Bubnoff's questions

Just installed VCenter 5.5 -- simple install method. Defaults all around.

• Got logged in to web client using [email protected]
• configured SSO to allow local account as admin.
• Gave admin perms to this user for the Vcenter server listed
• Logged back in as this user
• Attempts to create datacenter just churn endlessly

I've tried creating a datacenter with both the local Administrator account and the [email protected] account --- same results.

Both accounts have carte blanche admin rights to the one listed item, which is the vcenter server itself.

I can't add a host or datastore without defining a top-level datacenter [ from my understanding anyway ]

Am I missing something?

UPDATE: I can't create folders. Also, it seems like the refresh button at top is constantly spinning. Basically, no task will complete.

UPDATE 2: Following ewwhite's suggestion [ see below ], I tried the .net client and met with success. I will try rebooting the server and see if that resolves the issue with the web client. As I understand it, some newer 5.5 VMware Vsphere features are only available in the web client.

I have a NFS mount at /mnt/web/ on OpenBSD 5.2.

How can I mount this so it's accessible to the web?

Currently I'm soft linking it to /var/www/web

ln -s /mnt/web /var/www/web

I've added an alias directive in the apache config like so:

Alias /web/ "/var/www/web/"


    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all

The ownership shows that everyone should have read and execute. What am I doing wrong? Apache says:

Not Found The requested URL /web was not found on this server.

Is it possible that OpenBSD's default chroot'd apache configuration doesn't allow this?

Additional Info:
I was able to access the NFS share when linked to the /var/www/users directory and apache configured with the "UserDir" option.

UPDATE
It works when Apache is run without chroot enabled ...so, my next question: How can I get this to work within chroot?

UPDATE
I changed the mount location and mount options and now it works [ see my answer below ]. But I'd like advice on optimal permissions. These are static files only. Who should own these files?

We need to track hits on a particular page for usage stats, evaluate client need, etc. More specifically we need to track an internal DMZ network segment for hits on this page. Google Analytics displays traffic from other network segments but not this one.

Are there certain network configurations that would block Google stat collection?

Problem

I'd like to enable remote powershell scripting for all workstation hosts on a VLAN. There's no Active Directory or Directory services whatsoever. So HOST A on subnet 192.168.1.x would like to query HOST B 192.168.2.x.

I've already run:

Enable-PSRemoting -force

A prompt for credentials would be the desired result for any workstation on the VLAN. The admin stations are on subnet 192.168.1.x and fall in the IP range 192.168.1.10-20.

Question

Is it possible to allow powershell remote auth for hosts in that range, or any IP coming from a particular subnet?:

192.168.1.0/24

To clarify: I am setting up workstations to deploy and I'd like them to be set up to allow me remote powershell powers out in the field. My admin stations are at one subnet and the workstations to be deployed are at numerous others.

RTFM

I'm looking at this link from Microsoft:

http://technet.microsoft.com/en-us/magazine/ff700227.aspx

This suggests that I need to run the following for each admin computer:

winrm s winrm/config/client '@{TrustedHosts="RemoteComputer"}'

Can someone confirm or refute this?

I am trying to configure virtual hosts on a Slackware server and have run into a glitch.

When I browse to localhost or 127.0.0.1 I get:

Forbidden

You don't have permission to access / on this server.

I need to finish configuring the WebApp at 8080. When I browse to localhost:8080 or 127.0.0.1:8080 I get:

Unable to connect

          Firefox can't establish a connection to the server at 127.0.0.1:8080.

