Bourne's questions

As the title says, I've setup a central RHEL rsyslog server with a couple of RHEL clients forwarding all their logs to it. The logs are being forwarded correctly because when I look at the content of /var/log/* logs on the server, all the client events show up.

However, when I run...

perl /usr/share/logwatch/scripts/logwatch.pl

...on the server, one of the clients does not show up on the report. Don't know if this has anything to do with this at all but, the client that's not showing up used to have logwatch configured at some point. Currently though, I have disabled the functionality and removed all the logwatch files from it.

The content of /usr/share/logwatch/default.conf/logwatch.conf is as follows.

LogDir = /var/log
TmpDir = /var/cache/logwatch
Output=mail
Format=html
MailTo = [email protected]
MailFrom = [email protected]
Print =
Range = yesterday
Detail = Med 
Service = All
mailer = "sendmail -t"
HostLimit = no
SplitHosts = yes
MultiEmail = no
Service = -zz-disk_space

So here are my questions:

1. Why is this host being excluded?
2. And secondly, somewhat related, what's the best way to customize the report formatting?

Thank you!

I changed the user quota on a windows 2008 machine and after that some users reported that they were able to read but not write to their mapped home folders. If I re-enter the Home Folder path in the Server Manager and accept the default prompt of...

"The \\server\folder home folder already exists. Do you want this user to be granted full control on this folder?"

...the issue disappears.

1. Is there a way to do the same thing with Powershell where the script will check to see if the user has the permissions and if not reassign them?

2. What about listing the folder permissions along with the owner to identify who doesn't have full permissions? I spent a couple hours on this second question with mixed results.

The following script does not seem to list folders with mismatching permissions.

get-acl "D:\users\*" | select Path -Expand Access | where
{ $_.Identityreference -notcontains 'NT AUTHORITY\SYSTEM' 
-and $_.Identityreference -notcontains 'CREATOR OWNER' 
-and $_.Identityreference -notcontains 'BUILTIN\Administrators' 
-and $_.Identityreference -notcontains 'BUILTIN\Users' 
-and $_.Identityreference -notcontains 'BUILTIN\Account Operators' 
-and $_.Identityreference -notcontains 'BUILTIN\BUILTIN\Users'} | 
select @{Expression={$_.path};Label="Folder"},
@{Expression={$_.IdentityReference};Label="User"},
@{Expression={$_.AccessControlType};Label="Permissions"} |
Format-Table -Wrap -AutoSize

What's the practical difference between:

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

and

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Which one is best to use?

Thank you.

I'm trying to understand the logic behind the failure in the following scenario:

a. If a linux bridge with 2 interfaces, eth0 (LAN) and eth1 (WAN) is behind an ISP device e.g. a cable modem, it does not receive an ip address even if the bridge interface (br0) is set to do so. Instead, it forwards the DHCP offer to the device behind the bridge i.e. whatever device is connected to eth0.

The command dhclient br0 indicates that no leases get offered at all and dhclient then goes back to the leases recorded in dhclient.leases, which are old and irrelevant.

However,

b. if the bridge is inside the LAN itself with eth1 being exposed to an internal DHCP server, it does retrieve an ip address. And so do the devices behind it.

The /etc/network/interfaces contains:

auto lo eth0 eth1 br0
iface eth0 inet dhcp
iface eth1 inet dhcp
iface br0 inet dhcp
     bridge_ports eth0 eth1
     bridge_stp off

1. This is puzzling. Any idea why this is happening? What's different in b vs. a?
2. Is there a way to force br0 to obtain an ip address first and not pass it downstream?

We had a single reverse lookup zone in our 2008 DNS with the name:

220.10.in-addr.arpa (I'll call this the mother zone) which was hosting records from 3 different subzones / child zones:

10.220.0.x, 10.220.1.x and 10.220.2.x.

In trying to separate records of one zone from the others, I created initially two zones, 0.220.10.in-addr.arpa and 1.220.10.in-addr.arpa that are replicating to all DNS servers in the domain. At first, these zones appeared at the same level as the 220.10.in-addr.arpa but then after a while two grayed out containers corresponding to each child zone showed up underneath the mother zone in addition to the individual ones I created.

Why are these containers grayed out and why did they not show up at the beginning? Does grayed out mean that they are delegated?

Thank you.

Is it safe to delete these two crossRef objects in ADSIEdit? This is in a Win2K8 environment where the DCs are running DNS and these two zones are missing.

I would like to do this because I cannot create any new zones, forward or reverse. When I attempt to do so, the error I get is

"The zone cannot be created. There was a server failure."

