Christian's questions

I have a problem with high CPU load, caused by Firefox (60.6.2 ESR) sessions on a Windows Server 2016 Terminal Server I'm maintaining.

However, in Windows Task manager, I can only see the firefox instances, but not what in firefox causes the high CPU load. I do know about the firefox-internal task manager (about:performance) but I do not see how to analyze firefox instances of other users.

Is it possible to profile the performance of other firefox instances, so I can check which pages / webapps or whatever are causing the high load? My guess is that some user visits inappropriate sites like youtube or music streaming sites (for which the terminal server isn't designed).

I have the following scenario: A central update server (running apache) is hosting update packages for different customers. Some of the packages contain license information, so customer A mustn't be able to access packages of customer B.

I want to ensure this by using client certificates. So I created a root CA (using plain openssl) and created two intermediate CA (one per customer, both directly signed by the root CA, so those are in "parallel").

I was able to configure apache in a way it requires the clients to provide a valid certificate. Unfortunately, both vHosts on the server accept certificates issued by both intermediate CAs.

How can I configure apache so it only accepts client certificates issued directly by one of both intermediate CAs?

This is one of the configuration files:

#pache  ************************************
# Vhost template in module puppetlabs-apache
# Managed by Puppet
# ************************************

<VirtualHost cust2.munki.puppet.intra:443>
ServerName cust2.munki.puppet.intra

## Vhost docroot
DocumentRoot "/srv/munki/cust2.munki.puppet.intra"

## Directories, there should at least be a declaration for /srv/munki/cust2.munki.puppet.intra

<Directory "/srv/munki/cust2.munki.puppet.intra">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Require all granted
</Directory>

## Logging
ErrorLog "/var/log/apache2/munki.puppet.intra cust2 ssl_error_ssl.log"
ServerSignature Off
CustomLog "/var/log/apache2/munki.puppet.intra cust2 ssl_access_ssl.log" combined

## SSL directives
SSLEngine on
SSLCertificateFile      "/etc/ssl/cust2.munki.puppet.intra.cert.pem"
SSLCertificateKeyFile   "/etc/ssl/private/cust2.munki.puppet.intra.key.pem"
SSLVerifyClient         require
SSLVerifyDepth          2
SSLCACertificateFile    "/etc/ssl/cust2.cert.pem"
</VirtualHost>

regards, christian

Currently we're maintaining an environment with a single Windows Server 2008 R2 fileserver. We'd like to replace the server with a Server 2012 R2 machine and switch to DFS (fileshare on dfs server, without replication).

Now I have the problem that the old server could have been referenced by:

• \\IP\sharename
• \\hostname\sharename
• \\FQND\sharename

And I don't know what links the users have in their documents. When I now switch to the new server with dfs, the old hostname becomes invalid anyway and I can only reference the new share by:

• \\hostname\sharename (which would be without DFS and therefore wrong and, of course, the new host has a new name anyway) or:
• \\domain\namespace\share

Long story short: Is there a possibility to switch to DFS but keeping the old paths still valid (some sort of alias or something)?

I need an Apache server to offer multiple vhosts. Every vhost should only be accessible by one customer. To clear it up, I'll make a small example:

• vhost1: Servername: cust1.example.com
• vhost2: Servername: cust2.example.com

Now, only hosts from customer1 shoud be able to access vhost1 and only hosts from customer2 should be able to access vhost2. Here is what I did so far:

• Set up a CA using openxpki (works)
• Created a certificate for every vhost and configured the vhosts appropriately (works)
• Imported the root certificate of the CA into server and clients (works)
• Tested if Client-SSL-Auth works without filtering. (Works)

But now I can't get the filtering to work. I would like to filter for the CN in the certificates. For vhost1 this would be that all certificates with a CN of "*.cust1.example.com" would be allowed to access the ressource. How can I achieve this?

Bonus: Would be great to be abble to manage the change with puppet

Regards, Christian

I want to play around with puppet, so I set up a small test environment, consisting of 4 VMs

• pfSense: Router
• Windows Server 2012 R2: DNS, DHCP
• Ubuntu Server 16.04: Puppetmaster
• Ubuntu Server 16.04: Puppet agent

DNS is set up correctly, it answers all forward- and reverse lookups correctly.

