Stuggi's questions

I have a peculiar problem. For some reason as the clock struck midnight on February 1st, cron is now running certbot every minute trying to renew a certificate.

When running sudo crontab -l I get the following output, which I can't really understand the syntax of;

* * */89 * * sudo certbot renew

I personally can get my head around what that /89 is supposed to mean.

Anyone seen anything like this before with certbot? If I check the /etc/cron.d/certbot file, it's just there as it should be, running twice a day.

I have a very simple static site hosted on nginx.

Everything works fine, but I would like to clean up the path showed in the browser bar so that it only shows example.com instead of example.com/index.html#someanchor

The site has several subpages in their own HTML-files, but I would still prefer to always just show the "root domain".

This problem seems to be very elusive as I can't find a single hit on Google on how to do this.

Here's the server block from my sites-available config file:

server {
        listen 80;
        listen [::]:80;


        root /var/www/example.com;

        index index.html index.htm index.nginx-debian.html;

        server_name example.com;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ =404;
        }

}

When running 'sudo apt update' I get the following error:

user@gitlab:~$ sudo apt update
Hit:1 http://security.debian.org/debian-security stretch/updates InRelease
Ign:2 http://ftp.fi.debian.org/debian stretch InRelease
Hit:3 http://ftp.fi.debian.org/debian stretch-updates InRelease
Hit:4 http://ftp.fi.debian.org/debian stretch Release
Get:6 https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease [23.3 kB]
Err:6 https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
Fetched 23.3 kB in 2s (11.0 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.gitlab.com/gitlab/gitlab-ee/debian stretch InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
W: Failed to fetch https://packages.gitlab.com/gitlab/gitlab-ee/debian/dists/stretch/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3F01618A51312F3F
W: Some index files failed to download. They have been ignored, or old ones used instead.

I have a single Windows server (Windows Server 2016 / 1607) which has peculiar issues with web browsers.

Both Google Chrome and Microsoft Edge Chrome crash instantly when they are launched and display the Aw Snap / This Page is having a problem error respectively, even when I launch the about:chrome page.

IE11 on the other hand works perfectly.

First I thought it was the Chrome / Symantec bug from a couple of months ago, but I've already implemented policies enterprise-wide to fix that particular issue.

I've tried the following:

• Reinstalling latest version of Chrome
• Installing latest version of Edge Chrome
• Disabling Symantec Endpoint Protection (SEP)
• Updating SEP to 14.2.xxxx

Backstory: I have a couple of internal startum 1 NTP clocks with GPS receivers, and 2 public NTP servers that are virtualized on top of VMware ESXi which take time from the S1 clocks and distribute it. Otherwise this setup works rather fine and provides good time when compared to other public servers.

Problem: When I reboot the virtual machines, they do not start syncing properly, and get stuck in an unsynchronised state. Below is the ntpq -p output after a reboot.

root@server:~$ ntpq -p
 remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 192.168.1.40    .GPS.            1 u   27   64    3    1.533  -258.43 5948.73
 192.168.2.40    .GPS.            1 u   24   64    3    1.118  -258.47 6138.19
 192.168.3.42    .GPS.            1 u   24   64    3    0.709  -258.42 5655.02
 194.100.49.151  194.100.49.134   2 u   22   64    3    8.124  -258.74 7131.65
 gbg1.ntp.se     .PPS.            1 u   26   64    3   21.856  -258.43 4876.90
 ntp2.sptime.se  .PPS.            1 u   23   64    3   19.991  -258.42 7764.97
 ntp1.sptime.se  .PPS.            1 u   27   64    3   20.489  -258.41 8574.46

If I then run ntp service restart I get this:

root@server:~$ ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 192.168.1.40    .GPS.            1 u    2   64    1    1.517  -258.45   0.065
 192.168.2.40    .GPS.            1 u    1   64    1    1.126  -258.46   0.025
 192.168.3.42    .GPS.            1 u    2   64    1    0.719  -258.42   0.020
 194.100.49.151  194.100.49.134   2 u    5   64    1    8.041  -258.72   0.000
 gbg1.ntp.se     .PPS.            1 u    6   64    1   21.839  -258.41   0.000
 ntp2.sptime.se  .PPS.            1 u    4   64    1   19.968  -258.41   0.000
 ntp1.sptime.se  .PPS.            1 u    3   64    1   20.418  -258.43   0.000

A second later it steps:

root@server:~$ ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 192.168.1.40    .STEP.          16 u    2   64    0    0.000    0.000   0.000
 192.168.2.40    .STEP.          16 u    2   64    0    0.000    0.000   0.000
 192.168.3.42    .STEP.          16 u    8   64    0    0.000    0.000   0.000
 194.100.49.151  194.100.49.134   2 u    -   64    1    7.976   -0.261   0.000
 gbg1.ntp.se     .PPS.            1 u    -   64    1   21.840    0.060   0.000
 ntp2.sptime.se  .STEP.          16 u    6   64    0    0.000    0.000   0.000
 ntp1.sptime.se  .STEP.          16 u    6   64    0    0.000    0.000   0.000

