paradroid's questions

I have a bash script running as cron job which has some gcloud commands in it.

eg.

gcloud compute firewall-rules update allow-ssh--source-ranges=$(echo "${mylocations[@]}" | tr ' ' ',')

I have the crontab entry redirecting stdout to /dev/null, so that I don't get emails every time it runs.

The problem is that gcloud's output goes to stderr, even when there is no error, so I get emails like this:

TITLE: Cron user@host /home/user/bin/firewall-update.sh >/dev/null

Updated [https://www.googleapis.com/compute/v1/projects/project-name-4234534/global/firewalls/allow-ssh].

...

I have tried adding --verbosity=error, critical and noneto the gcloud commands, but they have no effect.

So how do I stop gcloud from sending this message to stderr when it completes successfully? Why does it even do that?

Is it possible to do a DNS Zone Transfer to Google Cloud DNS on Google Cloud Platform?

I can see references to Zone Transfers in the documentation (eg. https://cloud.google.com/dns/zones/) and elsewhere on the web, but cannot find any further information on it.

If it is possible, how do you do it?

I have been using the Bitnami multi-tier WordPress stack on AWS.

I know how to use autoscaling on AWS, but none of the documentation has showed me where to store changeable data files when using something like WordPress.

The database is on RDS, so that is not an issue, and uploaded static files can be kept on S3 or EFS. Latency will not be a problem, as the static files will be on the CloudFront CDN.

What I am unsure about is what to do about the wp-content/plugins directory, as the data there will be changed by the WordPress administrators, so it can't just be part of the AMI.

This page says under "Don't even think about running app code from EFS" that these files should not be on EFS, due to latency.

So should these files be copied from EFS to new instances using a EC2 bootstrap script or something like that? I could use rsync or aws-cli I suppose?

Or should I be doing this though a lifecycle hook or Lambda?

This can't be a unusual scenario, so I am surprised how difficult it has been to find any information about this.

When I go to the following page in the Google Cloud Platform console..

https://console.cloud.google.com/compute/instances

..and click on an instance's name, I get the following error:

"Cannot read property 'fetchPolicy' of undefined"

What is going on here and is there anything I can do about it?

In Exchange Online (Office 365), I need to extract emails, from particular sending addresses, from a handful of user mailboxes, to another user mailbox folder.

I've been reading about the Export-Mailbox PowerShell cmdlet, which seems to be able to do what I want, but I am not sure if it is possible to use on Office 365.

What are the functional differences between Windows Defender and Windows Intune Endpoint Protection and SCCM Endpoint Protection, apart from methods of management, if any?

(I am referring to the Windows 8 version of Windows Defender, which I understand to include the functionality of Windows Security Essentials)

I have a couple of test servers on Windows Azure. One is in the North Europe location and the other is in West Europe. I yet to get around to testing which location offers better connection speeds from where I am (London, UK).

The Northern Europe Azure datacentre is apparently in Ireland and the West Europe datacentre is in the Netherlands, which is weird in itself I think.

But what I am confused about are the IP addresses are both 168.63.xxx.xxx. GeoIP lookup says that they are both located in the US, and traceroute from London to the addresses get to the US before failing to respond pings.

What's going on?

Does the HP ProCurve 1800-24G Switch have a fan or not?

The specs say that it does not have a fan, and so do many references I can see on the web. However, a person who is offering to sell me a used one is insisting that it does have a fan, although it is relatively quiet.

Are there different versions? Could it actually be a fake?!

I have been trying to sort out some time sync issues involving two domain controllers and seem to have ended up with a bigger problem. It's horrible.

They are both virtual machines (one being on Amazon EC2), which I think may complicate things regarding time servers.

The primary DC with all the FSMO roles is on the LAN. I reset its time server configuration like this (from memory):

net stop w32time
w23tm /unregister
shutdown /r /t 0
w32tm /register
w32tm /config /manualpeerlist:”0.uk.pool.ntp.org,1.uk.pool.ntp.org,2.uk.pool.ntp.org,3.uk.pool.ntp.org” /syncfromflags:manual /reliable:yes /update
W32tm /config /update
net start w32time
reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config /v AnnounceFlags

I checked to see if it was set to 0x05, which it was. The output for...

w32tm /query /status

Leap Indicator: 0(no warning) Stratum: 1 (primary reference - syncd by radio clock) Precision: -6 (15.625ms per tick) Root Delay: 0.0000000s Root Dispersion: 10.0000000s ReferenceId: 0x4C4F434C (source name: "LOCL") Last Successful Sync Time: 10/04/2012 15:03:27 Source: Local CMOS Clock Poll Interval: 6 (64s)

While this was not what was intended, I thought I would sort it out after I made sure that the remote DC was syncing with it first. On the Amazon EC2 remote replica DC (Windows Server 2008 R2 Core)...

net stop w32time
w32tm /unregister
shutdown /r /t 0
w32time /register
net start w32time

This is where it all goes wrong

System error 1290 has occurred.

