Dr I's questions

I'm wondering if there is a way to get a ssh server to allow interaction with the user such as Request for access?

I've found out some pam plugin allowing for 2FA but for now I can't found anything related to the request for access part. Having a pam plugin for 2FA means that at least limited interaction is possible, but what about a way to get a user to ask for access?

Are you aware of any plugin or development effort regarding this specific topic?

I'm currently trying to work on a task which will create directories for two differents services but I've trouble solving how am I suppose to do that using ansible loops.

Here is the object:

obj:
  metadata:
    uuid:
    version:

  services:
    - server:
      archive: binary.tar.gz
      dirs:
        bindir: /path/to/bindir/
        confdir: /path/to/confdir/
        tmpdir: /path/to/tmpdir/

    - client:
      archive: binary.tar.gz
      dirs:
        tmpdir: /path/to/tmpdir

And here is my associated task:

#Creating directories
- name: Creating directories for server and client mode.
  file:
    path: "{{ item.1.dirs['tmpdir'] }}"
    state: directory
    owner: "{{ item.0.metadata.uuid }}"
    group: "{{ item.0.metadata.uuid }}"
    mode: 0750
  with_subelements:
    - "{{ obj }}"
    - services

Now, I'm a little bit disturbed by how loops works on ansible and a little bit stick for now with my current iteration, so, could you help me to find a way to achieve what I'm trying to do?

If someone with quite good kubernetes's services understanding could confirm me that once you require a new service to be created kubernetes push a reference of it on the etcd database and what is the URL to request it would be wonderful!!!

As I asked it on this topic's comments: block all but a few ips with firewalld

I'm looking for a way to deny all public IPs except for mine on the public zone of firewalld.

For now, my public zone just have ssh/http/https services and I have specified sources IP has required all over the internet.

The thing is that I don't get why firewalld is not filtering the source IPs as requested?

Normally, from what I understand, specifing to the zone the source IPs ask Firewalld to drop all requests excepts those coming from the specified IPs.

But on my box it's not working as I'm able to connect on the machine from home which is not one of the specified source IPs.

Some suggest to create a new zone named "Internal/Other" the thing is that I only have one public interface as the server is not on a private lan, so why should I create/use another zone as the public zone should drop all IPs except those specified on the source list.

Does Firewalld Public zone make the services added on it open to the world automatically?

If I create a second zone named internal, with only the ssh service and sources IPs, and then link this zone to my eth0, will firewalld block all not "sourced" IPs ?

Of course doing such a process will suppose that I remove ssh service from the public zone served services.

My firewall is:

[root@groot ~]# firewall-cmd --list-all-zones
block
  interfaces:
  sources:
  services:
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

dmz
  interfaces:
  sources:
  services: ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

drop (default)
  interfaces:
  sources:
  services:
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

external
  interfaces:
  sources:
  services: ssh
  ports:
  masquerade: yes
  forward-ports:
  icmp-blocks:
  rich rules:

home
  interfaces:
  sources:
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

internal (active)
  interfaces: eth0
  sources: 192.168.0.0/24
  services: ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

public
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

trusted
  interfaces:
  sources:
  services:
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

work
  interfaces:
  sources:
  services: dhcpv6-client ipp-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

I've to do a migration of two servers with large SAN attachments to our new VMWare environment.

EDIT: I have to supply some additional intelligence as I have good answers regarding VMWare solution.

Ok so, I can't attach a previous EMC LUN on the New system due to some technologies limitations on the server.

I can't use VMWare Converter to clone the missing volumes on my new VM as VMWare Converter can't see EMC PowerPath Pseudo-devices and that the previous admin used those Pseudo-device to built LVM2 and/or ASM volumes on top of.

Those two physicals servers are attached to an old EMC² CX-340 SAN and handle 5TB of data.

Those 5TB of data are small PDF and I need to transfer them to the new machine through our 1Gbit/s LAN.

