Jonas's questions

I try to start etcd as a systemd service run in a container with podman.

After start I get this error log from systemd:

systemd[1]: etcd.service: Got notification message from PID 4696, but reception only permitted for main PID 4868

But etcd seem to be able to start an try to notify the container daemon:

21T15:31:08.817Z","caller":"etcdserver/server.go:2500","msg":"cluster version>
Aug 21 15:31:08 ip-10-0-0-71 podman[4696]: {"level":"info","ts":"2021-08-21T15:31:08.817Z","caller":"etcdmain/main.go:47","msg":"notifying init daemon>
Aug 21 15:31:08 ip-10-0-0-71 podman[4696]: {"level":"info","ts":"2021-08-21T15:31:08.818Z","caller":"etcdmain/main.go:53","msg":"successfully notified>

But systemd seem to not be aware of that and terminates the etcd service:

Aug 21 15:32:34 ip-10-0-0-71 systemd[1]: etcd.service: start operation timed out. Terminating.
Aug 21 15:32:35 ip-10-0-0-71 podman[4696]: {"level":"info","ts":"2021-08-21T15:32:35.000Z","caller":"osutil/interrupt_unix.go:64","msg":"received sign>
Aug 21 15:32:35 ip-10-0-0-71 podman[4696]: {"level":"info","ts":"2021-08-21T15:32:35.000Z","caller":"embed/etcd.go:367","msg":"closing etcd server","n>

This is the systemd service status:

$ sudo systemctl status etcd.service
● etcd.service - etcd
     Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: enabled)
     Active: failed (Result: timeout) since Sat 2021-08-21 15:32:35 UTC; 8min ago
    Process: 4868 ExecStart=/usr/bin/podman run -p 2380:2380 -p 2379:2379 --volume=/var/lib/etcd:/etcd-data:z --name etcd 842445240665.dkr.ecr.eu-nort>
   Main PID: 4868 (code=exited, status=0/SUCCESS)
        CPU: 3.729s

This is my systemd unit service file for etcd started with podman:

cat <<EOF | sudo tee /etc/systemd/system/etcd.service
[Unit]
Description=etcd
After=podman_ecr_login.service mk_etcd_data_dir.service

[Service]
Type=notify
ExecStart=/usr/bin/podman run -p 2380:2380 -p 2379:2379 --volume=/var/lib/etcd:/etcd-data:z \
 --name etcd <my-aws-account>.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0 \
 /usr/local/bin/etcd --data-dir=/etcd-data \
 --name etcd0 \
 --advertise-client-urls http://127.0.0.1:2379 \
 --listen-client-urls http://0.0.0.0:2379 \
 --initial-advertise-peer-urls http://127.0.0.1:2380 \
 --listen-peer-urls http://0.0.0.0:2380 \
 --initial-cluster etcd0=http://127.0.0.1:2380

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable etcd
sudo systemctl start etcd

I suspect that this might be related to Type=notify or perhaps the way I use podman or etcd. I start etcd in a similar way as described in etcd documentation: Run etcd clusters inside containers - Running a single node etcd. I run this on Debian 11 with Podman 3.0.1.

Any suggestions on how I can start etcd with podman as a systemd service?

I want to start etcd (single node) in docker from systemd, but something seems to go wrong - it gets terminated about 30 seconds after start.

It looks like the service starts in status "activating" but get terminated after about 30 seconds without reaching the status "active". Perhaps there are any missing signalling between docker container and systemd?

Update (see bottom of post): systemd service status reaches failed (Result: timeout) - when I remove the Restart=on-failure instruction.

When I check the status of the etcd service after boot, I get this result:

$ sudo systemctl status etcd● etcd.service - etcd   Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: exit-code) since Wed 2021-08-18 20:13:30 UTC; 4s ago
  Process: 2971 ExecStart=/usr/bin/docker run -p 2380:2380 -p 2379:2379 --volume=etcd-data:/etcd-data --name etcd my-aws-account.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0 /usr/local/bin/etcd --data-dir=/etcd-data --name etcd0 --advertise-client-urls http://10.0.0.11:2379 --listen-client-urls http://0.0.0.0:2379 --initial-advertise-peer-urls http://10.0.0.11:2380 --listen-peer-urls http://0.0.0.0:2380 --initial-cluster etcd0=http://10.0.0.11:2380 (code=exited, status=125)
 Main PID: 2971 (code=exited, status=125)

I run this on an Amazon Linux 2 machine, with a user data script to run at launch. I have confirmed that docker.service and docker_ecr_login.service run successfully.

