batfastad's questions

2 CentOS servers that I'd like to apply the same manifest to. The manifest creates a user with a custom home directory location under /var/username

Problem is on one of the servers /var/username has to be a symlink off to /data/username. So simply running ensure => 'directory', would attempt to overwrite the symlink.

And I can't use ensure => 'present' because that creates a file by default if it doesn't exist. So for new servers that this manifest applies to a blank file will be created when I actually need it to be a directory.

1. Is there a way of doing ensure directory or link? So that if it's absent a directory is created. And if it's a link, then just leave it alone? By default the Puppet file type creates a file when doing ensure => 'present'.

2. Or a way of doing if absent ensure directory else leave it alone?

What about exec, doing a simple bash if /var/username not exist then mkdir sort of thing?
Nasty but it would work.

The ideal solution is probably to avoid special cases from the start. Having multiple config variants in a single manifest does seem a bit wrong. So eventually I will either:

• normalise the VMs (might switch from a symlink to a bind mount for example)
• give them separate manifests, since the configuration between them is different

But for the purposes of this question I would like to know if there are any options/syntax within Puppet that I currently don't know about.

I have a reasonably lengthy block of authorization config directives within an Apache <Directory> context in a virtual host configuration file.
It has LDAP credentials and a complex filter that will be annoying to reproduce within the vhost configuration file.

Here's a simplified example:

ServerName server.domain.com
DocumentRoot /var/www/server.domain.com

<Directory /var/www/server.domain.com/>
    AllowOverride FileInfo
    Options +ExecCGI

    # PASSWORD PROTECT
    AuthType Basic
    AuthBasicProvider ldap file
    AuthName "INTERNAL"
    AuthLDAPURL ldap://xxx
    AuthLDAPBindDN uid=xxx,cn=xxx
    AuthLDAPBindPassword xxx
    AuthzLDAPAuthoritative on
    AuthUserFile /var/www/server.domain.com/.htpasswd
    Require valid-user
</Directory>

Alias /alias1 /var/www/alias1.domain.com
<Directory /var/www/alias1.domain.com>
    # ?
</Directory>

Alias /alias2 /var/www/alias2.domain.com
<Directory /var/www/alias2.domain.com>
    # ?
</Directory>

Alias /alias3 /var/www/alias3.domain.com
<Directory /var/www/alias3.domain.com>
    # ?
</Directory>

</VirtualHost>

Now because most of the Auth* directives have to be used within a Directory or .htaccess context, I am faced with having to repeat the full AuthType...Require valid-user block for each Alias that I add.

The only way I can think of to avoid this is to split the auth section out into a separate file and reference that using Include.

As a solution the Include would work fine and be easy to maintain.

Is there another way of doing this which gives a cleaner vhost configuration file with less repetition?
Just in case there's a great way of doing things like this in Apache that I haven't picked up in the last 15 years!

EDIT: I should point out that the reason I'm using Alias is for easy deployment, I don't want to have to re-create symlinks whenever I re-build that DocumentRoot directory. I realise though that using symlinks and Location would provide the cascade I would be looking for to avoid the repetition.
The problem I've got I suppose is more to do with the fact that Alias requires a matching Directory block to be able to restrict access.

I have a DHCP server running ISC dhcpd which offers the option domain-search "domain.local"; option.

This is being ignored by a particular CentOS 5 dhclient which is removing the search parameter in resolv.conf even if I add it in manually and restart networking.

When looking at the dhclient lease in /var/lib/dhclient/dhclient-eth0.leases I notice that the option domain-search is not among the options it's received from the DHCP server.

I'm aware that you can set a dhclient.conf file to locally override options received from DHCP servers but there doesn't appear to be an /etc/dhclient.conf or /etc/dhcp/dhclient.conf

It's strange that it's being actively overwritten and not in the local leases file. CentOS 6 guests appear to be receiving the option ok.

