jimbobmcgee's questions

My Google-fu is letting me down with this one.

Is it possible to EITHER/preferably configure sendmail to...

• masquerade the From address of any mail intended for [email protected] to appear as [email protected] and use smtp.aaaa.com to send it (with authentication)
• AND masquerade any mail intended for [email protected] (including those that share To, CC or BCC with above) to appear as [email protected] and use smtp.bbbb.com to send it (with different auth user/pwd)
• AND use smtp.cccc.com for any other non-local address (again, with different auth)
• AND store mail for local users, as it currently is in /var/spool/mail/$USER

...OR configure sendmail to...

• use smtp.aaaa.com (with auth) to send any mail appearing to be From [email protected]
• AND use smtp.bbbb.com (different auth) to send any mail appearing to be From [email protected]
• AND use smtp.cccc.com (different auth) for any other non-local address
• AND store mail for local users, as it currently is in /var/spool/mail/$USER

...?

The sendmail server is not exposed externally, so this isn't a security/open-relay concern -- just trying to support a local app with limited mail config, that we're hoping to send to different parties with differing (mostly vanity) mail requirements.

I'm not a sendmail guy, by trade, and am only targeting sendmail because I understand it to be the de-facto on AIX7.1 and AIX7.2, which are the current- and next-validated OS for the proprietary app.

The server appears only to have an /etc/mail/sendmail.cf file, rather than a sendmail.mc (although a lot of /usr/samples/*/sendmail/*/*.m4). The server reports Version AIX7.1/8.14.4.

I think I need to enable mailertable (for the relay), genericstable (for the masquerade) and authinfo (for the auth), and use some combination of those to get what I'm after but, without a sendmail.mc, I'm at a loss as to how I do that.

Somewhere between Windows 2012 and 2016, Microsoft added a conditional feature to NTFS permissions, where a given ACE could be limited to only apply if certain claims about the user or device were true.

When the Advanced view of the Permissions Entry dialog refers to these conditions, one of the options you are given the choice of is User is a member of... or Device is a member of....

Does anyone know definitively, when referring to Device is a member of..., is it referring to the server device (i.e. the one on which the file or folder resides) or the client device (i.e. the one from which the end-user attempts to access the file)?

In the contrived below example dialog, is it saying that:

• Everyone has read-access to the folder as long as they access it from a machine in the Domain Computers group?
• Everyone has read-access to the folder as long as the file server on which that folder resides is in the Domain Computers group?

I can see uses for either approach so, in either case, is there an alternative condition I could use (or define via a GPO/Central Access Policy) that infers the other meaning...?

(aside: I think this is referred to Dynamic Access Control, but my Google-fu is failing me, and I keep getting info on Azure AD, which is not what I am interested in.)

In a new, on-premises Exchange 2016 environment — deliberately chosen to be installed with AD Split Permissions so that Exchange administrators could not accidentally delete AD objects — how is one supposed to create Shared Mailboxes?

The AD admin has created the User object representing the shared mailbox, but the EAC shows no + button under the recipients -> shared section, and the New-Mailbox PS cmdlet has no -Type or -Shared parameter.

The recipients -> mailboxes section has an + button, from which the Exchange admin can choose User mailbox and choose an existing user (they rightly cannot choose New user), and a user mailbox is created, but there seems to be no way to change it to be a shared mailbox.

Running Set-Mailbox foo -Type Shared in PS (against the user mailbox created in EAC) fails with Insufficient access rights to perform the operation.

Running Enable-Mailbox foo -Shared in PS (against the AD user created by the AD admin) succeeds, but warns The ntSecurityDescriptor of the Active Directory object wasn't updated successfully with further Access is denied/INSUFF_ACCESS_RIGHTS wording.

If the AD admin has to do the legwork here, that's fine (within reason), but what do they actually have to do?

I have a VBScript file that is run by the Task Scheduler, every day. The task was manually created on 6th February 2017, using the regular Create Task GUI, and has a Weekly trigger with Monday-Friday checked and a start time of 08:00.

It runs the VBScript file, using a Start a program action of:

• Program/script: %SystemRoot%\system32\cscript.exe
• Add Arguments: x:\pathto\scriptname.vbs //NOLOGO //E:VBS //B
• Start In: x:\pathto

I have history records that prove that the task has run, and it is not being updated or replaced by Group Policy Preferences.

The same script runs on all my servers — same script, same trigger, same action — and has just started happening on four different Windows Server 2012 R2 servers at once, but has not occurred on any of my Windows Server 2008 R2 instances.

When I recreated the task on one of the affected servers, it started reporting Last Run Time again. Is this some known issue? Any known fixes? My Google-fu is letting me down.

http://support.microsoft.com/en-us/kb/950934 describes the manner in which, when a member of the Administrators group uses Explorer to navigate to a folder to which the Administrators group has permission, the user will be prompted to "Click Continue to permanently get access to this folder".

