows should we always prefix the command? Also, should we contact Microsoft and tell them they are bad for implanting this expected behavior?

My background is Windows, so I am biased in expecting programs in the current directory to be able to run, even though I know that isn't the way it works in the Unix world. Which is why I presented the question out there.

To expand what I mean on "bad security practices" (and why they are in quotes) is because we could cite millions, if not billions, of security practices that people SHOULD be doing...but we don't and if we did, a person would certainly go insane. Should we mitigate every security risk with the potential of interfering with the user's experience? I say no but that is because I believe security should be transparent to the user(s), but I like haus's first sentence in his response "As much as anything else it is a mindset.". And I think we should leave it at that.

I am working on a client's site, and I spot this htaccess file.

# -FrontPage-

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit POST PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName [cut]
AuthUserFile  /web/u354/www70620/www/_vti_pvt/service.pwd
AuthGroupFile /web/u354/www70620/www/_vti_pvt/service.grp  

Can someone explain what is going on?

So, in the first limit, they are allowing all post, but in the second limit they deny it?

And what is up with the Auth stuff at the bottom? I know it deals with basic web auth, but the site doesn't require a login to view it.

I am currently under an SSH attack.
The attack is very strange in nature, the attacker is using a botnet of computers and using them as individual login attempts (see log snippet):
Dec 11 08:30:51 rhea sshd[16267]: Invalid user maureen from 78.43.82.153
Dec 11 08:35:24 rhea sshd[20012]: Invalid user maurizio from 201.244.188.202
Dec 11 08:44:46 rhea sshd[27711]: Invalid user max from 211.140.12.46
Dec 11 08:49:10 rhea sshd[31383]: Invalid user max from 190.144.47.82
Dec 11 08:58:19 rhea sshd[6659]: Invalid user max from 69.250.227.138
Dec 11 09:07:28 rhea sshd[14249]: Invalid user maxim from 93.63.231.55
Dec 11 09:12:03 rhea sshd[18127]: Invalid user maximus from 79.188.240.210

I am willing to filter all access to port 22 (ie only allow IPs I specify to connect), and what I have done a couple days ago (is block all connections to port 22 but from myself). What I want to do is log ALL connections that don't have an accept rule to log and drop it - this way I can track all the computers in the bot not without giving them the opportunity to attempt to login.

What I have is something like this:
-A INPUT -s my.addr(s) -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP

Update
I have added this to my iptables:
[0:0] -A INPUT -m limit --limit 5/min -p tcp -m tcp --dport 22 -j LOG --log-level 4 --log-prefix "** DoS **"
and used
http://www.cyberciti.biz/tips/force-iptables-to-log-messages-to-a-different-log-file.html
To setup a separate file, however, I can only see the logged data in dmesg.

I currently have a RAID level 1 of 2 500 GB HDs. The RAID is managed by server 1 and the drives are in 2 different servers.

The RAID works great once I get it setup, however, at random times the connection seems to get dropped and mdadm marks it as faulty and even though I use nbd-client with the -persist option; mdadm refuses to see the drive as good. The only way to get this disconnect drive back into the RAID array is to:
mdadm -r /dev/md0 /dev/nbd1
mdadm -a /dev/md0 /dev/nbd1

My problem with this is that it causes a FULL RESYNC of 500GB over the network.
I have 2 questions to this problem:

Is there a way to tell mdadm not to complete a full resync because it does complete a resync before it disconnects so I can't see a good reason for it to perform a FULL resync?

Would I be better off with rsync because all I need is just a backup copy of whatever data I write/delete? I suggest this because rsync, supposedly, only transfers the delta (or changed) data instead of what mdadm seems to be doing.

Does anyone know if it is possible to install Ubuntu server headless?

I do know of the ability to output a terminal to a COM port, BUT, I was wondering if there was a way to drop a prompt, install SSH, and relaunch the setup through SSH.

I am looking for a "Parallel File System" that is easy to setup, maintain, and scalable.

My goal is to have a single mount point on a Linux machine that applications can read/write using standard coding practices (such as C++) that essentially is several mount points. I am not looking for speed, I am looking for storage and reliability; though speed would be a plus obviously.

So for example lets say:
/mnt1 -> smb://srvr1/share
/mnt2 -> smb://srvr2/share
/vfs -> mnt1 + mnt2

I looked at ZFS and although they support actual files as disks, they don't recommend it. Anyone have any suggestions on this?