Home / user-372802

Bino Oetomo's questions

Martin Hope
Bino Oetomo
Asked: 2019-02-22 18:39:09 +0800 CST
  • 1

I have 2 host, connected via switch. There is no vlan configured on the switch.

On Host A :

5: enp5s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 0c:c4:7a:58:ef:95 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.11/24 brd 192.168.10.255 scope global enp5s0f1
       valid_lft forever preferred_lft forever
    inet 192.168.10.10/24 scope global secondary enp5s0f1
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fe58:ef95/64 scope link 
       valid_lft forever preferred_lft forever
[root@ceph-node1 ~]# ip addr show enp5s0f1.1001
24: enp5s0f1.1001@enp5s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0c:c4:7a:58:ef:95 brd ff:ff:ff:ff:ff:ff
    inet 172.16.0.1/24 scope global enp5s0f1.1001
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fe58:ef95/64 scope link 
       valid_lft forever preferred_lft forever

On Host B :

5: enp5s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 0c:c4:7a:59:a9:5b brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.12/24 brd 192.168.10.255 scope global enp5s0f1
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fe59:a95b/64 scope link 
       valid_lft forever preferred_lft forever
[root@ceph-node2 ~]# ip addr show enp5s0f1.1001
8: enp5s0f1.1001@enp5s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 0c:c4:7a:59:a9:5b brd ff:ff:ff:ff:ff:ff
    inet 172.16.0.2/24 scope global enp5s0f1.1001
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fe59:a95b/64 scope link 
       valid_lft forever preferred_lft forever

Host A ping Host B on non-vlan interface :

[root@ceph-node1 ~]# ping 192.168.10.12
PING 192.168.10.12 (192.168.10.12) 56(84) bytes of data.
64 bytes from 192.168.10.12: icmp_seq=1 ttl=64 time=0.169 ms
64 bytes from 192.168.10.12: icmp_seq=2 ttl=64 time=0.241 m

s

But when A ping host B on VLAN interface

[root@ceph-node1 ~]# ping 172.16.0.2
PING 172.16.0.2 (172.16.0.2) 56(84) bytes of data.
From 172.16.0.1 icmp_seq=1 Destination Host Unreachable
From 172.16.0.1 icmp_seq=2 Destination Host Unreachable

OS is Centos7

Kindly please give me clue to fix this problem

Sincerely

centos
Martin Hope
Bino Oetomo
Asked: 2018-11-30 18:41:15 +0800 CST
  • 1

I have 2 nodes : - patroni1 : 192.168.1.38 - patroni2 : 192.168.1.39

and Virtual IP : 192.168.1.40

I have HA-Proxy installed on both.

Here is my pcs status when VIP is attached to patroni2 and haproxy is activated on patroni2

-----------
[root@patroni1 ~]# pcs status
Cluster name: haproxy_cluster
Stack: corosync
Current DC: patroni2 (version 1.1.18-11.el7_5.3-2b07d5c5a9) - partition with quorum
Last updated: Thu Nov 29 21:29:00 2018
Last change: Thu Nov 29 21:24:52 2018 by root via cibadmin on patroni1

2 nodes configured
4 resources configured

Online: [ patroni1 patroni2 ]

Full list of resources:

 xen-fencing-patroni2   (stonith:fence_xenapi): Started patroni1
 xen-fencing-patroni1   (stonith:fence_xenapi): Started patroni2
 Resource Group: HAproxyGroup
     haproxy    (ocf::heartbeat:haproxy):   Started patroni2
     VIP    (ocf::heartbeat:IPaddr2):   Started patroni2

Daemon Status:
  corosync: active/enabled
  pacemaker: active/enabled
  pcsd: active/enabled
[root@patroni1 ~]# pcs resource show VIP
 Resource: VIP (class=ocf provider=heartbeat type=IPaddr2)
  Attributes: cidr_netmask=24 ip=192.168.1.40
  Operations: monitor interval=1s (VIP-monitor-interval-1s)
              start interval=0s timeout=20s (VIP-start-interval-0s)
              stop interval=0s timeout=20s (VIP-stop-interval-0s)
[root@patroni1 ~]# pcs resource show haproxy
 Resource: haproxy (class=ocf provider=heartbeat type=haproxy)
  Attributes: binpath=/usr/sbin/haproxy conffile=/etc/haproxy/haproxy.cfg
  Operations: monitor interval=10s (haproxy-monitor-interval-10s)
              start interval=0s timeout=20s (haproxy-start-interval-0s)
              stop interval=0s timeout=20s (haproxy-stop-interval-0s)