And short after launch of the machine, I can see that the etcd is running:

 sudo systemctl status etcd
● etcd.service - etcd
   Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: disabled)
   Active: activating (start) since Wed 2021-08-18 20:30:07 UTC; 1min 20s ago
 Main PID: 1573 (docker)
    Tasks: 9
   Memory: 24.3M
   CGroup: /system.slice/etcd.service
           └─1573 /usr/bin/docker run -p 2380:2380 -p 2379:2379 --volume=etcd-data:/etcd-data --name etcd my-aws-account.dkr.ecr.eu-north-1.amazonaws.com...

Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.690Z","logger":"raft","caller":"...rm 2"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.691Z","caller":"etcdserver/serve..."3.5"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.693Z","caller":"membership/clust..."3.5"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.693Z","caller":"etcdserver/server.go:2...
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.693Z","caller":"api/capability.g..."3.5"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.693Z","caller":"etcdserver/serve..."3.5"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.693Z","caller":"embed/serve.go:9...ests"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.695Z","caller":"etcdmain/main.go...emon"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.695Z","caller":"etcdmain/main.go...emon"}
Aug 18 20:30:17 ip-10-0-0-11.eu-north-1.compute.internal docker[1573]: {"level":"info","ts":"2021-08-18T20:30:17.702Z","caller":"embed/serve.go:1...2379"}
Hint: Some lines were ellipsized, use -l to show in full.

I get the same behavior wether etcd listen to the Node IP (10.0.0.11) or 127.0.0.1.

I can run etcd locally, started from command line (and it does not terminate after 30 seconds), with:

sudo docker run -p 2380:2380 -p 2379:2379 --volume=etcd-data:/etcd-data --name etcd-local \
my-aws-account.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0 \
/usr/local/bin/etcd --data-dir=/etcd-data \
--name etcd0 \
--advertise-client-urls http://127.0.0.1:2379 \
--listen-client-urls http://0.0.0.0:2379 \
--initial-advertise-peer-urls http://127.0.0.1:2380 \
--listen-peer-urls http://0.0.0.0:2380 \
--initial-cluster etcd0=http://127.0.0.1:2380

The parameters to etcd is similar to Running a single node etcd - ectd 3.5 documentation.

This is the relevant part of the startup script that is intended to launch etcd:

sudo docker volume create --name etcd-data

cat <<EOF | sudo tee /etc/systemd/system/etcd.service
[Unit]
Description=etcd
After=docker_ecr_login.service

[Service]
Type=notify
ExecStart=/usr/bin/docker run -p 2380:2380 -p 2379:2379 --volume=etcd-data:/etcd-data \
 --name etcd my-aws-account.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0 \
 /usr/local/bin/etcd --data-dir=/etcd-data \
 --name etcd0 \
 --advertise-client-urls http://10.0.0.11:2379 \
 --listen-client-urls http://0.0.0.0:2379 \
 --initial-advertise-peer-urls http://10.0.0.11:2380 \
 --listen-peer-urls http://0.0.0.0:2380 \
 --initial-cluster etcd0=http://10.0.0.11:2380
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable etcd
sudo systemctl start etcd

When listing all containers on the machine, I can see that it has been running:

sudo docker ps -a
CONTAINER ID   IMAGE                                                       COMMAND                  CREATED          STATUS                      PORTS                          NAMES
a744aed0beb1   my-aws-account.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0   "/usr/local/bin/etcd…"   25 minutes ago   Exited (0) 24 minutes ago                          etcd

but I suspect that it cannot be restarted since the container name already exists.

