kockiren's questions

There are two Domains and there is a trust between both domains, this works fine for a long time but now we get access denied errors. So I open "Domains and Trust" and validate the Trust between both domains. In the following dialog there is shown following error:

The secure channel (SC) verification on Active Directory Domain Controller \\pdc.site1.company.tld of domain site1.company.tld to domain site2.company.tld failed with error: Access is denied.

The secure channel (SC) reset on Active Directory Domain Controller \\pdc.site1.company.tld of domain site1.company.tld to domain site2.company.tld failed with error: Access is denied.

The secure channel (SC) verification on Active Directory Domain Controller \\pdc.site2.company.tld of domain site2.company.tld to domain site1.company.tld failed with error: Access is denied.

The secure channel (SC) reset on Active Directory Domain Controller \\pdc.site2.company.tld of domain site2.company.tld to domain site1.company.tld failed with error: Access is denied.

Next I reset the trust password and enter the credentials from a Domain-Admin of the other Domain and get the following errors:

and

The same Issue occurs if I try it from the other DC. I have checked the conditional forwarders, that looks good. I also delete the Trust on each Domain and recreate the trust level, but the same issue. How can I solve this trust issue?

Both DC run with Windows Server 2008 R2 in Domain functional level Windows Server 2008 R2.

On my Cisco Catalyst 3850 there is a SFP Module which is connected to another device, the port on the Other device (vendor equipment) come up but my interface is still down. The DOM Information show me receive and transmit pegel and if I do a shut command on that interface the other side goes down.

This is the config of that port:

interface GigabitEthernet1/0/8
 description port1
 no switchport
 ip address 10.1.1.80 255.255.255.254
end

But the port is still down:

sh int gi1/0/8 status

Port      Name               Status       Vlan       Duplex  Speed Type 
Gi1/0/8   port1   notconnect   routed       full   1000 1000BaseLX SFP

And on transceiver detail page there is everything fine:

#sh int gi1/0/8 transceiver detail   
ITU Channel not available (Wavelength not available),
Transceiver is internally calibrated.
mA: milliamperes, dBm: decibels (milliwatts), NA or N/A: not applicable.
++ : high alarm, +  : high warning, -  : low warning, -- : low alarm.
A2D readouts (if they differ), are reported in parentheses.
The threshold values are calibrated.

                              High Alarm  High Warn  Low Warn   Low Alarm
          Temperature         Threshold   Threshold  Threshold  Threshold
Port       (Celsius)          (Celsius)   (Celsius)  (Celsius)  (Celsius)
--------- ------------------  ----------  ---------  ---------  ---------
Gi1/0/8     39.7                95.0        90.0       -40.0      -45.0

                              High Alarm  High Warn  Low Warn   Low Alarm
           Voltage            Threshold   Threshold  Threshold  Threshold
Port       (Volts)            (Volts)     (Volts)    (Volts)    (Volts)
---------  ---------------    ----------  ---------  ---------  ---------
Gi1/0/8    3.32                  3.60        3.50        3.10       3.00

           Optical            High Alarm  High Warn  Low Warn   Low Alarm
           Transmit Power     Threshold   Threshold  Threshold  Threshold
Port       (dBm)              (dBm)       (dBm)      (dBm)      (dBm)
---------  -----------------  ----------  ---------  ---------  ---------
Gi1/0/8     -5.2                -1.0        -1.9       -10.0      -11.0

           Optical            High Alarm  High Warn  Low Warn   Low Alarm
           Receive Power      Threshold   Threshold  Threshold  Threshold
Port       (dBm)              (dBm)       (dBm)      (dBm)      (dBm)
-------    -----------------  ----------  ---------  ---------  ---------
Gi1/0/8     -6.8                -1.9        -2.9       -24.9      -26.0

I change the SFP Module but still the same, also change the port with the same result. How can I troubleshoot this issue.

It is a little bit strange to me that the Port on the other device comes up but my device is still down.

I'am searching for a way to bypass some accounts to a diffrent Mailserver then postfix. So some accounts should exist on the postfix server but anything else should be transport to a second SMTP Server. For that I setup a new centos 7 and install postfix with yum install postfix. In the defaultconfig I add transport_maps and for a simple test I add example.com in transport_maps with the destination Mailserver. But in case I send a Mail to [email protected] postfix told me the account doesnet exist.