Anyone aware of any other conditions where this might happen?
OS is CentOS 5.8 64bit and dhclient 12:3.0.5-33.el5_9

Currently setting up a small KVM host to run a few VMs for a small business. The server has 2 drives in software md RAID 1, then I have it set as a PV in an LVM setup. Guests and hosts are all CentOS 6.4 64bit.

The / partition of the KVM guests are disk images but with one particular guest that will have higher i/o requirements, I've added a 2nd HDD to the VM which is a logical volume from the host storage pool.

I was running some pretty intense i/o on this LV this evening within the guest, extracting a 60GB multi-volume 7z archive of data. 7z barfed about 1/5th of the way through with E_FAIL. I tried to move some files around on this LV disk and was greeted with "cannot move ... read-only file system". All devices are mounted rw. I looked in /var/log/messages and saw the following errors...

Nov 22 21:47:52 mail kernel: Buffer I/O error on device vdb1, logical block 47307631
Nov 22 21:47:52 mail kernel: lost page write due to I/O error on vdb1
Nov 22 21:47:52 mail kernel: Buffer I/O error on device vdb1, logical block 47307632
Nov 22 21:47:52 mail kernel: lost page write due to I/O error on vdb1
Nov 22 21:47:52 mail kernel: Buffer I/O error on device vdb1, logical block 47307633
Nov 22 21:47:55 mail kernel: end_request: I/O error, dev vdb, sector 378473448
Nov 22 21:47:55 mail kernel: end_request: I/O error, dev vdb, sector 378474456
Nov 22 21:47:55 mail kernel: end_request: I/O error, dev vdb, sector 378475464
Nov 22 21:47:55 mail kernel: JBD: Detected IO errors while flushing file data on vdb1
Nov 22 21:47:55 mail kernel: end_request: I/O error, dev vdb, sector 255779688
Nov 22 21:47:55 mail kernel: Aborting journal on device vdb1.
Nov 22 21:47:55 mail kernel: end_request: I/O error, dev vdb, sector 255596560
Nov 22 21:47:55 mail kernel: JBD: I/O error detected when updating journal superblock for vdb1.
Nov 22 21:48:06 mail kernel: __ratelimit: 20 callbacks suppressed
Nov 22 21:48:06 mail kernel: __ratelimit: 2295 callbacks suppressed
Nov 22 21:48:06 mail kernel: Buffer I/O error on device vdb1, logical block 47270479
Nov 22 21:48:06 mail kernel: lost page write due to I/O error on vdb1
Nov 22 21:48:06 mail kernel: Buffer I/O error on device vdb1, logical block 47271504
Nov 22 21:48:06 mail kernel: end_request: I/O error, dev vdb, sector 378116680
Nov 22 21:48:06 mail kernel: end_request: I/O error, dev vdb, sector 378157680
Nov 22 21:48:06 mail kernel: end_request: I/O error, dev vdb, sector 378432440
Nov 22 21:51:25 mail kernel: EXT3-fs (vdb1): error: ext3_journal_start_sb: Detected aborted journal
Nov 22 21:51:25 mail kernel: EXT3-fs (vdb1): error: remounting filesystem read-only
Nov 22 21:51:55 mail kernel: __ratelimit: 35 callbacks suppressed
Nov 22 21:51:55 mail kernel: __ratelimit: 35 callbacks suppressed
Nov 22 21:51:55 mail kernel: Buffer I/O error on device vdb1, logical block 64003824
Nov 22 21:51:55 mail kernel: Buffer I/O error on device vdb1, logical block 64003839
Nov 22 21:51:55 mail kernel: Buffer I/O error on device vdb1, logical block 256
Nov 22 21:51:55 mail kernel: Buffer I/O error on device vdb1, logical block 32
Nov 22 21:51:55 mail kernel: Buffer I/O error on device vdb1, logical block 64
Nov 22 21:51:55 mail kernel: end_request: I/O error, dev vdb, sector 6144
Nov 22 21:55:06 mail yum[19139]: Installed: lsof-4.82-4.el6.x86_64
Nov 22 21:59:47 mail kernel: __ratelimit: 1 callbacks suppressed
Nov 22 22:00:01 mail kernel: __ratelimit: 1 callbacks suppressed
Nov 22 22:00:01 mail kernel: Buffer I/O error on device vdb1, logical block 64003824
Nov 22 22:00:01 mail kernel: Buffer I/O error on device vdb1, logical block 512