I've tried using rsync, but it's really to slow and have a strong impact on the RAM and CPU performance.

I've try using NC with TAR but the transfer rate is quite slow as I've an average throughput of about 50MB/s on a 1Gbit/s link with barely zero traffic.

Could you give me some advice or return of experience with this kind of migration and how you manage to have it finished correctly within reasonable amount of time?

I'm currently building a private servers farm with a thousand and thousand hosts, and I suddenly faced a really interesting question that I was unable to answer at the moment.

Is there a Standard ISO/Whatever for servers hostname attribution into a really large environnement?

For now, my puppet generate a random alphanumeric hostname that it not relevant for anyone connecting on the host.

That fine, and I'm able to connect to the correct server and service for maintenance because my puppet is managing all my host and link them to Nagios which has category etc.

But I'm really interesting to know if someone already faced this kind of question AND/OR if you have personal experience and testimony.

Many thanks!

My Oracle DBA Colleague is requesting root access on our production servers.
He is arguing that he need it to perform some operations like rebooting the server and some other tasks.

I do not not agree with him because I've set him a Oracle user/group and a dba group where Oracle user belong. Everything is running smoothly and without the DBA having root access currently.
I also think that all administrative tasks like scheduled server reboot needs to be done by the proper administrator (The Systems administrator on our case) to avoid any kind of issues related to a misunderstanding of the infrastructure interactions.

I would like input from both sysadmins and Oracle DBAs - Is there any good reason for an Oracle DBA to have root access in a production environment?

If my colleague really needs this level of access I'll provide it, but I'm quite afraid of doing so because of security and system integrity concerns.

I'm not looking for pros/cons but rather advice on the how I should take to deal with this situation.

I'm currently looking at my Nagios metrics, and especially on my WebServers and I suddently noticed that sometimes, I've a negative amount of Request per second and other metrics, how it is possible??

I though that Request per second or Connection per second could only be positive or equal zero.

What's going on there? Is that negative value mean that the webserver reuse an existing connection throught keepalive or use cache data?

If someone could explain me those metrics, it would be great.

Is someone here able to start/stop/reload/... a list of units specified with a wildcard or similar method on systemctl?

I try do do somethin like: systemctl restart openstack-nova-*.services or systemctl restart openstack-nova-?.services

but it's a dead end and I didn't found anything usefull on systemctl's manual.

I could use a for loop but before that I'll have to make a systemctl -t service --failed and then grep for listed units... a little bit boring isn't ?

So, if someone know if it's possible to do something like that or not, I'll be happy to hear it.

If it's not, I think I'll push the idea on systemctl developers list or maybe do the patch if I have time to ^^

Good morning everyone!

On my daily job, we are using NGINX+uWSGI+MongoDB as Python Application container. For versionning and collaborative developpement we are using GIT install on each developer computer and a central GIT repository for delivery purpose.

Everything is running well and smoothly, BUT there is one minor issue.

Until now, when we want to deliver a new version of our internal softwares, all developers merge their changes and then a choosen one (usually the project manager) push the final product into the "branch master" repository on our central GIT Server.

Once this push is made, a script which is constently looking on GIT retrieve the new version and push it on our uWSGI server which then load the new version for all new connections.

Now, we are wondering how to be able to push on GIT server and that uWSGI directly load and servs its webapps from this GIT server.

Is there anybody which already have a similar solution or a uWSGI configuration to do so?

I recently update our web infrastructure to use NGINX instead of our Apache servers. Now, I'm also operating an OpenStack Infrastructure and I was wondering if there is a state of the art way to replace Apache/Mod_wsgi with any NGinx/uwsgi architecture or something else.

So if you operate any OpenStack cloud infrastructure using NGINX instead of Apache, any tips and tricks or even PRO/CONS tips would be really appreciate.

Thanks a lot!!

