onik's questions

I have an ESXi 6.7u3 server which is running pfSense for my network. The problem is, I need to change this VMs network adapter, which connects the pfSense instance to the other VMs while bridged to a physical NIC for LAN.

So, if I power off the VM, I lose connectivity from LAN to the vmnic, other VMs and the management network.

I was hoping that I could do the change and it would be applied on next restart of the VM, but no. I think I also could reset the management network to the builtin NIC on the motherboard, but I had some issues getting the management interface back to the vmnic the last time, so I'd prefer to keep it as is.

Can I use esxcli to do this change locally?

I'm getting some conflicting information regarding the memory use of a virtualized server. The most alarming information is this:

Note that the server has only 4GB of RAM allocated, even though committed shows 12GB.

Also, if i run ps aux | grep httpd I get the following:

root      1566  0.1  9.5 580392 375540 ?       Ss   Jun18  96:15 /usr/local/apache/bin/httpd -k start -DSSL
root      4212  0.0  9.4 580388 371948 ?       S    08:01   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody    7674  0.6  9.5 580392 373600 ?       S    08:26   0:02 /usr/local/apache/bin/httpd -k start -DSSL
nobody   10894  0.6  9.5 580532 373508 ?       S    08:28   0:01 /usr/local/apache/bin/httpd -k start -DSSL
nobody   11668  0.6  9.5 580392 373600 ?       S    08:29   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   11669  0.6  9.5 580392 373512 ?       S    08:29   0:01 /usr/local/apache/bin/httpd -k start -DSSL
nobody   11975  0.6  9.5 580392 373492 ?       S    08:29   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   12108  0.7  9.5 580392 373492 ?       S    08:29   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   12993  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13080  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13211  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13496  0.6  9.5 580392 373520 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13497  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13829  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13858  0.6  9.5 580392 373492 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   13963  0.6  9.5 580392 373484 ?       S    08:30   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14070  0.7  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14290  0.6  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14404  0.6  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14745  0.6  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14850  0.6  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   14957  0.5  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15061  0.6  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15174  0.8  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15228  0.6  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15263  0.4  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15264  0.5  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15290  0.7  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15291  0.5  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15294  0.4  9.5 580392 373484 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15296  0.6  9.5 580392 373492 ?       S    08:31   0:00 /usr/local/apache/bin/httpd -k start -DSSL
nobody   15401  0.5  9.5 580392 373484 ?       S    08:32   0:00 /usr/local/apache/bin/httpd -k start -DSSL
root     15506  0.0  0.0 103228   840 pts/0    S+   08:32   0:00 grep httpd

This totals up to over 294.5% of memory used.

top gives similar results too.

However, if I run free -m I get this:

             total       used       free     shared    buffers     cached
Mem:          3831       3647        184          0        257       2358
-/+ buffers/cache:       1031       2799
Swap:         4031         29       4002

This seems OK to me, no sign of overcommitted memory.

The server is relatively quick, there's no unusual downtime/sluggishness, and I'd like to keep it that way. Are the abnormal readings just an anomaly, or something more serious?

I restarted my apache daemon today to reload the config file, but after this i began to see many php zombie processes on the system. The amount varies from 10 to 30 and they all take a little slice of CPU while they die. Where should I begin to debug this problem?

The modification I made was reducing Max Requests Per Child from 0 (massive memory leaks) to 1000. I think that the php processes are from a script that receives data from "dumb" devices, ie. they send a request with GET parameters and don't care about the result.

Some data:

uname -a

# uname -a
Linux <hostname> 2.6.32-71.29.1.el6.x86_64 #1 SMP Mon Jun 27 19:49:27 BST 2011 x86_64 x86_64 x86_64 GNU/Linux

ps -aux | grep php

# ps aux | grep php
user1     5709  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5717  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5721  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5722  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5723  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5724  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5725  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5729  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5731  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5737  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5760  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5778  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5793  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5798  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5800  1.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5833  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5850  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5870  3.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5875  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5876  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5877  2.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5886  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5926  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5939  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5941  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5961  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5962  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5973  0.0  0.0      0     0 ?        Z    12:15   0:00 [php] <defunct>
user1     5977  0.0  0.2 106836  8680 ?        R    12:15   0:00 /usr/bin/php /home/user1/public_html/<script>.php
root      5981  0.0  0.0 103228   836 pts/0    S+   12:15   0:00 grep php

free

# free -m
             total       used       free     shared    buffers     cached
Mem:          3831       3173        658          0        183       2502
-/+ buffers/cache:        487       3344
Swap:         4031          7       4024

uptime

# uptime
 12:18:10 up 105 days, 23:21,  1 user,  load average: 0.23, 0.20, 0.18

Anything else needed to help me debug this?