Postfix only accept Mails for known user so I create a alias in /etc/aliases userX: trash and the Mail will be transport to the destination SMTP Server. My Issue is that I do not know all the aliases from the Destination SMTP Server so I cant add all aliases to aliases.db is there a Option to accept all user on postfix for a known domain?

For a trivial example I need to transport all user to a diffrent SMTP Server.

#postconf -n
alias_database = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, example.com
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550

And my /etc/postfix/transport looks like:

example.com smtp:smtp.local

UPDATE As mentioned below I try to solve the issue with fallback_transport. I had updated my main.cf with

fallback_transport = relay
fallback_transport_maps = hash:/etc/postfix/transport

and the content of /etc/postfix/transport is

example.com smtp:smtp.local
*           smtp:smtp.local

but with this config the issue is the same. The user doestn exist so postfix told me the user doesnt exist. If I delete the example.com URL from mydestination the behavior is that the mail to [email protected] is in the mailq

In centos 7 I want to block traffic from a source IP (example 3.3.3.3) and for that I apply the following rule:

# firewall-cmd --permanent --zone=drop --add-source=3.3.3.0/24
# firewall-cmd --reload

After that command I checked that my rule applies by:

firewall-cmd --list-all --zone=drop
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: 
  sources: 3.3.3.0/24
  services: 
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

Here you can see the output of all the other active rules:

firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno4
  sources: 
  services: dhcpv6-client ssh
  ports: 5060/udp 16384-32768/udp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

firewall-cmd --list-all --zone=internal
internal (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno1
  sources: 
  services: mdns dhcpv6-client samba-client ssh
  ports: 80/tcp 60024/tcp 5080/udp 8080/tcp 5060/tcp 161/udp 5080/tcp 5060/udp 16384-32768/udp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

In the route table the public zone is listed in that one which routes traffic for 3.3.3.0/24.

ip route
default via 1.1.1.1 dev eno4 
10.1.1.0/24 via 10.1.1.1 dev eno1 

So that rule is applying, but I still get traffic (UDP) from this source IP on a listen Port (5060) on my centos machine. What is wrong with my rule?

UPDATE as Michael mentioned there is an output of iptables -nvL

iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  46M   33G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
53342 3122K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
 315K   35M INPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 315K   35M INPUT_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 315K   35M INPUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   85  3916 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
 1908 87293 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 FORWARD_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FORWARD_IN_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FORWARD_IN_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FORWARD_OUT_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FORWARD_OUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 46M packets, 21G bytes)
 pkts bytes target     prot opt in     out     source               destination         
  46M   21G OUTPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD_IN_ZONES (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDI_public  all  --  eno4   *       0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 FWDI_internal  all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 FWDI_public  all  --  +      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain FORWARD_IN_ZONES_SOURCE (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDI_drop  all  --  *      *       3.3.3.0/24       0.0.0.0/0           
    0     0 FWDI_drop  all  --  *      *       3.3.3.0/24       0.0.0.0/0           

Chain FORWARD_OUT_ZONES (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDO_public  all  --  *      eno4    0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 FWDO_internal  all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 FWDO_public  all  --  *      +       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDO_drop  all  --  *      *       0.0.0.0/0            3.3.3.0/24      
    0     0 FWDO_drop  all  --  *      *       0.0.0.0/0            3.3.3.0/24      

Chain FORWARD_direct (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_drop (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDI_drop_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_drop_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_drop_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDI_drop_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_drop_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_drop_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_internal (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDI_internal_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_internal_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_internal_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDI_internal_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_internal_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_internal_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_public (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDI_public_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_public_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDI_public_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDI_public_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_public_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDI_public_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_drop (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDO_drop_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_drop_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_drop_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDO_drop_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_drop_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_drop_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_internal (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDO_internal_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_internal_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_internal_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDO_internal_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_internal_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_internal_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_public (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 FWDO_public_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_public_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 FWDO_public_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FWDO_public_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_public_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FWDO_public_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT_ZONES (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 272K   32M IN_public  all  --  eno4   *       0.0.0.0/0            0.0.0.0/0           [goto] 
42964 2736K IN_internal  all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 IN_public  all  --  +      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain INPUT_ZONES_SOURCE (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 IN_drop    all  --  *      *       3.3.3.0/24       0.0.0.0/0           
    0     0 IN_drop    all  --  *      *       3.3.3.0/24       0.0.0.0/0           

