user540468's questions

I'm trying to start an openvpn v2.4.9 server with running

systemctl start openvpn-server@server

as root on Arch Linux.

This results in the following error:

 The job identifier is 176005 and the job result is failed.
Nov 03 13:42:35 hostname audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='[email protected] comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?>
Nov 03 13:42:35 hostname systemd[100169]: [email protected]: Changing to the requested working directory failed: No such file or directory
Nov 03 13:42:35 hostname systemd[100169]: [email protected]: Failed at step CHDIR spawning /usr/bin/openvpn: No such file or directory
Subject: Process /usr/bin/openvpn could not be executed
Defined-By: systemd
Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel

The process /usr/bin/openvpn could not be executed and failed.

I am not quite sure what is meant with "Failed at CHDIR spawning".

/usr/bin/openvpn is existing and executable for everyone:

root@hostname > ls -l /usr/bin/openvpn
-rwxr-xr-x 1 root root 788544 Apr 20  2020 /usr/bin/openvpn

/usr and /usr/bin are enterable by anyone as well.

My config is located at /etc/openvpn/server.conf and looks like this:

user nobody
group nobody

persist-key
persist-tun

proto udp
proto udp6

dev tun

ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/cert.crt
key /etc/openvpn/easy-rsa/pki/private/key.key
dh /etc/openvpn/easy-rsa/pki/dh.pem

cipher AES-256-CBC
auth SHA512
comp-lzo
reneg-sec 36000

server 192.168.100.0 255.255.255.0
push "route 192.168.100.0 255.255.255.0"

keepalive 10 36000

status openvpn-status.log

log /var/log/openvpn.log

verb 6

None of the two logfiles list any valuable information.

Do you need more information from my system?

Any help is highly appreciated.

I am trying to create a master-master replication between two databases, one being an RDS instance with MySQL 5.6.44 on AWS the other one being on an Ubuntu-Server running MySQL 5.7 (I was unable to install 5.6) by creating a slave replication in both directions as shown here. This is an attempt to evade problems occuring when using two RDS instances for a master-master-topology.

However, mysql on the Ubuntu-Server fails to recognise every configuration variable provided in /etc/mysql/my.cnf with [ERROR] unknown variable 'server-id=8', thus I am unable to configure this instance as a replication-master. Adding whitespaces between the variable name, = and the value did not solve the problem.

Any help to solve this is highly appreciated.

my.cnf:

[mysql]
server-id=8
replicate-same-server-id=0
auto-increment-increment=2
auto-increment-offset=1
relay-log-index=serverB-relay-bin.index
master-info-file=mysqk-master.info
relay-log-info-file=serverB-relay-log.info
log-bin=mysql-bin
log-error=/var/log/mysql/err

The goal is to create a master-master replication consisting of two RDS MySQL 5.6 instances, db0 and db1. I orientate myself by this article.

So far, I have created db1 as a read-replica of db0 and set read_only = 0 and autocommit = 1 at db1's parameter group.

To set a replication master manually, AWS defined the mysql.rds_set_external_master() function. According to AWS's documentation on this function, it is disabled by default and can be enabled by setting autocommit to 1.

Meanwhile, about 45 minutes have passed and the instance has been rebooted twice and excuting call mysql.rds_set_external_master() still returns RDS_SET_EXTERNAL_MASTER is disabled on this host and does not update the master.

Any help with this is highly appreciated.

I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS.

I followed this tutorial to enable Keycloak to sign me in using SAML. I noticed, that this tutorial is guiding me to download the “SAML Metadata IDPSSODescriptor” from the client's "Installation"-Tab. However, I can only choose "SAML Metadata SPSSODescriptor".

In AWS, I entered the name of my realm as "Provider Name" and imported the SPSSODescriptor. This led to the following error: SAML Providers must reference at least one SAML assertion issuer.

Trying to install certbot on CentOS 8 with sudo dnf install certbot python3-certbot-nginx, as suggested at certbot's website fails with the following error

Error: 
 Problem 1: package python3-certbot-nginx-1.3.0-1.el8.noarch requires python3.6dist(certbot) >= 1.1.0, but none of the providers can be installed
  - package python3-certbot-nginx-1.3.0-1.el8.noarch requires python3-certbot >= 1.0.0, but none of the providers can be installed
  - conflicting requests
  - nothing provides python3-mock needed by python3-certbot-1.3.0-3.el8.noarch
  - nothing provides python3.6dist(mock) needed by python3-certbot-1.3.0-3.el8.noarch
 Problem 2: package certbot-1.3.0-3.el8.noarch requires python3-certbot = 1.3.0-3.el8, but none of the providers can be installed
  - conflicting requests
  - nothing provides python3-mock needed by python3-certbot-1.3.0-3.el8.noarch
  - nothing provides python3.6dist(mock) needed by python3-certbot-1.3.0-3.el8.noarch
(try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

Adding --nobest to the command, as the last errorline suggests, did not work.

Epel-Release and python3 were installed previously.

Can anyone help me with this?

I am running an OpenVPN 2.4.9 server (without Access web interface) on a CentOS 7 machine for ~30 employees using Windows 10 laptops.

Recently, I noticed some people were disconnecting with UDP error 10051 after a few minutes of being connected. This error only occurs once in a while and always at the same clients and disappears after rebooting the operating system or after waiting an undefined amount of time.

According to Microsoft's documentation this error is indicating that it cannot reach the network.

