I want to create an ACL in haproxy 1.6 that allows a particular url and url parameter ONLY when they both appear at the same time. For example:
example.com/url/of/page3?foo=bar
I am doing this already in the frontend section of my haproxy config:
acl whitelist path /url/of/page1
acl whitelist path /url/of/page2
acl whitelist path_beg /url/of/page3
block unless whitelist
How do I use url_param in combination with with path in my acl?
For a lab/teaching environment, we need to set up a Windows 2012R2 machine as a domain controller, with LDAPS enabled on 636. As we also need ADCS installed, we have just let ADCS auto generate the cert on the LDAPS service.
However, the cert expires in one year. Is there a mechanism where the cert auto renews somehow when a year is up?
I can't seem to find an answer to this.
Or should I manually set up a cert like this with a more distant expire time?
In a test environment, we are seeing how you can manage Japanese usernames and english usernames on a Windows 2012 R2 domain controller in Windows 2012 domain.
AdsiEdit.msc displays Japanese usernames correctly but Active Directory Users and Computers does not, it shows underscores where the characters should be. Furthermore, any attempt to bring up the properties of the users in AD users/computers produces an "object cannot be displayed" error.
How can I get active directory users and computers to display unicode characters in user names?
For a presentation I am doing, I am trying to find out if there is a Linux based open source application whitelisting service for Linux, Similar to software restriction policies in Windows since 2002. It seems there are some commercial ones (e.g. McAfee application control), but my googling has so far failed to turn up an equivalent open source one.
I know you can sort of achieve something similar with SE Linux, especially now the likes of redhat and centos come with decent policies for popular services. But it seems there is nothing that can say, "these users can execute these programs identified by these hashes".
Am I wrong?
We are testing a VPN server for DR. We have a rackspace cloud instance, with a pure IPSEC VPN server running in racoon, serving "road warrior" clients. We have some NAT going on on the server to route externally:
-A POSTROUTING -s 172.31.31.0/24 -o eth0 -j SNAT --to-source w.x.y.z
It works very well, with windows, apple-ios and android clients connecting perfectly.
What we want to do is set the server to host a few web pages on the VPN only, i.e. for the server to have an IP on the VPN. We could do this using vpnc, to connect to the public IP, but that seems like overkill.
Is there a way we can do this using racoon, or a loopback interface perhaps?
our (test) racoon conf:
path pre_shared_key "/etc/racoon/psk.txt";
remote anonymous {
ph1id 1;
exchange_mode aggressive,main;
my_identifier user_fqdn "redacted";
peers_identifier keyid tag "blah";
dpd_delay 20;
ike_frag on;
nat_traversal on;
passive on;
initial_contact off;
generate_policy unique;
proposal_check claim;
lifetime time 24 hour;
mode_cfg on;
verify_cert off;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
#hash_algorithm md5;
authentication_method xauth_psk_server;
dh_group 2;
}
}
sainfo anonymous {
remoteid 1;
lifetime time 12 hour;
encryption_algorithm aes,3des,blowfish;
authentication_algorithm hmac_sha1,hmac_md5;
compression_algorithm deflate;
}
mode_cfg {
network4 172.31.31.1;
pool_size 100;
netmask4 255.255.255.0;
dns4 8.8.8.8;
auth_source pam;
save_passwd on;
}
On our windows 2003 domain, with XP clients, we have started seeing routes appearing in the routing tables on both the servers and the clients. The route is a /32 for another computer on the domain. The route gets added when one windows computer connects to another computer and needs to authenticate.
For example, if computer A with ip 10.0.1.5/24 browses the c: drive of computer B with ip 10.0.2.5/24, a static route will get added on computer B like so:
dest netmask gateway interface
10.0.1.5 255.255.255.255 10.0.2.1 10.0.2.5
This also happens on windows authenticated SQL server connections. It does not happen when computers A and B are on the same subnet.
None of the servers have RIP or any other routing protocols enabled, and there are no batch files etc setting routes automatically.
There is another windows domain that we manage with a near identical configuration that is not exhibiting this behaviour. The only difference with this domain is that it is not up to date with its patches.