I have a private network that had 3 servers before. Now that I added a fourth, I tried to set up public key authentication from the main entry point to this new server. However, the usual procedure doesn't work, for some reason.

I've generated public keys that work with the other 2 servers, added the public keys to the new host's ~/.ssh/authorized_keys file and verified that /etc/ssh/sshd_config contains PubkeyAuthentication yes. However, I keep getting the password prompt.

Suggestions?

Here's a debug log from an attempted connection:

$ ssh -vv NEWHOST
OpenSSH_5.1p1 Debian-5, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to NEWHOST [x.x.x.x] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /root/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /root/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-5
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 135/256
debug2: bits set: 518/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'NEWHOST' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:16
debug2: bits set: 496/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/identity ((nil))
debug2: key: /root/.ssh/id_rsa (0x7f551b60b860)
debug2: key: /root/.ssh/id_dsa (0x7f551b60b880)
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Offering public key: /root/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: /root/.ssh/id_dsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
root@NEWHOST's password:
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug2: channel 0: send open
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug1: Sending environment.
debug2: channel 0: request shell confirm 1
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_confirm: type 99 id 0
debug2: shell request accepted on channel 0
Last login: Fri Apr 20 09:28:47 2012 from OLDHOST
[root@NEWHOST ~]#

So as the title says, I need to promote a standalone Win2008R2 server to a Domain Controller, and I don't a DNS Server (I think), as there will be no clients connected to the domain, it will be only used for Remote Desktop Services. Yes, I know, it's considered bad practice to install other roles on the DC, but in this case, it's necessary.

Do I need to install the DNS Server, and if I do, how to make it as transparent as possible?

EDIT: Seems that I need to install the DNS Server, so I can I configure it not to mess up my entire domain?

For example:

The server I need to promote is rdc.mydomain.com, and it has an A entry to it's IP in the current DNS, while other servers under mydomain.com are running Linux and don't need to know anything about this Windows box. The domain uses a third-party DNS and all edits and updates need to be done via a separate web page, our servers don't have write/update access.

I'm having a pretty bizarre problem with a Terminal Services server used for RemoteApp. In our network the server works as it should, but at a client's office if two users log in simultaneously, the first one gets disconnected as the other one connects. The users belong to the same group but have individual users. The similar configuration works fine for all other clients.

About the server, it's Windows 2008 SP2, no AD, SSL encrypted connections. Event viewer shows no useful information.

Any hints where to start debugging? Do you need more info about the setup?

EDIT: Ok, so the problem has resurfaced with another pair of clients. Similar setup: two users, one group, more than enough CALs. Could this be a problem in the client side firewall/NAT?

I'm more familiar with Linux tools to stop brute force attacks, so I'm having trouble finding suitable tools for Windows. I'm running a Windows Server 2008 R2 with Terminal Server, and I'd like to block an IP after repeated attempts to login via RDP. Any hints?

I've been getting a couple of strange GET requests on my dev server from unknown IPs. I don't know if this is some weird character encoding or something entirely else. The mysterious thing is, my server responds with the status 200, so the input matches something, but I don't know what.

The request is ":\xcc\x89\xa9L\xcf\xc3\xb6\xc1\x8f\xa9\xe7\xc0\xec\x16"

Ideas?

EDIT: Corrected the request, it wasn't a GET request, but still returns the root index page.

EDIT2: A new one just popped up:
xxx.xxx.xxx.xxx - - [20/Oct/2010:09:10:33 +0300] ";\x8e\xb0!\xa2\xa7\xe7\x11\xf1HX\xb6\x188|z\x9b\xac;z\x10\xafn\xd8*fD\x9d\xc1\x11I\x9a5\xe6\xcbu,\x8c\xd7\x84O[\xf7\xca\xe67\xe5\xba\x94\xdd.\xc0d\xd0} " 200 2085 "-" "-"
Nope, definitely not unicode anymore...