Andrew's questions

I'm trying to install Bash on a FreeBSD 8.3 (pfSense 2.1.2) system as follows:

pkg_add -r http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/old-releases/amd64/8.3-RELEASE/packages/Latest/bash.tbz

which is failing with throwing warnings that

pkg_add: warning: package 'bash-4.2.20' requires 'libiconv-1.13.1_2', but 'libiconv-1.14_1' is installed
pkg_add: warning: package 'bash-4.2.20' requires 'gettext-0.18.1.1', but 'gettext-0.18.3.1' is installed

I mentioned that it's a pfSense box but there's no Bash package available via the web frontend; is there an easy way forward or should I be looking into use a ports system?

Edit: it turns out that this was a non-fatal warning, and bash successfully installed after all.

(Not tagged with pfsense as it's not a routing/firewall issue, but feel free to retag if this turns out to be pfsense-specific.)

Similar to this question:

What happens when a port is configured as ACCESS and is a part of VLAN 'X' and we get a packet of VLAN 'Y' on that port? Will the switch drop it or it will add a VLAN header 'X' and forward to the respective port/ports (Double VLAN tagging).

Suppose I have the a switch stack (HP/3COM A5120) with a port range configured as

• Untagged: 1
• Tagged: None
• PVID: 1

connected to NICs on vSwitch0 has a local network set as VLAN 0. Traffic from that switch ends up on VLAN 1 inside the physical network and is routed correctly.

What will happen if I change the vSwitch VLAN ID to 1? Will the frames be dropped? Will they be double tagged? Will the tagging be stripped and the frames end up on VLAN 1?

I want to add another VM Port Group (VM network) to that vSwitch & a corresponding VLAN on the HP switch ports, but I'm wondering if I should explicitly assign the VLAN on the existing vSwitch port group first and whether doing so will break things.

I have a vSphere 5.0 VM that was created with entirely thin-provisioned disks (I don't have any other options when creating them). A year later, one of the disks is now no longer thin provisioned but is Thick Provision Eager Zeroed.

I'm not licensed for storage vMotion (I do have normal vMotion), it hasn't ever been migrated between datastores via offline migration and as far as I'm aware nobody has manually inflated VMDKs.

I do know that at one point the filesystem on the disk in question became full; would this have triggered a conversion to thick provisioned?

For about the last 6 months, and for about a year before that (with a 6 month hiatus), one of my servers has had a consistently high load average:

13:37:34 up 192 days, 5:44, 2 users, load average: 2.00, 2.01, 2.00

Per another answer, I checked the output of ps:

$ ps -eo stat,pid,user,command | egrep "^STAT|^D|^R"
STAT   PID USER     COMMAND
D<    3043 root     /sbin/modprobe -Q pci:v00008086d0000293Esv000015D9sd0000D780bc04sc03i00
D<    3150 root     /sbin/modprobe -Qba pnp:dPNP0401

Checking the config & loaded modules:

$ modprobe -c | grep "pnp:dPNP0401"
alias pnp:dPNP0401* parport_pc

$ sudo modprobe -l | grep parport_pc
/lib/modules/2.6.24-29-server/kernel/drivers/parport/parport_pc.ko

So it appears to be a parallel port rule, but I can't think of what might be connected, or why. Physical access to the server is about 2 hours drive away.

Operating system is Ubuntu 8.04.4.

I can't see anything obvious anywhere in /etc/ but I may not know what I'm looking for.

Any clues as to what might be causing this, and where this modprobe rule may have come from?

Cleaning out our server room, we found two of these:

IBM eServer xSeries dummy heatsink assembly

I can't find any documentation on what they were used for (presumably during shipping or for a multi-socket Xeon board with only 1 CPU installed); can anyone tell me what they are?

I saw a strange comment bagging IT departments (i.e. sysadmins) on Slashdot the other day:

half the time they cant even do a simple thing like provide a jack with a set IP address for us

Reading the DHCP specs, nothing obvious jumps out as supporting this, but (some?) Cisco switches offer a feature called "DHCP Server Port-Based Address Allocation" which achieves this; so can it be done by:

• VLANs and a VLAN-aware DHCP server?
• some special combination of DHCP options (option 82, relay agent information)?
• only proprietary solutions like specific Cisco switches?

This is largely theoretical (I don't need to implement it), but I'm curious as to how "simple" it really is. Could I do it with my existing HP Procurve 2524 & dnsmasq, would I need a more sophisticated DHCP server, or would I need a new Cisco switch too?

We're in the process of incrementally upgrading our PCs to Windows 7, and several times now have been unable to open an RDP connection to the upgraded machine to remotely administer them. At some point we realised that Network Level Authentication was the culprit, and subsequently disabled it in the images we've deployed since.