When they do this, Explorer alters the ACL of the folder to grant that specific user Full Control to the folder. The MS link describes exactly the design constraint that requires it to be this way.

However, it ruins the permission set for that folder and makes central management of permissions effectively impossible. For example, if the named user is later removed from the Administrators group, that ACL entry still exists to permit them access to that folder.

I'm not looking to disable UAC (I actually like the distinction between elevated and non-elevated), and I am happy to use alternative tools to navigate and view files in an elevated fashion.

The eventual intent is to run one of the workarounds described in the MS link (either using a separate file navigator that can run elevated, or defining a separate group to control access to the whitelisted folders) but, all the time Explorer continues to clobber the ACLs of the folder, at will, it makes it impossible to identify where these workarounds need to be applied (short of regularly auditing every folder for ACL changes).

I would simply prefer to have the standard "access denied" message, if I attempt to access a restricted folder when running non-elevated in Explorer.

Is there a setting (either one-time on each box, or via GPO) that removes this "permanently get access" prompt, while retaining the other facilities of UAC?

NB: I fully understand why this prompt exists, what it means and why the behaviour is as it is (although I don't necessarily agree with the design decision). However, I should point out that I am not looking to discuss workarounds relating to the working practice of my users, nor the merits/pitfalls of UAC or Administrators group membership.

In the VMware Infrastructure Client (no vCenter), under the Resources / Advanced CPU section of each VM's Edit Settings dialog, there is an option to alter the Scheduling Affinity of a VM. It sets the sched.cpu.affinity value in the VMX file.

I believe this allows me to force a VM to only be serviced by a specific physical CPU on the host, judicious use of which might in some cases allow me to license a VM for one physical CPU rather than the two that are in the host.

The description of the config field in Edit Settings is as follows:

Hyperthreading Status: Active

Available CPUs: 12 (logical CPUs)

Select logical processor affinity for this virtual machine.

Use '-' for ranges and ',' to separate values. For example, "0,2-4,7" would indicate processors 0, 2, 3, 4 and 7.

Is it fair to assume (in this and similar cases):

• numbers 0 to 11 represent each of the physical cores (or are the 'hyperthreads' numbered too)?
• if I wanted to limit the VM to run on one of the physical CPUs, I should enter either 0-5 or 6-11 (or are these numbers in some different pattern)?

Otherwise, is there a reliable source (VIC screen, shell command, etc.) to look up the number-to-CPU mapping on any particular host?

(For reference, the CPUs are Intel Xeon X5675 units, which are each 6-core with hyperthreading.)

Today I have had disks on two separate HP ProLiant servers go into Predictive Failure. One of these servers runs Windows Server 2008 R2 and one runs Oracle Enterprise Linux 5 (a RHEL5-based distro).

If I look in the Integrated Management Logs for these servers, the Windows server has a 'Caution' entry announcing the Predictive Failure, but the OEL server does not have the same.

We have some existing business process around the IML (ticket integration, reporting, etc.), hence the preference to have these messages there. All the right bells and whistles sounded for the Windows box, but nothing from the OEL server.

I've gone back through my monitoring system's alert history and it shows that this has always been the case -- the Windows server reports its disk failures (predictive and actual), while the OEL server does not.

SNMP trap alerts appear to be working; these are logged in root's mail file and are captured in the /var/log/messages file. Interestingly, the IML on the OEL server does appear to be showing me Repaired entries for previous disk failures. It is just the initial Caution or Failure entry that appears to be missing from the log.

The Windows server has all the HP Management agents installed as part of the Intelligent Provisioning/Smart Start install of the OS. The OEL server has the RHEL5 HP yum repo enabled, and has the hpsmh, hpilo, hp-health and hp-snmp-agents packages installed.

The Windows server is a DL380p Gen8, while the OEL server is a DL380 G7. I have no other server generations running OEL to compare (although it does appear to be common to the three DL380 G7 servers I have running OEL). Further checking shows IML-logged drive errors on other Windows servers, at least as far back as G5 (so I don't think it is a generation issue).

I've also looked at the startup/config scripts in /opt/hp/hp-snmp-agents/storage/etc/cma* but can't see anything the pertains to the IML (not that I really know what I am looking for here).

Is it a missing package or config statement (i.e. something readily rectifiable) that is preventing these messages reaching the IML?

Or is it a known issue (leaving me no choice but to hack something else into the business process)?