-----------

My problem is : fencing is not triggered whenever I manualy kill haproxy on patroni2. fencing is only triggered when I manualy halt or reboot patroni2.

here is pcs status when I manualy kill haproxy

------------
[root@patroni1 ~]# pcs status
Cluster name: haproxy_cluster
Stack: corosync
Current DC: patroni2 (version 1.1.18-11.el7_5.3-2b07d5c5a9) - partition with quorum
Last updated: Thu Nov 29 21:37:37 2018
Last change: Thu Nov 29 21:24:52 2018 by root via cibadmin on patroni1

2 nodes configured
4 resources configured

Online: [ patroni1 patroni2 ]

Full list of resources:

 xen-fencing-patroni2   (stonith:fence_xenapi): Started patroni1
 xen-fencing-patroni1   (stonith:fence_xenapi): Started patroni2
 Resource Group: HAproxyGroup
     haproxy    (ocf::heartbeat:haproxy):   Started patroni2
     VIP    (ocf::heartbeat:IPaddr2):   Starting patroni2

Failed Actions:
* haproxy_monitor_10000 on patroni2 'not running' (7): call=38, status=complete, exitreason='',
    last-rc-change='Thu Nov 29 21:37:36 2018', queued=0ms, exec=0ms


Daemon Status:
  corosync: active/enabled
  pacemaker: active/enabled
  pcsd: active/enabled

------------

How to make fencing trigered when HA-Proxy not responding ?

Sincerely -bino-

haproxy
Martin Hope
Bino Oetomo
Asked: 2017-10-13 02:28:01 +0800 CST
  • 3

How to do conditional proxy_pass based on custom HTTP Header

Suppose I have 4 nginx Engine run in my private network, lets Call it : web1, web2, web3, web4.

I have a main nginx server, sit betwen internet and my private network, lets call it : Main_Web

At the same host as Main_web, I have python based authentication service run on port 5000, lets callit auth_backend.py.

as an authentication backend this auth_backend.py will return 401 if user is ilegal. But for legal user it will return a redirect (302) to internal location (/afterauth) AND also add custom HTTP Header,

i.e:X-HTTP-BACKEND = 'http://web4/thispage?var=2'

/etc/nginx/conf.d/default 

server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;
    add_header X-Backend $http_x_backend;
    location / {
    proxy_pass http://127.0.0.1:5000 ;
    proxy_set_header Host $host;
    }

    location /afterauth/ {
    set $my_next_proxy $upstream_http_x_backend;
    proxy_pass http://$my_next_proxy ;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

}

auth backend script 

#!/usr/bin/python
from flask import Flask, request, make_response, redirect
app = Flask(__name__)

@app.route('/',methods=['GET', 'POST'])
def hello_world():
    resp = make_response('Flask make_response', 200)
    #resp = redirect('afterauth/mykey=NEXTKEY')
    resp.headers['X-Backend']='192.168.100.1:5001/?key=MYKEY01'
    return resp

if __name__ == "__main__":
    app.run(debug=True)

Last Debug at https://pastebin.com/DwcgVeuN

at line 114 - 126 of 'last debug', I got :

    2017/10/13 03:22:53 [debug] 1737#1737: *9 http proxy header: "X-Backend: 192.168.100.1:5001/?key=MYKEY01"
    2017/10/13 03:22:53 [debug] 1737#1737: *9 http proxy header: "Server: Werkzeug/0.12.2 Python/2.7.9"
    2017/10/13 03:22:53 [debug] 1737#1737: *9 http proxy header: "Date: Thu, 12 Oct 2017 20:22:53 GMT"
    2017/10/13 03:22:53 [debug] 1737#1737: *9 http proxy header done
    2017/10/13 03:22:53 [debug] 1737#1737: *9 HTTP/1.1 302 FOUND
    Server: nginx/1.13.5
    Date: Thu, 12 Oct 2017 20:22:53 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 253
    Connection: keep-alive
    Location: http://192.168.100.48/afterauth/mykey=NEXTKEY
    X-Backend: 192.168.100.1:5001/?key=MYKEY01

How to put that '192.168.100.1:5001/?key=MYKEY01' as proxy_pass url ?