And after that we're back to normal operation:

root@server:~$ ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 192.168.1.40    .GPS.            1 u    1   64    1    1.474    0.044   0.017
*192.168.2.40    .GPS.            1 u    1   64    1    1.102    0.030   0.005
 192.168.3.42    .GPS.            1 u    1   64    1    0.674    0.049   0.009
 194.100.49.151  194.100.49.134   2 u    8   64    1    7.976   -0.261   0.000
 gbg1.ntp.se     .PPS.            1 u    8   64    1   21.840    0.060   0.000
 ntp2.sptime.se  .PPS.            1 u    6   64    1   19.979    0.059   0.000
 ntp1.sptime.se  .PPS.            1 u    5   64    1   20.440    0.048   0.000

So it seems that after reboot the system clock is off by quite a bit, which is to be expected, but why ntpd doesn't panic and just steps the clock is a bit hard for me to understand.

Here's my ntp.conf

tinker panic 0
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntp/ntp.drift


# Enable this if you want statistics to be logged.
statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable


# You do need to talk to an NTP server or two (or three).
#server ntp.your-provider.example

# pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your server will
# pick a different set every time it starts up.  Please consider joining the
# pool: <http://www.pool.ntp.org/join.html>
server 192.168.1.40  iburst
server 192.168.2.40 iburst
server 192.168.3.42 iburst
server time1.mikes.fi
server ntp1.gbg.netnod.se
server ntp2.sptime.se
server ntp1.sptime.se

# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details.  The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust


# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255

# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines.  Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient

Backstory, I operate a couple of public stratum 2 NTP servers that are part of the NTP pool. These then sync to internal stratum 1 NTP clocks.

The issue I have is that clients using the public NTP servers see the internal IPs of the stratum 1 clocks. I'd much rather have something else there, for example the DNS name of the servers. Is this at all possible?

The MySQL repository key has suddenly expired again, so I get a GPG error in Ubuntu when running apt-get update

The error is W: GPG error: http://repo.mysql.com/apt/ubuntu xenial InRelease: The following signatures were invalid: KEYEXPIRED 1550412832 KEYEXPIRED 1550412832 KEYEXPIRED 1550412832

I'm having this peculiar issue with Microsoft DNS.

Basically, we have domain.com that's a split horizon setup (external public DNS and internal DNS are both authoritative for separate zones), don't ask me why, it was like this when I got here.

In this AD we have 3 domain controllers, serving as DNS servers for the internal zones. On top of this, we have 2 DNS servers that forwards queries to these AD servers, and cache the results.

Additionally, we have another domain, example.com that's only in our external public DNS servers.

Now to the problem; AD servers have taken an issue with the name subdomain.example.com. The return queries with "domain name can't be found", as an authoritative server does when it doesn't have a record. However, the DNS forwarders for clients do resolve the query.

Externally everything works fine, subdomain.example.com resolves as it should to a CNAME for www3.domain.com

However, the problem is not with the whole zone, it's only with that specific subdomain. www.example.com resolves both internally and externally as a CNAME for www3.domain.com.

So, how can a DNS server that's not authoritative for a zone reply that a record can't be found?

As a workaround, I created a new zone for subdomain.example.com and added an A record that's identical with the one for www3.domain.com. And an hour later this record was gone?

I'm close to giving up and becoming a goat farmer. :)

So, it recently dawned on me that since I have 3 GPS clocks in my network, I could, technically, give back a little and serve time to the rest of the world. So far I've not quite seen any downsides with this ideas, but I have the following questions;

1. Can I virtualize this? I'm not going to spend money and time on standing up hardware for this, so virtualization is a must. Since the servers will have access to three stratum 1 sources, I can't see how this can be a problem provided the ntpd config is correct

2. What kind of traffic do a public NTP server (part of pool.ntp.org) normally see? And how big VMs do I need for this? ntpd shouldn't be too resource intensive as far as I can gather, but I'd rather know beforehand.

3. What security aspects are there to this? I'm thinking just installing ntpd on two VMs in the DMZ, allow only ntp in through the FW, and only ntp out from the DMZ to the internal ntp servers. There also seem to be some ntp settings that are recommended according to the NTP pool page, but are they sufficient? https://www.ntppool.org/join/configuration.html

4. They recommend not having the LOCAL clock driver configured, is this equivalent to removing the LOCAL time source configuration from the config files?

5. Anything else to consider?