Some context: I need to duplicate the following instructions for Debian/Ubuntu on Slackware and need a hand --- so here's the Debian version:

5. sudo ln -s /etc/koha/koha-httpd.conf /etc/apache2/sites-available/koha
6. sudo a2enmod rewrite deflate
7. sudo a2ensite koha && /etc/init.d/apache2 reload

So far: My httpd.conf ( LoadModule stuff and comments left out )

ServerRoot "/usr"
Listen 127.0.0.1:80
User apache
Group apache
ServerAdmin [email protected]
ServerName localhost:80
DocumentRoot "/srv/httpd/htdocs"
<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>
<Directory "/srv/httpd/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
Order allow,deny
    Allow from all
</Directory>
<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>
<Directory "/srv/httpd/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>
DefaultType text/plain

Include /etc/httpd/extra/httpd-vhosts.conf
Include /etc/httpd/extra/httpd-default.conf

This is a CGI app I should mention. I added the apps apache configurations to /etc/httpd/extra/httpd-vhosts.conf ( here with comments deleted ):

NameVirtualHost *:80
<VirtualHost *:80>
   ServerAdmin  webmaster@auction
   DocumentRoot /usr/share/koha/opac/htdocs
   ServerName localhost
   ScriptAlias /cgi-bin/koha/ "/usr/share/koha/opac/cgi-bin/opac/"
   ScriptAlias /index.html "/usr/share/koha/opac/cgi-bin/opac/opac-main.pl"
   ScriptAlias /opac-search.pl "/usr/share/koha/opac/cgi-bin/opac/opac-search.pl"
   ScriptAlias /search "/usr/share/koha/opac/cgi-bin/opac/opac-search.pl"
   ErrorLog /var/log/koha/koha-opac-error_log
   SetEnv KOHA_CONF "/etc/koha/koha-conf.xml"
   SetEnv PERL5LIB "/usr/share/koha/lib"
   <IfModule mod_gzip.c>
     mod_gzip_on yes
     mod_gzip_dechunk yes
     mod_gzip_keep_workfiles No
     mod_gzip_can_negotiate yes
     mod_gzip_update_static No
     mod_gzip_temp_dir /tmp
     mod_gzip_minimum_file_size 512
     mod_gzip_maximum_file_size 1000000
     mod_gzip_maximum_inmem_size 1000000
     mod_gzip_handle_methods GET POST
     mod_gzip_item_exclude reqheader "User-Agent: .*Mozilla/4\..*\["
     mod_gzip_item_exclude mime ^image/.*
     mod_gzip_item_exclude rspheader Content-Type:image/*
     mod_gzip_item_include file \.js$
     mod_gzip_item_include mime ^application/javascript$
     mod_gzip_item_include mime ^application/x-javascript$
     mod_gzip_item_include file \.php$
     mod_gzip_item_include mime ^text/html$
     mod_gzip_item_include file \.css$
     mod_gzip_item_include mime ^text/css$
  </IfModule>
  <IfModule mod_deflate.c>
    # Compress content with type html, text, and css, ...
    AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml application/javascript application/x-javascript
    DeflateCompressionLevel 9
    # Properly handle old browsers that do not support compression
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    DeflateFilterNote Input instream
    DeflateFilterNote Output outstream
    DeflateFilterNote Ratio ratio
    LogFormat '"%r" %{outstream}n/%{instream}n (%{ratio}n%%)' deflate
    <IfModule mod_headers.c>
       #properly handle requests coming from behind proxies
       Header append Vary User-Agent
    </IfModule>
  </IfModule>
   Options +FollowSymLinks
   ErrorDocument 400 /cgi-bin/koha/errors/400.pl
   ErrorDocument 401 /cgi-bin/koha/errors/401.pl
   ErrorDocument 403 /cgi-bin/koha/errors/403.pl
   ErrorDocument 404 /cgi-bin/koha/errors/404.pl
   ErrorDocument 500 /cgi-bin/koha/errors/500.pl