Sincerely

-bino-

nginx
Martin Hope
Bino Oetomo
Asked: 2017-09-16 18:39:13 +0800 CST
  • 2

My rabbitmq-env.conf looks like :

root@encoder001 /etc/rabbitmq# cat ./rabbitmq-env.conf 
CONFIG_FILE=/etc/rabbitmq/rabbitmq.config

when I restart , the log said :

=INFO REPORT==== 16-Sep-2017::09:22:21 ===
node           : rabbit@encoder001
home dir       : /var/lib/rabbitmq
config file(s) : /etc/rabbitmq/rabbitmq.config (not found)
cookie hash    : r6Fx293RnLUql2MqE0Wfqg==
log            : /var/log/rabbitmq/[email protected]
sasl log       : /var/log/rabbitmq/[email protected]
database dir   : /var/lib/rabbitmq/mnesia/rabbit@encoder001

In fact , the file is there .. and I'm prettysure it have proper access flags

root@encoder001 /etc/rabbitmq# ls -la |grep config
-rw-r--r--  1 root rabbitmq 22994 Sep 16 09:16 bunnies.config
-rw-r--r--  1 root rabbitmq 22994 Sep 16 08:58 rabbitmq.config

I also tried to change to 'CONFIG_FILE=/etc/rabbitmq/rabbitmq' , but the server can not start.

Kindly please give me any clue to fix it.

linux
Martin Hope
Bino Oetomo
Asked: 2016-10-10 15:00:29 +0800 CST
  • 2

I'm writing a django based json rest service for use with rlm_rest.

FreeRadius will serve both AAA and DHCP.

Despite my scripting skill, The DHCP Part is working correctly ... but have problem with the authentication part.

My test scenario:

  1. Using Radtest : Client got good response ... including the 'Framed-Pool'

  2. Mikrotik PPPoe Server, Xubuntu PPPoE Client with All Auth Protocol enabled : Always Rejected, because my script Got no 'User-Password' only got MSCHAP-Challenge and MSCHAP-Response.

  3. Mikrotik PPPoe Server, Xubuntu PPPoE Client with only PAP enabled : Success

    Here is what rlm_rest send to myscript :

    {"User-Name":{"type":"string","value":["dokter01"]},"NAS-IP-Address":{"type":"ipaddr","value":["10.255.255.2"]},"NAS-Port":{"type":"integer","value":[6]},"Service-Type":{"type":"integer","value":[2]},"Framed-Protocol":{"type":"integer","value":[1]},"Called-Station-Id":{"type":"string","value":["pppoe4"]},"Calling-Station-Id":{"type":"string","value":["08:00:27:B2:02:7E"]},"NAS-Identifier":{"type":"string","value":["mtik02"]},"NAS-Port-Type":{"type":"integer","value":[15]},"NAS-Port-Id":{"type":"string","value":["ether4"]},"MS-CHAP-Challenge":{"type":"octets","value":["0x85b513a5551084b06a801b240d5b77ea"]},"MS-CHAP2-Response":{"type":"octets","value":["0x0100f5707f4ee9b6bb6a99c5670b15ec789a0000000000000000af338d696f9bfc4e68549bb85940aaa95c8161a2e740f857"]}}

Could you please give me some clue ?

Sincerely

-bino-

freeradius
Martin Hope
Bino Oetomo
Asked: 2016-08-30 20:11:06 +0800 CST
  • 1

I read : Configuring rlm_rest module in FreeRadius

My FreeRadius version is 3.0.11 (git #d667a28)

My try is using included demo.pl, just change the port.

radtest --> radtest testing testing123 127.0.0.1 1 testing123

I tried some scenario for 'authorize' section.