I'm trying to mount a snapshot of a ZFS zvol. The zvol should have a ext2 partition on it (as evidenced by the CentOS VM to which the zvol is currently shared by iSCSI):

[root@test-vm ~]# file - < /dev/sdb
/dev/stdin: x86 boot sector; partition 1: ID=0x83, starthead 4, startsector 256, 6291200 sectors, code offset 0xb8
[root@test-vm ~]# file - < /dev/sdb1
/dev/stdin: Linux rev 1.0 ext2 filesystem data (mounted or unclean) (large files)

However, mount always returns Invalid argument:

[root@freenas] /dev/zvol/vol01# ls
./                        zvol01                    zvol01@backups1           zvol01@manual-20140521s1  zvol01@manual-20140522s1
../                       zvol01@backup             zvol01@manual-20140521    zvol01@manual-20140522
[root@freenas] /dev/zvol/vol01# file - < zvol01
/dev/stdin: x86 boot sector; partition 1: ID=0x83, starthead 4, startsector 256, 6291200 sectors, code offset 0xb8
[root@freenas] /dev/zvol/vol01# file - < zvol01@backup
/dev/stdin: x86 boot sector; partition 1: ID=0x83, starthead 4, startsector 256, 6291200 sectors, code offset 0xb8
[root@freenas] /dev/zvol/vol01# file - < zvol01@backups1
/dev/stdin: data
[root@freenas] /dev/zvol/vol01# mkdir /tmp/zvol01
[root@freenas] /dev/zvol/vol01# mount -t ext2fs -r /dev/zvol/vol01/zvol01@backup /tmp/zvol01
mount: /dev/zvol/vol01/zvol01@backup: Invalid argument
[root@freenas] /dev/zvol/vol01# mount -t ext2fs -r /dev/zvol/vol01/zvol01@backups1 /tmp/zvol01
mount: /dev/zvol/vol01/zvol01@backups1: Invalid argument

I presume that zvol01@backups1 is the correct target (i.e. the first partition under on the block device, zvol01@backup) -- both return Invalid argument, regardless.

What am I missing here?

Edit

As requested, the output of zfs list and zfs get all...

[root@freenas] ~# zfs list
NAME                   USED  AVAIL  REFER  MOUNTPOINT
vol01                 25.6G   358G   232K  /mnt/vol01
vol01/.system         1.44M   358G   244K  /mnt/vol01/.system
vol01/.system/cores    209K   358G   209K  /mnt/vol01/.system/cores
vol01/.system/samba4   506K   358G   506K  /mnt/vol01/.system/samba4
vol01/.system/syslog   517K   358G   517K  /mnt/vol01/.system/syslog
vol01/ds01             784M   358G   784M  /mnt/vol01/ds01
vol01/zvol01          24.9G   382G   113M  -

[root@freenas] ~# zfs get all vol01/zvol01
NAME          PROPERTY              VALUE                  SOURCE
vol01/zvol01  type                  volume                 -
vol01/zvol01  creation              Wed May 21 20:29 2014  -
vol01/zvol01  used                  24.9G                  -
vol01/zvol01  available             382G                   -
vol01/zvol01  referenced            113M                   -
vol01/zvol01  compressratio         1.00x                  -
vol01/zvol01  reservation           none                   default
vol01/zvol01  volsize               24G                    local
vol01/zvol01  volblocksize          4K                     -
vol01/zvol01  checksum              on                     default
vol01/zvol01  compression           lz4                    inherited from vol01
vol01/zvol01  readonly              off                    default
vol01/zvol01  copies                1                      default
vol01/zvol01  refreservation        24.8G                  local
vol01/zvol01  primarycache          all                    default
vol01/zvol01  secondarycache        all                    default
vol01/zvol01  usedbysnapshots       215K                   -
vol01/zvol01  usedbydataset         113M                   -
vol01/zvol01  usedbychildren        0                      -
vol01/zvol01  usedbyrefreservation  24.8G                  -
vol01/zvol01  logbias               latency                default
vol01/zvol01  dedup                 off                    inherited from vol01
vol01/zvol01  mlslabel                                     -
vol01/zvol01  sync                  standard               default
vol01/zvol01  refcompressratio      1.00x                  -
vol01/zvol01  written               221K                   -
vol01/zvol01  logicalused           74.4M                  -
vol01/zvol01  logicalreferenced     74.3M                  -

[root@freenas] ~# zfs get all vol01/zvol01@backup
NAME                 PROPERTY              VALUE                  SOURCE
vol01/zvol01@backup  type                  snapshot               -
vol01/zvol01@backup  creation              Thu May 22  1:48 2014  -
vol01/zvol01@backup  used                  215K                   -
vol01/zvol01@backup  referenced            113M                   -
vol01/zvol01@backup  compressratio         1.00x                  -
vol01/zvol01@backup  devices               on                     default
vol01/zvol01@backup  exec                  on                     default
vol01/zvol01@backup  setuid                on                     default
vol01/zvol01@backup  xattr                 on                     default
vol01/zvol01@backup  nbmand                off                    default
vol01/zvol01@backup  primarycache          all                    default
vol01/zvol01@backup  secondarycache        all                    default
vol01/zvol01@backup  defer_destroy         off                    -
vol01/zvol01@backup  userrefs              0                      -
vol01/zvol01@backup  mlslabel                                     -
vol01/zvol01@backup  refcompressratio      1.00x                  -
vol01/zvol01@backup  written               113M                   -
vol01/zvol01@backup  clones                                       -
vol01/zvol01@backup  logicalused           0                      -
vol01/zvol01@backup  logicalreferenced     74.3M                  -

