When OS Login is enabled, and a user is granted access by having either the "Compute OS Login" or "Compute OS Admin Login" roles, they can run sudo.
In my experience, the per-user sudoers file always has this permission:
# cat /var/google-sudoers.d/first_last_example_com
first_last_example_com ALL=(ALL) NOPASSWD: ALL
Is it possible to customize these permissions or even disable sudo completely for a specific user or group?
I've created a cluster (eks.3) through the console and then used aws eks update-config to generate the kubeconfig configuration. I immediately had access to the cluster through kubectl but the EKS user guide talks about aws-iam-authenticator as if it was required. Is this still needed? If not, how is authentication happening after cluster creation?
Azure offers various types of virtual machine sizes and they have uppercase letters (e.g. B, D, DC, E, F, etc). Some instance types also have lowercase letters (e.g. Da, Dd, Das, Ds, Ed, etc). Does that map to any specific functionality?
I noticed the dockerd and docker-proxy processes were using more CPU than expected, 15% and 24% respectively, so I decided to use the "host" network to avoid the overhead. However, the results I got were much worse. How to explain this?
The same does not happen with a nginx container (performance increases from 43k req/sec to 48k req/sec with "host" network).
Start CouchDB container: docker run -d -p 5984:5984 couchdb
$ wrk -d 60 http://localhost:5984/mydb/mydoc
Running 1m test @ http://localhost:5984/mydb/mydoc
2 threads and 10 connections
Thread Stats Avg Stdev Max +/- Stdev
Latency 1.51ms 197.54us 7.81ms 75.74%
Req/Sec 3.32k 111.59 3.60k 71.58%
396492 requests in 1.00m, 698.02MB read
Requests/sec: 6608.12
Transfer/sec: 11.63MB
Start CouchDB container: docker run --net=host -d -p 5984:5984 couchdb
$ wrk -d 60 http://localhost:5984/mydb/mydoc
Running 1m test @ http://localhost:5984/mydb/mydoc
2 threads and 10 connections
Thread Stats Avg Stdev Max +/- Stdev
Latency 42.98ms 1.17ms 54.99ms 96.96%
Req/Sec 116.79 13.73 151.00 56.00%
13966 requests in 1.00m, 24.59MB read
Requests/sec: 232.57
Transfer/sec: 419.29KB
Postfix is returning a temporary error code (4xx) instead of a permanent error code (5xx) for "Relay Access Denied", which causes MX's to keep retrying:
Logs:
postfix/smtpd[14279]: connect from unknown[10.244.x.x]
postfix/smtpd[14279]: NOQUEUE: reject: RCPT from unknown[10.244.x.x]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mx.somewhere.com>
postfix/smtpd[14279]: disconnect from unknown[10.244.x.x]
Relevant configuration:
smtpd_recipient_restrictions =
reject_unauth_destination
reject_unknown_reverse_client_hostname,
reject_invalid_helo_hostname,
reject_non_fqdn_helo_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_invalid_hostname,
reject_rbl_client zen.spamhaus.org,
permit
virtual_alias_domains = example.com
virtual_alias_maps = hash:/etc/postfix/virtual
I would prefer if Postfix would reply with a 554 error so the remote server stops retrying something that will never work.
It seems that Ansible Galaxy will understand it has to download dependencies if those are specified in either meta/main.yml or a requirements.yml file.
Is there a best practice for this?
We use Ansible to create users with this task:
- name: Create adm users
user:
name: "{{ item.name }}"
group: "{{ common_adm_group }}"
createhome: yes
password: "!!"
update_password: always
state: present
with_items: "{{ common_adm_users }}"
And common_adm_users is like this:
- name: user1
comment: "First Last"
ssh_key: "ssh-rsa AAAAB3Nza..."
This works fine for creating users, but when someone leaves the team, just removing their user from common_adm_users doesn't cause it to be removed from the servers when we re-apply the role that includes this task.
What is the best practice to maintain an exact list of users?
I need to run a command on the target server that accepts data through stdin only. The data I'm feeding it comes from a template file and contains sensitive data, so I'd rather not have it sitting in the filesystem even for a second.
I'm trying to find a way to grab the output of a template task so I can pass it to the command. Something like:
- name: generate data
template:
src: data.j2
dest: [I'd rather not have any files written]
register: myvar
- name: run command
shell: "command < {{ myvar }}"
Is a better way to go about this that doesn't involve writing a temporary file, feeding it to the command and then erasing it?
I have noticed that when I issue a reboot command, my SSH connection is immediately closed on CentOS 7. It does not mean the server has rebooted, as I can still ping it.