Is this meant to be happening? Has anyone else seen this? Why is it needed when I have perfectly good default gateways set on all the computers on the domain?!
On a test rig, I'm trying to get SQL Server 2005 peer to peer (transactional) replication working, with the replication agents running under the NT AUTHORITY\NETWORK SERVICE account.
Before this I setup a peer to peer replication with the agents running under the SQL Server agent service account (i.e. SYSTEM account) and I created a security group in AD containing the machine accounts. I gave this group the neccessary permissions on the dbs, PAL, distributor. This worked fine.
If I try to do the exact same setup with the agents running as NT AUTHORITY\NETWORK SERVICE (or NT AUTHORITY\NETWORKSERVICE - no space, I tried both), I see the following error in replication monitor:
Unable to start execution (reason: Error authenticating proxy Nt Authority\Network Service, system error: Logon Failure: unknown username or bad password)
I have also tried making Network Service a sql login on each server, and giving it the sysadmin role. This made no difference. Is it simply not possible to run a replication agent as network service?
(note - I am aware I can use an AD account with a username/password. For various reasons we don't want to do that in this instance)
I feel like this is a stupid question but:
I have a test environment set up where I need to enable SMTP basic authentication with IIS. I have a Win2k3 r2 server as a DC in its own windows domain called testdom.local. I also have the MS pop3 server set up with the testdom.local domain on that server. I have a windows account called "simon" on that domain and a mail box set up on the pop3 service.
With anonymous access set up on the IIS smtp server, I can send an email from a client to the server which will arrive in the simon mailbox. If I turn on basic authentication on the SMTP server, I can not get the mail client (outlook 2003) to authenticate.
I have followed what is said here: http://support.microsoft.com/kb/324285
I have tried:
What am I doing wrong? I feel like I am missing something really obvious!
Please note: This is a test environment, I have a requirement to use SMTP basic auth, so I am not interested in using any other authentication option. I have made sure Integrated Windows and SPA auth are turned off on client and server, and I have double checked the password is right because the pop3 works to collect the mail.
This may be a really stupid question, but...
The TDS protocol used by sql server appears to use unicode or UTF-16 character encoding. A query like select foo from bar appears like
s.e.l.e.c.t. .f.o.o. .f.r.o.m. .b.a.r in the tcp stream in wireshark.
If you have an application connecting to SQL server over a network, that absolutely does not and probably never will use unicode text fields, is there a way to tell the sql client to encode the queries in ascii to cut network traffic?
I have just started work on an existing 2003/AD domain where users are complaining about the amount of time it takes for an XP client to reach the logon prompt after boot (around 4 minutes).
I haven't looked into this too much so far, but one thing I did notice is that there are ~150 GPOs. Most of these could be reduced by manually going through and merging several into one. It looks so far like I could achieve the same outcome with about 30 GPOs. Luckily, the GPOs are well documented.
Some wireshark traces I have done seem to show each client checking the timestamp on each file in each gpo in the sysvol share when they boot (or on a group policy refresh). This takes about 25 seconds.
I am fairly certain there are other factors that are contributing to the long boot time of the clients, but in general, is it worth keeping the number of GPOs to a minimum?
I work in a test facility where we have to test some pretty new software on some pretty old kit. The developers who write the software test it on vmware workstation before it gets to me. They all have fairly recent high spec PCs and so the vmware guests perform quite well.
I want to tune those guests to work like the lowest spec of hardware I have to test the software on. Something like a Pentium III 1 GHz (!) with 1 GB of RAM. The RAM is obviously not a problem, how can I get the "cpu" in the VMs to act like a 10 year old PC?!
I was thinking of running some CPU stress tools, prime number generators etc, but that seems like overkill. I would like to stick to vmware workstation if possible.
I'm trying to work out how to set the default profile for the distribution agent programatically using t-sql. I see there is the sp_help_agent_profile and sp_help_agent_default sprocs which allow you to find out what the default is, but they don't allow you to set it.
Is there a sproc, or should I be directly updating the MSagent_profiles table?
I have a requirement to mark certain traffic originating from some Windows 2003 servers with a certain DSCP value.