[root@freenas] /dev/zvol/vol01# gpart show
=>      63  16777153  da0  MBR  (8.0G)
        63   1930257    1  freebsd  [active]  (942M)
   1930320        63       - free -  (31k)
   1930383   1930257    2  freebsd  (942M)
   3860640      3024    3  freebsd  (1.5M)
   3863664     41328    4  freebsd  (20M)
   3904992  12872224       - free -  (6.1G)

=>      0  1930257  da0s1  BSD  (942M)
        0       16         - free -  (8.0k)
       16  1930241      1  !0  (942M)

=>       34  286749421  da1  GPT  (136G)
         34         94       - free -  (47k)
        128    4194304    1  freebsd-swap  (2.0G)
    4194432  282555023    2  freebsd-zfs  (134G)

=>       34  286749421  da2  GPT  (136G)
         34         94       - free -  (47k)
        128    4194304    1  freebsd-swap  (2.0G)
    4194432  282555023    2  freebsd-zfs  (134G)

=>       34  286749421  da3  GPT  (136G)
         34         94       - free -  (47k)
        128    4194304    1  freebsd-swap  (2.0G)
    4194432  282555023    2  freebsd-zfs  (134G)

=>       34  286749421  da4  GPT  (136G)
         34         94       - free -  (47k)
        128    4194304    1  freebsd-swap  (2.0G)
    4194432  282555023    2  freebsd-zfs  (134G)

=>      63  50331585  zvol/vol01/zvol01@backup  MBR  (24G)
        63       193                            - free -  (96k)
       256   6291200                         1  linux-data  (3G)
   6291456  44040192                            - free -  (21G)

=>      63  50331585  zvol/vol01/zvol01-clone-backup  MBR  (24G)
        63       193                                  - free -  (96k)
       256   6291200                               1  linux-data  (3G)
   6291456  44040192                                  - free -  (21G)

Edit #2

Found these in dmesg:

ext2fs: zvol/vol01/zvol01@backup: wrong magic number 0 (expected 0xef53)
ext2fs: zvol/vol01/zvol01@backups1: wrong magic number 0 (expected 0xef53)
ext2fs: zvol/vol01/zvol01-clone-backup: wrong magic number 0 (expected 0xef53)
ext2fs: zvol/vol01/zvol01-clone-backups1: wrong magic number 0 (expected 0xef53)

Is there something else I have to do to the block device before it will mount?

I've got a Dell T310 server for which we have made volume backups of the system drive with Windows Backup. I'm trying to restore one of these, which means I need to boot from the Windows install CD. I also know I need to load the PERC storage controller drivers, and have them on a USB.

There is usually splash screen which asks for your language/keyboard settings and then offers options to "Install Now" and "Repair your computer". Normally, I would click "Repair your computer", which opens the System Recovery dialog. From there, I would choose the "Load drivers" button, browse to the drivers on the USB and carry on from there.

However, when this server boots, it asks for the language/keyboard settings, then immediately says "A required CD/DVD device driver is missing." and prompts for the driver. I point it at the PERC drivers on the USB and it continues.

However, at this point, it completely bypasses the "Install Now" / "Repair your computer" splash screen and proceeds to the edition menu and the disk partitioning, as if I had clicked "Install Now".

How do I get it to take the "Repair your computer" branch after taking the device driver?

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still see The SQL Server Network Interface library could not register the Service Principal Name when trawling the ERRORLOG file.

I have added my service account (not a Managed Service Account, just a regular user account), to an AD group (e.g. SQL Servers), and I have added an ACE to my domain Computers container's ACL, for this group, selecting:

• Apply to: Descendant Computer objects
• Validated write to service principal name: Allow
• Read servicePrincipalName: Allow
• Write servicePrincipalName: Allow

I have replicated this to all domain controllers, and confirmed the inheritence of the new ACE to the specific computer object, using both the Effective Permissions tab and with dsacls CN=SERVER01,CN=Computers,DC=fabrikam,DC=local, the latter of which now includes:

Allow FABRIKAM\SQL Servers
                                  SPECIAL ACCESS for Validated write to service principal name   <Inherited from parent>
                                  WRITE SELF
Allow FABRIKAM\SQL Servers
                                  SPECIAL ACCESS for Validated write to service principal name   <Inherited from parent>
                                  WRITE SELF
                                  WRITE PROPERTY
                                  READ PROPERTY

However, when I restart the SQL Server service, I still see the could not register the Service Principal Name message. I have also restarted the server, with the same result.

