I may not be asking the question correctly, I am looking for how I can create a GP object
Running some scans I can see:
FAILED 19.7.7.3 Ensure 'Do not use diagnostic data for tailored experiences' is set to 'Enabled'
'Do not use diagnostic data for tailored experiences' setting does not exist
How can I am it?
Server 2016 Domain Controller Default Domain Policy
Had a domain controller die, physical machine, was able to p2v the hard drive and I have it attached to the new virtual server.
Server 2016 Standard.
No there was no replica, the only access I have to the old DC is on the p2v'd harddrive
This is not a mission critical DC but there was a lot of GPO's that were in use.
Where can I find the Group Policy objects for the domain? I have done a lot of googling and looks like they are in the sysvol/domain/policies folder.
Can I just copy and paste?
Is there a correct way to restore group policy objects from a dead hard drive?
Please note these are not local policies there are domain group polices.
I have been struggling with this all day. Going on day 2.
I created a support.oracle.com account and can login, however I am redirected a page asking for a Support Identifier. I do not have one, reading it says it would have sent with the registration email, it was not.
See attached email
I called customer support, they asked me what product I was trying to patch, "Java SE"
Specifically "Oracle Java SE 1.7.0_301 / 1.8.0_291 / 1.11.0_11 / 1.16.0_1 Multiple Vulnerabilities (Apr 2021 CPU)" from the nessus scans.
They asked me who paid for the license, "There is there a license?" I called sales, they said I would need to get in contact with my org administrator to get the CSI, that is me, I just setup the account yesterday.
Am I doing something wrong? How to get patches for Java SE?
I have nessus professional 8.14.0 installed on a server, which is attached to the network, 3 esxi 6.7 hosts and 1 vcenter servers.
Nessus Server (192.168.1.21)
vCenter Server (192.168.1.9)
ESXi Host 1 (192.168.1.10)
ESXi Host 2 (192.168.1.11)
ESXi Host 3 (192.168.1.12)
If I run a scan with just host 1 (192.168.1.10) in the targets.
Warning
Possible Reasons :
If I run a scan with just host 1 (192.168.1.10) and vCenter (192.168.1.9) in the targets.
On host vCenter server I get about 68 warnings.
On host 1 I get:
Possible Reasons :
The complicanse file I am using is "cis vmware esxi 6.7 v1.1.0 level 2" or "cis vmware esxi 6.7 v1.1.0 level 1"
Settings:
Target: 192.168.1.9, 192.168.1.10 or just 192.168.1.10
VMWare vCenter SOAP API:
I have also tried the bare metal scans, which ask for ssh creds, however the Credentials scans = No, which will not do.
Any suggestions on what I am missing?
I have double checked and tripple check the password,
From the nessus host I can telnet to vCenter and Host 1 on port 443.
How do I test the SOAP API access? I have googled to the end of google and cannot find out how this is done.
I have a 2 node Windows server 2019 Cluster running on Vmware ESXi 6.5
I added 3 25GB disks to the server after it had been created.
I can see the 3 disks in the disk management tool
If I run Get-PhysicalDisk it will only list one disk
If I run wmic diskdrive list brief it will list all for.
Why are these disks not showing up under Get-PhysicalDisk
I have tried many ways to get the disks, initialize disk, reset disk, make MBR make GPT, convert to dynamic, create and mount to dive letter. Nothing seems to work.
Any more info I can provide please let me know
I am googling around and finding myself going down a rabbit hole and getting nowhere.
My over all goal is to limit the number of connections that can be made at the same time to Apache on a Centos 7 server.
With the default setting:
[root@app1 ~]# cat /etc/httpd/conf.modules.d/00-mpm.conf
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
#LoadModule mpm_worker_module modules/mod_mpm_worker.so
#LoadModule mpm_event_module modules/mod_mpm_event.so
[root@app1 ~]# httpd -t -D DUMP_MODULES | grep mpm
mpm_prefork_module (shared)
[root@app1 ~]# httpd -V | grep MPM
Server MPM: prefork
If I run:
[root@app1 ~]# ab -n 200 -c 100 http://afterratest.com/
I can see about 135 connections coming in.
If i set the following setting in the httpd.conf file
KeepAlive Off
<IfModule prefork.c>
StartServers 5
MinSpareServers 5
MaxSpareServers 100
MaxClients 100
MaxRequestsPerChild 3000
</IfModule>
Restart Apache and run the same command I can see 100 connections.
What I am hoping to get form this question is:
I have read the docs online and they do not make sense.
What do the following setting do for each?