There were plenty more than that, full excerpt here http://pastebin.com/vH8SDrCg
Note the point where there's an i/o error when "updating journal superblock" then later the volume is re-mounted as read-only because of an aborted journal.

So time to look at the host.

• cat /proc/mdstat returns UU for both RAID 1 arrays (boot and main PV).

• mdadm --detail shows state: clean and state: active respectively

• The typical LVM commands pvs, vgs and lvs all return the following error:

  /dev/VolGroup00/lv_mail: read failed after 0 of 4096 at 262160711680: Input/output error
  /dev/VolGroup00/lv_mail: read failed after 0 of 4096 at 262160769024: Input/output error
  /dev/VolGroup00/lv_mail: read failed after 0 of 4096 at 0: Input/output error
  /dev/VolGroup00/lv_mail: read failed after 0 of 4096 at 4096: Input/output error
  VG         #PV #LV #SN Attr   VSize   VFree  
  VolGroup00   1   4   1 wz--n- 930.75g 656.38g

• /var/log/messages on the host shows this:

Nov 22 21:47:53 localhost kernel: device-mapper: snapshots: Invalidating snapshot: Unable to allocate exception.
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 0
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 1
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 2
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 3
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 0
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 64004095
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 64004095
Nov 22 22:11:04 localhost kernel: Buffer I/O error on device dm-3, logical block 0

• A short self-test with smartctl revealed nothing on either physical disk. There were no worrying error counters in the SMART data either, most all at 0 apart from power on hours, spin up time, temperature. Even power on hours were relatively low, about 150 days or so. I currently have long self-tests in progress.

So based on all that, what's the likelihood of this being the start of a drive failure?
Worth running an fsck or badblocks in the host?
I don't want to cause a full kernel panic at this stage. I would have thought mdstat would have shown a failed array member by now, about 1hr after the event.

This machine is a dedicated server so I don't have physical access. I'll check the console through the DRAC shortly but I'm expecting to see a bunch of i/o errors on the console. I don't have virtual media access so can't load systemrescuecd to do repairs, so I'm a bit wary of rebooting at this stage.

I've had a test CentOS KVM host running for about a week now with 3 CentOS guests. There's 12GB physical RAM with about 7.5GB actually allocated to VMs. These VMs aren't even being used yet as the server's still in the testing stage but I've noticed that swap usage had been climbing over the last 24-48 hours. Now it looks like it's exhausted.

Here's the output of free

# free -m
             total       used       free     shared    buffers     cached
Mem:         11905      11749        155          0         81       4632
-/+ buffers/cache:       7035       4869
Swap:         2047       2047          0

So as you can see the physical memory is all used but it's used as cached memory which I believe is generally fine, as that will be released if an application needs it.

I ran the shell script found in this answer which listed 3 qemu-kvm processes.

The server was provisioned for me with only a 2GB logical volume allocated for swap and usually I like to match physical memory up to 8GB.
Is it worth expanding the swap logical volume or adding a separate swap volume?

Is this common with KVM? It's not something I've seen on other KVM hosts so is there a particular setting I need to adjust?

Any other comments/suggestions?

Running postfix on CentOS 6 as an edge relay for a while now, so all our outgoing mail is routed through one point with opendkim signing the mail. This works great. I was originally using dkim-filter/dkim-milter (I believe) but switched to opendkim a couple of years back.

