AWS does not allow you to modify the pg_hba.conf file which is unfortunate to say the least. Does anyone know of a way that we can setup external user authentication for a RDS Postgres instance?
The driving factor of this is compliance due to the industry we are in. It requires being able to fully log who is querying what. We're trying to keep identity management as centralized as possible and would rather not have to manage a bunch of local users and permissions in postgres.
Currently we are creating a new environment and are running into some quirks with SSL. We are using an ELB that accepts 80/443. Both route to the same port on an Nginx box (ELB Decrypts). On the Nginx box we are checking for the AWS header and if we do not see it we redirect back to https. So far though the redirect isn't working.
Below is a copy of our nginx config file for the site that is listening on port 3000 (ELB 80->3000. ELB 443->3000).
server {
listen 80;
root /home/app/web-app/public;
passenger_enabled on;
passenger_user app;
# If this is a Ruby app, specify a Ruby version:
passenger_ruby /usr/bin/ruby2.2;
passenger_min_instances 2;
if ($http_x_forwarded_proto != "https") {
return 301 https://$host$request_uri;
}
}
Any thoughts on what I'm doing wrong here?
EDIT -
We are using the passenger docker image as seen here - https://github.com/phusion/passenger-docker
Passenger starts up and seems to take in all requests on port 3000 despite what the Nginx config shows of listen 80.
Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 )
Ironically Splunk also recommends against JSON (ref: http://docs.splunk.com/Documentation/Storm/Storm/User/Bestpractices ). Granted storm is cloud and not hosted but wtf?
Has anyone leveraged JSON within splunk? Can someone talk towards real world performance differences in index search and regarding the ability to easily create search queries leveraging spath?
Note - I know there are a ton of questions around AD Naming. I do not believe though that this is a duplicate question. If it is please link me to a relevant one :).
We are implementing AD. Our big issue is the domain name. We already have decided against .local after reading the many articles out there and speaking with people (We are 70/30 Mac right now).
We're trying to figureout if we should go with ourdomain.com or corp.ourdomain.com for our Domain Name.
We know already if we went with ourdomain.com we'd have potential issues if people didn't prepend www. to our site's URL, and we are willing to live with that.
Our concern is if there are any other consequences we don't know about. E.g. If we have an Exchange server of ours hosted in a Data center that isn't part of the LAN, would it have issues with DNS?
To give an overview of what we have -
Our site is hosted in an external datacenter, we currently use Google Apps but plan a migration to Exchange (Yes, we know it's against the trend..) which may also be hosted in a datacenter or onsite.
We also make extensive use of our UTM Firewalls VPNs and are looking at a Cisco VPN or Citrix solution as we scale up.
There are also plans to institute Windows Distributed File Sharing and possibly use Centrify or Extreme-Z IP if we find Native Mac Integration lacking.
We also plan to use AD as our authentication backbone using it for RADIUS and LDAP services for authentication and role management across our internal web apps and wireless.
We did read http://msmvps.com/blogs/acefekay/archive/2009/09/07/what-s-in-an-active-directory-dns-name-choosing-a-domain-name.aspx but I was hoping for some more up to date information from anyone well versed in maintaining AD especially in hybrid/distributed environments.
This might be a silly question but we rolled out a large batch of VoIP Phones. Some due to port shortages have been bridged and PoE turned on. Management right now on the switch is tedious and we are debating turning PoE on for all ports so we can ease the burden of bridging new phones as they come in.
The question is does keeping PoE turned on for a port that links to a device (i.e. a desktop) that doesn't need it bad in any way for the device? Is there any chance of power disruptions or other ill-effects?
Has anyone utilized something aside from a SAN to run their VMWare images off? We are looking to drop in two HP Servers and VMWare on them and run them off a SAN. Due to the cost of SAN though our CFO and VP are wondering if there are any viable alternatives (I.e. NAS) that can effectively run a VMWare. I can't think of any off of the top of my head. IF anyone can provide one or a good article outlining why to stick to SAN that'd be great.
Our current setup utilizes multiple VPS's along with multiple domains.
ex (And yes I know these IPs are all fake and unusable in reality. All for example..)
alpha.domain.com 66.555.555
beta.domain.com 66.555.554
charlie.domain.com 66.555.555
delta.domain.com 66.555.557
Let's assume the first 3 domains require SSL (https)
There's two challenges I have here. One is multiple domains, the other is multiple IP/servers. (Currently each is on their own server but in theory we could stack multiple IPs onto a single server also..either way same issue I believe..)
What is the best method of certificate for this? if alpha was our primary ecommerce site lets say I would think it should have its own unqiue SSL. But the others are secondary systems which primarily run crons and backend scripts that require Https for interaction. Is it possible to share one cert among multiple domains/servers/ips or is it that we should get a cert for each domain or each ip/server?