   RewriteEngine On
   RewriteCond %{QUERY_STRING} (.*?)(?:[A-Za-z0-9_-]+)=&(.*)
   RewriteRule (.+) $1?%1%2 [N,R,NE]
   RewriteRule ^/bib/([^\/]*)/?$ /cgi-bin/koha/opac-detail\.pl?bib=$1 [PT]
   RewriteRule ^/isbn/([^\/]*)/?$ /search?q=isbn:$1 [PT]
   RewriteRule ^/issn/([^\/]*)/?$ /search?q=issn:$1 [PT]
</VirtualHost>
<VirtualHost *:8080>
   ServerAdmin webmaster@auction
   DocumentRoot /usr/share/koha/intranet/htdocs
   ServerName localhost:8080
   ScriptAlias /cgi-bin/koha/ "/usr/share/koha/intranet/cgi-bin/"
   ScriptAlias /index.html "/usr/share/koha/intranet/cgi-bin/mainpage.pl"
   ScriptAlias /search "/usr/share/koha/intranet/cgi-bin/search.pl"
   ErrorLog /var/log/koha/koha-error_log
   SetEnv KOHA_CONF "/etc/koha/koha-conf.xml"
   SetEnv PERL5LIB "/usr/share/koha/lib"
   Options +FollowSymLinks
   ErrorDocument 400 /cgi-bin/koha/errors/400.pl
   ErrorDocument 401 /cgi-bin/koha/errors/401.pl
   ErrorDocument 403 /cgi-bin/koha/errors/403.pl
   ErrorDocument 404 /cgi-bin/koha/errors/404.pl
   ErrorDocument 500 /cgi-bin/koha/errors/500.pl
   <IfModule mod_gzip.c>
     mod_gzip_on yes
     mod_gzip_dechunk yes
     mod_gzip_keep_workfiles No
     mod_gzip_can_negotiate yes
     mod_gzip_update_static No
     mod_gzip_temp_dir /tmp
     mod_gzip_minimum_file_size 512
     mod_gzip_maximum_file_size 1000000
     mod_gzip_maximum_inmem_size 1000000
     mod_gzip_handle_methods GET POST
     mod_gzip_item_exclude reqheader "User-Agent: .*Mozilla/4\..*\["
     mod_gzip_item_exclude mime ^image/.*
     mod_gzip_item_exclude rspheader Content-Type:image/*
     mod_gzip_item_include file \.js$
     mod_gzip_item_include mime ^application/javascript$
     mod_gzip_item_include mime ^application/x-javascript$
     mod_gzip_item_include file \.php$
     mod_gzip_item_include mime ^text/html$
     mod_gzip_item_include file \.css$
     mod_gzip_item_include mime ^text/css$
   </IfModule>
   <IfModule mod_deflate.c>
     # Compress content with type html, text, and css, ...
     AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css
     AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml application/javascript application/x-javascript
     DeflateCompressionLevel 9
     # Properly handle old browsers that do not support compression
     BrowserMatch ^Mozilla/4 gzip-only-text/html
     BrowserMatch ^Mozilla/4\.0[678] no-gzip
     BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
     DeflateFilterNote Input instream
     DeflateFilterNote Output outstream
     DeflateFilterNote Ratio ratio
     LogFormat '"%r" %{outstream}n/%{instream}n (%{ratio}n%%)' deflate
     <IfModule mod_headers.c>
       #properly handle requests coming from behind proxies
       Header append Vary User-Agent
     </IfModule>
  </IfModule>
   RewriteEngine On    
   RewriteCond %{QUERY_STRING} (.*?)(?:[A-Za-z0-9_-]+)=&(.*)
   RewriteRule (.+) $1?%1%2 [N,R,NE]
   RewriteRule ^/bib/([^\/]*)/?$ /cgi-bin/koha/detail\.pl?bib=$1 [PT]
   RewriteRule ^/isbn/([^\/]*)/?$ /search?q=isbn:$1 [PT]
   RewriteRule ^/issn/([^\/]*)/?$ /search?q=issn:$1 [PT]
</VirtualHost>

Have I missed a fundamental basic here? I should mention that the modules deflate, rewrite and perl are installed and in the LoadModule instructions.

Thanks!

Bubnoff

UPDATE - with a concern/question

First -- Thank you quanta for your help thus far. I suspected a permissions issue and added this to my httpd.conf directory stanza.

