Dan's questions

OK, so i'm at my wits end.

We have a system which works perfectly in our UAT environment (not HA) but will not work in live.

so the config is:

• dns A record to iis box
• binding in iis on :80 to dnsname
• HTTP/dnsname SPN

HA SQL 2014 cluster

• dynamic ports off
• standard port 1433 specified in TCP/IP config
• named pipes enabled

All the service accounts running SQL across the cluster are now the same (MSA's) i thought that might have been the problem, Alas no!

I now have - probably too many SPN's registered against the thing:

setspn -l chdom\msaBOXSQL01SVC$
Registered ServicePrincipalNames for CN=msaBOXSQL01SVC,CN=Managed Service Accounts,DC=chdom,DC=mydomain,DC=local:
        MSSQLSvc/BOXSQL-APPDB01
        MSSQLSvc/BOXSQL-APPDB01:1433
        MSSQLSvc/BOXSQL01:1433
        MSSQLSvc/BOXSQL02:1433
        MSSQLSvc/BOXSQL03:1433
        MSSQLSvc/BOXSQL03
        MSSQLSvc/BOXSQL02
        MSSQLSvc/BOXSQL01
        MSSQLSvc/BOXSQL-APPDB01.chdom.mydomain.local:1433
        MSSQLSvc/BOXSQL03.chdom.mydomain.local:1433
        MSSQLSvc/BOXSQL02.chdom.mydomain.local:1433
        MSSQLSvc/BOXSQL01.chdom.mydomain.local:1433
        MSSQLSvc/BOXSQL-APPDB01.chdom.mydomain.local

Can anyone see what i've done wrong here, i think i have google blindness at this stage

I'm not an application developer - Ill start off with that caveat.

In Brief; our development team have asked for me to open a series of ports from WAN to LAN completely bypassing our DMZ. They say this is fine because their api secures the connection first from two webservers in the DMZ (using diffie helman but that's another story) but were a little unsure that having open ports from WAN to LAN can ever be secure - can anyone enlighten me on the viability of this from a security standpoint?

Should not the end user always communicate to the DMZ and then a server within this do all the communication to any internal servers?

Im trying to format logs straight from our F5 using HSL and Logstash.

I've copied the example configuration exactly from the site as it contains the majority of the information I wanted logstash example

My F5 is now outputting logs to my elasticsearch cluster marking the sample log data below with the tag "message:" however when I try to apply the example grok filter, which appears to be correct; into my logstash conf file i get a _grokparseerror.

Does anyone see where i'm going wrong with my filter?

SAMPLE LOG

12.123.123.254 [13/Feb/2016:16:04:13 +0000] 123.16.1.23 /SITE/SITE_SSLV2 /SITE/SITE_SSLV2_pool 123.16.1.156 443 '/' 'GET / HTTP/1.1' 200 21003 217 'https://w2.website.co.uk/Planner/Planner' 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36'

SAMPLE GROK

%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}

MY CONFIG

filter {
  if [type] == "f5-access" {
    grok {
        match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}
}
    geoip {
      source => "clientip"
    }
  }
}

i have three nodes which should autoconfig into a cluster but for some reason they dont seem to want to cluster up.

The 3 Hyper-V VM Servers are CENTOS 7 installed as compute with just the tool packages installed. the servers have consecutive IP's in the same subnet there is no firewall enabled - they can all ping each other both by DNS and IP. Ports on all servers seem to be open.

[root@manelasticshard01 ~]# netstat -tuplen
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.1.247.246:9200       0.0.0.0:*               LISTEN      993        26721      3913/java
tcp        0      0 10.1.247.246:9300       0.0.0.0:*               LISTEN      993        23402      3913/java
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          20731      1549/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      0          19136      2441/master
tcp6       0      0 :::22                   :::*                    LISTEN      0          20733      1549/sshd
udp        0      0 127.0.0.1:323           0.0.0.0:*                           994        16999      913/chronyd
udp6       0      0 ::1:323                 :::*                                994        17000      913/chronyd

same output for all aside for IP addresses

NODE 3

 "cluster_name" : "PACMAN",
  "nodes" : {
    "NlrIawYrR1aq79P6F_Q3zA" : {
      "name" : "node3",
      "transport_address" : "manelasticshard03/10.1.247.244:9300",
      "host" : "10.1.247.244",
      "ip" : "10.1.247.244",
      "version" : "2.2.0",
      "build" : "8ff36d1",
      "http_address" : "manelasticshard03/10.1.247.244:9200",
      "process" : {
        "refresh_interval_in_millis" : 1000,
        "id" : 3968,
        "mlockall" : false
      }
    }
  }
}

NODE 2

"cluster_name" : "PACMAN",
  "nodes" : {
    "9Sv2k73BTFSgxMDRDdpRgA" : {
      "name" : "node2",
      "transport_address" : "manelasticshard02/10.1.247.245:9300",
      "host" : "10.1.247.245",
      "ip" : "10.1.247.245",
      "version" : "2.2.0",
      "build" : "8ff36d1",
      "http_address" : "manelasticshard02/10.1.247.245:9200",
      "process" : {
        "refresh_interval_in_millis" : 1000,
        "id" : 3898,
        "mlockall" : false
      }
    }
  }
}