PS: Oh, and by the way, I'm operating an ESSEX Stack over Debian 7.0

I'm currently working on the renewal of my Web plateform and switching from Apache to Nginx.

So I've to test all our administrative and internal applications before doing it.

Well, so far, I didn't face any problems, BUT it would be a little bit too easy without it :D

So, today, I install my supervision plateform using the following component:

• OS: Debian Squeeze 6.0.6
• WebServer: Nginx 1.2.5
• FastCGI: fcgiwrap 1.0.3-3
• PhpCGI: php 5.4.11
• Supervision: Nagios 3.4.3

Here is my directories structure:

/usr/local/$APPNAME$/$SUBTREE$ --> Aim for all binaries and libraries outside the OS.
/etc/$APPNAME$/$SUBTREE$ --> Directory for all binaries configuration files.
/srv/apps/$WEBAPPNAME$/$SUBTREE$/ --> Directory for all HTML/PHP/CGI related files.

Following these I've got:

/usr/local/nagios/ all owned by nagios user/group.
/usr/local/nginx/ all owned by nginx user/group.
/usr/local/fcgiwrap/ all owned by nginx user/group.
/usr/local/phpcgi/ all owned by nginx user/group.

&

/etc/nagios/ all owned by nagios user/group.
/etc/nginx/ all owned by nginx user/group.

&

/srv/app/nagios/{cgi-bin;stylesheets;etc} all owned by nginx.

My PhpCGI Wrapper is running well and serving PHP pages as requested because I've got the Nagios main page correctly displayed.

The problem seems to come from my FastCGI Wrapper which doesn't stop to send a stupid error claiming that it don't have be called with any DOCUMENT_ROOT or SCRIPT_FILENAME parameters.

But, regarding my Nginx Configuration, everything seems to be OK.

I found something related on an other ServerFault question, but the upgrade of the FastCGI wrapper doesn't help me.

Here is my NGinx config:

  1 user                    nginx nginx;
  2 worker_processes        4;
  3 pid                     /var/run/nginx/nginx.pid;
  4 error_log               /var/log/nginx/error.log;
  5
  6 events {
  7     worker_connections 1024;
  8 }
  9
 10
 11 http {
 12     include             mime.types;
 13     default_type        application/octet-stream;
 14     sendfile            on;
 15     keepalive_timeout   65;
 16     gzip                on;
 17
 18 upstream fcgiwrap {
 19         server unix:/var/run/fcgiwrap.socket;
 20 }
 21
 22
 23     server {
 24         listen                  443;
 25         server_name             nagios.domain.tld;
 26         root                    /srv/apps/nagios;
 27         ssl                     on;
 28         ssl_certificate         /etc/nginx/security/cert.crt;
 29         ssl_certificate_key     /etc/nginx/security/cert.key;
 30         ssl_session_timeout     5m;
 31         ssl_protocols           SSLv2 SSLv3 TLSv1;
 32         ssl_ciphers             HIGH:!aNULL:!MD5;
 33         ssl_prefer_server_ciphers on;
 34
 35         charset         utf8;
 36         access_log      /var/log/nginx/access.log;
 37
 38         location / {
 39                 index index.php;
 40                 auth_basic "Nagios Restricted Access";
 41                 auth_basic_user_file /etc/nagios/passwd.users;
 42         }
 43
 44         location ~\.php$ {
 45                 auth_basic "Nagios Restricted Access";
 46                 auth_basic_user_file /etc/nagios/passwd.users;
 47                 include fastcgi_params;
 48                 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 49                 fastcgi_pass 127.0.0.1:9000;
 50         }
 51
 52         location ~\.cgi$ {
 53                 auth_basic "Nagios Restricted Access";
 54                 auth_basic_user_file /etc/nagios/passwd.users;
 55                 include fastcgi_params;
 56                 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 57                 fastcgi_param AUTH_USER $remote_user;
 58                 fastcgi_param REMOTE_USER $remote_user;
 59                 fastcgi_pass fcgiwrap;
 60         }
 61     }
 62 }

the Fcgiwrap socket is handle by nginx, and all my permissions seems good.