Chain INPUT_direct (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_drop (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 IN_drop_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 IN_drop_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 IN_drop_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain IN_drop_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_drop_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_drop_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_internal (1 references)
 pkts bytes target     prot opt in     out     source               destination         
42964 2736K IN_internal_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
42964 2736K IN_internal_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
42964 2736K IN_internal_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain IN_internal_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353 ctstate NEW
  201 15678 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137 ctstate NEW
  627  144K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138 ctstate NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW
  969 50388 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 ctstate NEW
39727 2400K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:60024 ctstate NEW
    7  4458 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5080 ctstate NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 ctstate NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5060 ctstate NEW
 1252 90788 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:161 ctstate NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5080 ctstate NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 ctstate NEW
  140 28000 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:16384:32768 ctstate NEW

Chain IN_internal_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_internal_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_public (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 272K   32M IN_public_log  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 272K   32M IN_public_deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 272K   32M IN_public_allow  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    5   196 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain IN_public_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1184 70012 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW
  388  271K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 ctstate NEW
 268K   31M ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:16384:32768 ctstate NEW

Chain IN_public_deny (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       3.3.3.0/24       0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       3.3.3.0/24       0.0.0.0/0            reject-with icmp-port-unreachable

Chain IN_public_log (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT_direct (1 references)
 pkts bytes target     prot opt in     out     source               destination    

UPDATE In the following ladder diagram (sngrep) you can see that the Option Ping (5060) is answered by my application so the firewall rule did not affect.

UPDATE 2 The error occurs again, and now I reload the filter rule and the IP isn't apply to the drop list. I figure out that the issue occurs if the Interface has traffic load. After shutdown the server and restart the rule is applied. But I need a way to apply a drop rule also if the server has load.

I'am trying to configure my ESA C170 and all works as expected. But now I want to add support for relay function for authed external user. I add a SMTP Auth Profile against LDAP that works. Next Step is to configure HAT and the sender group. If I add the Mail Flow Policy to HAT Relay and add my own IP to Sendergroup than it works but I need for all the internet. What I'am looking for is a rule that allows only authed User from 0.0.0.0/0 to relay and all other should match to accepted if the Address is listed in the transport section. In the manual for the ASYNC OS I found the section "Configuring AsyncOS for SMTP Authentication"

SMTP Authentication and HAT Policy Settings

Because senders are grouped into the appropriate sender group before the SMTP Authentication negotiation begins, Host Access Table (HAT) settings, are not affected. When a remote mail host connects, the appliance first determines which sender group applies and imposes the Mail Policy for that sender group. For example, if a remote MTA “suspicious.com” is in your SUSPECTLIST sender group, the THROTTLE policy will be applied, regardless of the results of “suspicious.com’s” SMTPAUTH negotiation.

However, senders that do authenticate using SMTPAUTH are treated differently than “normal” senders. The connection behavior for successful SMTPAUTH sessions changes to “RELAY,” effectively bypassing the Recipient Access Table (RAT) and LDAPACCEPT. This allows the sender to relay messages through the appliance. As stated, any Rate Limiting or throttling that applies will remain in effect.

I'am searching for the configuration path of "senders that do authenticate using SMTPAUTH are treated differently" but there is nothing like that.

Heres my current HAT if I add my own IP to sender list of sendergroup RELAYLIST than I can see the AUTHMECH in SMTP Dialog. How can I change the Sendergroups to show SMTP AUTH like this

Connected to 192.168.100.3.
Escape character is '^]'.
220 ironport.domain.tld ESMTP
ehlo test
250-ironport.domain.tld
250-8BITMIME
250 SIZE 10485760
250-AUTH PLAIN LOGIN
250 AUTH=PLAIN LOGIN

For all external Users to Login. If I change the senderlist to 0.0.0.0/0 than everyone must authenticate against the iron port so I cannot accept Messages for the own recipients.

I'am little bit confused about the CPU limitation of Windows Server 2012 R2 Foundation. The Server is installed on a HP proliant DL380 Gen9 with 2x 6-core CPUs, with the HP provisioning Tool I do install the Windows Foundation Server on this machine. After the installation process I can see that 2 CPUs are active, but only 4 Cores per CPU.