Why does the etcd container get terminated after ~30 seconds, when started from systemd? It appears like it successfully start, but systemd only shows it in status "activating" but never in status "active" and it seem to be terminated after about 30 seconds. Is there some missing signalling from the etcd docker container to systemd? If so, how do I get that signalling correct?

UPDATE:

After removing the Restart=on-failure instruction in the service unit file, I now get status: failed (Result: timeout):

$ sudo systemctl status etcd
● etcd.service - etcd
   Loaded: loaded (/etc/systemd/system/etcd.service; enabled; vendor preset: disabled)
   Active: failed (Result: timeout) since Wed 2021-08-18 21:35:54 UTC; 5min ago
  Process: 1567 ExecStart=/usr/bin/docker run -p 2380:2380 -p 2379:2379 --volume=etcd-data:/etcd-data --name etcd my-aws-account.dkr.ecr.eu-north-1.amazonaws.com/etcd:v3.5.0 /usr/local/bin/etcd --data-dir=/etcd-data --name etcd0 --advertise-client-urls http://127.0.0.1:2379 --listen-client-urls http://0.0.0.0:2379 --initial-advertise-peer-urls http://127.0.0.1:2380 --listen-peer-urls http://0.0.0.0:2380 --initial-cluster etcd0=http://127.0.0.1:2380 (code=exited, status=0/SUCCESS)
 Main PID: 1567 (code=exited, status=0/SUCCESS)

Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.332Z","caller":"osutil/interrupt...ated"}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.333Z","caller":"embed/etcd.go:36...379"]}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: WARNING: 2021/08/18 21:35:54 [core] grpc: addrConn.createTransport failed ...ing...
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.335Z","caller":"etcdserver/serve...6a6c"}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.337Z","caller":"embed/etcd.go:56...2380"}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.338Z","caller":"embed/etcd.go:56...2380"}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal docker[1567]: {"level":"info","ts":"2021-08-18T21:35:54.339Z","caller":"embed/etcd.go:36...379"]}
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal systemd[1]: Failed to start etcd.
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal systemd[1]: Unit etcd.service entered failed state.
Aug 18 21:35:54 ip-10-0-0-11.eu-north-1.compute.internal systemd[1]: etcd.service failed.
Hint: Some lines were ellipsized, use -l to show in full.

I installed containerd on Amazon Linux 2 using the suggested commands:

sudo amazon-linux-extras enable docker
sudo yum install -y containerd

I added this in the EC2 user data script to run at instance launch time.

But, how am I supposed to start containerd (a container runtime - similar to docker) as a service? Since I installed through yum there doesn't seem to include a systemd service file. The binary is located on /usr/bin/containerd. Am I supposed to use echo in the boot script to generate a systemd service file or what is a good practice?

I used the Java keytool to generate a "keystore":

keytool -genkey -alias example.com -keyalg RSA -keystore example.com.keystore

Then I generated a CSR (Certificate Signing Request):

keytool -certreq -keyalg RSA -alias example.com -file example.com.csr
-keystore example.com.keystore

Then I issued an certificate and saved it in a textfile example.com.crt

Now I want to use this certificate with Nginx.

I have placed my certificate on /etc/ssl/certs/example.com.cert and I placed my "keystore" (I think it contains my private key?) on /etc/ssl/private/example.com.keystore

Then I configured my Nginx following Nginx, SSL and vhosts. But when I reload the Nginx configuration file I get this error message:

sudo service nginx reload
Reloading nginx configuration: [emerg]: SSL_CTX_use_certificate_chain_file("/etc/ssl/certs/myssl.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)
configuration file /etc/nginx/nginx.conf test failed

When I followed the same guide and generated an SSL-certificate using openssl it worked fine. But using Java keytool I get this error.

How can I use a SSL-certificate and keys from Java keytool with Nginx?

I'm developing a website that should be used with HTTPS. I am developing the site on my Windows machine and I have a Linux machine on the same LAN where I test my websites. I don't have a DNS-server on the LAN so I use IP-addresses to access the website.