So if you have any clue or help, it would be greatly appreciate :D

Thanks in advance.

I just wondering myself if it would be possible to create massive amount of symbolic links using a for loop?

For exemple, I have a lot of directory on my /tmp directory (I know, not recommanded) and I do not want to move them out.

Instead I just want to have them on my root directory using symbolic links.

Here is what I did, but unfortunatly, do not work at all:

for directories in /tmp/; do ln -s /tmp/$directories /$directories; done

So if someone could bring me a hint, it would be wonderfull ;-) Thanks.

I'm currently working on a Tomcat Cluster for Q&A, but unfortunatly, it seems that the auto deploy of a war across this cluster is not working at all.

I know the cluster is working perfectly because each server are receiving correctly the multicast communications and are aware of any missing host instantly.

The problem here is coming from the FarmWarDeployer function which seems to not working.

Indeed, when I upload a war, using the tomcat manager, or a simple SFTPd push, on the node1 of my cluster, the war is unpacked and used by the node1, but, it's not sent to my node 2. Instead, my node1 is saying:

WARNING: Manager [localhost#/APPTest##1.0.0]: No context manager send at 9/14/12 5:21 PM received in 103 ms.

and my node2 is claiming:

WARNING: Context manager doesn't exist:localhost#/APPTest##1.0.0

well, my APPTest is correctly set with the tag and the cluster is correctly receiving session if I manually push the application on the node2.

So, about me, the problem is coming from my FarmWarDeployer Settings which are:

103     <Engine name="Catalina" defaultHost="localhost">
104
105
106
107         <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
108                  channelSendOptions="8">
109
110           <Manager className="org.apache.catalina.ha.session.DeltaManager"
111                    expireSessionsOnShutdown="false"
112                    notifyListenersOnReplication="true"/>
113
114           <Channel className="org.apache.catalina.tribes.group.GroupChannel">
115             <Membership className="org.apache.catalina.tribes.membership.McastService"
116                         address="224.0.0.1"
117                         port="45564"
118                         frequency="500"
119                         dropTime="3000"/>
120             <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
121                       address="auto"
122                       port="4000"
123                       autoBind="100"
124                       selectorTimeout="5000"
125                       maxThreads="6"/>
126
127             <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
128               <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
129             </Sender>
130             <Interceptor className="org.apache.catalina.tribes.group.interceptors.TcpFailureDetector"/>
131             <Interceptor className="org.apache.catalina.tribes.group.interceptors.MessageDispatch15Interceptor"/>
132           </Channel>
133
134           <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
135                  filter=""/>
136           <Valve className="org.apache.catalina.ha.session.JvmRouteBinderValve"/>
137
138           <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
139                     tempDir="/opt/tomcat/temp/"
140                     deployDir="/opt/tomcat/webapps/"
141                     watchDir="/opt/tomcat/webapps/"
142                     watchEnabled="enable"/>
143
144           <ClusterListener className="org.apache.catalina.ha.session.JvmRouteSessionIDBinderListener"/>
145           <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
146         </Cluster>
147
148       <Realm className="org.apache.catalina.realm.LockOutRealm">
149         <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
150                resourceName="UserDatabase"/>
151       </Realm>
152
153       <Host name="localhost"  appBase="webapps"
154             unpackWARs="true" autoDeploy="true">
155       </Host>
156     </Engine>

About me there is nothing too strange for a testing cluster, but I'm definitly not a tomcat expert.

So, if something is wrong or missing, let me know ;-)

I'm currently working on our IT System to improve it a little bit. I've install set and run a rsyslogd on our servers (Physicals and virtuals), all of them now sending their logs into a database.