I have used Sysinternals Process Explorer to inspect the running sqlservr.exe; the Security tab there clearly shows the correct service user and its membership of the SQL Servers group.

I know I can manually add the SPN with setspn -A, but that isn't really the point.

What else must I do to ensure that the service account (and any future account I place in the SQL Servers group) can automatically register its own SPN without manual intervention?

AND/OR

How can I further diagnose which privileges/permissions are missing here?

When defining IPSec VPN tunnels, how much of a performance impact can I expect from choosing "stronger" Phase 1 settings (such as AES256/SHA1/DH5 over DES/MD5/DH1)?

For example, I'm told that AES-256 is 40% slower than AES-128 (which is reasonable, I guess), but am I right in thinking that overall "noticable" tunnel throughput is only really going to be affected if that is specified in Phase 2?

I'm thinking that specifying/prioritising stronger Phase 1 settings will just mean that the endpoints will take marginally longer to authenticate on startup (and at the lifetime intervals), rather than decreasing the throughput of the tunnel, and so I should probably prioritise IKE proposals (which are shared by all tunnels in a Cisco ASA device) by algorithm strength, rather than performance.

Am I on the right track?

(Having discussed it with some of the guys at Security.SE, I reckon I have a preference based on the security of the stronger algorithms; for now, I'm more interested in the performance aspect)

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various compression tools unzip to, when a user might choose to open an executable straight from a Zip file.

From the TechNet article, http://technet.microsoft.com/nl-nl/library/cc786941%28v=ws.10%29.aspx:

You can use environment variables in a path rule. Since path rules are evaluated in the client environment, the ability to use environment variables (for example, %Windir%) allows a rule to adapt to a particular user’s environment.

...

A path rule can incorporate the ? and * wildcards, allowing rules such as "*.vbs" to match all Visual Basic Script files. The following examples illustrate the use of wildcards:

• “\DC-??\login$” matches \DC-01\login$, \DC-02\login$
• “*\Windows” matches C:\Windows, D:\Windows, E:\Windows
• “c:\win*” matches c:\winnt, c:\windows, c:\windir

I have these Path rules (which I have applied both singularly and in various combinations):

• %APPDATA%\*.exe
• %APPDATA%\*\*.exe
• %LOCALAPPDATA%\*.exe
• %LOCALAPPDATA%\*\*.exe
• %TEMP%\*.exe
• %TEMP%\7z*\*.exe
• %TEMP%\wz*\*.exe
• %TEMP%\Rar*\*.exe

...which theoretically should represent executables directly under the user's temp folder, and executables in temp folders named in the manner that Winzip, WinRAR and 7-zip might name their temp folders (e.g. %TEMP%\7zSF20.tmp\the_file.exe).

The %APPDATA% and %LOCALAPPDATA% ones work; the %TEMP% ones don't. Executables appear to be blocked under %TEMP% but this is only because, in a default setup, they also match the %LOCALAPPDATA%\*\*.exe rule (Temp is under AppData\Local, by default).

I had originally thought this was an issue with wildcards in partial folder names, but it appears this is specific to the use of the %TEMP% variable (hence the rewrite).

The two workarounds I have confirmed (and why I'd prefer not to use them) are:

1. using %LOCALAPPDATA%\Temp in place of %TEMP%

   • Strictly speaking, this is not correct, as the %TEMP% variable can be set to differ from %LOCALAPPDATA%\Temp.

2. using %HKEY_CURRENT_USER\Environment\TEMP%

   • Registry-based path rules seem to apply to all subfolders -- I would prefer a slightly lighter touch (so I don't have to go around whitelisting everything else)
   • Registry-based rules appear to be limited such that you cannot have anything more specific, e.g. %HKEY_CURRENT_USER\Environment\TEMP%\7z*\*.exe
     • I have since discovered %HKEY_CURRENT_USER\Environment\TEMP%7z* will get close (the \ between the variable and the subfolder should not be specified, and you can't specify a filename mask afterwards)
   • It is also also technically incorrect, as this registry location only contains the value as it should be at the start of a process and not what it might be changed to during the course of that process -- e.g. it would not apply if you opened a Command Prompt, issued SET TEMP=C:\ and ran the program from the prompt).

(For what it is worth, I have tried configuring the SRP in both the Computer and User sections of the GPO, both independently and simultaneously, in case one overwrote the other, or %TEMP% was resolved differently at Computer and User level.)

What's so special about the %TEMP% variable that it would not apply here, whereas something like %LOCALAPPDATA%\Temp\\wz*\\*.exe would?

Update:

It appears that the limitation is specifically with the %TEMP% environment variable. I have edited the question, as such.