<Directory "/srv/httpd/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>

Changed deny from all to "allow from all". So now it works and I thank you again, however, have I just committed major security faux paux?

I'm trying to set up a backuppc client using ssh+rsync via cygwin on Win 7. SSH was working fine. I added the backuppc user then used mkpasswd to add the user to /etc/passwd. Now ssh fails with:

Windows could not start the CYGWIN sshd service on Local Computer. Error 1069 the service did not start due to a logon failure.

These directories are huge and trying to use a standard copy process would suck. I will settle for robocopy but I'm curious as to how one can completely incapacitate a fully functional ssh service simply by adding a user to /etc/passwd.

Any idea how to get sshd running again? It's fallen like a deck of cards -- I've tried reconfiguring it with ssh-host-config ...reinstalling it. Nothing, nada -- fail.

So I am looking for recommendations for enterprise backup solutions for Windows. I am hugely disappointed with Acronis though on an individual station it's fine -- centralized = FAIL.

Needs to:

• Support centralized management ( deployment if possible )
• Alerts
• Work with laptops
• Centralized monitoring.
• incremental - differential
• Space management
• Bare metal recovery.

If BackupPC or Bacula supported easy Bare Metal restore I'd look at those but I have a few stations that have complicated ( read time-consuming ) setups that I'd like to be able to restore easily and quickly.

Thanks for reading!

Bubnoff

****Update****

Spoke with a rep and it sounds like what the doctor ordered. Will set up the trial this week. Thank you to all who responded. Backups and virus cleanup are the bane of any sysadmin's existence -- looks like this could improve life a little.

I have two VMware servers - ESX + ESXi. Two backup NAS boxes. The current NAS boxes are low-cost and unsuitable for running VMs from. Support NFS only. Slow.

My plan is to have a dedicated iSCSI/NAS for storing and running VMs. Two additional low-cost boxes for backup.

I'm looking for advice regarding 2 things really:

1. Recommendations as far as VMware architecture/design for a smaller organization. Less than 20 Virtual Machines. 2 servers + 2 x 1.5 terabyte backup NAS boxes.
2. A good NAS/iSCSI box with your recommendation on RAID config ...I would go with 6 or better.

I'm trying to design an installation that is both fast and reliable/redundant. If you have any experiences to share or your current configuration including network design ( switches, fiber ...etc ), I will be enormously thankful. I'm not married to this idea, so if you have a design not using iSCSI NAS boxes ...let er rip. Cost? Can we stay around $5,000 ( on top of already stated components )?

Links to info are welcome also.

Thanks for reading!

Bubnoff

* UPDATE *

Thanks to all who responded. I began this post looking more at the NAS/SAN issue but am beginning to think that my main issue at this point is properly setting up our network for virtualization ...with all the equipment that entails. The slow NFS during testing is likely due to issues we've got on our network rather than protocol or device issues. We have a network consultant coming in this year and I now have more ammo to work with in getting it right.

Any other network examples, gotchas or advice is welcome. Thanks again.

I have a perl form email script on the servers cgi-bin directory ( /usr/lib/cgi-bin ).

/etc/apache2/sites-enabled/000-default

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
    AllowOverride None
    Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    AddHandler cgi-script cgi pl
    Order allow,deny
    Allow from all
</Directory>

The issue is with paths.

html calls script here:

<form name="Request" method="post" action="http://server-test.local/cgi-bin/formprocessorpro.pl" onsubmit="return checkWholeForm49874(this)">

The directory with the templates and configs is passed here:

<input type="hidden" name="base_path" value="../contact" />

The path to this form is:

http://server-test.local/formstest/contact.htm

No matter what variation I try for the base_path I get an error from the formprocessor script that it can't find the directory:

An error occurred when opening the Form Configuration File (../contact/form.cfg): No such file or directory.

I need to move this script from an old server, configured by a previous sysadmin, to a new server.