Our organization is reaching around a 100 email addresses (60 odd user addresses + assorted ones i.e. [email protected], [email protected]) along with about a dozen email groups.
Currently we are using Google Apps, at $50 per email address per year. Right now, that's $5,000 a year. At our current rate of growth I'm estimating we may need up to another 50 addresses.
We use Atlassian Confluence for our wiki system and Atlassian Crowd for SSO, so Google Apps is offering us little ROI save for the administration burden. (I'll add I am the defacto CTO and am still in process of hiring. We are getting a backend LAMP Developer first and then in six-twelve months a sysadmin and network engineer).
Is it worthwhile at this point to switch to an internal email solution (I.e Zimbra?) which could be hosted in an external datacenter, or is it still cost-effective to use Google apps?
Apologies if this is the wrong section (May be better in serverfault?)
Recently in doing a check of the logs I've found our system was for the last several days constantly attempting to mail somebody. Below is a copy of the mail log excerpt
May 4 17:14:51 li240-237 sm-mta[22961]: p3UN9oiX011581: to=<REDACTED@REDACTED.com>, delay=3+18:05:01, xdelay=00:00:01, mailer=esmtp, pri=48812230, relay=mx3.REDACTED*.com. [REDACTED], dsn=4.0.0, stat=Deferred: Connection refused by mx3.REDACTED*.com.
Does anyone have any ideas why so many attempts have been made and if I can track where these attempts are coming from? We do have a php based form which sends out an email to people upon confirmation of the submission and utilizes swiftMailer. Could this be constantly attempting to send the email for some reason?
My account has not been compromised and is the only one on the server aside from the root. The only other thought is someone attempting to send emails via our servers port 25...
Any ideas?
So I preface this with saying this may belong in IT Security, not too sure feel free to move.
Currently we have an email account [email protected] - hosted via google apps (as is all our email).
We had an incident where we had to terminate an employee. This employee however had the password for this account as we have 20-30 people utilizing it at any given point to manage customer emails etc.
Thinking on this I feel there must be a better way to manage access. With Google you can associate upto 10 email accounts to another the problem is we have more like 20-30 people going.
We were evaluating tools such as SalesForce and Assistly where people have their own login credentials and then the system contains the appropriate smtp information for the [email protected] email address to send emails from it rather than a users personal account.
Aside from those options does anyone have any other thoughts? One suggestion floated was moving everyone to desktop clients and saving the PW info there so they could only login from their physical workstation but we may have situations where we'd like employees to work remotely.
Does anyone have experience with this sort of system where ~20-30 people are responding from one email box and how to manage security and access?
Our company has grown quite quickly and I am facing new tasks which I did not think I'd need to deal with. Recently we've come ot a point where we have 100+ Devices (Routers, Bridges, Computers, Laptops, VOIP Phones etc). The other day I was quite frightened when I asked for an inventory and no one had one.
I want to start tagging all equipment and recording serials to begin tracking our inventory and ensuring we have a proper record of what equipment we have. Does anyone have advice as to how to go about 1. Convincing the higher ups why we need to do this and 2. What software or strategies might work?
Keep in mind this is not for furniture, office equipment etc but IT specific equipment. I'm concerned over people 1. Stealing the physical devices and 2. Losing track of configuration data etc in case we'd need to do a wipe and restore
I've boiled Two factor authentication down from all my research and come to the conclusion I'd like to do it with "Something someone HAS" and "Something someone KNOWS"
I have a few options but I'd like to know if the really count as 2 Factor Authentication. Keep in mind this is for SSH access in
Firewall IP Filtering - Someone HAS to have a specific IP / SSH Password.
SSH Private Key (PER User) / SSH User Password
Phone/SMS Authentication of a dynamic token that is sent to the number of a person / SSH Key or Password
Any ideas if these would be workable? Or any alternatives?
Hey, currently our office has no server or ability to share documents from a central server. We are exploring options to determine the best way to 1. share documents and 2. back them up.
The current floating idea is we get an in house server to share documents on and use as a NAS
We would then back up that NAS to a cloud service that does backups (i.e. Carbonite). The one issue here is still that employees would not be able to access the shared documents outside the office.
Our current idea is to get a router with VPN tunneling built in i.e. the Cisco RV042 Dual WAN/VPN Router. This router would allow users to connect in and access our network shares.
Keep in mind this is a start up with limited money so we're trying to be creative but diligent in our setup so that it can scale and still be usable when our budget expands
UPDATE- Most of are users will be using Apple MacBooks or Desktops, so ideally solutions would need to be compatible.