mgutt's questions

I want to execute a powershell command on multiple windows machines.

At first the working command:

# ssh foo@windows_hostname powershell -command hostname
foo@windows_hostname's password:
windows_hostname

But as I need to execute the command in a loop I need to set the -n option or redirect stdin to /dev/null, but with this option I don't get any stdout back:

# ssh -n foo@windows_hostname powershell -command hostname
foo@windows_hostname's password:
# 

The same problem is present if I use the cmd.exe:

# ssh foo@windows_hostname cmd.exe /c hostname
foo@windows_hostname's password:
# 

But I don't have this problem with a linux machine and ssh only:

# ssh -n foo@linux_hostname hostname
foo@linux_hostname's password:
linux_hostname

I tried multiple variantes like -nT, -nf, -nt, but the result stays blank.

This is the verbose output of ssh when it works:

debug1: Next authentication method: password
foo@windows_hostname's password:
debug1: Authentication succeeded (password).
Authenticated to windows_hostname ([10.0.0.1]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = POSIX
debug1: Sending env LC_CTYPE = de_DE.UTF-8
debug1: Sending command: powershell -command hostname
windows_hostname
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 4304, received 2008 bytes, in 0.9 seconds
Bytes per second: sent 4565.1, received 2129.8
debug1: Exit status 0

And when it fails:

debug1: Next authentication method: password
foo@windows_hostname's password:
debug1: Authentication succeeded (password).
Authenticated to windows_hostname ([10.0.0.1]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = POSIX
debug1: Sending env LC_CTYPE = de_DE.UTF-8
debug1: Sending command: powershell -command hostname
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 4320, received 1976 bytes, in 0.1 seconds
Bytes per second: sent 37875.5, received 17324.5
debug1: Exit status 0

EDIT: Found something interesting. Although the verbose output says it sent the command, it did not:

 # ssh foo@windows_hostname 'powershell -command date | Out-File C:\test.txt'
foo@windows_hostname's password:
plato:~ # ssh foo@windows_hostname 'powershell -command cat C:\test.txt'
foo@windows_hostname's password:

Samstag, 13. August 2022 16:15:53
    
plato:~ # ssh -n foo@windows_hostname 'powershell -command date | Out-File C:\test.txt'
foo@windows_hostname's password:
plato:~ # ssh foo@windows_hostname 'powershell -command cat C:\test.txt'
foo@windows_hostname's password:

Samstag, 13. August 2022 16:15:53

It's nice to have a zeroconf setup with mDNS, but some of my machines (like docker containers) do not contain the avahi-daemon and by that they are not able to resolve .local hostnames. Now I could create manually a zone file for all my .local hostnames, but by that I would break the zeroconf concept.

Is there a solution available that automatically imports all mDNS entries into a bind9 .local zone file?

I tried the following command, but only an empty file is created on the target and the command stays open

qemu-img convert -f raw -O vmdk /dev/sda1 - | ssh foo@bar "cat > /home/foo/foobar.vmdk"

Note: sshfs is not available.

If I send a pdf as raw to a printer through lp, the job is sometimes (if the printer was in standby) not printed and its status is "deleted" in the CUPs WebGUI. If I check the content of the correspondending /var/spool/cups/c123456 job file, it contains the string "job-canceled-by-user".

Now I found the option job-cancel-after=0, which I think could be the reason for this problem:

lpoptions -d p01
copies=1 device-uri=socket://prt01.example.com:9100 finishings=3 job-cancel-after=0 job-hold-until=no-hold job-priority=50 job-sheets=none,none marker-change-time=1634718006 marker-colors=#000000,none,#00FFFF,#FF00FF,#FFFF00 marker-levels=80,0,20,20,90 marker-names='Toner\ Schwarz,Resttoner,Toner\ Cyan,Toner\ Magenta,Toner\ Gelb' marker-types=toner,waste-toner,toner,toner,toner number-up=1 printer-commands=AutoConfigure,Clean,PrintSelfTestPage printer-info='PRINTERMODEL' printer-is-accepting-jobs=true printer-is-shared=true printer-location=Office printer-make-and-model='PRINTERMODEL' printer-state=3 printer-state-change-time=1634718006 printer-state-reasons=none printer-type=8564988 printer-uri-supported=ipp://localhost/printers/p01

I tried to overwrite it as follows, but it returns nothing and the value is not changed:

lpadmin -d p01 -o job-cancel-after=30

EDIT1:

Doesn't work, too:

lpadmin -d p01 -o job-cancel-after-default=30

EDIT2:

I found the "job attribute" in the IPP documentation and I'm able to read the value as follows:

ipptool -t -v ipp://example.local:631/printers/p01 get-printer-attributes.test | grep cancel
        job-cancel-after-default (integer) = 0
        job-cancel-after-supported (rangeOfInteger) = 0-2147483647
        which-jobs-supported (1setOf keyword) = completed,not-completed,aborted,all,canceled,pending,pending-held,processing,processing-stopped

EDIT3:

Is it maybe possible to add this attribute to a print job through lp as follows?

lp -d p01 -o job-cancel-after=30 -o raw "$pdf"

I tried it, but finally I don't know, how to verify that it works.