Since cgi-bin is automatically linked to /usr/lib/cgi-bin and linked such that the script resides:

http://server-test.local/cgi-bin/formprocessorpro.pl

I would imagine that, given that the templates are in the webroot in a directory called contact, the correct path would be:

../contact

Any ideas? It's been awhile since I've messed with CGI.

* UPDATE * It works if I put the templates in or in the vicinity of the actual cgi-bin directory. Debian symlinks cgi-bin to /usr/lib/cgi-bin and apparently the form mail script wasn't informed of this. If this solution suits you, silence is welcome, otherwise, flame me and suggest a different strategy. Thanks!

* UPDATE pt. 2 * The path passed works if /var/www/. Shouldn't CGI scripts be able to follow links in apache's conf files?

Bubnoff

I've used FreeBSD for about 5 years - server/Desktop - and I've tended to take my apt-get/yum upgrade everything habits along with me ( I admin Debian/RHEL/Cent boxes as well -- I know, I know ...should be more discerning regardless of platform ). So it's usually a:

portsnap fetch
portsnap update
portmanager -u

For the ports

Sometimes followed by a:

freebsd-update fetch
freebsd-update install

For the system ...etc. Then just clean up any messes afterwards ...if they occur.

This, I realize, is a fairly excessive un-BSD way to do things. What is your philosophy for your BSD boxes? Do you run a portaudit/portversion -- check output then update (make deinstall ...etc) after careful consideration?

I'm fairly new to OpenBSD, I confess. I see myself cvsupping the ports tree, running the "out of date" script, then just upgrading critical ports --- but leaving the kernel/binaries alone and just upgrading every six months. Do you patch/recompile/rebuild kernel, binaries --- why?

What's a conservative approach for critical services ( reasonably critical -- this ain't no bank or hospital ) on BSD boxes? Are you using a similar approach on your Linux boxes? I generally don't touch the kernel on any servers unless a security alert has stricken terror into my soul.

Yeah, there's docs and books galore -- what do you people actually do? Assuming we know the basics -- what's the wisdom? Use cases/environments and scenarios vary, as do the stakes/stakeholders/users. Books and man pages cover tools and uses, but lack practical application. Recommend a book if you know of one that covers it!

Thanks for reading!

Bubnoff

Conclusions ~ Thanks to everyone who took the time to answer this post. My strategy overall is now to follow the mailing lists for both BSDs and be more selective/discerning with updating than I have been in the past.

FreeBSD ~ Portaudit is a good answer. With the mailing lists and diligent audits, I think this will serve well here. It's interesting the different emphasis on ports between OpenBSD verses FreeBSD.

OpenBSD ~ Will follow the mailing list and use the package tools ( pkg_info and pkg_add -u ) where deemed critical. Upgrades: Looks like you need to upgrade at least once a year. They support the newest release plus one back - so right now it's 4.8 and 4.7.

Thanks again.

Problem: Trying to isolate the issue preventing one of our BlueSocket routers from logging to a FreeBSD syslog box. The one that is not logging has identical logging settings to the other but is on a DMZ segment, so I believe it is either a Firewall issue or a bug with the BlueSocket ( different firmware version ) at this point. Nonetheless, I am submitting my syslog settings to eliminate that possibility.

Here's the pertinent part of my syslog.conf:

*.err;kern.warning;auth.notice;mail.crit                /dev/console
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages
security.*                                      /var/log/security
auth.info;authpriv.info                         /var/log/auth.log
mail.info                                       /var/log/maillog
lpr.info                                        /var/log/lpd-errs
ftp.info                                        /var/log/xferlog
cron.*                                          /var/log/cron
*.=debug                                        /var/log/debug.log
*.emerg                                         *

!ppp
*.*                                             /var/log/ppp.log
!*
+bluesocketWPL
local1.*                                        /var/log/bluesocketWPL.log
+bluesocketML
local0.*                                        /var/log/bluesocketML.log

bluesocketML logs just fine regardless of position in file or interface set.