The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service.

I cannot get the w32time service to start. I've tried resetting the time settings and tried to reverse what I have done.

The Ec2Config service cannot start either, as it depends on the w32time service.

All the solutions I have seen involve going into the telephony service registry settings, but as it is Server Core, it does not have that role, and I cannot see the relationship between that and the time service. w32time runs in the LocalService group and this telephony service which does not exist on Core runs in the NetworkService group.

Could this have something to do with the process (svchost.exe) not being able to be run as a domain account, as it now a domain controller, but originally it ran as a local user group, or something like that?

There seem to be a lot of cases of people having this problem, but the only solution has to do with the (non-existant on Core) telephony service. Who even uses that?

When I open the DNS console in Administrative tools, I keep finding a couple of problems which keep on reappearing by themselves, and I want to stop them from happening.

One of the DNS servers has two network interfaces, and it should only be listening for requests on of them, and I get errors in the Event Log otherwise. But when right clicking one DNS server and selecting Properties, I can see on the Interfaces tab that 'All IP addresses' is selected. If I Change it to 'Only the following IP addresses:' and deleselect the WAN addess, I will find it reslected when I next check it after a couple of days.

In the other DNS server's Properties, on the Forwarders tab, there should only be two forwarder addresses. However, the address for the router keeps in appearing. This router has the DNS server as its forwarder. There shouldn't be anything using the router's DNS forwarders for DNS other than the router itself, but this surely is causing a loop.

How do I get these properties on both DNS servers to stick?

As the NetBIOS protocol acts on Layer 2 and so is not routable, In order to enable network browsing of remote networks, WINS has been installed and configured on two domain controllers, both of which are on different networks.

The WINS servers seem to be replicating with eachother, and each has 127.0.0.1 set as the Primary WINS Server in each of their LAN interface properties, with nothing entered for Secondary WINS Server.

The DC which holds the PDC Emulator FSMO role has the Computer Browser service running and set to Auto start, and it has the WINS/NBT node type network setting at 0x8 (H-node - Hybrid node).

Remote network browsing does not work.

Is the WINS/NBT node type correct for this scenario? The reason why I think it may not be the right one is because I set the DHCP Server's 046 WINS/NBT node type option to 0x8 as well, after which the DHCP clients started to disappear from the Network folders. When that option is not set, does it default to B-node (Broadcast node)?

Or could it be a problem with the WINS servers setup?

I understand that this is the way a PTR record would be made on a Class A subnet (10.100.250.100 255.0.0.0)

dnscmd /RecordAdd 10.in-addr.arpa. 100.250.100 PTR host.domain.tld

To clarify the syntax, this is what it should be for a Class C subnet (192.168.1.100 255.255.255.0)

dnscmd /RecordAdd 1.168.192.in-addr.arpa. 100 PTR host.domain.tld

Is that right?

Now how do I do this for a host with the IP address 172.31.111.210 on a 172.31.111.192/26 network? I'm not sure how to do this with a classless subnet mask.

On the Advanced settings in the of a network interface Properties there is the WINS tab, where the address for the WINS server can be set.

How do I add the address using netsh instead, for both interfaces with static addresses, and ones with addresses received through DHCP?

I've tried a few things which I thought would have worked, but they didn't.

If there is a GPO which is applied to all Domain Computers which disables something, is there a way to re-enable the disabled thing for some hosts in the domain, without taking those hosts out of the default Domain Computers group?

In other words, can another GPO, which re-enables the feature that was disabled, be applied to a subset OU, whose member computers are still members of Domain Computers? If so, where exactly in the domain hierarchy should that OU be made, and how should the two GPOs be applied?

I've set up a replica DC in a remote location. It's connected to the main site through a VPN connection. DCdiag passes on the primary DC, but I get the following error on the replica DC:

Running enterprise tests on : mydomain.co.uk

      Starting test: LocatorCheck

         Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355

         A Global Catalog Server could not be located - All GC's are down.