Apache WebDAV allows to setup a WebDAV server without the PHP overhead which is usualy produced through Nextcloud/Owncloud. But is it also able to:

• share a file / folder with other authed users?
• share a file / folder by link for a guest?

Does Apache WebDAV include a WebGUI which has such a feature or how does it work?

My setup is a Windows 10 PC with 10G card (LR-LINK 6880BT) and a Synology DS1618+ NAS with 10G card (Synology E10G18-T1). Both 10G ports are connected directly to avoid buying a 10G switch.

A) How the 10G connection works:

• NAS eth4 (10G) is set to 192.168.178.11
• PC 10G is set to 192.168.178.13
• NAS 10G and PC 10G are connected directly
• >400 MB/s (limited by NAS performance) copying a file from .11 through SMB

B) How it does not work:

1. NAS eth4 (10G) is set to 192.168.178.11
2. PC 10G is set to 192.168.178.13
3. NAS 10G and PC 10G are connected directly
4. NAS eth3 (1G) is set to 192.168.178.10
5. NAS eth3 is connected to the router (192.168.178.1)
6. I create on the NAS a bridge between eth3 (1G) and eth4 (10G) (to connect the PC to the intra- and internet):
   brctl addbr br0 brctl stp br0 off ifconfig br0 192.168.178.12 netmask 255.255.255.0 up brctl addif br0 eth3 brctl addif br0 eth4 ifconfig eth3 promisc up ifconfig eth4 promisc up
7. <115 MB/s copying a file from .12 through SMB

In both cases the PC shows "10,0 Gbit/s" transfer speeds in its adapters status. The NAS, too:

ethtool eth4
Settings for eth4:
        Supported ports: [ TP ]
        Supported link modes:   100baseT/Full
                                1000baseT/Full
                                10000baseT/Full
        Supported pause frame use: Symmetric
        Supports auto-negotiation: Yes
        Advertised link modes:  100baseT/Full
                                1000baseT/Full
                                10000baseT/Full
        Advertised pause frame use: Symmetric
        Advertised auto-negotiation: Yes
        Speed: 10000Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 0
        Transceiver: external
        Auto-negotiation: on
        MDI-X: Unknown
        Supports Wake-on: g
        Wake-on: d
        Link detected: yes

Maybe important: I'm not able to set a gateway for the bridge. I tried this:

route add default gw 192.168.178.1 dev br0

But it returns:

SIOCADDRT: Network is unreachable

I do not know why as the IPs are all correctly set up:

    ifconfig
    br0       Link encap:Ethernet  HWaddr 00:00:00:00:00:00
              inet addr:192.168.178.12  Bcast:192.168.178.255  Mask:255.255.255.0
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:553505 errors:0 dropped:0 overruns:0 frame:0
              TX packets:3324 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:61656890 (58.8 MiB)  TX bytes:2251363 (2.1 MiB)
    ...
    eth3      Link encap:Ethernet  HWaddr 00:00:00:00:00:00
              inet addr:192.168.178.10  Bcast:192.168.178.255  Mask:255.255.255.0
              UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
              RX packets:3422085 errors:0 dropped:0 overruns:0 frame:0
              TX packets:845424 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:4592877231 (4.2 GiB)  TX bytes:1126753162 (1.0 GiB)
    eth4      Link encap:Ethernet  HWaddr 00:00:00:00:00:00
              inet addr:192.168.178.11  Bcast:192.168.178.255  Mask:255.255.255.0
              UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
              RX packets:1354792 errors:0 dropped:0 overruns:0 frame:0
              TX packets:4370314 errors:1 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:1199786642 (1.1 GiB)  TX bytes:6062719532 (5.6 GiB)

    route
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    default         fritz.box       0.0.0.0         UG    0      0        0 eth1
    192.168.178.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1
    192.168.178.0   0.0.0.0         255.255.255.0   U     0      0        0 eth3
    192.168.178.0   0.0.0.0         255.255.255.0   U     0      0        0 eth4

    brctl show
    bridge name     bridge id               STP enabled     interfaces
    br0             8000.000000000000       no              eth3
                                                            eth4