I've looked at the man pages and docs for syslog ...this looks right to me. This seems all the more obvious as the order of the entries makes no change in result.

Thanks for any thoughts you may have ....in advance.

Bubnoff

PS: Checked perms on files in question. Identical.

** UPDATE **

As per Chris' tip I ran a tcpdump for the hosts in question, looking for syslog traffic.

tcpdump -i bge0 host bluesocketML or host bluesocketWPL and port syslog

One WAP comes in loud and clear ...the other, nothing. I can ping it ...it can ping me. Thinking that it must be a firewall issue on the device or on our firewall. We are connected by VPN in both cases. VPN policies seem whorish enough to me, but that seems like the next place to look.

Feel free to point me to the appropriate documentation for this.

When in ex mode ( Q ) and entering numerous commands, the file scrolls up to where you can't see what you're working on.

Are there key bindings for scrolling the visible file while in ex mode? Ctrl-J puts lines in the ex window - but there doesn't seem to be a way to go the other direction - Ctrl-J scrolls down by line. Maybe it's the OS or Vim version?

Is there a setting to keep ex from scrolling the file up? Very annoying.

Thanks ~

Bubnoff

I have a BASH script that "reads" the backup logs, reports the success/failure of the last backup, lists the contents of the backup directory then emails the results. After moving the backups to a new server and turning the email routine into functions, it spams me with email. Looks like it's expanding the date and sending an email for each date it expands to. I can't see how for the life of me. Here's some code from "MAIN":

YDATE=$(date -s "yesterday" '+%a%b%d')
BKPLOG="/mnt/nfs/horizon/backuplog_$YDATE.log"

STATUS=$(cat /mnt/nfs/horizon/backuplog_$YDATE.log)

# Catenate logs and status into message body -- email report to 
# Support.
func_make_msg $MSG "$RPT" "$STATUS" "$DB_SERV_BACKUP_LISTING"
func_send $MSG "[email protected]" # Send it!

func_make_message just creates the message. Note that neither function are in a for or while loop. Here's the send function:

function func_send ()
{
    local _message=$1
    local _cc=$2
    local _recipient=$3
    $PRINT --columns=2 -t < $_message | $MAIL -s "Backup Logs" "$_cc"
}

My inbox shows an email from each date in the backup logs every time I run it. Thankfully I tarred up the old ones otherwise my inbox would still be going nuts.

Backup server is Debian. Script runs on a cron job:

0 7 * * *      bash /home/bkpadmin/scripts/backup_mail.sh

any ideas? The time was off by a mile, but I eliminated the ntp, cron factor by running it manually. I get the same results even after fixing the time/date and running it manually.

Here's the func_make_msg function for the curious:

function func_make_msg ()
{
    local _msg_body=$1
    local _file=$2
    local _backup_status=$3
    local _db_backups=$4
    cat > $_msg_body << EOM 
## Nightly backup logs ###########################
** Backup Status **
File name: $_file
$_backup_status
---------------

** Important DB Server ****
$_db_backups
---------------
EOM
}

Thanks ~

Bubnoff

UPDATE Thanks Dennis. That was it. A stupid, stupid mistake on my part. The resulting loop-esque results are interesting. I am twice the fool, as I actually read the man page to remind myself how to calculate "yesterday". Swapped 's' for 'd'. 'S' as in "string" I guess. ...For more stupidity ...read on ...

This didn't happen during testing because the script belonged to, and was run in ...a regular user account. The date -s command failed but still output yesterday ...just didn't set the system date ...lacking permissions and all. Points to my second ...even more idiotic mistake ...the cron entry was for root. Another example of why one should never run scripts as root, or, even log in as root unless there is no other way.

The script was able to change the system date date and massively screw up as the variable was repeatedly expanded, thanks to having rootly powers. I am turning myself in to the proper authorities as we speak. Sorry World.

Can anyone see any other stupid mistakes while we're on the subject?