But one thing I've been meaning to get around to for a long time is getting the DomainKey-Signature header added in addition to the DKIM-Signature. I realise that DomainKeys is the older spec and is technically replaced by DKIM but I think there's still a reasonable number of systems that verify both (e.g.: Gmail).

Would this involve multiple milters, one for DKIM and another for the older DomainKeys?
I'm not too happy about the idea of having to maintain 2 sets of configurations and signing tables etc, as I have to add/remove relay domains reasonably frequently.

Anyone know if it's possible to add both signatures within opendkim?

I've got a simple shell script that runs a few LFTP commands and processes the files.
When running straight from bash I get full output of those LFTP commands on screen.

When running from crontab with the following...
*/5 * * * * /bin/bash /home/user/ftp-getter.sh >> /var/log/ftp-getter.log 2>&1
I only get the output of lines where I am explicitly echoing some output and the output of the date command. The text returned by LFTP doesn't go into the log.

I've tried moving the 2>&1 to before the >> and still get the same result.

When running that crontab command straight from the command line I do get the LFTP output both on screen and in the log file. But not when running in crontab.

Is there something special about the output from LFTP that would cause this and that might apply to other commands when running from a shell script in crontab?

I'm planning on setting up a test iSCSI export on my NAS which will be used by a KVM virtualisation host to store all guest volumes and data. My NAS box is a self-build running CentOS.

The device that will be exported by iSCSI from the NAS will be an SSD.
But I'd like to try and find a way of replicating this volume to a slower/cheaper old disk on the NAS. I could use RAID 1 between the SSD and slower backup drive but then my understanding is that the total speed of the array will be reduced by the slower drive.

Is there any way of performing some sort of block-level full/incremental replication of the SSD to the slower HDD?

Some sort of asynchronous RAID 1 or replication would be great, so the changed blocks are queued up and written to the slower drive whenever the slower drive is available. The data on the SSD won't be changing that much in this case and there will always be some points within a 24 hour period where the slower drive can catch up.

I'd like to avoid having to configure backups within each guest. Having it all take place at a block level in the storage box would be an elegant solution and would allow me to just change the iSCSI settings to export the backup volume in case the SSD fails.

I've had a look at LVM snapshots but that feels like something that would need to be configured on the KVM virt host and I would need to somehow store the snapshots on a different device.

Anyone know of anything that can do this, that's within the budget of my small test environment (i.e.: open source)?
I'm guessing most solutions of this type are the preserve of high-cost SAN vendors.

EDIT: Ok just been looking at DRBD. Asynchronous mirroring seems ideal but is it possible between storage devices on the same machine?

EDIT 2: This is a home lab test, not a production roll-out. I basically want to experiment with remote VM storage using iSCSI/NFS. If there's an opportunity to add some sort of device replication technology into the equation here then I may as well give it a go. I'm not going to buy an additional SSD and RAID 1 them as it would be a pointless to my experiment... I have used RAID 1 extensively and my conclusion was that it works. Perfectly. I'm looking to find out if there's another technology that I don't know about that I can fiddle with and learn from.

I'm having some trouble with getting the Order directive right in a vhost configuration in Apache.

I have some IP addresses that I want to totally deny access to the entire vhost. These have been previously flagged as malicious.
I also want to deny all requests apart from GET and HEAD from all IP addresses, apart from our internal IP range.

I'm having trouble with the first Directory directive and figuring out how is best to arrange it with the Order directive.

This is what I've got so far and it doesn't appear to work so I'd like to get some advice on how is best to order this block...