This morning I had another machine that I could not connect to, having tried the following:

• Remote desktop via our RDS server (2008R2)
• Remote desktop into another Windows 7 machine on the same LAN/subnet & try opening a connection from there

AFAICT nmap showed port 3389 not open.

The machine in question is several hundred kilometres away, so physical access is to perform a local login is somewhat difficult (and I'd prefer not to hand out the local login details to get the user to fix it).

"Group Policy" is non-existent for two reasons: the machine is not domain connected,

Since we're using FOG for imaging & management, it would probably be possible to deploy a registry hack or batch/powershell script to disable it; does anyone have any suggestions on a possible solution?

In the spirit of the question LVM mirroring VS RAID1 I thought I'd push a bit further.

Suppose I have 4 identical hard drives (e.g. 1TB) that I want in a RAID setup for a backup/media server. LVM over the top seems to be current best practice for resizing, but what about the RAID layout? My options seem to be:

• 2x 1TB RAID1 sets with LVM concatenation
• 2x 1TB RAID1 sets with LVM striping
• 1x 2TB RAID10 (striped 2x 1TB) set with LVM on top
• 1x 2TB RAID6 (striped 2x1TB with 2x 1TB parity) with LVM on top

RAID-on-LVM sounds too crazy to be worth investigating, but I'd be interested if someone can make a good case for using it.

How does each of these perform in the scenario of

• The I/O load will be a combination of low but constant (e.g. video streaming) and high but bursty (e.g. a backup system)
• It is very likely that a drive will die unexpectedly
• I want to upgrade (increase the capacity of) the drives 1 or 2 at a time (no longer relevant)
• At some point in the future I might want to add another 2x HDDs in RAID1 to the LVM

What are you recommendations/experiences with any of these RAID configs?

Environment: Windows Server 2008 R2 with Samba 3.5 domain & OpenLDAP backend.

Background: on our previous Terminal Server (Windows Server 2003) we used logon/logoff scripts to log user logins and logouts respectively to plain text files on a network drive. Unfortunately we couldn't capture the remote IP address, only the workstation name.

Now that we're moving to Server 2008, we've discovered that the Event Log captures a huge amount of data - including the remote IP - but there doesn't seem to be an easy way to get the data that we want in the format that we want.

There are several resources that might be a step in the right direction:

• use logparser or a perl module
• parsing the XML into a database
• general wevtutil scripting

My question is: do I try and get some sort of real-time export of events in human readable form (and how), or do I perform periodic parsing via a scheduled task (and how)?

We're rolling out a new Remote Desktop Services server and have decided that it's probably time to install antivirus software on it; while we wait for our vendor/supplier to tell us about the licensing options, can anyone explain how various AV software works (in terms of processes/services) in a multi-user Remote Desktop server environment? Do they use:

• background service with no per-user component?
• per-user component only?
• something else?

This question suggested that ESET had a background service and Symantec would load one instance per user; what do various other AV programs do on remote desktop servers? Specifically I'm looking at Symantec Endpoint Protection, Trend Micro and Microsoft Forefront.

A quick run through of what I've done:

1. apt-get install libapache-mod-security
2. a2enmod mod-security
3. create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core rules set
4. create /etc/apache2/conf.d/mod_security as below
5. create /var/www/test.php as below

The conf file looks like

<IfModule security2_module>
Include /etc/apache2/mod_security_rules/*.conf
Include /etc/apache2/mod_security_rules/base_rules/*.conf
Include /etc/apache2/mod_security_rules/optional_rules/*.conf
</IfModule>

test.php looks like

<?php
$secret_file = $_GET['secret_file'];
include ( $secret_file);
?>

which several sites say mod_security should block.

My problem is that accessing test.php?secret_file='whatever' shows me the file.

Is this normal, and is mod_security working, or if not, what do I need to change?

Most people are familiar with using find to run the same command on a number of files, e.g.:

find -type f | xargs command

or

find -type f -exec command {} \;

My question is whether it's possible to run multiple commands from find:

find [path] [expression] -exec command1 {} -exec command2 {} \;

so that the output would look like

command1: file1
command2: file1
command1: file2
command2: file2
command1: file3
command2: file3
command1: file4
command2: file4

Obviously I can write a simple shell script wrapper for this, but is it possible to do it all from the command line (perhaps using awk, tee etc.)?

Isolating websites on a single machine from each other the underlying OS (i.e. without using a bare-metal hypervisor such as ESX) can be achieved using "container" technologies, such as:

• chroot
• OpenVZ
• KVM
• Xen
• FreeBSD jails
• Solaris zones
• LXC (Linux containers)
• (... more here ...)

What are the pros, cons and other important details of each?

Background:

We run the open-source edition of Zimbra mail (5, not 6 yet) and while it's not something that we want to encourage (prevention is better than a cure), we currently have no way of backing up (or restoring) mail in the system. The Network (paid) Edition has automated backups; various user-contributed solutions exist for the open source edition.

