alphadogg's questions

I have recently set up an ADFS 2016 server and restored an export from a previous ADFS 2.0 on Windows 2008 R2. Passed the new configuration through MS' analyzer with no issues (except for using a wildcard cert which seems to confuse it).

Using Chrome on the ADFS server, when I surf to the service: (fqdn = adfs.corp.mydomain.com = federation service name)

1. http://fqdn --> default IIS page
2. https://fqdn --> cannot be reached
3. http://localhost/adfs/fs/federationserverservice.asmx --> 503
4. https://localhost/adfs/fs/federationserverservice.asmx --> XML
5. http://fqdn/adfs/fs/federationserverservice.asmx --> 503
6. https://fqdn/adfs/fs/federationserverservice.asmx --> cannot be reached

So, according to the first and fourth responses, I can viably reach the service and it responds with XML. But, I'm not sure why I can't get the response when using the full domain name and path in the last URL? How do I diagnose this?

Using MS scripts, I attempted a migration of an ADFS 2.0 configuration (on Windows 2008R2) to a new ADFS server (Windows 2016) server. I have warnings in my event log that seem to be linked, via the thumbprint in the error, to the token-decrypting and token-signing certificates.

The EventID was: 329. The error was: "The certificate that is identified by thumbprint 'xxxxxx' could not be decrypted using the keys for X.509 certificate private key sharing. MSIS7708: The group for X.509 certificate private key sharing with the distinguished name 'yyyyyy' does not exist."

How do I resolve these warnings?

I inherited a migration of ADFS 2.0 on Windows Server 2008R2 to ADFS on Windows Server 2016. The task had been started manually, but not completed. I am using the MS scripts, and exported configuration via Export-FederationConfiguration.ps1. The warning stated that I ensure I used a specific service account on the target server. However, upon verification, the ADFS 2016 service account is not the same user and domain as the source.

Is this an issue? What can one do to correctly import using the import script?

I have a large blob container in one Azure Storage Account in one Directory (abc.com) that I would like to move to another Storage Account in a completely different Directory (efg.com).

Is the only way to do this via something like AzCopy? If so, should that be done in Azure somehow? (I assume that if I use AzCopy on my local machine I am downloading then uploading all the individual blobs?)

I need to configure Atlassian Crowd to query all the users in my AD server that are in various groups in a top-level OU.

The DN for the OU is "OU=Atlassian,DC=NNNN,DC=com". The various groups would be "CN=,OU=Atlassian,DC=NNNN,DC=com". There are 30.

I have used:

(&(objectCategory=Person)(sAMAccountName=*)
  (|
    (memberOf=CN=group1,OU=Atlassian,DC=NNNN,DC=com)
    (memberOf=CN=group2,OU=Atlassian,DC=NNNN,DC=com)
    ...
    (memberOf=CN=groupN,OU=Atlassian,DC=NNNN,DC=com)
  )
)

But, have to remember to reconfigure Crowd for every change in AD. IS there a better "catch-all" filter?

The nginx config:

server {
        listen          443 ssl;
        server_name     crowd.example.com;
        access_log      off;

        client_max_body_size    10M;

        ssl_certificate         /etc/nginx/ssl/crowd.example.com.crt;
        ssl_certificate_key     /etc/nginx/ssl/crowd.example.com.key;

        location / {
                proxy_pass              http://localhost:8095/;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $remote_addr;
                port_in_redirect        off;
                proxy_redirect          https://crowd.example.com/ /;
        }
}

Crowd's relevant section from its server.xml:

<Service name="Catalina">

    <Connector
        acceptCount="100"
        connectionTimeout="20000"
        disableUploadTimeout="true"
        enableLookups="false"
        maxHttpHeaderSize="8192"
        maxThreads="150"
        minSpareThreads="25"
        port="8095"
        redirectPort="8443"
        useBodyEncodingForURI="true"
        URIEncoding="UTF-8"

        proxyName="crowd.example.com"
        proxyPort="443"
        scheme="https"
        secure="true"/>

    <Engine defaultHost="localhost" name="Catalina">
        <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
    </Engine>