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName      www.test.com
        ServerAlias     test.com

        DocumentRoot    /var/www/html/www.test.com

        <Directory      /var/www/html/www.test.com>
                Options +FollowSymLinks

                Order Deny,Allow

                # Deny suspect IPs previously flagged
                Deny from 111.111.111.111
                Deny from 222.222.222.222
                Deny from 333.333.333.333

                # But only internal IPs can POST
                <LimitExcept GET HEAD>
                    Deny from all
                    Allow from 10.10.0.0/22
                </LimitExcept>

                Allow from all

        </Directory>

    # CLI directory not web accessible
        <Directory      /var/www/html/www.test.com/cli>
                Order Deny,Allow
                Deny from all
        </Directory>


        # Restrict access to admin internal IPs only
        <Directory      /var/www/html/www.test.com/admin>
                Order Deny,Allow
                Deny from all
                Allow from 10.10.0.0/22
        </Directory>

</VirtualHost>

My head is so scrambled with this now that I'm unable to see it clearly. Anyone know how to do this?

Can I use multiple Directory directives for the same directory?
So I separate out my denying the malicious IPs from the denying all requests apart from GET and HEAD?

If I specify a Deny from xx.xx.xx.xx Directive in a <Directory /var/www/html/test-directory/></Directory> block in an Apache vhost configuration.
Then specify a different Deny from yy.yy.yy.yy in a .htaccess file in the same directory, which comes out on top?

It's my understanding that .htaccess should always take priority but in the case of Deny/Allow directives with different IP addresses, will the directives merge?
So both xx.xx.xx.xx and yy.yy.yy.yy are denied?

Or will one override the other?
I will do some tests later but I just wondered if anyone knew what should happen theoretically.

I have a software RAID 10 array which I recently noticed went into a degraded state. The OS is CentOS 5.8.

It has 4x 500GB drives in 3 different arrays:
/dev/md0 is RAID 1 and mounted to /boot (200MB ext3)
/dev/md1 is RAID 10 and is swap (4GB swap)
/dev/md2 is RAID 10 and is the main system and data device (895GB ext3)

One of the drives has failed but only /dev/md2 (main system and data array) is degraded.
Here's the full mdadm and /proc/mdstat output... http://pastebin.com/VL0uYdU9

The problem seems to be failed sectors on one of the drives...

Dec  9 04:25:37 hostname smartd[3199]: Device: /dev/sdb, 1 Currently unreadable (pending) sectors
Dec  9 04:25:37 hostname smartd[3199]: Device: /dev/sdb, 1 Offline uncorrectable sectors

Replacing the drive ASAP is the ideal option. However I won't have physical access to the server for the next few weeks. I have backups going to another device on the network anyway so we should be covered if another drive goes (the mirror of the already failed drive).

Is there a way I can resize the file system of /dev/md2 down to under 500GB, so I can then migrate the degraded RAID 10 to a 3 drive RAID 1 array?
And can this be attempted online (full, verified, backups being made of course)?
I don't have access to the server for loading a recovery CD.

I've got 4x 500GB drives in software RAID. /dev/md0 is RAID 1 and mounted to /boot /dev/md1 is RAID 10 and is swap /dev/md2 is RAID 10 and is the main system and data device

I looked at mdadm this evening and noticed on md2...

State : clean, degraded
Number   Major   Minor   RaidDevice State
0       8        3        0      active sync   /dev/sda3
1       0        0        1      removed
2       8       35        2      active sync   /dev/sdc3
3       8       51        3      active sync   /dev/sdd3

Checking md0 and md1 all drives are shown as active sync and the device state as clean.

Here's the full outputs from mdadm for each device and also the output from /proc/mdstat http://pastebin.com/VL0uYdU9

So it looks like /dev/sdb1 and /dev/sdb2 are functioning in /dev/md0 and /dev/md1 respectively. But /dev/sdb3 has dropped out (apparently it's been removed) from /dev/md2

With RAID 10 I believe the data is ok unless I lose the other drive on the opposite side of the mirror. I am of course backing up to an external device and have verified that these are stable.

I've done some log grepping and noticed this pair of log lines...

Dec  9 04:25:37 hostname smartd[3199]: Device: /dev/sdb, 1 Currently unreadable (pending) sectors
Dec  9 04:25:37 hostname smartd[3199]: Device: /dev/sdb, 1 Offline uncorrectable sectors

Repeating every 30 minutes. It appears this has been the case for a while and it looks like the drive has failed a SMART data check.