Maybe interesting, too:

• All clients in the intranet are able to ping .12 after the bridge is setup
• the router does not show up .12. It lists only .10 (not pingable) and .13 (PC).
• br0 and eth3 and the routers .10 client have all the same mac address

I found this explanation how a CDN works. But there is one thing I don't really understand. Let's assume I setup multiple DNS servers at my location and they use the nameserver domains dns1.example.com, dns2.example.com and dns3.example.com. This DNS servers are able to deliver a server IP depending on the visitors location (ping, geo database, browser language or whatever). Now I update this nameserver settings for my domain www.example.org at the registry.

Now, the very first request on www.example.org with an expired TTL tries to resolve the domain. It asks:

1. the local .hosts/DNS, if TTL expired:
2. the internet providers DNS, if TTL expired:
3. the root DNS, if TTL expired:
4. my local dns1.example.com

But if I understand it correct, the new IP is then added to all these nameserver caches until the TTL expires again. So how is it possible to send other IPs to the visitor depending on his location?

In this answer theandym said the request is "forwarded", but I don't think this is how a CDN works, because "forwarding" means lengthen the transmission way resulting a longer loading time. Or does a CDN require zero TTL for the domain?

Update1
Through this question I found Google's document describing how they optimized CDN performance. It did not explain how the CDN works in general, but there were interesting explanations like the following:

Thereafter, whenever a client attempts to fetch content hosted on the CDN, the client is redirected to the node determined to have the least latency to its prefix. This redirection however is based on the prefix corresponding to the IP address of the DNS nameserver that resolves the URL of the content on the client’s behalf, which is typically co-located with the client.

This means Google checks at first the latency of all IP prefixes and defines a DNS resolution table (?) for all available prefixes. And if a visitor has the IP 198.51.100.231 the Google server IP is used, that is set for the prefix 198.51.100.0. But again: How does Google's DNS know which IP the visitor is using? Most visitors resolve Google's domain through their internet provider and by that the resolving is done through those external DNS servers or not?

As an additional example: If I start a DNS resolution for the domain facebook.com with different online tools (hosted in different countries) it is resolved to different IPs with different domains like:

• 31.13.92.36 Reverse: edge-star-mini-shv-01-frt3.facebook.com
• 31.13.76.68 Reverse: edge-star-mini-shv-01-sea1.facebook.com
• 31.13.69.228 Reverse: edge-star-mini-shv-01-iad3.facebook.com
• 157.240.2.35 Reverse: edge-star-mini-shv-01-ort2.facebook.com

After that I thought it could depend on the DNS server location used by the visitor, but I tried my own (Deutsche Telekom, Germany), Google's (8.8.8.8) and a major one from France (Orange) and they all returned for facebook.com the IP 31.13.92.36.

At first the rule that works:

DirectoryIndex index.php
ErrorDocument 403 /form.html

RewriteCond %{REQUEST_URI} ^/index\.php$
RewriteCond %{REQUEST_METHOD} !POST
RewriteRule . - [F,L]

This means http://example.com and http://example.com/index.php can only be opened through POST.

Now the problem

I added this additional rule set:

RewriteCond %{REQUEST_URI} !^/index\.php$
RewriteRule . - [F,L]

Now, I send a POST again to http://example.com but receive this error:

Forbidden

You don't have permission to access / on this server.
Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.

This does not make sense, because the rule should NOT catch requests on index.php sending a 403, but ok, I extended the second rule as follows:

RewriteCond %{REQUEST_URI} !^/form\.html$
RewriteCond %{REQUEST_URI} !^/index\.php$
RewriteRule . - [F,L]

And sending again a POST to http://example.com returns no 500, but I still receive a 403?!

Update 1
If I remove the first rule set, the second one works alone as expected. This means only http://example.com, http://example.com/index.php and http://example.com/form.html can be accessed.

Update 2
If I use both rule sets and send my POST to http://example.com/index.php I do not receive any errors?!

So the rules interfere only if I sent a POST to the root URL. But why?

My code doesn't work with second level tld's like domain.co.uk

Here is my conf:

  # add www.
  if ($host ~ ^(?!www)) {
   rewrite ^/(.*)$ http://www.$host/$1 permanent;
  }

  # remove subdomain
  if ($host ~ "^www\.(.*)\.(.*\.([a-z]{2,4}|[a-z]{2}\.[a-z]{2}))") {
   set $host_without_sub $2;
   rewrite ^/(.*)$ http://www.$host_without_sub/$1 permanent;
  }