NODE 1

   "cluster_name" : "PACMAN",
      "nodes" : {
        "RborUe8CS_C7ynX_yFWJ6Q" : {
          "name" : "node1",
          "transport_address" : "manelasticshard01/10.1.247.246:9300",
          "host" : "10.1.247.246",
          "ip" : "10.1.247.246",
          "version" : "2.2.0",
          "build" : "8ff36d1",
          "http_address" : "manelasticshard01/10.1.247.246:9200",
          "process" : {
            "refresh_interval_in_millis" : 1000,
            "id" : 3913,
            "mlockall" : false
          }
        }
      }
    }

my config is currently as follows but i have pretty much been through every setting i can find.

cluster.name: PACMAN
node.name: "node3"
# node.master: false
# node.data: true
network.host: manelasticshard03
# http.port: 9230
discovery.zen.ping.unicast.hosts: [manelasticshard01, manelasticshard02]
discovery.zen.ping.multicast.enabled: false
# discovery.zen.ping.unicast.enabled: true
# discovery.zen.fd.ping_timeout: 30s
# gateway.expected_nodes: 3
# gateway.recover_after_time: 5m
# gateway.recover_after_nodes: 2
# discovery.zen.minimum_master_nodes: 2

Does anyone have any ideas as to why the nodes are not clustering, or of any other tests i can do to find out.

UPDATE - if i set discovery minimum master nodes to two in order to force the cluster to search for a second node i get the following output.

[root@manelasticshard01 ~]# curl http://manelasticshard01:9200/_cluster/health?pretty=true
{
  "error" : {
    "root_cause" : [ {
      "type" : "master_not_discovered_exception",
      "reason" : null
    } ],
    "type" : "master_not_discovered_exception",
    "reason" : null
  },
  "status" : 503
}

This is probably subjective but if anyone could suggest a robust solution for the following that would be fantastic.

We have potentially multiple URL's in service which are currently 1:1 with Public IP addresses. The problem being that we will eventually run out of public IP's. Essentially they just point to servers for RDP Sessions.

we need to keep the client urls the same so adding ports to the URL is not really an option. (can DNS map an URL with no specified port to an IP with a Port somehow?)

we have an F5 load balancer but we do not have the Global Traffic manager is there some way of dishing out incoming requests to the correct internal IP via that?

In short What is the easiest way to route multiple URLs through one public IP to multiple Private IP's

I'm trying to import en employee list into AD using powershell. The script needs to update exisisting AD objects.

The problem I have is that some users will have mobile number some internal numbers and some just an extension, when i run the Set-ADuser command in its most basic form it seems to fail whenever a value is blank.

I'm not great at scripting, can anyone explain to me why the script below doesnt work? And if so could anyone suggest how to make it work? Cheers

Import-module ActiveDirectory

$CSVPath = "c:\scripts\ictdepartment2.csv" 
$csvData = Import-CSV $CSVPath -delimiter "," -Header ("SamaccountName","identity","Title","Company","Department","Description","Office","OfficePhone","IPPhone","MobilePhone") 


##

foreach ($line in $csvData) 
{
$accountTable = @{ 
'SamaccountName'= $line.SamaccountName 
'identity'= $line.identity
'title'= $line.title 
'company'= $line.company 
'department'= $line.department 
'description'= $line.description 
'office'= $line.office
'officephone'= $line.officephone 
'IPPhone'= $line.ipPhone 
'mobilephone'= $line.mobilephone 
}
}

##

ForEach($line in $csvData) 
{
$SamaccountName = $line.SamaccountName
$identity = $line.identity
$title = $line.title 
$company = $line.company 
$department = $line.department 
$description = $line.description 
$office = $line.office
$officephone = $line.officephone
$IPPhone = $line.ipPhone 
$mobilephone = $line.mobilephone 
}

##

ForEach($line in $csvData) 
{
if ($officephone -ne $null)
{Set-ADUser -Identity $SamaccountName -OfficePhone $officephone}
if ($mobilephone -ne $null)
{Set-ADUser -Identity $SamaccountName -MobilePhone $mobilephone}
if ($ipphone -ne $null)
{Set-ADUser -Identity $SamaccountName -replace @{ipPhone=$ipphone}}

Set-ADUser -Identity $SamaccountName -Company $Company -Department $Department -Description $Description -Office $office -Title $title
}

If i use the following commands it works, however as soon as i add the if $null statement in it again fails :(

ForEach($line in $csvData) 
{ 
Get-ADUser -Filter "SamAccountName -eq '$($line.samaccountname)'" |
Set-ADUser -Replace @{ipphone=$ipphone}
}

ForEach($line in $csvData) 
{ 
Get-ADUser -Filter "SamAccountName -eq '$($line.samaccountname)'" |
Set-ADUser -Company $Company -Department $Department -Description $Description -MobilePhone $mobilephone -Office $office -OfficePhone $officephone -Title $title
}