On Jan 7th an idiot user rebooted the server, thinking it would solve a mail relay problem.
Here's the the boot from /var/log/messages... http://pastebin.com/jGVsDD54

Why do /dev/sdb1 and /dev/sdb2 appear to be functioning ok and just /dev/sdb3 failed?
Just a particular failed sector that happens to be on sdb3?

Is it worth attempting to re-add this partition to the md2 array?
Or should I bin the drive and replace with a fresh drive?

I've got multiple named vhosts on an Apache web server (CentOS 5, Apache 2.2.3).
Each vhost has their own config file in /etc/httpd/vhosts.d and these vhost config files are included from the main httpd conf with... Include vhosts.d/*.conf

Here's an example of one of the vhost confs...

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName www.domain.biz
        ServerAlias domain.biz www.domain.biz
        DocumentRoot /var/www/www.domain.biz
        <Directory /var/www/www.domain.biz>
                Options +FollowSymLinks
                Order Allow,Deny
                Allow from all
        </Directory>
        CustomLog /var/log/httpd/www.domain.biz_access.log combined
        ErrorLog /var/log/httpd/www.domain.biz_error.log
</VirtualHost>

Now I when anyone tries to access the server directly by using the public IP address, they get the first vhost specified in the aggregated config (so in my case it's alphabetical order from the vhosts.d directory). Anyone accessing the server directly by IP address, I'd like them to just get an 403 or a 404.

I've discovered several ways to set a default/catch-all vhost and some conflicting opinions.

• I could create a new vhost conf in vhosts.d called 000aaadefault.conf or something but that feels a bit nasty.

• I could have a <VirtualHost> block in my main httpd.conf before the vhosts.d directory is included.

• I could just specify a DocumentRoot in my main httpd.conf

What about specifying a default vhost in httpd.conf with _default_ http://httpd.apache.org/docs/2.2/vhosts/examples.html#default
Would having a <VirtualHost _default_:*> block in my httpd.conf before I Include vhosts.d/*.conf be the best way for a catch-all?

I'm trying to figure out the best way to setup a central place to store and interrogate server logs. syslog, Apache, MySQL etc.

I've found a few different options but I'm not sure what would be best. I'm looking for something that is easy to install and keep updated on many virtual machines. I can add it to a VM template going forward but I'd also like it to be easy to install to keep the VM complexity down.

The options I've found so far are:

• syslogd
• syslog-ng
• rsyslog
• syslogd/syslog-ng/rsyslog to logstash/ElasticSearch
• logstash agent in each log "client" to send to Redis/logstash/ElasticSearch

And all sorts of permutations of the above.

What's the most resilient and light from the log "client" perspective?
I'd like to avoid the situation where log "clients" hang because they are unable to send their logs to the logging server. Also I would still like to keep local logging and the rotation/retention provided by logrotate in place.

Any ideas/suggestions or reasons for or against any of the above?
Or suggestions of a different structure entirely?

I've been using private-public key logins on my home server for several years but I've always left PasswordAuthentication yes so that if anything untoward happened I could still login.
Of course the likelihood of anything untoward happening is hugely increased by leaving password auth enabled.

So if I set PasswordAuthentication no I obviously won't be able to login to SSH using a username/password.
But can I still login to the machine locally using a system username/password?

I'm assuming yes, since logging in locally to the physical machine would have nothing to do with SSH. But before I go ahead and disable password auth I wanted to make 100% sure.

What's the best way to stop/start a particular service on a schedule using cron?

I tried running service servicename stop in a cron job but that didn't appear to work so switched to /etc/init.d/servicename

0 19 * * * /etc/init.d/servicename stop >/dev/null 2>&1
0 7 * * * /etc/init.d/servicename start >/dev/null 2>&1

That appears to work, not sure how consistently yet.
But the strange thing is that I get an e-mail from cron with the following error:

/bin/sh: line 1: 20178 Terminated  /etc/init.d/servicename start > /dev/null 2>&1

I only seem to get this error on the starting of the service. The stopping appears to be fine.