Here is the set of command I executed on both of the ubuntu vms (base configuration)

sudo dpkg-reconfigure keyboard-configuration
sudo apt-get install -y vim openssh-server ntp
sudo dpkg-reconfigure tzdata

vi /etc/hostname (set to puppet / puppetclient)
sudo reboot now

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-xenial.deb
sudo dpkg -i puppetlabs-release-pc1-xenial.deb
sudo apt-get update

And then on the master:

sudo apt-get -y install puppetserver
sudo /opt/puppetlabs/bin/puppet resource service puppetserver ensure=running enable=true
sudo service puppetserver restart

The puppetserver-service is running nicely (after assignign 6GB of RAM to the VM ;))

On the client:

sudo apt-get install puppet-agent
sudo /opt/puppetlabs/bin/puppet resource service puppet ensure=running enable=true

On the client, I then do a:

puppet agent --server puppet.puppet.intra --waitforcert 60 --test

This is answered by

Error: Could not request certificate: The CSR retrieved from the master does not match the agent's public key.
CSR fingerprint: 82:F5:08:CC:98:8A:D1:8F:EC:3D:B0:F7:5B:EB:43:FC:FC:0D:95:30:E8:6F:7F:81:9E:1B:02:CB:A4:01:0E:50
CSR public key: Public-Key: (4096 bit)
Modulus:
    ...
Exponent: 65537 (0x10001)

Agent public key: Public-Key: (4096 bit)
Modulus:
    ...
Exponent: 65537 (0x10001)

To fix this, remove the CSR from both the master and the agent and then start a puppet run, which will automatically regenerate a CSR.
On the master:
  puppet cert clean puppetclient.puppet.intra
On the agent:
  1a. On most platforms: find /home/administrator/.puppetlabs/etc/puppet/ssl -name puppetclient.puppet.intra.pem -delete
  1b. On Windows: del "\home\administrator\.puppetlabs\etc\puppet\ssl\certs\puppetclient.puppet.intra.pem" /f
  2. puppet agent -t

Of course, I executed the proposed troubleshooting steps, without result. I further checked:

• I can open port 8140 on the server
• the time settings to match
• both machines have the correct hostname set and are resolved by the dns correctly

What am I doing wrong?

Regards, Christian

Edit

I just realized something: It seems like the problem only occurs when I try to run puppet as a different user than I installed it with.
I wanted to run puppet agent -t as root with sudo on an OS X client and got the error message described earlier. When I run puppet as the user I installed it with, the error doesn't occur.

How can I fix this?

I have an older Windows 2008R2 Server which operates as file server ("normal" smb shares). As I need to replace it, I asked myself if it would be a good idea to move to DFS and start using namespaces, therefore making future server changes much more painless.

However I couldn't find information from microsoft if it's supported to have a single server as namespace server, without replication?

Regards, Christian

First of all, I have to apologize: I really couldn't think of a better title, I do not really know how to describe my problem in only a few words.

So here is my problem: I just installed Windows Server 2012 R2 on an Supermicro A1SRi-2758F. This mainboard has 4 Ethernet-Ports + one dedicated IPMI Port (which I'm not using ATM). The mainboard-manual describes the port numbers as follows:

• Lower left: LAN1
• Lower right: LAN2
• upper left: LAN3
• upper right: LAN4

However, my windows numbered them differently. To make it clear, I'm not speaking of the normal name which you can easily change but of the one you see in the properties of each port. Here it is for example: Intel(R) Ethernet Connection I354 #2

Windows named them as follows: - Lower left: LAN1 -> Ethernet I354 #3 - Lower right: LAN2 -> Ethernet I354 - upper left: LAN3 -> Ethernet I354 #2 - upper right: LAN4 -> Ethernet I354 #4

I want to change it because it leads to confusion as, for example Hyper-V Manager, shows the port number from windows, which doesn't correspond to the hardware port number.

Regards Christian