Julien's questions

I just configured some Content negotiation for my root url based on this Apache Document and it seems to work great.

As my site also set a language cookie, I tested the following in my virtualhost (also mentionned in the doc)

  SetEnvIf Cookie "lang=([^;]+)" prefer-language=$1
  Header append Vary cookie

But then, As I only have one URL with negotiated content, I don't want to send a Vary: Cookie for all requests. It would prevent all caching to be efficient as a sessionid is also stored in a cookie (correct me if i'm wrong).

So my question is how can I only append the Vary header for this specific url.

I already tried to specified the directives in a Location Directory or Files section, but none seemed to work.

<Location "/">
  Header append Vary cookie
</Location>  

The vary header is sent for / but also for /eng/index.html and all requests

<Directory /my/htdocs>
  Header append Vary cookie
</Directory>

The vary header is not sent neither for / nor for any requests

<Files "/index.html">
  Header append Vary cookie
</Files>

The vary header is not sent neither for / nor for any requests

I noticed something weird regarding ssh key based login and selinux in permissive mode.

Let me introduce you the setup: The server is an updated Centos 6.4 x86_64.

We create user without a password (the user will then be locked):

# useradd testuser
# passwd -S testuser
testuser LK 2013-05-03 0 99999 7 -1 (Password locked.)

Then we setup the ssh keys:

# install -d -m 700 -o testuser -g testuser /home/testuser/.ssh/
# install -m 600 -o testuser -g testuser /root/.ssh/id_rsa.pub /home/testuser/.ssh/authorized_keys

Let's check the selinux status

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Then let's try to log in as testuser:

# ssh testuser@localhost
Last login: Fri May  3 13:26:32 2013 from ::1
$

It works ! Now we set Selinux to the permissive mode

# setenforce 0
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

And we try to log again:

# ssh testuser@localhost
testuser@localhost's password:

SSH doesn't accept the key and asks for a password !

Question: Is that a bug ?

EDIT: After restorecon -Rv /home, I have

$ ls -laZ ~/.ssh/
drwx------. user wheel unconfined_u:object_r:ssh_home_t:s0 ./
drwxr-x---. user wheel unconfined_u:object_r:user_home_dir_t:s0 ../
-rw-------. user wheel system_u:object_r:ssh_home_t:s0  authorized_keys

$ getsebool -a | grep 'ssh'
allow_ssh_keysign --> off
fenced_can_ssh --> off
ssh_chroot_full_access --> off
ssh_chroot_manage_apache_content --> off
ssh_chroot_rw_homedirs --> off
ssh_sysadm_login --> off

EDIT: Here is the content of /var/log/secure

Jun 13 16:30:51 dhcp-240 sshd[13681]: User testuser not allowed because account is locked
Jun 13 16:30:51 dhcp-240 sshd[13682]: input_userauth_request: invalid user testuser

I'm looking for info to automate the patching/updating process for several hundred Suse machines. Apart from Zenworks and SMT is there other patch management/automation tools you know with good support on Novell SLES OS?

I found several tools but mainly for Windows...
Do you have any experience with the following tools and Novell SLES servers?
- Patchlink from lumension
- Tivoli Provision Manager from IBM
- Bigfix
- HP Server Automation
- BMC Bladelogic
- CA Spectrum Automation Manager

The datacenter to keep updated is composed around 600 servers both real and virtual running SLES version 10 mainly (but SLES 9 also present).

I think SMT could do most part of the job but it seems to come short regarding reporting and inventory. Do you know of complementary tools for these aspects ?

Thanks for any advice.