Nicolas Raoul's questions

I am seeing this in Liferay 6 (a Tomcat-based clustered webapp)'s log:

APR does not understand this error code: proxy: read response failed from [::1]:8009 (localhost)
The timeout specified has expired: ajp_ilink_receive() can't receive header
ajp_read_header: ajp_ilink_receive failed

[... the 3 lines above repeated many times ...]

Connection reset by peer: ajp_ilink_receive() can't receive header
APR does not understand this error code: proxy: read response failed from (null) (localhost)
ajp_read_header: ajp_ilink_receive failed

[... the 3 lines above repeated many times ...]

The webapp becomes unusable (the web UI does not respond to web requests) when the "Connection reset by peer" errors start appearing.

While the first problem (The timeout specified has expired) is covered by another question, what usually causes the second problem (Connection reset by peer), and what is the difference between the two problems?

I want to execute some server-side JavaScript (to manipulate repository nodes).

I have admin access via Alfresco Share, but I have no Alfresco Explorer nor SSH access.

• The best would be a kind of console in which I could type commands, like JavascriptConsole but it can't be installed without SSH access. I don't think there is anything like this, but maybe there are tricks involving rules?
• Writing one-time webscripts sounds overkill and inconvenient.

Is it possible?
(Alfresco 5.0)

I am thinking of implementing Single Sign-On for a whole company.

PROBLEM: Some employees of that company need to be able to work offline, without having to switch user/environment.

Is there any trick to make both compatible?
While normally using SSO, is there any magic trick to continue working offline, at least for a few days or so?
If there is absolutely no way to ever achieve this, please post an answer saying so, thank you!

Allowing such employees to stay away from SSO is risky: They won't be able to use some company services, or alternatively some hard-to-maintain tricks will have to be implemented to allow both SSO and non-SSO.

Technologies: Latest Active Directory (others can be considered), Windows, Mac.

I have an Alfresco server available via port 8080 (HTTP) and 443 (HTTPS), with a web proxy redirecting URLs ending with /alfresco to port 8080.

In my CMIS client, I specified the HTTPS CMIS URL.

PROBLEM: Despite this, I notice with a network analyzer that most of the CMIS traffic happens on 8080, unencrypted.

I want Alfresco to authenticate users using SSO with MIT Kerberos.

What authentication.chain should I use?

I tried authentication.chain=kerberos1:kerberos without success.

Based on this answer I have also set up an LDAP server containing the same users as MIT Kerberos, and tried with authentication.chain=kerberos1:kerberos;ldap1:ldap, but that does not work either.

Important lines of ldap1/ldap-authentication.properties:

ldap.authentication.active=true
ldap.synchronization.active=true

I always get CIFS server configuration error, Error creating bean with name 'globalAuthenticationFilter', even though I don't care about CIFS, only HTTP. In kerberos1/kerberos-authentication.properties I have kerberos.authentication.authenticateCIFS=false.

What am I doing wrong?
Do I maybe need passthru somehow?

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation.
Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum.

Upon starting Alfresco, I get this error:

04:01:38,725 ERROR [org.alfresco.fileserver] CIFS server configuration error, Error creating bean with name 'globalAuthenticationFilter' defined in file [/home/alfresco/alfresco-community-4.2.c-installer-linux-x64/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/kerberos/kerberos-filter-context.xml]: Invocation of init method failed; nested exception is java.lang.SecurityException: Configuration Error: No such file or directory

I haven't modified the kerberos-filter-context.xml.
Any idea what could trigger this message?
I can post any configuration file you want.
No debug info gets logged.

I am following these instructions to install OpenLDAP on Debian 6.0.

The instructions tell me to run slapindex as root, but it sounds like Debian does not like the idea:

WARNING!
Runnig as root!
There's a fair chance slapd will fail to start.
Check file permissions!

Google leads me to a discussion that suggests running slapindex as openldap. I find it strange as slapindex is not in the $PATH of openldap.

Which user should I run slapindex as?
If not root, why is slapindex in /usr/sbin?

The Alfresco documentation seems to consider only LDAP or Active Directory cases.

In my case, all users are in MIT Kerberos, but I don't use LDAP nor Active Directory.

What authentication chain should I use?

ldap1:ldap is what the documentation seems to suggest, but I guess it won't work as I don't even have an LDAP server.

Installed and ran Alfresco 4.2 with Java 6 on Linux, I get this error:

NoClassDefFoundError: java/nio/channels/SeekableByteChannel

How to fix this error?

I installed Alfresco Community 4.2.0c (manual install) with these Tomcat settings in startup.sh:

CATALINA_OPTS="-Xms512m -Xmx1024m -Xss1024k -XX:MaxPermSize=900m -XX:NewSize=512m -server -Dalfresco.home=/home/aegif/alfresco -Dcom.sun.management.jmxremote"

On Oracle jdk1.7.0_15, Linux 2.6.18, CentOS 5.8.
When I launch startup.sh, Alfresco starts running, but a minute after the Alfresco started message, I get:

Apr 15, 2013 7:17:32 PM org.apache.catalina.startup.HostConfig deployWARs
SEVERE: Error waiting for multi-thread deployment of WAR files to complete
java.util.concurrent.ExecutionException: java.lang.OutOfMemoryError: PermGen space

How can I get this error even though MaxPermSize=900m which is already a huge value?
By the way, I get the same exception with other MaxPermSize values like 256m or 700m.

Hint: The log says:

maximum heap size 247.500MB
WARNING - maximum heap size 247.500MB is less than recommended 512MB

Even though startup.sh has -Xmx1024m.

Is my CATALINA_OPTS wrong?