StartServers 5
MinSpareServers 5
MaxSpareServers 100
MaxClients 100
MaxRequestsPerChild 3000
Explain it like I am 5
terraform -v
Terraform v0.12.23
+ provider.aws v2.53.0
I am trying to create 4 instances on put them on 2 different subnets
resource "aws_subnet" "private-subnet-1" {
vpc_id = aws_vpc.vpc.id
cidr_block = "10.150.2.0/24"
availability_zone = "us-west-2a"
tags = {
Name = "private-subnet-1"
}
}
resource "aws_subnet" "private-subnet-2" {
vpc_id = aws_vpc.vpc.id
cidr_block = "10.150.4.0/24"
availability_zone = "us-west-2b"
tags = {
Name = "private-subnet-2"
}
}
variable "subnet_ids" {
type = list(string)
default = ["aws_subnet.private-subnet-1.id","aws_subnet.private-subnet-2.id"]
}
resource "aws_instance" "web" {
count = 4
ami = "ami-0dc33a373d61e6ce0"
instance_type = "t2.micro"
key_name = "AF_KEY_PAIR"
subnet_id = element(var.subnet_ids, count.index)
vpc_security_group_ids = ["${aws_security_group.web-SG.id}"]
}
When I try to apply I get the follow error
Error: Error launching source instance: InvalidSubnetID.NotFound: The subnet ID 'aws_subnet.private-subnet-1.id' does not exist
status code: 400, request id: 17b46634-5319-4f78-9898-09142e9cb449
on test.tf line 175, in resource "aws_instance" "web":
175: resource "aws_instance" "web" {
Error: Error launching source instance: InvalidSubnetID.NotFound: The subnet ID 'aws_subnet.private-subnet-2.id' does not exist
status code: 400, request id: d092e6a6-d430-4a28-bd75-5af373c76ac7
on test.tf line 175, in resource "aws_instance" "web":
175: resource "aws_instance" "web" {
Error: Error launching source instance: InvalidSubnetID.NotFound: The subnet ID 'aws_subnet.private-subnet-1.id' does not exist
status code: 400, request id: ec672172-3bf7-4cbb-bce0-ae752c59393f
on test.tf line 175, in resource "aws_instance" "web":
175: resource "aws_instance" "web" {
Error: Error launching source instance: InvalidSubnetID.NotFound: The subnet ID 'aws_subnet.private-subnet-2.id' does not exist
status code: 400, request id: 4136f03c-1a5b-44ab-b0bf-a209134c08c9
on test.tf line 175, in resource "aws_instance" "web":
175: resource "aws_instance" "web" {
I have tried to change up the
subnet_id = element(var.subnet_ids, count.index)
and
variable "subnet_ids" {
type = list(string)
default = [aws_subnet.AF-private-subnet-1.id,aws_subnet.AF-private-subnet-2.id]
}
I still get the same error
When I create the subnet_id manually it will work
subnet_id = aws_subnet.public-subnet-1.id
A user removed the authorized_keys from ec2-user ssh directory and now cannot log in with the ppk file though putty.
I can still access the server as a different user, however that user does not have sudo access.
The only user that has sudo access is ec2-user.
I have tried to upload the public and private keys from the ppk file and use
ssh -v -i ec2-userprivate [email protected]
Anything else I can try?
[oracle@ip-172-31-62-50 ~]$ ssh -v -i ec2-userprivate [email protected]
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file ec2-userprivate type -1
debug1: key_load_public: No such file or directory
debug1: identity file ec2-userprivate-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 127.0.0.1:22 as 'ec2-user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:truUDHodSW7Zjq/jaruRD7MlYmN0l2vDmxhspUDfwdE
debug1: Host '127.0.0.1' is known and matches the ECDSA host key.
debug1: Found key in /home/oracle/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:1001)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:1001)
debug1: Next authentication method: publickey
debug1: Trying private key: ec2-userprivate
Enter passphrase for key 'ec2-userprivate':
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
I have 3 servers
Following this guide for the chefmaster and chefworkstation
https://www.itzgeek.com/how-tos/linux/centos-how-tos/setup-chef-12-centos-7-rhel-7.html
chefmaster 192.168.1.200 Centos7
chefworkstation 192.168.1.200 Centos7
chefnode 192.168.1.210 Window Server 2016
I have setup a windows user on the server with administrators access.
user: chefUSER
I have the chefmaster setup and configured running chef 13.1.13
I have the chefworkstation setup and configured running chefdk-0.19.6-1.el7.x86_64
Googling around seem to only get me how to install the chef server on windows. I am trying to install the client to make it a node.