I have a handful of HP DL3xx G7 servers, that I know have HP D2600 disk units attached via P411 SmartArray controllers.

I can see info about the array controllers and the disks (via the Array Configuration Utility and the System Management Homepage); I can use various OS tools to see the on-board devices (e.g. by Windows Device Manager, WMI; or Linux lshal); I can see the volumes (Windows Device Manager/Disk Management; Linux fdisk) but nothing about the physical enclosures, themselves.

I was really just trying to answer some basic questions (e.g. the serial numbers of the enclosures) without having to go to the data centre.

The servers are running a RHEL-based Linux and I just thought it was my own lack of understanding of Linux, but I also can't seem to discover these in Windows either.

Am I going mad? Blind? Or can you really not remotely or programatically retrieve information about such devices attached to your server?

I'll try as hard as I can to word this so it is not considered a shopping list.

We have been successfully running a dev/test ESXi environment for some time, with a couple of Dell PE2950III servers over an HP MSA2012fc Starter Kit (with the Brocade-based HP Class B SAN switch). This has worked very well for us, but being in dev/test, it comes with various caveats with regards to uptime/performance.

In any case, the perceived success of the dev/test platform has led to calls for a more 'production-ready' virtualisation platform. We are drafting the recommendations at the moment.

However, one of the complaints levelled at the existing stack is a lack of support for other virtualisation technologies (HyperV, Xen, etc), as the SAN LUNs are fully-allocated and formatted as VMFS. This is something that we have been told to overcome but, as is typical, there is no indication of the uptake of HyperV/Xen (and we don't particularly want to waste the 'expensive' storage resource by allocating LUNs to such where it won't be used).

As such, our current line of thinking is to forego the traditional fibre SAN, in favour of a straight-forward CentOS box (probably higher-end HP ProLiant DL380p Gen8), running NFS and Samba/CIFS daemons, with a 10GbE switch (probably Cisco Nexus 5000/5500-series).

The reasoning is and that the ESXi heads could talk NFS and the HyperV heads could talk CIFS, but both ultimately be pointing to the same XFS/RAID1+0 volumes.

Now, I'm not green enough to think that 10GbE is going to allow me to get true 10 gigabits of I/O throughput between the heads and the disks, but I don't know the kinds of overheads I can expect to see from the NFS and CIFS implementations (and any other bits that might interfere when more than one host tries to talk to it).

I am hoping to at least get near to the sustained disk read/write speeds of direct-attached disks, though, for as many hosts as I can. Looking at various drive manufacturer websites, I'm roughly anticipating this to be somewhere around the 140-160MB/s mark (if I am way off, please let me know).

What recommendations/guidelines/further reading can anyone offer with regards to Linux/NFS/Samba or 10GbE switch configuration that might help attain this?

We have a Windows Server 2008 R2 domain controller which always sets its NLA location to 'Network 3' after a reboot. Without fail, this defaults to Public, which screws with my Domain profile firewall settings. I have to manually disable and re-enable the network adapter before it will set itself back to the domain profile.

I've tried KB2524478 and a whole host of other things. Now I'm tired of trying to fix this problem (and fast running out of time) so just want to get around it. I was thinking about scripting the disable/enable with netsh and being done with it, but I'd like to go one step further and make sure that the NLA location is actually "Network 3" and not "the-domain.example.org" (more specifically, just checking it is not the domain) before I do. That way, I can schedule it more frequently than just on startup.

I'm just missing a piece of this puzzle — how to retrieve the location using something I can pipe to FIND /i "the-domain.example.org", so I can run it as:

<something> | ...
FIND /i "the-domain.example.org" || ...
NETSH interface set interface name="Local Area Connection" admin=DISABLED & ...
NETSH interface set interface name="Local Area Connection" admin=ENABLED

So what is <something>?

The Cisco Nexus 5548UP switch is sold in a both front-to-back and back-to-front cooling options, but which side is considered the front?

• The side with all the SFP+ ports?
• The side with the management RJ45 ports?

I would want to mount the switch so that the SFP+ ports are at the rear of the rack, in line with the backs of the servers. Does this mean I should buty the back-to-front model?

(Redefined the question to match actual LAN topology...)

I have a new Cisco ASA-5512-X firewall, which is going into an existing network stack to separate some specific client servers from the rest of our LAN (i.e. not as the edge device).

The existing LAN infrastructure already has a Data VLAN (where the normal network nodes live), a Management VLAN (where the sysadmins desktops and backup devices live) and a Devices VLAN (where all the 'remote management' interfaces for all the network devices and servers live). The VLANs are all firewalled by the core firewall, with security-level statements to allow the sysadmins/backup server to access both the Data and Devices VLANs, while preventing the Data and Devices VLANs from talking to each other.

Below is an attempted diagram to explain the current setup.