On the server I use Ubuntu Server and Nginx web server. Is there any easy way I can test the HTTPS configuration in my LAN? E.g if I generate a SSL-certificate myself, but I don't have a domain name to set up it with. Any recommendations for testing? Or should I use a subdomain test.example.com and put an A record to my local IP-adress to the test server E.g. 192.168.1.10?

We had a Windows Domain with a SBS 2003 as a server. The server crashed. We used the Windows Vista client in offline mode for a few months.

We had My Documents synchronized with the SBS 2003.

Now two months later we installed a new Windows SBS 2008. On some clients did I copy all contents in My Documents to a USB stick. Then connected the computer to the SBS 2008 using a new user account. That worked fine.

Now on this Vista client, I copied the hole C:\Users\username\ directory to the USB stick. And then connected the computer to the SBS 2008 using a new user account. But when I copy back the content of the directory to C:\Users\NEWDOMAIN.username\ there is no directory My Documents. Windows seem to not include these files or it seem to delete these files when connecting to a new Domain Controller.

Now I try to recover these files using NTFS Undelete but nothing of these files can be found either on the USB stick or on the computer. Are they stored in a different directory when synchronized to the SBS 2003?

I can recover them from the crashed SBS 2003 server, but these files will be two months old.

Any ideas?

Until yesterday, we had no server at our network, so we used our router, D-Link DFL 200 as DHCP server. The router has IP: 192.168.1.1 and all clients has IP in the range: 192.168.1.10 - 192.168.1.20.

Yesterday I installed a Windows SBS 2008, and I was recommended to use that one as DHCP-server instead and heard that it was pre-configured as DHCP-server. This server has IP: 192.168.1.2.

Now I would like to turn off the DHCP-server in the router and use the SBS 2008 as DHCP-server. In the router I has changed from Use built-in DHCP Server to Relay DHCP request to other DHCP server: 192.168.1.2.

Then I tried from a Windows XP client to renew the IP-address but that failed. The DHCP service on SBS 2008 was stopped, but I started it again, and now is it "Started", but I can still not renew the IP-address from the Windows XP client.

How do I set the Windows SBS 2008 as DHCP-server?

We have a LAN and the router is the DHCP server. We have a server with Windows SBS 2008, it has the IP address 192.168.1.2 while the router has the IP address 192.168.1.1.

I have tried to add a client computer to the SBS domain by visiting http://connect from the client computer. But that page doesn't exist. I can visit http://192.168.1.2/ then the default startpage for IIS7 is shown. I'm logged in as a local Administrator on the computer that I tries to add to the domain.

How do I add the client computer to the SBS 2008 domain?

UPDATE: I have now set the Windows SBS 2008 as DHCP Server. I can connect to http://connect/ on an Windows XP client, but I have problem with a Windows Vista client, it can not connect to http://connect/ and I have tried to renew the IP address and flush the DNS Cash with ipconfig /flushdns but it doesn't help.

How can I solve this?

I have a Windows Vista client computer that is connected to a Windows Domain. I can login with the user account for DOMAIN\user1 and also with the Domain Administrator account DOMAIN\Administrator but the local Administrator account is locked. And I need to log in to the local Administrator account to connect the client computer to another domain controller.

How can I reset the local Administrator password for a Windows Vista client connected to a domain?

The server is a Windows SBS 2003.

I installed PostgreSQL on my Windows 7 machine a few weeks ago. Now I would like to create a database with createdb mydb but I don't remember the password.

Is there anyway to reset the password? I have access to the Administrator account on my machine. Or do I have to uninstall PostgreSQL and then reinstall it again?

How can I reset the password on a PostgreSQL database on my machine?

I'm planning to set up a Linux-VPS and run a PHP site on it. I have read that it's recommended to use PHP Suhosin to patch PHP for security. But isn't PHP patched for security in every new release? or is PHP Suhosin making the security better than what PHP themself plan to do? Or is PHP Suhosin just for older versions of PHP?

I wounder how important it is to have an UPS for a server. Everyone seems to use UPS for servers but not for client computers.

In example, if I use Windows Small Business Server on a small network for Active Directory and storing the users home directory for backup is it still useful with an UPS, why? If a power outage happens, shouldn't the filesystem handle that, so no files are corrupted? And in this case I think the problem is the same on the clients.