         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355

         A Primary Domain Controller could not be located.

         The server holding the PDC role is down.

         ......................... mydomain.co.uk failed test LocatorCheck

Is it giving this error just because it is not the global catalogue server, or is there some connectivity issue where it does not think there is one at all, as the error seems to imply? If so, it seems odd, as all other tests were passed.

What do I do about this?

I am using this directive to redirect to HTTPS:

<VirtualHost *:80>
        ServerName              foo.bananas.net
        Redirect                301 / https://foo.bananas.net
</VirtualHost>

The problem is that when a path is used in the address bar, like http://bananas.net/webpage, it takes a pauses for a while before failing with https://bananas.netwebpage (no slash).

Should a rewrite rule be used instead? What should it be, and are there any differences in behaviour that I should be aware of?

I have shellinabox running on a subdomain through HTTPS and using HTTP Basic Access Authentication using the vhosts file below:

<VirtualHost xx.xx.xx.xx:80>
        ServerName              host.bananas.net
        Redirect                301 / https://host.bananas.net
        CustomLog               ${APACHE_LOG_DIR}/access.log combined
        ErrorLog                ${APACHE_LOG_DIR}/error.log
</VirtualHost.net>

<VirtualHost xx.xx.xx.xx:443>
        ServerName              host.bananas.net
        SSLEngine               On
        SSLCertificateFile      /etc/apache2/ssl/bananas.net.crt
        SSLCertificateKeyFile   /etc/apache2/ssl/bananas.net.key
        SSLCertificateChainFile /etc/apache2/ssl/sub.class1.server.ca.pem
        SSLCACertificateFile    /etc/apache2/ssl/ca.pem
        SetEnvIf                User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
        ProxyRequests           Off
        ProxyPass               / http://localhost:4200/
        ProxyPassReverse        / http://localhost:4200/
        <Location />
                AuthUserFile    /etc/apache2/.htpasswd-secure
                AuthName        "Go Away!"
                AuthType        Basic
                Require         valid-user
                Order           Deny,Allow
                Allow           from all
        </Location>
        SetEnvIf                Request_URI "^/u" dontlog
        HostnameLookups         Double
        CustomLog               ${APACHE_LOG_DIR}/ssl_request.log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
        ErrorLog                ${APACHE_LOG_DIR}/error.log
</VirtualHost>

I currently have another site on another subdomain, using this vhosts file:

<VirtualHost xx.xx.xx.xx:80>
        ServerName              files.bananas.net
        DocumentRoot            /var/www/files.bananas.net/

        CustomLog               ${APACHE_LOG_DIR}/access.log combined
        ErrorLog                ${APACHE_LOG_DIR}/error.log
</VirtualHost>

I would prefer to have the second site available at https://host.bananas.net/files instead of http://files.bananas.net.

The main reason for this is so that I can use the same SSL certificate, but there are other reasons as well.

How do I move the second site to be a subdirectory of the first site?

Are there dual port PCIe x1 gigabit NICs available?

I only know of ones that require a x4 slot, but if PCIe v2 doubles the bandwidth per lane, and PCIe v3 quadruples it, there ought to be dual port PCIe v2/3 NICs that only require a x1 slot, surely?

I've only got one x1 PCIe v2 slot available on a machine which ideally needs another two network ports.

To add to the complication, it needs to be compatible with VMware ESXi, so an Intel chipset is desirable.

I cannot get netdom join working on Windows Server 2008 R2.

netdom join bananas /domain:fruitland.local /userd:fruitland\Administrator /passwordd:*

Logon failure: unknown user name or bad password.

The command failed to complete successfully.

The local admin account I am using is has the same name and password as the domain admin account. I've double checked DNS and passwords. I can ping the DC. The DC accepted netdom join from a Windows Server 2003 R2 machine earlier. I've made sure that the older version of netdom for pre-Vista is not in the path.

However, when I go through the GUI System Properties > Computer Name and enter the same domain, username and password, it works fine. The only difference I can see is that the user account details dialogue box is already set to use a domain, with the top level domain at the end.

So I tried:

netdom join bananas /domain:fruitland.local /userd:fruitland.local\Administrator /passwordd:*

...but that did not work either. I get the same error.

I must be getting something wrong, as the GUI method works fine.