In the technet article is written that the Limitation on this Windows Server edition is 1 CPU but with unlimited Cores. But on my System are 2 CPUs active with limited to 4 Cores per Socket.

Here you can see the Edition is set to foundation but I can see 2 CPUs

What is now the right limitation of this edition?

UPDATE I can reproduce it, if I install from the ISO directly than I must type a Key but with the HP provisioning tool I insert the key after the Installation, maybe HP use any generic Key for the installation. The installed OS told me it is a not activated Foundation server and if I type my right key the limitation of the cores still exist. So the next step will be to find out the generic key of the provisioning tools and retry it with a normal ISO installation.

There is a CentOS Server with proftpd installed, that works for a long time. Now I create a user the right way as the last time and check it with ftp command on windows CMD and it works.

/etc/proftpd/ftpasswd --passwd --name newuser --uid 9999 --home /var/ftp/newuser --shell /bin/false

Now the new user try to connect with the new created credentials to the server and get a password incorrect. So I retry with the builtin ftp Client from windows an can connect to the Server. The new user use the windows explorer to connect to the FTP Server. I try it too and get a password incorrect too.

Maybe it is a encoding problem while transfer the password to the server. How can I debug it? The Auth log of proftpd didn't show a hint what goes wrong. I try serval FTP Clients and all tested works fine but not the Explorer FTP Client.

The log from the windows explorer FTP Client

FTP Server [18783] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:53:44 +0200] "USER newuser" 331
FTP Server [18783] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:53:44 +0200] "PASS (hidden)" 530

The log from same machine with builtin cmd ftp command:

FTP Server [19016] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:55:03 +0200] "USER newuser" 331
FTP Server [19016] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:55:03 +0200] "PASS (hidden)" 230

I enter the password serval times with copy and paste and typed it manually. How can I check the transferred password?

Update: On Client side I have to run wireshark and show that the password is send correctly. In the FTP Packets there is everything fine. This is the Wireshark protocol from the windows explorer. The only difference to the builtin FTP Client is the request for user anonymous.

Response: 220 ProFTPD 1.3.3g Server
Request: USER anonymous
Response: 331 Password required for anonymous
Request: PASS User@
Response: 530 Login incorrect.
Response: 220 ProFTPD 1.3.3g Server
Request: USER newuser
Response: 331 Password required for newuser
Request: PASS secret
Response: 530 Login incorrect

The same machine with the builtin ftp client give this output:

Response: 220 ProFTPD 1.3.3g Server
Request: USER newuser
Response: 331 Password required for newuser
Request: PASS secret
Response: 230 User newuser logged in

I just install a DFS system on different servers. My replication group consists of Windows 2003 R2 and Windows 2008 R2 servers. The replication itself works well. On the Windows 2008 R2 server I can enable the membership to read-only, in the Windows Server 2003 R2 not. Is there a way to enable this function, for example to update the DFS system OS independent or with some CLI Commands?

Here is the dialog of Windows 2008 R2 member:

And here the same dialog of Windows 2003 R2 member:

On a Windows Server 2003 there is a strange issue. Every 6 hours the server don't accept outbound TCP/IP traffic while inbound traffic working fine.

If the problem occurs I can connect with RDP to the server and ping around the world. If I try to connect to let's say an SMTP server using telnet on the same network switch, I can't get a connection. If I try to go to a Website (using Firefox or IE) I can't get an answer. But if I try to connect from another LAN Client to the server it works, I can use all TCP/IP Services on the Server but only inbound. The server doesn't use DHCP, it has a static IP and uses 8.8.8.8 as DNS Server.

If I restart the Server everything works fine for exact 6 Hours and then the error occurs again. Netstat shows me about 200 Connections and I try to set the MaxUserPort to 20000, if I restart the Network with nets int ip reset c:\resetlog.txt the issue is still the same. Only a restart will help.

What could cause such an error and where should I look for evidence on that outbound TCP/IP problem?

On proftpd/centos I configure the use of virtual user. I can login as a virtual user but I do not have write permission for this users.