                                   213.48.xx.xx    ( MGT_VLAN  Gi0/1.10  sec 100 )
                                         |     ____( DVCS_VLAN Gi0/1.12  sec 80  )
                                         |    /    ( DATA_VLAN Gi0/1.100 sec 80  )
                                         |   / 
           +------------------------[Core F/W]------------------------+
           |                             |                            |
     172.31.0.10                   172.31.255.10                172.31.100.10
           |                             |                            |
-------------------------------------------------------------------------------------
MgtVLAN#10:172.31.0.0/24 | DvcsVLAN#12:172.31.255.0/24 | DataVLAN#100:172.31.100.0/23  
-------------------------------------------------------------------------------------
         | | |                           |                |              \ \ \
      [SysAdmins]                 172.31.255.136    172.31.100.252    [LAN Clients]
                                         |                |
                                         +------------[New ASA]
                                                          |
                                                    172.31.250.10
                                                          |
                                       -----------------------------------------
                                       SecretLAN:172.31.250.0/24  [L2 Switching]
                                       -----------------------------------------
                                                        | | |
                                                   [Secret Servers]  

In keeping with the current LAN, I would like to specify the Management0/0 interface on the new ASA to live within the Devices VLAN, so it can only be accessed by Telnet/SSH/ADSM via an address in that VLAN's subnet. Ma0/0 has management-only enforced, preventing through traffic. It can't be removed from the new 5512-X model and I can't use one of the other interfaces, because the IPS component of the new ASA (the very reason we have to do this) is only accessible via Ma0/0.

If I plug a sysadmin desktop into an access-port for the Devices VLAN, I can access the management interface of the new ASA. However, a sysadmin desktop in its normal home in VLAN10 cannot, even though the security-level on the core firewall should permit this.

I believe I have narrowed it down to a basic routing issue: the new ASA is configured with route OUTSIDE 0.0.0.0 0.0.0.0 172.31.100.10 (i.e. the default gateway is the address of the core firewall's Data VLAN subinterface), and Ma0/0 is configured with ip address 172.31.255.136 255.255.255.0 (firmly in the Devices VLAN subnet). The new ASA will accept a management connection from the Management VLAN (172.31.0.0/24) but cannot send the reply because it tries to route back through the OUTSIDE interface.

I cannot add route MANAGEMENT 172.31.0.0 255.255.255.0 172.31.255.10, however, because that will surely cause the backup server's traffic (also on a 172.31.0.0/24 address) to mis-route via the MANAGEMENT interface (a 100Mbps NIC) instead of the OUTSIDE (a 1Gbps NIC).

Can I get the Ma0/0 interface working in this fashion? Or would I have to put in a terminal on the Devices VLAN and use it as a double-hop from my Management VLAN (e.g. by SSH remote port forwarding; or telnet to one, then telnet to the other)?

I have a CentOS 6.2 box up and running and have configured autofs to automount Windows shares under a /mydomain folder, using various howtos on the internet. Specifically, I have three files:

/etc/auto.master

# ...
/mydomain   /etc/auto.mydomain --timeout=60
# ...

/etc/auto.mydomain

* -fstype=autofs,-DSERVER=& file:/etc/auto.mydomain.sub

/etc/auto.mydomain.sub

* -fstype=cifs,uid=${UID},gid=${EUID},credentials=${HOME}/.smb/mydomain ://${SERVER}/&

This works and allows each user to specify their own credentials in a file under their home directory.

However, the mounts they create are then available to everyone, with the original user's credentials, until the timeout is reached. This is less than ideal, so I've been looking at trying to do one of the following:

1. Configure autofs so that the mounts are local to each user but under the same path, so they can each simultaneously access /mydomain/server1 with their own credentials
2. Configure autofs so that the mount points are under each users' home folder, so they can each simultaneously access ~/mydomain/server1 with their own credentials
3. Configure autofs so that the mounts are under a user-named folder, so they can simultaneously access /mydomain/$USER/server1 with their own credentials (but I would also need to ensure that /mydomain/$USER is 0700 to the given $USER)

So far, I can't see any way of doing #1, but for #2 or #3, I've tried changing the entry in /etc/auto.master so that the key is either ${HOME}/mydomain or /mydomain/${USER}, but neither have worked (the first showed no matching entry in /var/log/messages and the second did not appear to do the variable substitution).

Am I missing something obvious?

(PS: Bonus props if you can provide a way to avoid the need for a plain-text credentials file -- maybe a straight prompt for username/domain/password, or maybe even some kerberos magic?)

(PPS: I have looked briefly at smbnetfs, but I couldn't get it to configure/make -- it asks for fuse >= 2.6 even though I have v2.8.3 according to fusermount --version -- and I couldn't find a released version for yum install)

(PPPS: I also briefly looked at the supplied /etc/auto.smb but it looked like it would suffer the same sharing issues?)

