Oleg's questions

I'm in an environment with a serious lack of IPv4 addresses, but a whole lot of IPv6 addresses. I have all sorts of nice services going on on IPv6, among them MySQL replication. Now, I just want the 2 servers to have a single IPv4-address that can be reached by the outside world. I've tried the following config:

Running Keepalived v2.1.5 on Debian 11.

global_defs {
  @server01 router_id server01
  @server02 router_id server02
}
vrrp_instance vlan0 {
  @server02 state MASTER
  @server02 priority 110
  @server01 state BACKUP
  @server01 priority 100
  interface eth0
  virtual_router_id 123
  @server02 unicast_src_ip 2000:4000:6000:8000::102
  @server01 unicast_src_ip 2000:4000:6000:8000::101
  unicast_peer {
    @server01 2000:4000:6000:8000::102
    @server02 2000:4000:6000:8000::101
  }
  authentication {
    auth_type PASS
    auth_pass secret
  }
  virtual_ipaddress {
    172.1.2.3 dev eth0
  }
}

But that gives me the following errors:

(vlan0): address family must match VRRP instance [172.1.2.3] - ignoring
(vlan0) No VIP specified; at least one is required

Is what I'm trying to do achievable? If so, how? Feels like I'm missing just a little detail...

I'm running the following on Debian 10:

zfs-0.8.4-2~bpo10+1
zfs-kmod-0.8.4-2~bpo10+1

I have a 2TB (passphrase encrypted) dataset used by many colleagues. I am also using Zabbix for monitoring, and have implemented certain alarms to know if too many files have been deleted. This is the script I'm running as a cronjob once a day to check how many files have been modified, deleted or added:

#!/bin/bash
LIST="/tmp/snaplist.txt"
DIFF="/tmp/diff.txt"
zfs list -t snapshot | grep production_dataset | grep 'snap_31' | awk '{print $1}' | tail -2 > $LIST && echo "Snapshot list saved"

while read -r SNAP; do
        snaps+=("$SNAP")
done < $LIST

zfs diff "${snaps[0]}" "${snaps[1]}" > $DIFF && echo "Diff saved successfully"

status=(M - + R)
trappers=(mod rem add ren)

for ((n=0;n<${#status[@]};n++)); do
        RESULT=$(cat $DIFF | grep -E "^${status[n]}" | wc -l)
        TRAPPER="zfsdiff_${trappers[n]}"
        /usr/bin/zabbix_sender -c /etc/zabbix/zabbix_agentd.conf -k "$TRAPPER" -o "$RESULT"
done

rm $LIST
rm $DIFF

If I run the script manually, it works 90% of the time. Sometimes it gives this error (when running the zfs diff command:

Key must be loaded to discover path names: Permission denied

When running the script via cron, it fails almost all the time, unless I had run the script manually first. Then it works for 2 days, and goes back to giving me the error above.

It also takes a very long while to do the diff (15-20 minutes), and I'm not sure whether it has anything to do with the error above or not. Any ideas?

I would like to convert a lot of ZFS datasets I have on a (Ubuntu 20.04) server (about 3 TB of data). I've already tested this a bit, and what I've been doing so far is:

1. Create a new encrypted dataset with zfs create -o encryption=on -o keyformat=passphrase -o mountpoint=/mnt/encrypted tank/encrypted
2. rsync all the data from the (mounted) unencrypted dataset, i.e /opt/stuff to the encrypted dataset's mount (/mnt/encrypted)
3. Remove the unencrypted dataset.
4. Change the mountpoint for the encrypted dataset, from /mnt/encrypted to /opt/stuff.

The method above works, but maybe there's something in ZFS that would make it easier, and perhaps even let me keep my snapshots and encrypt those (ZFS forums say no to the last point tho).

I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04.

Ususally, when I want to examine traffic on a server, I simply run something like the following:

tcpdump -ni eth0 "tcp port 80" -w log.pcap

On the VPN server it doesn't help me too much though. I only catch "regular" traffic, and no IPSEC traffic. I imagine it's because IPSEC operates one layer below TCP. But I would still like to capture some packets for inspection on Wireshark.

How can I accomplish that?

I am running Debian 9 with mdadm RAID 1 on it. Previously both hard-drives could boot into the OS, now only one of them can.

I have recently had a faulty disk which needed to be replaced, so replace it I did.

First, I ran

mdadm --add /dev/md0 /dev/sda

Which worked well. Right after that I ran

grub-install /dev/sda

Which gave me the following output:

Installing for i386-pc platform.
grub-install: warning: Couldn't find physical volume `(null)'. Some modules may be missing from core image..
grub-install: error: unable to identify a filesystem in hd0; safety check can't be performed.