#authorize {
#    if (User-Password) {
#        update control {
#            Auth-Type := rest
#        }
#    }
#}

#authorize {
#    if (User-Password) {
#        update control {
#            Cleartext-Password := User-Password
#            Auth-Type := rest
#        }
#    }
#}

authorize {
    update control {
        Auth-Type := rest
    }
}

But I always got : 'Failed to authenticate the user'

Debug :

Tue Aug 30 03:54:46 2016 : Debug: (0) rest: EXPAND /
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:    --> /
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Sending HTTP POST to "http://10.10.255.2:5000/"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Adding custom headers:
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   X-FreeRADIUS-Section: authenticate
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   X-FreeRADIUS-Server: default
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Request body content-type will be "application/json"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Encoding attribute "User-Name"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Type   : string
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Length : 7
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Value  : "testing"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Encoding attribute "User-Password"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Type   : string
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Length : 10
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Value  : "testing123"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Encoding attribute "NAS-IP-Address"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Type   : ipaddr
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Length : 9
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Value  : "127.0.1.1"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Encoding attribute "NAS-Port"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Type   : integer
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Length : 1
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Value  : 1
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Encoding attribute "Message-Authenticator"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Type   : octets
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Length : 34
Tue Aug 30 03:54:46 2016 : Debug: (0) rest:   Value  : "0x9d06a674fbd767958883955ee01ec1cb"
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: JSON Data: {"User-Name":{"type":"string","value":["testing"]},"User-Password":{"type":"string","value":["testing123"]},"NAS-IP-Address":{"type":"ipaddr","value":["127.0.1.1"]},"NAS-Port":{"type":"integer","value":[1]},"Message-Authenticator":{"type":"octets","value":["0x9d06a674fbd767958883955ee01ec1cb"]}}
Tue Aug 30 03:54:46 2016 : Debug: (0) rest: Returning 296 bytes of JSON data
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: Processing response header
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Status : 200 (OK)
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Type   : json (application/json)
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: Parsing attribute "control:Cleartext-Password"
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Type   : string
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Length : 10
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Value  : "testing123"
Tue Aug 30 03:54:47 2016 : Debug: testing123
Tue Aug 30 03:54:47 2016 : Debug: Parsed xlat tree:
Tue Aug 30 03:54:47 2016 : Debug: literal --> testing123
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: EXPAND testing123
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:    --> testing123
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: Cleartext-Password := "testing123"
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: FROM 1 TO 1 MAX 2
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: Examining Cleartext-Password
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: APPENDING Cleartext-Password FROM 0 TO 1
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: TO in 1 out 1
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: to[0] = Auth-Type
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: Parsing attribute "reply:Reply-Message"
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Type   : string
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Length : 18
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:   Value  : "Hello from demo.pl"
Tue Aug 30 03:54:47 2016 : Debug: Hello from demo.pl
Tue Aug 30 03:54:47 2016 : Debug: Parsed xlat tree:
Tue Aug 30 03:54:47 2016 : Debug: literal --> Hello from demo.pl
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: EXPAND Hello from demo.pl
Tue Aug 30 03:54:47 2016 : Debug: (0) rest:    --> Hello from demo.pl
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: Reply-Message := "Hello from demo.pl"
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: FROM 1 TO 0 MAX 1
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: Examining Reply-Message
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: APPENDING Reply-Message FROM 0 TO 0
Tue Aug 30 03:54:47 2016 : Debug: (0) rest: ::: TO in 0 out 0
Tue Aug 30 03:54:47 2016 : Debug: rlm_rest (rest): Released connection (0)
Tue Aug 30 03:54:47 2016 : Debug: (0)     modsingle[authenticate]: returned from rest (rlm_rest) for request 0
Tue Aug 30 03:54:47 2016 : Debug: (0)     [rest] = updated
Tue Aug 30 03:54:47 2016 : Debug: (0)   } # authenticate = updated
Tue Aug 30 03:54:47 2016 : Debug: (0) Failed to authenticate the user
Tue Aug 30 03:54:47 2016 : Debug: (0) Using Post-Auth-Type Reject

Could you please give me any clue ?

freeradius