I have an existing firewall+switching layer which is separated into per-client VLANs, with its own numbering strategy, etc. This layer is interconnected by trunk ports such that VLANs numbered on one switch are honoured on any other.

One of my clients now wants to introduce a load-balancer into their VLAN. This device also designates VLANs (e.g. to separate management traffic from balanced traffic). We still require their traffic to be separate from all other clients (which is why we have the VLANs in the first place), so it is my intent to allocate them standard access switch-ports, assigned to their VLAN, as we would if it were just another server.

I don't quite have enough test equipment in my lab to do a full workup of this, so my question is really, will it work?

More specifically:

• Would a VLAN-defining device with its own VLAN strategy, plugged into an access port with my VLAN strategy cause cross-pollution of either strategy?
• Does the traffic coming from that VLAN-defining device just get encapsualated twice, firstly with its own VLAN tags, then with the switching layer's VLAN tags, and could that reasonably be expected to unwind correctly (e.g. for reply traffic)?
• Given that the servers will also be connected to access ports on the same client VLAN in the switching layer, will there be any difficulty with the load-balancer communicating with the servers?
• Even though I am looking for the balancer to reside on an access port in the switching layer, do I have to assign the balancer's VLAN numbers to specifically coincide with or diverge from the switching layer's VLANs?
• If, instead, I was looking to provide load-balancing services to multiple clients using the same balancer, is it just a case of configuring the VLAN numbers to coincide and configuring the interconnected switch and balancer ports as trunk ports?

(If it matters, the devices in question are all Cisco: ASA5540+Cat2960 at the firewall+switching layer, ACE4710 for the balancer)

Addenda

A bit of a mashup of systems here, so bear with me. Essentially, I'm having some trouble using the Backup Exec agent for Oracle, while trying to backup a remote Linux server. The BE agent appears to use RMAN to backup the databases

The backup server is on one VLAN and the target server on another, with a Cisco ASA firewall providing the only link between them. This is by design, as the backup server is to support numerous clients and each client must be on its own VLAN to prevent them from accessing each other. I have added the recommended ports to the firewall to at least allow the agent to talk to the media server.

The backup starts well enough (indeed a smaller Oracle database on the same server completes without issue) but a 200GB database, which would clearly take a few hours to complete, is not able to complete.

I believe the problem to be related to http://www.symantec.com/business/support/index?page=content&id=TECH59632, which says that a CORBA session is established on port 5633 at the start of the backup and used before each RMAN operation but, while data is being transferred, the CORBA session's socket receives no packets. Since the connection timeout on the firewall is 60 mins, the CORBA session is dropped and, when the RMAN agent tries to perform its next action, the whole process bombs. Symantec say this problem was fixed in an earlier version of Backup Exec, but do not detail any additional settings to enforce it.

Setting the connection timeout on the firewall to something high-enough to cover the backup window (e.g. 12 hours) seems like the wrong thing to do, as it is an estate-wide change, which would also affect the connection lifetime of (for example) web requests to another client's web server.

Moving the Linux server into the same LAN as the backup server is out of the question.

I'm not a Linux guru, but I roughly know my way around. So far, I have tried starting using libkeepalive (http://libkeepalive.sourceforge.net/) to force the beremote process' socket creation to be made with a KEEPALIVE TCP flag, but a quick netstat -top indicates that it is not taking. Either I'm using libkeepalive incorrectly, or it doesn't work for the beremote binary

I guess I am looking for an option that fits with the environment I am in. I figure I'm looking for one or more of the following:

• a way to configure the BE agent to keep the connection alive?
• a way to inject the keepalive flag to the existing TCP connection (e.g. via a cronjob)?
• a way to tell the Cisco device to increase the connection timeout for a specific source/target (maybe a policy-map)?

Any/all (other) ideas welcome...

J.

RE: Comment by @Weaver

As requested, class-map, policy-map and service-map entries...

class-map CLS_INSPECTION_TRAFFIC
 match default-inspection-traffic
class-map CLS_ALL_TRAFFIC
 match any
class-map CLS_BACKUPEXEC_CORBA
 description Oracle/DB2 CORBA port for BackupExec traffic
 match port tcp eq 5633
!
!
policy-map type inspect dns PMAP_DNS_INSPECT_SETTINGS
 parameters
  message-length maximum client auto
  message-length maximum 1280
policy-map PMAP_GLOBAL_SERVICE
 class CLS_INSPECTION_TRAFFIC
  inspect dns PMAP_DNS_INSPECT_SETTINGS 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ipsec-pass-thru 
  inspect icmp 
  inspect snmp 
 class CLS_BACKUPEXEC_CORBA
  set connection timeout idle 1:00:00 dcd 
 class CLS_ALL_TRAFFIC
  set connection decrement-ttl
!