I have a Git server, and I want to make it usable by all Kerberos-logged users.

eg: if a user has a valid Kerberos ticket, she can start pushing to Git without having to provide any username/password.

Is it even possible to do this with Git?
All I could find was this old unanswered question on the Git mailing list (with http://), and this project that says it is out-of-date (with git://).

Server is on Ubuntu 2012.10, but I could move it to Windows Server 2012 if necessary.
I can dictate which software to use on client-side.

I want to test my software's SSO, so I am trying to configure ActiveDirectory on Windows Server 2012, following this tutorial.

At "prerequisites step", the window is supposed to look like:

but unfortunately I get an error:

Sorry for the Japanese, it says:

x The prerequisites check for the domain controller upgrade failed.
   The certificate server is installed.
i The prerequisites check is over.
x One of the above failed. Please correct and retry.

It seems that ActiveDirectory is already installed, but not configured.

Is there another way to enter the forest/domain name details, apart from this wizard?
Or should I uninstall ActiveDirectory, then restart the tutorial?

Cisco says:

Cisco icons are globally recognized and generally accepted as standard for network icon topologies

However, some of those icons are very misleading, see for instance:

So I hesitate to use them in documentation, and find it hard to believe that they are a standard.

Is it really the generally accepted standard icon topology?
Or are there more up-to-date sets? (by another vendor or a community/standardization effort)

The rmem_max Linux setting defines the size of the buffer that receives UDP packets.
When traffic becomes too busy, packet loss starts occurring.

I made a graph showing how packet loss increases depending on the incoming bandwidth.
(I use IPerf to generate UDP traffic between two VM instances).
The different colors are for different rmem_max values:

As you can see, setting rmem_max to 26214400 (dark blue) results in packet loss earlier than smaller values. Linux's default value is 131071 (dark green) looks reasonable.

In these conditions, why does the JBoss documentation recommend to set rmem_max to 26214400?
Is it because UDP traffic is expected to be higher than 350 MBytes/second? I don't think anything would work with more than 1% packet loss anyway...

What am I missing?

Details: I used sysctl -w net.core.rmem_max=131071 (for instance) on both nodes, and used on as server iperf -s -u -P 0 -i 1 -p 5001 -f M and the other as client iperf -c 172.29.157.3 -u -P 1 -i 1 -p 5001 -f M -b 300M -t 5 -d -L 5001 -T 1.

My Tomcat 6.0.26 sometimes dies saying:

SEVERE: All threads (150) are currently busy, waiting. Increase maxThreads (150) or check the servlet status

... then Tomcat shuts down, and users can't access the webapp until I restart Tomcat manually.

Some of the threads indeed take a long time to execute, it is by-design, not a thread-gone-wild problem.

I know I could increase maxThreads, but that is not a viable solution, because the server might receive requests even more requests.

QUESTION: Instead of dying, can I tell Tomcat to just drop requests when maxThreads is reached and the AJP/1.3 backlog is full?

Below is my server.xml in any case:

<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JasperListener" />
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <GlobalNamingResources>
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>
  <Service name="Catalina">
    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" minSpareThreads="100"/>
    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
               enableLookups="false" useBodyEncodingForURI="true"
               backlog="150" maxThreads="150" executor="tomcatThreadPool"
               keepAliveTimeout="5000" connectionTimeout="300000" />
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="ecm1">
      <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
             resourceName="UserDatabase"/>
      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true"
            xmlValidation="false" xmlNamespaceAware="false">
      </Host>
    </Engine>
  </Service>
</Server>

I am trying to understand CouchDB network traffic with Wireshark and find it very difficult.

A simple transaction with plain-text content seems to result in many lines in Wireshark, most of them being not more than unparsed binary data:

44270 > terabase [PSH ACK] Seq=1411 Ack=2369 Win=16195 Len=27 [...]
00:00:00:1b:00:00:2a:6b:00:10:03:00:00:00:00:00:00:00:1c:00:00:00:00:03:21:00:1e

Packet data is decoded up to the TCP level, but not at the CouchDB level.

Is there any Wireshark plugin to understand CouchDB traffic ?

Using command-line (Linux) or LDIF, I could find many examples of creating a new group and defining its members, but no examples of this:

How to add a user to an existing group?

Let's say the person also already exists.

For instance adding user uid=fred,ou=people,dc=example,dc=com to group cn=vipb,ou=groups,dc=example,dc=com.

I am writing a Linux shell script to copy a local directory to a remote server (removing any existing files).

Local server: ftp and lftp commands are available, no ncftp or any graphical tools.

Remote server: only accessible via FTP. No rsync nor SSH nor FXP.

I am thinking about listing local and remote files to generate a lftp script and then run it. Is there a better way?

Note: Uploading only modified files would be a plus, but not required.

In my Ubuntu's /etc/mysql/my.conf, I have:

bind-address = 192.168.2.20  # My external IP

It works fine from remote, but when I want to connect locally, the app that uses on MySQL says: java.net.ConnectException: Connection refused at com.mysql.jdbc.StandardSocketFactory.connect.

So when I want to work locally, I change my.cnf to:

bind-address = 0.0.0.0

And it starts working locally, but then it doesn't work from remote anymore.

How to make MySQL accesible both from remote AND local?

Creating separate tablespaces is possible in expensive versions of Oracle, but I can't seem to find a way to do so with the free version Oracle XE.

The administration interface just has a "View tablespaces" button, where I can see four tablespaces, SYSAUX, SYSTEM, UNDO, and USERS where all of my data seems to reside.

Is it a limitation of Oracle XE?
Or did I overlook something?