I have tried:
knife bootstrap -o winrm 192.168.1.210 -u chefUSER -P PASSWORD
[root@chefworkstation .chef]# chef -v
ChefDK version: 4.6.35
Chef Infra Client version: 15.5.17
Chef InSpec version: 4.18.39
Test Kitchen version: 2.3.4
Foodcritic version: 16.2.0
Cookstyle version: 5.13.7
[root@chefworkstation .chef]# knife bootstrap -o winrm 192.168.1.210 -u chefUSER -P PASSWORD -N winnode1 -VV
INFO: Using configuration from /root/chef-repo/.chef/knife.rb
DEBUG: Checking if we need to accept Chef license to bootstrap node
DEBUG: Reading products and relationships...
DEBUG: Successfully read products and relationships
DEBUG: License acceptance required for chef version: 15
DEBUG: Searching for the following licenses: ["infra-client", "inspec"]
DEBUG: Found license chef_infra_client at /etc/chef/accepted_licenses/chef_infra_client
DEBUG: Found license inspec at /etc/chef/accepted_licenses/inspec
DEBUG: Missing licenses remaining: []
DEBUG: All licenses present
Connecting to 192.168.1.210
DEBUG: winrm-fs requested, loading WinRM::FS gem (~> 1.0)
DEBUG: WinRM::FS previously loaded
DEBUG: [WinRM] @192.168.1.210<{:transport=>:negotiate, :disable_sspi=>false, :basic_auth_only=>false, :endpoint=>"http://192.168.1.210:5985/wsman", :user=>"administrator", :password=>"<hidden>", :no_ssl_peer_verification=>false, :realm=>nil, :service=>nil, :ca_trust_file=>nil, :ssl_peer_fingerprint=>nil}> (Write-Host '[WinRM] Established
')
DEBUG: [WinRM] opening remote shell on http://192.168.1.210:5985/wsman
DEBUG: [WinRM] Endpoint doesn't support config request for MaxEnvelopsizekb
DEBUG: [WinRM] opening remote shell on http://192.168.1.210:5985/wsman
DEBUG: [WinRM] Endpoint doesn't support config request for MaxEnvelopsizekb
From the source
./lib/ruby/gems/2.6.0/gems/winrm-2.3.3/lib/winrm/shells/power_shell.rb
# calculate the maimum fragment size so that they will be as large as possible yet
# no greater than the max_envelope_size_kb on the end point. To calculate this
# threshold, we:
# - determine the maximum number of bytes accepted on the endpoint
# - subtract the non-fragment characters in the SOAP envelope
# - determine the number of bytes that could be base64 encded to the above length
# - subtract the fragment header bytes (ids, length, etc)
def max_envelope_size_kb
@max_envelope_size_kb ||= begin
config_msg = WinRM::WSMV::Configuration.new(connection_opts)
msg = config_msg.build
resp_doc = transport.send_request(msg)
REXML::XPath.first(resp_doc, "//*[local-name() = 'MaxEnvelopeSizekb']").text.to_i
ensure
logger.debug("[WinRM] Endpoint doesn't support config request for MaxEnvelopsizekb")
end
# rubocop:enable Layout/RescueEnsureAlignment
end
From here I have changed a couple setting in my winrm which does not seem to make a difference.
PS C:\Windows\system32> winrm get winrm/config
Config
MaxEnvelopeSizekb = 500
MaxTimeoutms = 60000
MaxBatchItems = 32000
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = true
Auth
Basic = true
Digest = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = false
DefaultPorts
HTTP = 5985
HTTPS = 5986
TrustedHosts
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = true
Auth
Basic = true
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = true
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 2147483647
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 2147483647
MaxMemoryPerShellMB = 2147483647
MaxShellsPerUser = 2147483647
When I log into my aws console I see the vpc id as "vpc-6856c210" however on my server through the aws cli I see "vpc-82fe07e9"
When I try to run a terraform script I get an error if i use 'vpc-6856c210' saying the VPC does not exist.
If I run the script using the 'vpc-82fe07e9' id it will run and I can see the instances in the cli however not the console.
Shouldn't they match? I am new to AWS and on the free tier
Trying to connect using CentOS7
I deployed a couple of EC2 instances using terraform and now and trying to log in.
aws2 ec2-instance-connect send-ssh-public-key --instance-id i-0788274a4861154d44 --availability-zone us-east-2 --instance-os-user ec2-user --ssh-public-key file:/aws_ssh/my_rsa_key.pub
Parameter validation failed:
Invalid length for parameter SSHPublicKey, value: 42, valid range: 256-inf
I tried this command as well
ssh-keygen -t rsa -f my_rsa_key -b 1024
Still gives the same error.
I am new to this so as much help as you can give.