Here is my output from lsblk:

sda           8:0    0 447.1G  0 disk
└─md0         9:0    0 232.8G  0 raid1
  ├─md0p1   259:0    0  14.9G  0 md    [SWAP]
  ├─md0p2   259:1    0     1K  0 md
  ├─md0p3   259:2    0   216G  0 md    /
  └─md0p5   259:3    0   1.9G  0 md    /boot
sdb           8:16   0   5.5T  0 disk
├─sdb1        8:17   0   5.5T  0 part
└─sdb9        8:25   0     8M  0 part
sdc           8:32   0   5.5T  0 disk
├─sdc1        8:33   0   5.5T  0 part
└─sdc9        8:41   0     8M  0 part
sdd           8:48   0 232.9G  0 disk
└─sdd1        8:49   0 232.9G  0 part
  └─md0       9:0    0 232.8G  0 raid1
    ├─md0p1 259:0    0  14.9G  0 md    [SWAP]
    ├─md0p2 259:1    0     1K  0 md
    ├─md0p3 259:2    0   216G  0 md    /
    └─md0p5 259:3    0   1.9G  0 md    /boot

And here is the output from mdadm --detail /dev/md0:

/dev/md0:
        Version : 1.2
  Creation Time : Wed Dec 12 15:26:35 2018
     Raid Level : raid1
     Array Size : 244066304 (232.76 GiB 249.92 GB)
  Used Dev Size : 244066304 (232.76 GiB 249.92 GB)
   Raid Devices : 2
  Total Devices : 2
    Persistence : Superblock is persistent

  Intent Bitmap : Internal

    Update Time : Thu May 28 18:59:51 2020
          State : clean
 Active Devices : 2
Working Devices : 2
 Failed Devices : 0
  Spare Devices : 0

           Name : localserver:0  (local to host localserver)
           UUID : 83d5a386:66110e10:e5f3c600:734423a8
         Events : 5339803

    Number   Major   Minor   RaidDevice State
       2       8        0        0      active sync   /dev/sda
       1       8       49        1      active sync   /dev/sdd1

I have tried booting with just /dev/sda, but to no avail. I have also tried running blockdev --flushbufs /dev/sda, as recommended by some, but to no avail.

When running GParted I can see that /dev/sdd1 has the flags boot and raid, while /dev/sda has none. I also see there that /dev/sda's first sector starts at 0, while /dev/sdd1's starts at 2048.

Can anyone suggest a way I can solve this?

I don't mind detaching the "weird" hard-drive, formatting it, and reattaching it.

I am running a Debian 10 server which has multiple network interfaces. Can I create rules that will route all network traffic coming in to one IP address on one of the interfaces from the outside (i.e. from other devices on the network), to another IP address not on the same machine but elsewhere on the network? Similarly to WAN-to-LAN routing.

I know how to do it on e.g pfSense but I am quite lost with iptables..

Non-iptables solutions are also welcome.

I'm running an application called Ambar on a (Samba)fileserver. I want users in my network to be able to search for documents freely, and securely. Since Ambar runs on HTTP, and the server already has Apache on it from before, I decided to set up a reverse proxy to Ambar through port 443. Should be quite straight-forward, one might think, but no, apparently Ambar (running on Redis) says the following:

Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted. (taken from docker-compose logs).

I can reach the app's GUI, but I can't do anything there. That's a good thing anyway, since at least I know it's not a certificate issue..

This is my Apache-config:

LoadModule ssl_module modules/mod_ssl.so


<VirtualHost *:443>
    ServerName ambar.internal

    ProxyPreserveHost On
    ProxyPass / http://ambar.internal:1000/
    ProxyPassReverse / http://ambar.internal:1000/

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/ambar.crt
    SSLCertificateKeyFile /etc/ssl/private/ambar.pem
</VirtualHost>

Edit: reverse-proxying with SSL/TLS activated from another machine does not work either.

Making manual modifications of Ambar packages isn't a great idea as the whole app comes with ready Docker containers. So my next attempt is to set up SSL in the docker-compose.yml file, but shouldn't there be a way to accomplish this with good-ol' reverse proxying?

Here is my docker-compose.yml:

version: "2.1"
networks:
  internal_network:
services:
  db:
    restart: always
    networks:
      - internal_network
    image: ambar/ambar-mongodb:latest
    environment:
      - cacheSizeGB=2
    volumes:
      - /opt/ambar/db:/data/db
    expose:
      - "27017"
  es:
    restart: always
    networks:
      - internal_network
    image: ambar/ambar-es:latest
    expose:
      - "9200"
    environment:
      - cluster.name=ambar-es
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
      - IPC_LOCK
    volumes:
      - /opt/ambar/es:/usr/share/elasticsearch/data
  rabbit:
    restart: always
    networks:
      - internal_network
    image: ambar/ambar-rabbit:latest
    hostname: rabbit
    expose:
      - "15672"
      - "5672"
    volumes:
      - /opt/ambar/rabbit:/var/lib/rabbitmq
  redis:
    restart: always
    sysctls:
      - net.core.somaxconn=1024
    networks:
      - internal_network
    image: ambar/ambar-redis:latest
    expose:
      - "6379"
  serviceapi:
    depends_on:
      redis:
        condition: service_healthy
      rabbit:
        condition: service_healthy
      es:
        condition: service_healthy
      db:
        condition: service_healthy
    restart: always
    networks:
      - internal_network
    image: ambar/ambar-serviceapi:latest
    expose:
      - "8081"
    environment:
      - mongoDbUrl=mongodb://db:27017/ambar_data
      - elasticSearchUrl=http://es:9200
      - redisHost=redis
      - redisPort=6379
      - rabbitHost=amqp://rabbit
      - langAnalyzer=ambar_en
  webapi:
    depends_on:
      serviceapi:
        condition: service_healthy
    restart: always
    networks:
      - internal_network
    image: ambar/ambar-webapi:latest
    expose:
      - "8080"
    ports:
      - "8080:8080"
    environment:
      - uiLang=en
      - mongoDbUrl=mongodb://db:27017/ambar_data
      - elasticSearchUrl=http://es:9200
      - redisHost=redis
      - redisPort=6379
      - serviceApiUrl=http://serviceapi:8081
      - rabbitHost=amqp://rabbit
  frontend:
    depends_on:
      webapi:
        condition: service_healthy
    image: ambar/ambar-frontend:latest
    restart: always
    networks:
      - internal_network
    ports:
      - "1000:80"
    expose:
      - "1000"
    environment:
      - api=http://192.168.123.123:8080
  pipeline0:
    depends_on:
      serviceapi:
        condition: service_healthy
    image: ambar/ambar-pipeline:latest
    restart: always
    networks:
      - internal_network
    environment:
      - id=0
      - apiUrl=http://serviceapi:8081
      - rabbit_host=amqp://rabbit
  documentation:
    depends_on:
      serviceapi:
        condition: service_healthy
    image: ambar/ambar-local-crawler
    restart: always
    networks:
      - internal_network
    expose:
      - "8082"
    environment:
      - name=documentation
      - ignoreExtensions=.{exe,dll,rar,s,so}
      - apiUrl=http://serviceapi:8081
    volumes:
      - /media/Documentation:/usr/data

I am running several Samba-shares on a dedicated Debian 9.6 machine joined to an AD-domain (Zentyal with SMB 4).

I am using a pretty straight-forward SSSD installation that has so far worked out perfectly for our needs.

I want to set Ambar up so that the various domain users could search documents on the aforementioned Samba-shares. However, I only want Ambar to crawl "public" documents, and nothing from private/"management" folders.

I've changed the docker-compose.yml file so that Docker will spawn the containers it needs as the user crawler, but when I run docker-compose up -d I get the following error:

ERROR: for Shared-folder Cannot start service Shared-folder: linux spec user: unable to find user crawler: no matching entries in passwd file

Editing the /etc/passwd file manually does not help here. I still get the same error.

This is how the relevant docker-compose.yml configuration looks like:

Shared-folder:
  depends_on:
    serviceapi:
      condition: service_healthy
  image: ambar/ambar-local-crawler
  restart: always
  networks:
    - internal_network
    expose:
    - "8082"
  environment:
    - name=Shared-folder
    - ignoreExtensions=.{exe,dll,rar,s,so}
    - apiUrl=http://serviceapi:8081
  user: crawler
  volumes:
    - /shared/Shared-folder:/usr/data

Please observe that if I remove the line user: crawler, everything works as expected (and root crawls all of my documents).

Here is my /etc/sssd/sssd.conf-file:

[sssd]
services = nss, pam
config_file_version = 2
domains = MY.COMPANY.COM

[domain/MY.COMPANY.COM]
id_provider = ad
access_provider = ad
ad_gpo_map_interactive = +cron
dyndns_update_ptr=false

# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME.  Use with pam_mkhomedir.so
override_homedir = /home/%u
ldap_idmap_autorid_compat = True

And here's my /etc/pam.d/common-session:

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required        pam_unix.so
session required        pam_mkhomedir.so skel=/etc/skel/ umask=0066
session optional                        pam_winbind.so
session optional                        pam_sss.so
session optional        pam_systemd.so
# end of pam-auth-update config

Please let me know if any configs would be helpful! My guess is that smb.conf is not that relevant in this case, and that there might be some way to tell Docker to just trust PAM?

I had set up Arpwatch on my office's pfSense 2.4.3 gateway. Ever since I had done that, I started getting a whole lot of emails - most of them very useful, while some are less useful.

I wonder if there is any way of restricting Arpwatch's reports only to new activity/new station, without the flip flop reports (which stand for 90% of all emails)?

Sure, I could use email filters as a last resort, but those emails are supposed to go to a whole team and not just me.