The proftpd.conf looks like:

ServerName                      "ftp01"
DefaultServer                   on
DefaultRoot                     ~
AuthPAMConfig                   proftpd
AuthOrder                       mod_auth_file.c  mod_auth_unix.c
RequireValidShell  off
AuthUserFile  /etc/proftpd/ftpd.passwd
AuthGroupFile /etc/proftpd/ftpd.group
AuthPAM off
User                            nobody
Group                           nobody
MaxInstances                    20
UseSendfile                     off

Here is the content of ftpd.passwd:

user1:hashfrompasswd:50:50::/var/ftp/user1:/bin/false

and ftpd.group:

ftp:x:50:user1

The output of ls -lah from the home dir (set permission to 755):

# ls -lah
insgesamt 44K
drwxr-xr-x. 10 root ftp      4,0K 27. Dez 11:19 .
drwxr-xr-x. 21 root root     4,0K  8. Jul 2013  ..
drwxr-xr-x.  3 ftp  user1    4,0K  7. Jan 15:04 user1

But when I connect to ftp Server as user1 I can connect and login but when I try to put a file or make a directory I get access denied from server. How can I solve this problem?

There is a Cisco SLM2048 switch and the last firmware upgrade aborted, now the switch doesn't work anymore. I can't access the switch. The only evidence is a blinking system LED. As the switch doesn't have a serial console, is there a way of fixing the firmware and thus the device?

There works a FTP Server (proftpd) on Centos 6.5, Auth mech is AUTH_FILE and default ROOT is /var/ftp all User should put Files into this directory but only 2 User should get or list this files. Is it possible to deny some FTP Commands for a few Users?

My proftpd Config looks like:

DefaultRoot                     /var/ftp/
AuthPAMConfig                   proftpd
AuthOrder                       mod_auth_file.c  mod_auth_unix.c
RequireValidShell  off
AuthUserFile  /etc/proftpd/ftpd.passwd
AuthGroupFile /etc/proftpd/ftpd.group
AuthPAM off
RequireValidShell off

The content of /etc/proftpd/ftpd.group is:

ftp_group:x:50:user1

And the user file /etc/proftpd/ftpd.passwd looks like:

user1:$1$somesaltblablablablablablablabd:9999:9999::/var/ftp:/bin/false
user2:$1$somesaltblablablablablablablabd:9999:9999::/var/ftp:/bin/false
user3:$1$somesaltblablablablablablablabd:9999:9999::/var/ftp:/bin/false

User1 should be the user who can't get or list Files on the FTP Server. Is it possible?

On a HP DL380e Gen8 with Dynamics Smart Array and SAS RAID installed I try to install Centos, after load the RAID Driver from HP Support Site I can access the RAID and do the installation.

The installation works fine and my new Centos Boot on the HP Proliant Server, but when I take a look into the /var/log/messages there is a lot of (>100 per second) this lines in the log file:

Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL
Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL
Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL
Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL
Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL
Dec  9 14:03:27 server01 kernel: PAL Shim AllocRequest returning NULL

What does this mean?

I try to set up my first pacemaker cluster as a FTP Server. There are two Server installed with a fresh centos 6.5 and proftpd

First step was to install pacemaker and some configuration Tools with:

yum install pacemaker cman pcs ccs resource-agents

After run this command on each server I start to configure my first Pacemaker Cluster with following Commands:

# ccs -f /etc/cluster/cluster.conf --createcluster ftpcluster 
# ccs -f /etc/cluster/cluster.conf --addnode ftp01 
# ccs -f /etc/cluster/cluster.conf --addnode ftp02
# ccs -f /etc/cluster/cluster.conf --addfencedev pcmk agent=fence_pcmk  
# ccs -f /etc/cluster/cluster.conf --addmethod pcmk-redirect ftp01 
# ccs -f /etc/cluster/cluster.conf --addmethod pcmk-redirect ftp02  
# ccs -f /etc/cluster/cluster.conf --addfenceinst pcmk node1 pcmk-redirect port=ftp01 
# ccs -f /etc/cluster/cluster.conf --addfenceinst pcmk node2 pcmk-redirect port=ftp02

Now I start the Cluster on both nodes:

# service cman start 
# service pacemaker start

Next step is to set a ClusterIP and a FTPService Ressource with the following

# pcs resource create ClusterIP ocf:heartbeat:IPaddr2 ip=10.2.1.50 cidr_netmask=32 op monitor interval=30s
# pcs resource create FTPService lsb:proftpd op monitor interval=30s

If I request the status I get following result:

# pcs status
Cluster name: ftpcluster
Last updated: Thu Jul 25 01:04:48 2013
Last change: Thu Dec  5 08:56:39 2013 via crmd on ftp01
Stack: cman
Current DC: ftp02 - partition with quorum
Version: 1.1.10-14.el6-368c726
2 Nodes configured
2 Resources configured


Online: [ ftp01 ftp02 ]

Full list of resources:

 ClusterIP  (ocf::heartbeat:IPaddr2):   Started ftp01 
 FTPService (lsb:proftpd):  Started ftp02 

My question is about the access to the FTP Service. Cluster IP runs on ftp01 but FTPService on ftp02, if I try to access "ftp 10.2.1.50" I get answer back from ftp01.