The clients can still use other networking functions (i.e. browsing the web) so general internet connectivity is available and the windows firewall is not configured to block the port I am using (otherwise the connection couldn't have been established in the first place,right?). There are no firewalls or other middleboxes other than the windows firewall between the server and it's clients.

Is there any advice that can be given to solve this riddle?

Server config:

user nobody
group nobody    
persist-key
persist-tun
port 1094   
proto udp
proto udp6
dev tun

ca easy-rsa/pki/ca.crt
cert c.crt
key c.key
dh dh.pem

cipher AES-256-CBC
auth SHA512
comp-lzo
reneg-sec 0
inactive 0
keepalive 10 36000

Client config:

client 

dev tun
remote vpn.domain.tld 1094
comp-lzo

ca a/ca.crt
cert a/d.crt # EasyRSA generated
key a/d.key

auth-nocache
auth-user-pass
cipher AES-256-CBC
auth SHA512
remote-cert-tls server
reneg-sec 36000

I am using this plugin to manage my redirections on my wordpress site.

After updating to version 4.7 the plugin indicates that an update of the redirection database is necessary. Doing so however breaks the functionality of the plugin completely.

I was able to manually set the database version back to it's prior value, which made the plugin work again, however prompting me to update the database again.

According to this, I further tried to clear my caches with W3 Total Cache to avoid the plugin from prompting me to update the database without success.

The database is currently version 2.4 and would be updated to version 4.1. Wordpress is running as version 4.19.13. Shell-access to the server is given.

I'd like to avoid updating wordpress as a whole for now, as I can't predict whether any workflow issues will arise.

Any help is highly appreciated.

After unpacking and starting keycloak to listen on 127.0.0.1, I configured nginx to work as a reverse proxy accessible from a publicly available domain via https.

This is the nginx configuration:

http
{
    server_tokens off;

    upstream keycloak { ip_hash; server 127.0.0.1:8080; }

    server
    {   
        server_name name.domain.tld;
        listen 443 ssl http2; # managed by Certbot
        ssl_certificate /path/to/cert; # managed by Certbot
        ssl_certificate_key /path/to/key; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

        location /
        {   
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            add_header Access-Control-Allow-Origin *;
            proxy_pass http://keycloak;
        }
    }


    server
    {   
        server_name name.domain.tld;
        listen 80;
        location / { return 301 https://$server_name; }
    }

}

Nothing has been changed at any file inside the keycloak directory.

Keycloak is accessible, however when navigating to the login page, I encouter a blank page because of a mixed-content javascript from "/auth/js/keycloak.js?version=df45z".

This can be temporarily solved by disabling the browsers protection against mixed content, however this will get me to an dysfunctional loginpage giving me this error message: " We are sorry... Invalid parameter: redirect_uri".

Also, a HTTP 400 was returned from "/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fname.domain.tld%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=5abb646f-d1c8-49ef-8ae1-9358bfc50d6d&response_mode=fragment&response_type=code&scope=openid&nonce=525b593c-07ab-4afa-8ca0-bd64499061eb".

(Hoping it's origin is of any value)

Previous questions relating this issue only suggested to add the proxy_set_header directives, which avoided a blank screen of the initial dashboard you see when you access keycloaks webpage but not helped in the latter mentioned problem.

Please take into account I'm quite new to this subject matter should I've missed something trivial.

Any advice to fix this behaviour is highly appreciated.

I'm trying to upload things to my server however I'm unable to ls inside a directory or upload a file to it.

I'm using CentOS 8, SELinux set on permisssive. The directory I want to operate on has 777 permissions set. The user I'm using is not listed in user_list or ftpusers. I further tried to chown the directory to the user I'm using. None of that worked.

Result of 'put'

---> TYPE I
200 Switching to Binary mode.
ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (-,-,-,-,63,76).

Result of 'ls'

ftp: setsockopt (ignored): Permission denied
---> PASV
227 Entering Passive Mode (-,-,-,-,125,59).

vsftpd.conf

userlist_deny=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
allow_writeable_chroot=YES
listen=YES
pam_service_name=vsftpd

Any help is appreciated.

Existing solutions did't help me so I must be missing something else.

So I'm trying to setup a website with Apache 2.4/CentOS 7 behind a AWS Network load balancer.

I'm using this in httpd.conf to rewrite HTTP->HTTPS which is also considered the right way to achieve HTTPS only behind a load balancer by AWS. RewriteEngine On RewriteCond %{HTTP:X-Forwarded-Proto} !https RewriteRule .* https://%{SERVER_NAME}/$1 [L,R=permanent]

where SERVER_NAME is the DNS name of my server which resolves to the IP address of the load balancer.

https://%{HTTP:Host}/ was tried unsuccessful as well.

Without this, accessing the server is possible without problems (except that it's possible to use HTTP of course).

As the load balancer is the encryption endpoint for the client, I'm only listening on port 80 on the webserver. That is the intended way of implementing by AWS.

Using this however, the server will endlessly redirect my request until the browser gives up. And it also happens when trying to connect with HTTPS initially.

The debug-level log output of Apache is not showing any errors except that the request is timing out and the load balancer logs are also not very helpful. But maybe you can make a sense out of it.

I was also thinking of SELinux causing trouble but it is set on permissive. So it shouldn't actually do anything.

Apache access_log: https://textuploader.com/10cjh

Apache error_log: https://textuploader.com/10cjx

Load balancer: https://textuploader.com/10cjg

Any help is highly appreciated.