Now, I'm able to request this database to found any kind of problem or informations that I'm looking for quickly and efficently, on our whole system, but, yet it remain a "problem" for me which is to lay out all those informations in a human way for my managers and all other none technical persons.

I was wondering if their was a piece of webapp able to do the trick but surprisingly, I've not been able to find one on google.

So the question is, do you know the name of a webapp which is able to parse and report all my logs hosted on a database?

Wahoo, thanks to all of you for those amazing solutions.

I take a look on all of it, and I've to said that splunk and Greylog2 seems to be the most fitted for my needs :D

Thanks a lot, I'll have to make some POC now :D

I've got a Windows Server 2008 R2 SP1 Active Directory with Full 2008 R2 Level Domain and a Windows XP SP3 Client which needs to join this domain.

Unfortunately the client is not able to join the domain and if I take a look at the Server's logs I saw the following error:

EVENT ID: 4776 error N° 0xc000006a

Following my search on Google, I've reset all my GPO's with the dcgpofix command according to the MS knowledge base, but once again my Windows client is still unable to join the domain and thrown up the same error.

Ok, so, I've made some progress with this issue.

I've notice two things:

First of all: - It seems to be a Kerberos Issue, because every logs are talking about Kerberos.

From server:

EVENT ID: 4776 error N° 0xc000006a

This mean, correct username, bad password (I'm sure of the password 'cause I'm using it to log me in the DC). And the first FAIL on my list is:

EVENT ID: 4768 -> A Kerberos Ticket has been requested.

Secondly:

On the client side I've a single error:

EVENT ID: 4 -> Error Kerberos, Source: Kerberos -> The client received a KRB_AP_ERR_MODIFIED error from the server prdldap01$. This indicates that the password used to encrypt the kerberos ticket is different than that on the target server.

Then, I've try to check the ticket on the client with the Klist tickets command, BUT there is no one on the client.

The klist command report:

Cached tickets: (0)

Finally:

All my Windows 7 clients are correctly joining the domain. My Server send the following ticket encryption:

KerbTicket Encryption: AES-256-CTS-HMAC-SHA1-96

My LSA Notification packages are the followings

SCECLI RASSFM SHA1HEXFLTR

My LSA Security packages are the following:

kerberos msv1_0 schannel wdigest tspkg pku2u

I really start to suspect the Domain Security GPO or Kerberos settings. If anyone have an idea, I'm listening :D

I've a little question.

Is there any usual performance matrice on DHCPd and BIND services?

I mean, can I scale my servers depending on my clients numbers and then how?

Can I found somewhere a matrix or something about number of DNS queries per second handle by BIND on a basic server?

Can I found somewhere a matrix or something about number of leases delivers by DHCPd per second?

I'm currently looking for a way to autorize my non administrators users to perform an installation of drivers.

Here is the speech:

All my users are standard users, they got a VirtualBox Hypervisor if they need the administrator rights.

But if they put an USB device on the local machine and try to redirect the device to the Virtual Machine, Windows ask for some Administrator rights.

I've try to set up those GPO:

• Allow standard users to install drivers.
• Install WHQL Drivers: Allow Silently.

I don't know how to do this.

I've just a little question.

My DNS Servers are updated by our DHCP Server (Microsoft Windows 2003 R2 SP2).

My clients are Debian Linux Distro's, and I have to modify my DHCLIENT.CONF file on it to send his Full Qualified Hostname.

BUT I've about 1600 computers and I don't want to modify each client one by one, then, Could I for exemple use a System Variable on the Config file?

Exemple:

#DHCLIENT CONF;
send "$hostname" where $hostname variable is the alias write on BASHRC for the hostname -f command.

If you need any more informations just tell me.

I've a tinny question, how can I crypt my scripts? I mean, for exemple, sometimes I've some sh scripts (provided by some company like VMWare) and when I VI's it they just show me a crypted file and not a plained text file.

How Can I transform my plained text scripts into an crypted script?