Question 1: What is the difference between ClusterIP and FTPService, why I should use a FTP Serice if the ClusterIP do the same?

Question 2: What should I do from this point to build a activ/active scenario and how it works? Is it load balanced or simple round robin?

There is a Citrix XenServer 5.5 (HP ML370 G5, Xeon 2GHz) on this Server there is a Windows Guest (Windows 2008 R2 x64) under Properties I set 4 CPU Cores with max prio. But if I check with CPU-Z the performance of the CPU from Host there is set the right CPU (XEON 2GHz) but with only 600MHz what is wrong with this Guest.

The /proc/cpuinfo from Citrix XenServer:

processor : 0
vendor_id : GenuineIntel
cpu family    : 6
model     : 15
model name    : Intel(R) Xeon(R) CPU           E5335  @ 2.00GHz
stepping  : 7
cpu MHz       : 2000.016
cache size    : 4096 KB
fdiv_bug  : no
hlt_bug       : no
f00f_bug  : no
coma_bug  : no
fpu       : yes
fpu_exception : yes
cpuid level   : 10
wp        : yes
flags     : fpu de tsc msr pae cx8 apic mtrr cmov pat clflush acpi mmx fxsr sse sse2 ss ht constant_tsc up pni vmx
bogomips  : 4002.63

Here is the Outout of CPU-Z from Windows Guest:

On another Citrix XenServer under Citrix XenServer 6.1 with the same machine it works fine. Is this a failure from Citrix Xenserver or of HP Hardware?

Update The Core speed don't increase if the CPU has load:

Update 2 This is the Output of xenpm

# xenpm get-cpufreq-states
Xen cpuidle is not enabled!
Xen cpufreq is not enabled!

I use Citrix XenServer 5.5 and on a Windows Server 2008 R2 Guest there is installed Xentools 5.5, for a year all works well. After a restart we get a BSOD with Stop Code 7B, it is a problem with the Citrix pv-driver I think, but how can I delete this driver without GUI, safe mode also bring up a BSOD.

So I install a second Windows Server on same VM and can access the filesystem of the Guest. In the Windows/System32/driver I delete xenvbd.sys and scsifilt.sys in the registry I delete everything I found with xenvbd or scsifilt, but the BSOD is still here.

The Windows Startuprepair and sfc /scannow dosent help.

Update: All known Snapshots are with the same Issue

Hey we use postfix as Mailsystem and the config contain virtual alias table for address verification. We also use a simple List for administrative use. The list is in /etc/postfix/virtual written as "[email protected] userxy"

The list and usermappings works fine but the problem is that we want protect some adresses for internal use only. So i add following lines to main.cf

smtpd_recipient_restrictions = 
      check_recipient_access hash:/etc/postfix/protected_destinations,
      permit_mynetworks, 
      permit_sasl_authenticated, 
      reject_unauth_destination

smtpd_restriction_classes = insiders_only 
insiders_only = check_sender_access hash:/etc/postfix/insiders, reject

The file protected_destinations contain:

[email protected]             insiders_only 

The file insiders contain:

domain.tld        DUNNO 

Output from postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
inet_interfaces = all
mailbox_size_limit = 0
mailbox_transport = cyrus
message_size_limit = 0
mydestination = domain.tld,domain2.tld
myhostname = domain.tld
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.100.0/24
myorigin = /etc/mailname
recipient_delimiter = +
relay_domains = domain.tld
relayhost = [x.x.x.x]
smtpd_recipient_restrictions = permit_mynetworks,        permit_sasl_authenticated,        reject_unauth_destination,   hash:/etc/postfix/access,   hash:/etc/postfix/virtual-user_access
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
virtual_alias_domains = /etc/postfix/virtual-domains
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_mailbox_limit = 0

But it dosent work, i can send mail from external Address to [email protected] can anyone explain what i do wrong?