Also I thought that the >/dev/null 2>&1 should suppress the e-mailing of notifications. In this case though I'm glad it didn't.

Anyone know of a better way to stop/start services on a schedule, hopefully using cron?
Anyone got any idea what this error is about?

Thanks

I've got a private postfix relay VPS which is used by customers where they've installed their own e-mail servers in their offices and hosted over their ADSL connection. In the interests of reliable e-mail delivery, it's really not recommended to send mail directly from ISP IP addresses so I offer them the ability to use our private relay. However one of these customers has decided to send a newsletter to 5,000 recipients. I caught this straight away and dumped them all into the hold queue.

But now I'd like to try and flush this queue in batches, starting with the oldest messages.

Anyone got any ideas how to do this?
It looks like it would be a monster of a shell script to grep through the output of postqueue -p

I've just started experimenting with WebDAV under Apache 2.2 on CentOS 5. It works well although the Windows WebDAV client is clunky and nowhere near as seamless as it should be.

When a user deletes a file through WebDAV, is there a way to have it moved to a specified folder on the server rather than deleted?
So you could setup a sort of trash folder so that anything deleted could be recoverable by an admin with server access?

I admin the network for a small business which has an IPCop firewall box providing DHCP services to the network (and various other services). The DHCP server in IPCop appears to be dhcpd and IPCop provides a web-based front end to editing the configuration file.

I'm looking to use the vendor-encapsulated-options option to send particular values for DHCP options 66 and 67 to a particular vendor-class-identifier. The purpose being the auto-configuration of some VoIP phones which support DHCP options 66/67 and 43/60.

I've already managed to get options 66 tftp-server-name and 67 bootfile-name working to auto-configure the phones. But of course these options are global and sent to all DHCP clients. I'm looking to experiment with the vendor-class-indentifier and vendor-encapsulated-options DHCP options to send the auto-configure information only to the phones. I realise this is probably overkill for a small business network but this is all to broaden my knowledge.

So I started reading through some information that's out there and I just cannot work out how to encode options 66/67 within a vendor-encapsulated-options string.
Here's the relevant RFC... https://www.rfc-editor.org/rfc/rfc2132#section-8 section 8.4 And here's the man page for dhcpd http://www.daemon-systems.org/man/dhcp-options.5.html under "VENDOR ENCAPSULATED OPTIONS"

Those documents seem to suggest that the options are to be encoded in HEX format, however looking at the man page example of the vendor-encapsulated-options option...

The value of this option can be set in one of two ways.  
The first way is to simply specify the data directly,  
using a text string or a colon-separated list of hexadecimal values.  
For example:  
       option vendor-encapsulated-options
           2:4:AC:11:41:1:
           3:12:73:75:6e:64:68:63:70:2d:73:65:72:76:65:72:31:37:2d:31:
           4:12:2f:65:78:70:6f:72:74:2f:72:6f:6f:74:2f:69:38:36:70:63;

When I try and decode that lot from HEX to ASCII I get the following:
????A?????????sundhcp-server17-1????????/export/root/i86pc
So I'm sure I'm not understanding the format/encoding properly.

