djneely's questions

For starters I have several Ubuntu servers successfully joined to the domain for the servers that sit in the same subnet as the DCs. However, I'm working to join a few Ubuntu machines through haproxy but running into an odd error that has me stuck at the moment. Worrying about auth flapping I disabled one of the DCs through haproxy for now.

haproxy config:

frontend DC
    bind *:389
    bind *:636
    bind *:88
    bind *:464
    mode tcp
    option tcplog
    default_backend DC_Backend

backend DC_Backend
    mode tcp
    server dc1 X.X.X.21

All in all connectivity all seems good.

On the server I'm connecting from I'm authing with the same creds as I have successfully done so inside the network. Also, I've added the int.domain.com IP in /etc/hosts to point to the proxy's IP address (Y.Y.Y.20 int.domain.com)

realm join -U linux_ad_admin --computer-ou="OU=LinuxServers,OU=Servers,OU=IT_Systems" int.domain.com --verbose

Log:

 * Resolving: _ldap._tcp.int.domain.com
 * Resolving: int.domain.com
 * Performing LDAP DSE lookup on: Y.Y.Y.20
 * Successfully discovered: int.domain.com
Password for linux_ad_admin: 
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli
 * LANG=C /usr/sbin/adcli join --verbose --domain int.domain.com --domain-realm INT.DOMAIN.COM --domain-controller Y.Y.Y.20 --computer-ou OU=LinuxServers,OU=Servers,OU=IT_Systems,dc=int,dc=domain,dc=com --login-type user --login-user linux_ad_admin --stdin-password
 * Using domain name: int.domain.com
 * Calculated computer account name from fqdn: DMZHOSTTEST1
 * Using domain realm: int.domain.com
 * Sending NetLogon ping to domain controller: Y.Y.Y.20
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-llM0zh/krb5.d/adcli-krb5-conf-qOXHOs
 * Authenticated as user: [email protected]
 * Using GSS-SPNEGO for SASL bind
 ! Couldn't authenticate to active directory: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)
adcli: couldn't connect to int.domain.com domain: Couldn't authenticate to active directory: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)
 ! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain

Any idea what I'm missing here? This same command/account joins the servers to the AD no problem while in the same subnet. But going through the proxy is suddenly giving me the insufficient permissions error. Are additional open ports needed to go through haproxy?

We're running Nginx on a couple Ubuntu servers (16.04) and all in all everything is working fine. However after some time (few days) Nginx stops logging requests to the logs (/var/log/nginx/[host].log). If I restart Nginx logging resumes/starts back up. But pretty frustrating as I don't know exactly when logging stops and all in all, don't want to not be logging the traffic.

Thoughts on what could be causing this or how to fix?

Logrotate config:

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi \
    endscript
    postrotate
        invoke-rc.d nginx rotate >/dev/null 2>&1
    endscript
}

I have a MSSQL database dump I'm trying to grep through. However, grep does not seem to work on it, at all. Here is a snippet of the file.

...
    ALTER DATABASE [Documents] SET RECURSIVE_TRIGGERS OFF
    GO
    ALTER DATABASE [Documents] SET  DISABLE_BROKER
    GO
    ALTER DATABASE [Documents] SET AUTO_UPDATE_STATISTICS_ASYNC OFF
...

However when I do a grep on it I get nada.

$ cat Documents.sql | grep -i 'alter'
$ <nothing>
$ cat Documents.sql | grep -i 'go'
$ <nothing>

For giggles I created another document 'tempfile' with:

$ cat tempfile 
alter

Alter

ALTER
$

And ran the same grep on it:

$ cat tempfile | grep -i 'alter'
alter
Alter
ALTER

Thoughts on why grep wouldn't work on certain files? Concerns me that when I have to grep through a bunch of stuff to find a small nugget, it 'may' be missing something. Thoughts?

We've got several locations with reverse proxies setup. Our current config up and running is:

upstream backends {
    server Backend1;
    server Backend2;
}

server {
    ... other server config stuff here ...

    location /App1 {
        ... proxy header stuff ...

        proxy_pass http://backends/App1;
     }
}

Now what we're trying to do is set it up such that the case-sensitive backends (in this case Backend1/2 http://backends/App1) can be case insensitive to the public such that you can access http://example.com/app1 OR http://example.com/App1 (or any variation of)

Our new config that we're trying to get to work is something like:

location ~* /App1 {
    proxy_pass http://backends/App1;
}

But no dice when we reload the config. We're seeing the error:

"proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except"...

Any thoughts/insight on how we can accomplish this?

We're making a move over to some Nginx servers from Apache. While we've used Nginx for various sites its been in a mostly basic config. However, one of the 'sites' (multiple actually) we host is a sandbox type of site such that our developers can login to the server create a directory and they have a site up and running. I'm trying to figure out how to replicate this with Nginx but am unable to wrap my head around it thus far. Any help would be appreciated.

Server Directory Setup Example:

/home/[USER]/sandbox/site1
/home/[USER]/sandbox/site2
... etc.

Apache Config:

<VirtualHost *:80>   
    ServerName example.com
    ServerAlias *.example.com    
    ServerAlias *.*.example.com    

    RewriteEngine   on

    RewriteCond %{HTTP_HOST} ^(.*)\.(.*)\.example\.com$ [NC]
    RewriteRule ^(.*)$ /home/%1/sandbox/%2/$1 [L]

    <Directory />
        AllowOverride All 
        Require all granted
    </Directory>
</VirtualHost>

Resulting Domain:

[USER].site1.example.com
[USER].site2.example.com
.... etc.

What would be the equivalent in Nginx to parse the host and correctly route internally to said directory?