I do understand that it can be useful on servers when changing the server configuration, but that is done during a very limited time and it sounds like it's more worth to do good backups before the configuration.

And when thinking about database transactions, I think that the transaction logic in the database management system should handle it, that's what transactions are for.

And finally, if an UPS is used, doesn't the server applications need to have support for it? outherwise the power outage is only delayed? Or is it only the operating system that needs the UPS?

Why is an UPS needed for a server but not for clients?

I have had some problems using hardware-RAID on a server. Now I'm planning to use the Windows Server built-in software-RAID-1 instead. The server will only be used for Business Administrations, so I don't need high performance. The operating system is Small Business Server 2008 and the server is HP ProLiant DL320 G6.

Are there any disadvantages by using the Windows Server 2008 built-in software-RAID for mirroring?

I have problem with a new HP ProLiant DL320 G6 server. From the beginning it had to less memory, and now I have ordered more memory two times. Now I am struggling to populate the server with these memories.

I have two memories: HP 4GB 2Rx4 PC3-10600R-9 Kit

How should I populate them on the motherboard?

I have tried to understand the documentations, but it's very unclear for me. I have populated slot 1 and 4, but I can not start the server with that configuration.

Today we have a small network with 5 clients and a Windows SBS 2003 as a server. Now have we bought a new server with Windows SBS 2008.

How do I easiest:

• Switch the clients working with the old server, to work with the new server? Is it just to run http://domain/connectcomputer again?

• Move the data in "My Documents" from the old server to the new server?

And finally, is there anything other that I have to think of when changing server? It will be a new clean installation.

I have been administering servers and clients in small business offices, and have never used SNMP. But I have read about it and it looks interesting. As what I understand, it is mostly useful if you have a bigger network with a lot of network equipment that should be monitored.

Is there any useful use cases for SNMP in smaller networks? And is it recommended that I use it?

I'm looking for a database (DBMS) that is easy to scale out. I would like to have high availability so I need a multi-master cluster, where the data is replicated to two or more physical computers. I would also like to be able to start with one node (no replication), and then scale out to more nodes as needed without a reinstallation or downtime.

I would like to have a DBMS that are easy to maintain and manage. It should be easy to add nodes, remove nodes, take live backup and monitor the use of resources.

It doesn't have to be a relational database system, so a NoSQL is okey. And I would like to have a free version so I can test it in small scale and compare it with alternatives.

What alternatives do I have?

I have a domain with Windows SBS 2003 as domain controller. It's very common to get Master Browser errors in the logs, MRxSmb Event ID 8003. How can I avoid that? What have I done wrong?

I know how to solve this: Stop the Computer Browser service on clients, but I don't know how to avoid this since the problem comes back every time I add a new client and I forget to stop the Computer Browser service.

Error message:

The master browser has received a server announcement from the computer
[computer] that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{#######-####-####-#. The master browser is stopping 
or an election is being forced.

Is there an configuration of the server to avoid this problem?

Is there a way to record the Linux commands I use and reuse them on another machine or in case I want to reinstall the machine?

In example record how I set up NginX, PHP and permissions in my lab environment and then repeat the exact commands on my deploy machine?

I'm having a little server with Windows Small Business Server 2003. I'm using RAID1, via a HighPoint Rocket RAID 1640 RAID-card, using two harddrives.

This week the server alarmed, and durig reboot I got the error-message Broken Mirroring (User Manual page 30). I had a few alternatives (see the manual), first I tried Continue, but the server restarted during boot. Next time I took Power Off, and replaced the oldest harddrive with a new one, and when I booted, I selected Rebuild. Then I selected the new harddrive to be the new one. The rebuild-procedure started and a progress bar at 0% showed up, but after a few seconds I got the message Copy Failed!, then the server booted and Windows Server started. Now it works fine.

But I guess that I'm just using one harddrive now, and it's not mirrored. I haven't touched the server since then (two days ago). What should I do now? I have no experience of this situation.

Anyone that have some guidance?