    <Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
</Service>

Here's my crowd.properties:

session.lastvalidation=session.lastvalidation
session.tokenkey=session.tokenkey
crowd.server.url=http\://localhost\:8095/crowd/services/
application.name=crowd
http.timeout=30000
session.isauthenticated=session.isauthenticated
application.login.url=http\://localhost\:8095/crowd
session.validationinterval=0
application.password=fslLXYfj9DehGTmGjLqZbX

Going to https://crowd.example.com/crowd result in a redirect cycle after logging in. You can reach the login page. (Also, https://crowd.example.com/ works too.) Looking at it with Firebug in FF, I see it oscillating between https://crowd.commercialfire.com/crowd/console/login.action and https://crowd.commercialfire.com/crowd/console/defaultstartpage.action.

How do I properly configure a server with nginx to front for a Zimbra server with multiple domains?

I run a small SOHO network. I NAT/port forwarding on my Comcast router to get traffic to my handful of servers.

I setup a server with Zimbra, call it host1.internal.local. The server currently has two domains, call them domain1.com and domain2.com. Both offer webmail access at webmail.domain1.com and webmail.domain2.com.

I have a separate server with nginx. I want to configure nginx to reverse proxy, such that I can direct all HTTP/HTTPS, and send webmail traffic via matched host address/headers to the Zimbra server. If possible, I'd like to know how to map IMAP, POP and SMTP traffic too.

How would I do this?

What's the easiest way to find all files on a server (Windows Server 2003) created on or before a certain date? (BTW, Windows Search has been and is currently disabled.)

I have a Tyan server with an onboard AIC-7901. One drive out of four in a RAID10 array is marked as degraded. I power down, pop out the offending drive, put in a good one, reboot and go into Adaptec Storage Manager. However, it errors when I try to make the new drive a hot spare to be used for rebuilding the array.

The error says: "Could not create hot-spare drive. Controller 1, channel 0, device ID 0. Result codes: RC:-5 API:2 IOCTL:0 SenseKey:3 ASC:49 ASCQ:1"

Any suggestions?

So, I installed a minimal install of Fedora 15 to create a server for a web application. I also installed PostgreSQL 9.1 from pgrpms.org. PostgreSQL install went well. Locally, I was able to initdb, start and psql in to change the postgres password.

Now, I have installed pgAdmin on a Windows system on the same subnet. However, I cannot connect.

I have edited /var/lib/pgsql/9.1/data/postgresql.conf to set listen_addresses = '*'. I have edited /var/lib/pgsql/9.1/data/pg_hba.conf to allow host all all 192.168.1.0/24 trust. I have also restarted after the changes (service postgresql-9.1 restart)

The error in pgAdmin is: could not connect to server: Connection timed out (0x0000274C/10060) Is the server running on host "192.168.1.110" and accepting TCP/IP connections on port 5432?

The answer is yes. I didn't install a firewall, and disabled the one on my Windows-based workstation. I am able to ping and SSH into the server. tcpdump shows the connection attempt on port 5432 from pgAdmin does happen:

[root@cobalion yum.repos.d]# tcpdump port 5432
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
07:28:44.014920 IP totodile.mcs.local.54067 > 192.168.1.110.postgres: Flags [S], seq 3554805012, w in 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
07:28:47.023859 IP totodile.mcs.local.54067 > 192.168.1.110.postgres: Flags [S], seq 3554805012, w in 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
07:28:53.019464 IP totodile.mcs.local.54067 > 192.168.1.110.postgres: Flags [S], seq 3554805012, w in 8192, options [mss 1460,nop,nop,sackOK], length 0

I am at a loss to know where to look next? On the surface, seems like I should be able to connect. Any ideas? Can I somehow check from "inside" a running postgresql server what settings were loaded?

I have a webserver on IIS7. It hosts multiple websites via host header redirects. I want to install one installation of some blog engine, such that I can host one or more blogs per domain. For example, www.foo.com/blog1, www.foo.com/blog2, www.bar.com/blog1, blog.foo.com, etc.

How do I achieve this?