atariguy's questions

I am attempting to use the new S3 connector in SQL Server 2022 to backup a database to an S3 bucket. I have been following the instructions here:

https://learn.microsoft.com/en-us/sql/relational-databases/backup-restore/sql-server-backup-to-url-s3-compatible-object-storage?view=sql-server-ver16

I created the credential, and am trying to run the following:

BACKUP DATABASE database TO URL = 's3://bucket.s3-us-west-2.amazonaws.com/backups/database.bak' WITH FORMAT ,STATS = 10 ,COMPRESSION;

I get the following error message that I haven't been able to figure out:

Msg 3201, Level 16, State 1, Line 1 Cannot open backup device 's3://bucket.s3-us-west-2.amazonaws.com/backups/database.bak'. Operating system error 87(The parameter is incorrect.). Msg 3013, Level 16, State 1, Line 1 BACKUP DATABASE is terminating abnormally.

On the S3 side, I've been using the same bucket to backup files to from another server using a different program for any years, so I'm pretty sure it's set up correctly.

I'm moving an old .Net 2 web service from a Windows 2008 R2 server to a new Windows 2016 Datacenter server. It has something else set up on the Default Web Site, but I have created an additional one for the web service. (This is exactly the same scenario as the old server.) I have the physical path set to the same place as before. The web service installer (which was made by PowerBuilder 11.5) actually creates another folder under the physical path where it puts the files.

The problem is that I need the URL to be https://subdomain.domain.com/webservice.asmx, as it was on the old server. Instead, it is insisting on only working at https://subdomain.domain.com/webservicefolder/webservice.asmx. I have tried moving the physical path value down one folder, and it still behaves the same way. I have tried playing with the HTTP Redirect and URL Rewrite features, but the most I've been able to accomplish is a message saying that it has been moved, rather than automatically redirecting.

I tried doing what's described here, and get an error 503 when using the desired URL, and the URL with the folder included is still working: https://blog.discountasp.net/root-redirection-to-subdirectory/

What is the proper way to do this?

This is kind of a long story, but we discovered that controller B had quit working some time ago. We bought a used replacement, and I swapped it out. But I got an error saying there was a mismatch between the controllers. At this point, I also got errors saying "Writeback Cache Forcibly Disabled" and "Insufficient Cache Backup Device Capacity" - but they were for controller A, which I had not touched.

I discovered that the replacement controller had an extra board in it, and after removing the extra board and reinserting the controller, the DS3524 was happy with it. But the cache errors remained. I thought maybe it was because the battery on the replacement controller needed to be charged, so I let it go overnight.

Now the battery in controller B is charged and has completed the learning cycle. But controller A is still having the cache errors. I ran some scripts I found to disable and re-enable caching, and that didn't fix it. I then tried doing a reset on the controller. That also didn't fix it. I guess I'll need to go in person (the DS3524 is at another location) and try removing the controller and reseating the SD card.

But it just seems really odd to me that these errors occurred on the controller that I didn't touch. Is there anything else I can try that doesn't require physical access?

I should also mention that the firmware level is 7.86.32.00. I did see some information about a firmware bug that causes this problem, but it's for a lower version.

I have a "Standard UCC SSL Certificate" from GoDaddy. I needed to add another SAN to it. They were able to reissue without having to create and submit a new CSR. However, I am now having trouble getting Exchange to recognize it. I went through the wizard for "Import Exchange Certificate" in the Server Configuration, and it said it was successful, but the new cert does not show up in the list. I tried doing it again, and was told that a certificate with that thumbprint already exists. So it's apparently there, but I seem to be missing a step before it will let me use it. I've searched for help, but everything I've found is about renewing the certificate or installing the initial one.

We've started having Trustwave do monthly PCI network vulnerability scans. The last couple months we've passed, but this month it failed for "Scan Interference Detected." This is their recommendation:

During the course of the scan, TrustKeeper detected a change in its ability to communicate with some services on the remote host. In some cases, this may be caused by network security devices actively blocking the vulnerability scan, which it may perceive as a threat. In other cases, an intermediate network device, or the host itself, may be unable to cope with the vulnerability scan.

It's often very difficult to tell the difference between these two scenarios, but in either case, this behavior significantly impacts the ability of this vulnerability scanning service to detect vulnerabilities on the remote host, resulting in an inconclusive vulnerability assessment. The PCI ASV Program Guide 1.0 requires that PCI ASV scan customers have a scan performed on all in-scope hosts without interference from IDS/IPS; if such interference is detected, then the ASV is required to fail the scan. Examples of products and devices that provide active measures that may interfere with the scan are firewall and intrusion detection systems (IDS) with active countermeasures, intrusion prevention systems (IPS), web-application firewalls (WAF), and distributed-denial of service (DDoS) mitigation products.

In order to achieve a conclusive vulnerability assessment of the remote host, the products and devices responsible for interfering with this scan may need to be temporarily configured to permit scanning without interference. This normally takes the form of adding the IP addresses of this scanning service to the "whitelist" of the product or device. Please ensure the following network blocks have full, unobstructed, access in order to more accurately perform a vulnerability scan: 204.13.201.0/24, 64.37.231.0/24.

I'm not exactly sure how to whitelist them. I set up a couple address objects in the WAN zone, but I'm not sure what to apply it to. I tried turning off "Stealth Mode" (due to an associated complaint of over 60,000 open ports, which is impossible) and I even went as far as to turn off IPS (I turned off protection but left on detection because I don't want to leave us totally exposed). However, the scans are still failing.

It does seem a bit ridiculous to turn off security in order to test security, but apparently that's now a normally accepted thing for PCI scans.

I've opened a support ticket with them, but the first guy I talked to had no idea what to do other than reading the same information I already had, and I'm waiting for a call back from their "scanning team." I'm hoping someone here has already figured this out on a Sonicwall and can help me better.