Here's my snippet from IPCop's dhcpd.conf

subnet 192.168.1.0 netmask 255.255.255.0 #GREEN
{
        range 192.168.1.30 192.168.1.200;
        option subnet-mask 255.255.255.0;
        option domain-name "domain.com";
        option routers 192.168.1.1;
        option domain-name-servers 192.168.1.1;
        option ntp-servers 192.168.1.1;
        option netbios-name-servers 192.168.1.3;
        default-lease-time 43200;
        max-lease-time 172800;
        option vendor-encapsulated-options "hello";
        option vendor-class-identifier "snom320";
        option vendor-class-identifier "snom821";
        option bootfile-name "voipsettings/firstboot.xml";
        option tftp-server-name "http://username:[email protected]";
} #GREEN

I have the vendor-class-identifiers set per the value submitted by the VoIP phones (Snom) in the DHCP request. The bootfile-name and tftp-server-name are the options (66/67) that I'm looking to encode in the vendor-encapsulated-options.
Snom have a guide on their wiki here...
http://wiki.snom.com/Networking/DHCP/Options#Auto_Provisioning_Options
(Apologies, my reputation is too low to post >2 links in a question)
That wiki seems to suggest that I need to encode the vendor-class-identifier as a "string of n octets"
Furthermore, the examples of the vendor-encapsulated-options given on that wiki article also return gibberish when converting from HEX to ASCII. So there's something critical that I'm not understanding here.

Can anyone give me a run-down of how to format/encode these DHCP options properly?

We currently have an 11 user SBS 2003 server which handles our e-mail, however I'm trying to setup a test migration to Zimbra. For this test migration I'd like to have some e-mail addresses moved over to Zimbra but the rest remaining on SBS 2003, all under the same domain.

In Microsoft terminology I've discovered that this is called a shared namespace/address space. I've looked through various articles and the best guide I've found so far is this http://support.microsoft.com/kb/321721

I was planning to set the new Zimbra server as the new primary, so port 25 of the Zimbra server is open to the internet through our firewall. This way round because it's easy to configure the routing in Zimbra so that specific e-mail addresses get passed on to the old SBS server. I've already got the routing set up within Zimbra and it works perfectly, so sending to [email protected] from a Zimbra account goes straight to the old SBS Exchange Server. I've not yet switched the port forwarding on our firewall though, so the SBS 2003 machine is still technically the primary.

The problem is I can't get the address space sharing to work in SBS 2003... so that if a user on the SBS server tries to send to an account that no longer exists in SBS, it gets passed to the new mail server.
I've pretty much followed that MS KB article by the word but I'm still getting bounce messages from Exchange when I try and send to a user who now lives on Zimbra.

So here's what I did, I edited our Default Recipient Policy and added @example.local as a new SMTP address, and removed @ourdomain.com
I added a new Recipient Policy called Split Namespace with a new SMTP address of @ourdomain.com and unticked the "This Exchange Organization is responsible for all mail delivery to this address" tick box, which I believe should mean that Exchange is now not-authoritative for that domain.
So I have 3 Recipient Policies listed in System Manager:
1) a mailbox manager policy with priority 1 which deletes messages older than 600 days from user mailboxes
2) Default Policy with priority lowest
3) Split Namespace policy with priority 2

Then I went into the properties of our Default SMTP Virtual Server and checked to make sure the "Forward all mail with unresolved recipients to host" text box was clear under the Messages tab. It was already clear.

Next step was to create an additional SMTP Connector, called it split namespace SMTP connector and set "Forward all mail through this connector to the following smart host" as the LAN IP address of our new Zimbra machine in square brackets... [192.168.1.5]. Added a Local Bridgehead of SERVER _ Default SMTP Virtual Server
Went to the "Address Space" tab and added a new SMTP address of ourdomain.com with Cost set to 1. I also ticked the "Allow messages to be relayed to these domains" box. Checked the delivery options and it's set to "Always Run"

Edited the our existing SmallBusiness SMTP connector to change the cost of the * asterisk Address Space down to 20 so in theory the new SMTP Connector should processed before this one.

Then restarted the MS Exchange Routing Service and the SMTP services

However when I try to send an email through our SBS server to our Zimbra server, I get the following bounce message: "The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address."

So it's not working or I've messed something up somewhere. Anyone know anything else I can check/try?
Is this even supported in SBS 2003? Wouldn't be suprised if there was some sort of crazy restriction stopping me from doing this.