Here is a Logfile about a mail from extern to [email protected]:

Apr 19 16:57:34 serverx postfix/smtpd[15963]: 777A51762F1: client=smarthost.host[192.168.100.xy], sasl_method=LOGIN, sasl_username=userxy
Apr 19 16:57:34 serverx postfix/cleanup[15966]: 777A51762F1: message-id=<[email protected]>
Apr 19 16:57:34 serverx postfix/qmgr[15959]: 777A51762F1: from=<[email protected]>, size=1720, nrcpt=2 (queue active)
Apr 19 16:57:34 serverx postfix/pipe[15972]: 777A51762F1: to=<[email protected]>, orig_to=<[email protected]>, relay=cyrus, delay=0.24, delays=0.06/0.01/0/0.17, dsn=2.0.0, status=sent (delivered via cyrus service)
Apr 19 16:57:34 serverx postfix/pipe[15969]: 777A51762F1: to=<[email protected]>, orig_to=<[email protected]>, relay=cyrus, delay=0.24, delays=0.06/0/0/0.18, dsn=2.0.0, status=sent (delivered via cyrus service)
Apr 19 16:57:34 serverx postfix/qmgr[15959]: 777A51762F1: removed

I'm trying to build a solution to transfer attachments from Mail to an FTP folder. Are there any suggestions to solve this task?

My first idea was to write a shell script which fetches the mail from the Cyrus /var/imap folder and searches for the mail attachment finally writing it into a pdf file. As this does not seem to be the intended way of solving this issue, there might be a better one.

I am researching alternative solutions for real-time-file-replication on windows Server OS. Now we use XO Soft WAN Sync for file-replication but in the next time we want to expand our Server-location and so we search for a alternative System for replication. Anyone has experience with real-time replication?

SAN is not possible because the System should be closed. So if the Network is down each node must still working with the replicated files. Any suggestions?

i try to setup a new Mailsystem and configure Postfix for smtp and Cyrus for IMAP, Authentication should be work over SASLAUTHD again Active Directory. I install following Versions:

• Cyrus 2.2
• Postfix: 2.5.5
• Debian GNU/Linux 5.0

Authentication for PAM (Linux Login) and IMAP still works, but not for smtp.

host:/etc/postfix# testsaslauthd -u user -p passwd -s smtp
0: NO "authentication failed"
host:/etc/postfix# testsaslauthd -u user -p passwd -s imap
0: OK "Success."
host:/etc/postfix# 

I install the Kerberos Auth following this Turorial: SASL authenticate against Active Directory

# saslfinger -s
saslfinger - postfix Cyrus sasl configuration Do 11. Nov 15:07:16 CET
2010
version: 1.0.4
mode: server-side SMTP AUTH

-- basics --
Postfix: 2.5.5
System: Debian GNU/Linux 5.0 \n \l

-- smtpd is linked to --
        libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb74fe000)

-- active SMTP AUTH and TLS parameters for smtpd --
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous

-- listing of /usr/lib/sasl2 --
insgesamt 680
drwxr-xr-x  2 root root  4096 11. Nov 09:37 .
drwxr-xr-x 46 root root 12288  8. Okt 15:22 ..
-rw-r--r--  1 root root 13476 24. Mai 2009  libanonymous.a
-rw-r--r--  1 root root   855 24. Mai 2009  libanonymous.la
-rw-r--r--  1 root root 13016 24. Mai 2009  libanonymous.so
-rw-r--r--  1 root root 13016 24. Mai 2009  libanonymous.so.2
-rw-r--r--  1 root root 13016 24. Mai 2009  libanonymous.so.2.0.22
-rw-r--r--  1 root root 15814 24. Mai 2009  libcrammd5.a
-rw-r--r--  1 root root   841 24. Mai 2009  libcrammd5.la
-rw-r--r--  1 root root 15352 24. Mai 2009  libcrammd5.so
-rw-r--r--  1 root root 15352 24. Mai 2009  libcrammd5.so.2
-rw-r--r--  1 root root 15352 24. Mai 2009  libcrammd5.so.2.0.22
-rw-r--r--  1 root root 46420 24. Mai 2009  libdigestmd5.a
-rw-r--r--  1 root root   864 24. Mai 2009  libdigestmd5.la
-rw-r--r--  1 root root 43500 24. Mai 2009  libdigestmd5.so
-rw-r--r--  1 root root 43500 24. Mai 2009  libdigestmd5.so.2
-rw-r--r--  1 root root 43500 24. Mai 2009  libdigestmd5.so.2.0.22
-rw-r--r--  1 root root 13650 24. Mai 2009  liblogin.a
-rw-r--r--  1 root root   835 24. Mai 2009  liblogin.la
-rw-r--r--  1 root root 13460 24. Mai 2009  liblogin.so
-rw-r--r--  1 root root 13460 24. Mai 2009  liblogin.so.2
-rw-r--r--  1 root root 13460 24. Mai 2009  liblogin.so.2.0.22
-rw-r--r--  1 root root 29076 24. Mai 2009  libntlm.a
-rw-r--r--  1 root root   829 24. Mai 2009  libntlm.la
-rw-r--r--  1 root root 28532 24. Mai 2009  libntlm.so
-rw-r--r--  1 root root 28532 24. Mai 2009  libntlm.so.2
-rw-r--r--  1 root root 28532 24. Mai 2009  libntlm.so.2.0.22
-rw-r--r--  1 root root 13970 24. Mai 2009  libplain.a
-rw-r--r--  1 root root   835 24. Mai 2009  libplain.la
-rw-r--r--  1 root root 14036 24. Mai 2009  libplain.so
-rw-r--r--  1 root root 14036 24. Mai 2009  libplain.so.2
-rw-r--r--  1 root root 14036 24. Mai 2009  libplain.so.2.0.22
-rw-r--r--  1 root root 21710 24. Mai 2009  libsasldb.a
-rw-r--r--  1 root root   866 24. Mai 2009  libsasldb.la
-rw-r--r--  1 root root 18080 24. Mai 2009  libsasldb.so
-rw-r--r--  1 root root 18080 24. Mai 2009  libsasldb.so.2
-rw-r--r--  1 root root 18080 24. Mai 2009  libsasldb.so.2.0.22

-- listing of /etc/postfix/sasl --
insgesamt 12
drwxr-xr-x 2 root     root           4096 11. Nov 15:00 .
drwxr-xr-x 4 root     root           4096 11. Nov 14:40 ..
-rw-r--r-- 1 kockiren domänen-admins  127 11. Nov 15:00 smtpd.conf

-- content of /etc/postfix/sasl/smtpd.conf --
#pwcheck_method: saslauthd
#mech_list: PLAIN LOGIN

pwcheck_method: saslauthd
mech_list: plain login ntlm cram-md5 digest-md5

-- content of /etc/postfix/sasl/smtpd.conf --
#pwcheck_method: saslauthd
#mech_list: PLAIN LOGIN

pwcheck_method: saslauthd
mech_list: plain login ntlm cram-md5 digest-md5

-- active services in /etc/postfix/master.cf --
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
smtp      inet  n       -       n       -       -       smtpd -o pam
587       inet  n       -       -       -       -       smtpd -o pam
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       -       300     1       qmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
        -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
maildrop  unix  -       n       n       -       -       pipe
        flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
uucp      unix  -       n       n       -       -       pipe
        flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
ifmail    unix  -       n       n       -       -       pipe
        flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
        flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -d -t$nexthop -f
$sender $recipient
scalemail-backend       unix    -       n       n       -       2       pipe
        flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store $
{nexthop} ${user} ${extension}
cyrus   unix    -       n       n       -       -       pipe
        flags= user=cyrus argv=/usr/sbin/cyrdeliver -r ${sender} -m $
{extension} ${user}

-- mechanisms on localhost --
250-AUTH CRAM-MD5 DIGEST-MD5 NTLM LOGIN PLAIN
250-AUTH=CRAM-MD5 DIGEST-MD5 NTLM LOGIN PLAIN

-- end of saslfinger output -- 

So i don't know where i can search for a solution. I read in the Tutorial some about a excellent Tutorial about Authentication between Windows and Linux, but there is no link to this excellent Document and i can't find it with google, anybody know this Document?

I think there can be a Problem with diffrent Service Principles in the AD, but i don't know the SP for Postfix for Cyrus works: host/hostname@REALM but not for Postfix.

Can anybody help me to find the excellent Document or a tip for a solution?

Regards Rene