It seems systemd is killing sshd too early. Sometimes a service will get stuck shutting down or just be slow, and I can't login anymore to verify what is wrong even though the server is up.
Is there a way to tell systemd to only kill sshd after all other service are down?
How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
I'm trying to install CentOS 7 using Hyper-V and it's failing with the following error message:
tsc: Fast TSC calibration failed
PCI: Fatal: No config space access function found
i8042: No controller found
[long waiting period...]
dracut-initqueue[475]: Warning: Could not boot.
dracut-initqueue[475]: Warning: /dev/disk/by-label/CentOS-7-livecd-x86_64 does not exist
dracut-initqueue[475]: Warning /dev/mapper/live-rw does not exist
Warning: /dev/disk/by-label/CentOS-7-livecd-x86_64 does not exist
Warning: /dev/mapper/live-rw does not exist
Generating "/run/initramfs/rdsosreport.txt"
I have created a Generation 2 virtual machine and disabled Secure Boot so it would at least start booting.
I have noticed that a Solaris 9 server keeps sending ARP requests for an IP address that is owned by our DNS server.
The DNS server answers with its MAC address but Solaris 9 does not record the address in the ARP table. You can ping the DNS server just fine from it but for every packet that goes out, it needs to request the MAC address again and again.
Here is the snoop output:
10.0.0.12 -> (broadcast) ARP C Who is 10.0.0.4, 10.0.0.4 ?
10.0.0.4 -> 10.0.0.12 ARP R 10.0.0.4, 10.0.0.4 is 0:14:4f:ac:cf:2e
10.0.0.12 -> (broadcast) ARP C Who is 10.0.0.4, 10.0.0.4 ?
10.0.0.4 -> 10.0.0.12 ARP R 10.0.0.4, 10.0.0.4 is 0:14:4f:ac:cf:2e
10.0.0.12 -> (broadcast) ARP C Who is 10.0.0.4, 10.0.0.4 ?
10.0.0.4 -> 10.0.0.12 ARP R 10.0.0.4, 10.0.0.4 is 0:14:4f:ac:cf:2e
Even though it's answering, 10.0.0.4 never shows in the ARP table but ping works all the time (presumably because it requests the MAC address for each request and thus can send the ICMP packet).
I've confirmed the source MAC address in the requests are indeed from the Solaris 9 server and the replies also ahve the correct source address from the DNS server. Basically everything seems to be working fine unles... ARP poisoning?
What makes this even more weird is that it works fine for all other IP address in the 10.0.0.0/24 network. Their MAC addresses are cached in the ARP table but this one doesn't.
Is there anything special about IP addresses appointed as DNS servers in /etc/resolv.conf that would make ARP behave like this? The other 2 DNS servers are not on the same subnet so I cannot test if it happens with other addresses.
# ndd -get /dev/arp arp_cleanup_interval
60000
We have +500 servers built with Supermicro motherboards and Kingston memory and we usually see the following alerts:
# fmdump -v
TIME UUID SUNW-MSG-ID
Oct 27 15:49:44.9379 108510ec-b4e1-c94b-dd9f-f7b2969a4725 INTEL-8001-94
100% fault.memory.intel.dimm_ce
Problem in: hc://:product-id=X7DB8:chassis-id=0123456789:server-id=hostname:serial=180104092839051c6a:part=KINGSTON:revision=C1/motherboard=0/memory-controller=1/dram-channel=3/dimm=0/rank=1
Affects: hc://:product-id=X7DB8:chassis-id=0123456789:server-id=hostname:serial=180104092839051c6a:part=KINGSTON:revision=C1/motherboard=0/memory-controller=1/dram-channel=3/dimm=0/rank=1
FRU: hc://:product-id=X7DB8:chassis-id=0123456789:server-id=hostname:serial=180104092839051c6a:part=KINGSTON:revision=C1/motherboard=0/memory-controller=1/dram-channel=3/dimm=0
Location: DIMM4A
My question is: how trustworthy are these faults when you are running on non-Oracle hardware?
We tried almost everything (short of never using these components again) but the faults randomly come back (eg. replace dimm4a and after a few months dimm1b has a fault, replace all memories and motherboard and another fault shows up after a few days).
The memory we replace is tested for days with memtest and we can never find a problem. Other teams using the same hardware with Windows & Linux don't see it. Is Solaris being too sensitive?
Right now we are going over another round of memory replacements but it's becoming a pain. We couldn't find anything wrong with the servers either, they've been working just fine but the randomly appearing memory faults are scary. Should we ignore them?
OS: OpenSolaris 2009.6 (b111)