Unfortunately in this situation neither marking the traffic on a router or upgrading to Windows 2008 are options that we can take.
I have spent some time with tcmon and tccom and I am so close to getting this working. On a full patched and up to date XP virtual machine, I have figured out how to script TCCOM (used process explorer for the variables and the word 2003 vba object explorer to figure out the api). The script runs on boot and sets up the flows properly without a problem on my XP VM.
But on windows 2003 server, I can not add a flow at all either via a script or using the tcmon gui. It simply says "unknown error" (when scripted it gives the error code 80004005).
I have tried the following to resolve this:
Has anyone managed to get tcmon/tccom working on Windows 2003 at all?
For anyone who is interested, here is my script (vbscript) with an example flow (not what I am actually doing). It makes a flow and adds a filter that applies DSCP 32 to traffic from 192.168.10.0/24 going to 192.168.20.0/24 tcp port 80.
option explicit
dim client
set client = wscript.createobject("TrafficControl.Client")
dim sInterface
sInterface = "AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport"
dim ifce
set ifce = getInterface(client,sInterface)
dim flowSpec
set flowSpec = ifce.CreateFlowSpec
dim filterSpec
set filterSpec = ifce.CreateFilterSpec(2)
clearAllFlows client
flowSpec.Parameters("TX_FRIENDLY_NAME") = "From Vbscript"
flowSpec.Parameters("TX_DCLASS") = 40
flowSpec.Parameters("TX_TOKEN_RATE") = -1
flowSpec.Parameters("TX_SERVICE_TYPE") = 1
filterSpec.Parameters("PROTOCOL_ID_MASK") =0
filterSpec.Parameters("PROTOCOL_ID") = 0
filterSpec.Parameters("DEST_PORT_MASK") = 65535
filterSpec.Parameters("SOURCE_PORT_MASK") = 0
filterSpec.Parameters("DEST_PORT") = 80
filterSpec.Parameters("SOURCE_PORT") = 0
filterSpec.Parameters("DEST_ADDRESS_MASK") = "255.255.255.0"
filterSpec.Parameters("SOURCE_ADDRESS_MASK") = "255.255.255.0"
filterSpec.Parameters("DEST_ADDRESS") = "192.168.20.0"
filterSpec.Parameters("SOURCE_ADDRESS") = "192.168.10.0"
dim newFlow
set newFlow = ifce.CreateFlow(flowSpec,1,"Flow obj from vbscript")
newFlow.CreateFilter filterSpec
function getInterface(oClient,sIntName)
dim oInterface
for each oInterface in oClient.interfaces
if oInterface.Name = sIntName then
set getInterface = oInterface
end if
Next
end function
sub clearAllFlows(oClient)
dim oInterface, oFlow
for each oInterface in client.interfaces
for each oFlow in oInterface.flows
oFlow.delete
Next
Next
end sub
I've been reading up on how to tune SQL Server 2005 for a machine in a test environment. I came across this article on technet which suggests how to configure "server tasking" and says I should refer to the Windows 2003 docs for more info.
I have googled Windows 2003 "server tasking" (with and without the quotes) but all I can find is more similar articles on SQL server telling me that it should be configured, not how/where you do it.
I know I'm probably searching for the wrong thing - can someone please tell me how to configure it in Windows or SQL server, whichever it is?
On Windows 2003 server/xp, the manual (NTP) mode of the windows time service CLIENT has a "SpecialPollInterval" which allows you to set a custom poll interval instead of what the OS decides.
I've been going through the MS docs on the registry settings for WTS here: http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx
It doesn't look like specialPollInterval works on NT5DS (domain hierarchy) mode. Is there something similar in this mode?
If not, how often will Windows poll for the correct time when the wts client is set domain hierarchy mode?
On a windows XP client that is a member of a domain, resetting the Windows time service to defaults (w32tm /unregister, w32tm /register) enables the NTP server on the XP machine itself.
(HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer\Eanbled = 1)
It also says this in the MS docs on WTS registry settings here: http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx
The server shows as being enabled by doing a "netstat -a":
UDP XP-PC:ntp :
Why?
Is there any harm in disabling it?