My question in two parts:

1. Does anyone have experience performing backups on Zimbra OSE? I'm particularly interested in snapshot backups over ssh/rsync (we use dirvish for filesystem backups), and we don't use LVM (/opt/zimbra/store/ is it's own partition, the server is Ubuntu on ESXi).
2. If backup/restore on a live system is "too hard", I'm happy to settle for backing up only specific shared accounts that are never logged into directly (and hence I have the password for) over IMAP. I'd be interested in recommendations for a command-line email client that
   1. can be automated to retrieve messages & folders (e.g. given command line parameters / config file, will log in to account, fetch new email, quit)
   2. stores email in the maildir format, which is nicer to backup than mbox

I'm leaning towards the second with something like isync, since the mail system has over 100GB of messages at present.

I've got about a dozen servers that I log into via an authorised ssh key, and up until today it was working fine. Today, one of those servers refuses to accept my key - it accepts a root key and my passphrase, just not my key. Nothing has changed in the ssh configs, and the key is still in my authorized_keys. Any idea why it's stopped working?

I've got an ESXi 3.5 server on "unsupported" hardware - SuperMicro motherboard, Adaptec 9410 3405 RAID controller (oops, the 9410 is the onboard controller that's not being used for RAID) - and I'm starting to wonder what the point of RAID is, because we don't have any monitoring on it.

Is it possible to have monitoring of RAID on ESXi apart from 100% compatible systems / using a paid product like vSphere, or should we switch to an "endorsed" hardware system or perhaps a SAN?

Update: I've found this Adaptec knowledge base article which says that ESXi has no monitoring support:

There is a AACRAID driver embedded in ESXi Server 3.5 (see VMware Certified Compatibility Guides) but there is no Management Software (ASM or ARCCONF) available.

The card does however have diagnostic LEDs with headers, so I suppose some sort of hardware hack might be a last resort.

I'm using FOG as a TFTP / PXE server and would like to be able to boot a FreeBSD LiveCD (specifically pfSense, but it could be any LiveCD, really); I've found HOWTOs for booting a "netboot" BSD but they all seem to use a BSD server. So:

• Is it possible to PXE boot BSD from a Linux server?
• Is it possible to PXE boot a BSD LiveCD?
• Is it possible to PXE boot a Linux LiveCD?

My main motivation is to be able to boot small LiveCD images (e.g. < 100MB) that I may only use once and don't want to burn a physical CD for.

I'm working on a project to replace my organisation's aging Slackware gateway/router/firewall machine, which will have several hundred users behind it. Previously we used rc.firewall but we are now looking for something more modern and easily configurable. The current requirements are (hopefully this is all of them, but I may have missed something):

• Act as a gateway router & firewall
• Port forwarding to a Terminal Server
• IP/traffic accounting, i.e. ability to view breakdown of external traffic by originating address (preferably accessible via SNMP or rrdtool to integrate with cacti)
• Possibility of acting as a PPTP server & routing these connections
• Is not an out-of-the-box Cisco product (don't have the finances or support to maintain it)
• edit: transparent proxy cache

I'd prefer to use Ubuntu or some other Debian-based distro but something that integrates everything we're looking for is certainly an option if it offers all the desired features and is easy to configure.

Is there a simple set of packages that will provide me with the Firewall & Accounting features, or am I best served with a custom-built distro / other solution?

I've got an Ubuntu 8.04 server using mdadm to create several RAID1 arrays. I created /etc/cron.hourly/mdadm as follows:

#! /bin/sh

set -e

mdadm --monitor /dev/md0 /dev/md3 /dev/md4 --oneshot

(Yes, the array numbers are not sequential, and I'm not using --scan beacuse I have a degraded array that may or may not have been used as swap and I can't delete, but I think that's a separate issue. If it's the underlying cause of this, I need to fix it.)

mdadm sends me email (configured in the /etc/mdadm/mdadm.conf) on DegradedArray etc. events. This is the desired behaviour. What is not desired, and I can't work out, is why cron is sending me (relatively pointless) emails, via an alias in /etc/aliases:

From: root@<hostname> (Cron Daemon)
To: root@<hostname>
Subject: Cron <root@<hostname>>    cd / && run-parts --report /etc/cron.hourly
Content-Type: text/plain; charset=ANSI_X3.4-1968
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <id@hostname>
Date: Fri,  7 May 2010 13:17:01 +0930 (CST)

/etc/cron.hourly/mdadm:
mdadm: Monitor using email address "<root_alias@domain>" from config file

I've got a dozen other servers behaving correctly (mdadm sends email, cron doesnt') with identical /etc/crontab files:

# /etc/crontab: system-wide crontab
# <snip comments>

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
<snip anacron jobs>

Should I simply remove the --report, or is there something else in my cron config somewhere causing this?