djk's questions

This may seem quite obscure and perhaps quite niche but bear with me.

The situation is:

• www.domain.com points to infrastructure in EC2, specifically an ELB
• domain.com points to a micro instance in EC2 and is an nginx server thats only purpose is to redirect all requests to www.domain.com
• said micro instance is a single point of failure due to there only being one of them

What we'd like to do is to remove the SPOF so have multiple servers running this redirect. Setting the root domain to a CNAME in order to use an ELB is against the RFC I believe and I don't believe our DNS host will allow us to do this anyway.

What should we do to remove this SPOF given these limitations? Admittedly it's low impact if it does disappear for any reason but the business wants to mitigate this risk.

We have just made a new website for a client and for SEO purposes have a HUGE urlmap setup to rewrite the old site URLs to relevant places on the new site.

Technical details are:

CentOS 5.6 
Apache 2.2
mod_rewrite
PHP 5.3.8

Here is the mod_rewrite block:

RewriteMap urls txt:/www/sites/domain.co.uk/etc/urlmap.txt
RewriteCond %{REQUEST_URI}      ^(.*)$
RewriteCond ${urls:%1|NONE} ^(.*)?$
RewriteCond %1  !NONE
RewriteRule .*  %1 [R=301,NS,QSA,L]

Some redirects do work, for example:

www.domain.co.uk/store/SEURLF/ASP/SFS/PP.Y/RID.577/SFE/Diaries.htm redirects correctly.

www.domain.co.uk/store/SEURLF/ASP/SFS/CATID.1/FORMAT.STUDENT%2FSCHOOL+WEEK+TO+VIEW/ACADEMIC.1/SFE/diaries.htm does not, and 404s. The only difference here is the "+" symbols. This doesn't appear in the rewrite log either, like it's being completely passed over by mod_rewrite due to the special characters.

Another odd occurrence is, for example:

www.domain.co.uk/store/diaries.asp?catid=3 - doesn't rewrite properly, looking in the Apache rewrite log it's completely ignoring the query "?catid=3" for some reason.

I am no expert on mod_rewrite so would appreciate any assistance. If you need more information please do ask.

Thanks in advance!

Edit:

Fixed with:

RewriteCond %{REQUEST_URI}\?%{QUERY_STRING}  ^(.*)$
RewriteCond ${urls:%1|NONE} ^(.*)$
RewriteCond %1  !NONE
RewriteRule .*  %1? [R=301,NS,L]

I'm not sure best how to solve this situation that I've found myself in. The VPN in this is running OpenVPN.

I have an app server that needs to make web server requests to a specific server that exists on another network and is only accessible via VPN. However, this machine is not connected to the VPN. There is another server in the farm which does batch processing tasks involving a database which is on the VPN, and therefore has a connection.

Obviously an easy answer to this issue would be to setup the VPN on the app server as well as the batch server, but these servers are in an EC2 farm using Scalr.net. At one point we had 15 app servers running and the client doesn't want to have 15 VPN connections running and we run into the issue of each server needing its own certificate (as far as I know – my knowledge of OpenVPN is limited) and how to include a server-specific cert when each new app server is built off a standard image so they would all be trying to connect with the same cert which is tied to an IP.

The app server needs to be able to send requests like this to a specific host that is at the other end of the VPN that's up and running on the batch box: https://xxx.xxx.xxx.xxx/client/WebService

Can this be achieved with an SSH tunnel or would I have to configure a VPN of my own between the two servers?

Port 80 and 443 are in use on the app servers.

I feel I haven't explained this well enough, so please do ask questions if you need to.

I thank you all in advance as I'm really not sure the best solution here.

Thanks.

We have Kerio Connect (mail server) running on a Windows Server 2003 server on a domain. In the webmail client, users are able to change their domain password. This functionality used to work fine until a user tried to change their password a few days ago, when every password they'd try would result in the webmail client claiming their password was "invalid". I spoke to Kerio about this and they claim that this error is returned by the domain controller, which supports my initial investigations.

The error that the DC is logging when an attempt is made to change the password is this:

"80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece"

The "data 52e" part indicates that this is an "invalid credentials" error. I don't see how this can be as I've tried (in the Kerio Connect configuration) various accounts that have privileges to modify accounts, including my own as I am a domain admin.

I have ran 'dcdiag' (all tests) on the DC and it came back passing every single one of them. I've searched high and low for an answer to this and came up empty.

Does anyone have any idea why this may have suddenly started happening?

Thanks!

Edit: I should mention that the passwords we are changing to do comply with the complexity policy.

This is somewhat related to my previous question, Why do installed fonts disappear after reboot?.

Having got the font install issue sorted out under XP just fine, recently we've got a Windows 7 workstation and I've created a special GPO for it. Initially it was UAC that was demanding administrative access to C:\windows\fonts despite the fact the policy dictates that directory is writable (as is the relevant registry entries, on XP anyway). The issue now though is that when I try to copy a font or hit install it claims that the font "does not appear to be a valid font". This happens with every type of font as well.

Is there some new and special consideration when allowing these changes on Windows 7?

Any input would be appreciated.

Many thanks, Doug

I'm currently replicating the setup of a CentOS box an am running into a strange error while trying to mount a samba share that resides on a NAS. The error I'm getting is:

mount error 127 = Key has expired

Refer to the mount.cifs(8) manual page (e.g.man mount.cifs)

The settings are identical to the old machine, the password is definitely correct as well. I have googled the issue of course, and looked at every single page that references this issue (not that many) and have still not found an answer.

The older CentOS box is using version 3.0.28-0.el4.9 of Samba and the one I'm trying to setup now is 3.0.33-3.7.el5_3.1. I don't know if this has anything to do with it but it's certainly one of the only differences between the 2 setups.

When I try the mount command this appears in the syslog:

Sep  8 10:51:54 helvetica2 kernel: Status code returned 0xc0000072 NT_STATUS_ACCOUNT_DISABLED

Sep  8 10:51:54 helvetica2 kernel:  CIFS VFS: Send error in SessSetup = -127

Sep  8 10:51:54 helvetica2 kernel:  CIFS VFS: cifs_mount failed w/return code = -127

The account is very much not disabled as it works on the old box using the same credentials.

Has anyone else seen this problem?

At my place of employment we have designers who have to be able to install fonts to complete their work so I have given them write access to %sysroot%\fonts and to %sysroot%\system32\FNTCACHE.DAT through GPO and they can install and use fonts fine but after a restart these fonts disappear. Anyone have any idea why?

Windows 2003 Server running AD as PDC. Windows XP clients.

Thanks!

I'm running a Windows Server 2003 PDC with AD and we have 2 machines that we require everyone to be able to remotely log in to. So I add "Domain Users" to the built in "Remote Desktop Users" account but after a policy refresh this group empties itself which results in the "The local policy of this system does not permit you to logon interactively" error.

In GPO I then added the "Domain Users" group to "Allow log on through Terminal Services". This gets me passed the previous error but brings up a new error message of "You Do Not Have Access to Logon to This Session".

Domain Admins can log on ok, it's just normal users that can't.

Anyone have any ideas? I'm tearing my hair out here. I come from a unix admin background so this is all new to me. GPO is proving to be a royal pain in the ass, but useful for some things.

Please help!

Thanks!

Edit: I should mention the 2 machines that I require people to be able to RDP into are Windows XP clients, so they don't have the "Terminal Services Configuration" tool. Edit2: Running Windows Server 2003 R2 x64, updated to the hilt.