I also see Event ID 4512 repeatedly in the DNS logs with the message

The DNS server was unable to create the built-in directory partition ForestDnsZones.domain.com. The error was 9906.

In a test environment, I was able to delete them safely and upon restarting netlogon and the DNS services the zones/crossRef objects were recreated.

Would deleting them in ADSIEdit be the same as deleting the replication contexts via ntdsutil?

Is there a way to back them up in case something goes wrong?

Thank you.

Update:

The result of:

ldifde -f con -d CN=0e4820e2-35e2-4fcf-bae9-789ca2003a
6b,CN=Partitions,CN=Configuration,DC=sub,DC=domain,DC=com

is:

Connecting to "dc2.sub.domain.com"
Logging in as current user using SSPI
Exporting directory to file con
Searching for entries...
Writing out entries.dn: CN=0e4820e2-35e2-4fcf-bae9-789ca2003a6b,CN=Partitions,CN
=Configuration,DC=sub,DC=domain,DC=com
changetype: add
objectClass: top
objectClass: crossRef
cn: 0e4820e2-35e2-4fcf-bae9-789ca2003a6b
distinguishedName:
 CN=0e4820e2-35e2-4fcf-bae9-789ca2003a6b,CN=Partitions,CN=Configuration,DC=sub,D
 C=domain,DC=com
instanceType: 4
whenCreated: 20071129065500.0Z
whenChanged: 20110702063659.0Z
nCName: DC=ForestDnsZones,DC=sub,DC=domain,DC=com
uSNCreated: 6080
uSNChanged: 8091
showInAdvancedViewOnly: TRUE
Enabled: FALSE
name: 0e4820e2-35e2-4fcf-bae9-789ca2003a6b
objectGUID:: RIDFRdDkrUO7JUySD8iRig==
dnsRoot: nonexistent.nonexistent.sub.domain.com
systemFlags: 5
objectCategory:
 CN=Cross-Ref,CN=Schema,CN=Configuration,DC=sub,DC=domain,DC=com
dSCorePropagationData: 16010101000000.0Z
msDS-NC-Replica-Locations:
 CN=NTDS Settings,CN=dc2,CN=Servers,CN=My-Site,CN=Sites,CN=Configuration,DC
 =sub,DC=domain,DC=com


1 entries exported

The command has completed successfully

The error I get when trying to establish new naming context for ForestDNSZones and DomainDNSZones:

And for the sake of clarity, a screenshot of the crossRef objects:

I'm working on setting up a web server running RedHat Enterprise 6 with Apache and PHP inside of a chroot jail environment. The chroot directory for apache is /chroot/httpd. I followed this example yet when I go to start apache, I see the following in /var/log/httpd/error_log.

[warn] ./mod_dnssd.c: No services found to register
[Mon Jul 25 13:14:31 2011] [notice] core dump file size limit raised to 4294967295 bytes
[Mon Jul 25 13:14:31 2011] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Mon Jul 25 13:14:31 2011] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Jul 25 13:14:31 2011] [notice] Digest: generating secret for digest authentication ...
[Mon Jul 25 13:14:31 2011] [notice] Digest: done
[Mon Jul 25 13:14:31 2011] [notice] mod_chroot: changed root to /chroot/httpd.
[Mon Jul 25 13:14:31 2011] [error] (13)Permission denied: could not create /var/run/httpd.pid
[Mon Jul 25 13:14:31 2011] [error] httpd: could not log pid to file /var/run/httpd.pid
[Mon Jul 25 13:14:31 2011] [warn] ./mod_dnssd.c: No services found to register

Also, SELinux is enabled and according to the instructions, you are supposed to change the value of the httpd_disable_trans boolean to 1 using the command

setsebool httpd_disable_trans 1

However, I cannot find such a boolean under /selinux/booleans or anywhere in the system. The command produces the following error:

Could not change active booleans: Invalid boolean

I've scoured the web for why this boolean is not present in the system with no result. I have no idea if it's SELinux that's not allowing httpd to start or if it is a permissions issue. I have double checked the permissions and they seem fine. Any suggestions?

Thank you.

Update: I've determined that SELinux is indeed the reason for those errors. Changing the default policy from Enforcing to Permissive does allow apache to start just fine. The question is, why is httpd_disable_trans not available in the system? That would allow me to maintain the security of SELinux along with apache.

Also, on a side note, with apache inside a chroot environment, is it best to host the web content inside the /chroot or create symbolic links from there to where it is located? My goal is that I need to enable web content inside user directories stored under /users.

Update 2: Some Apache config lines that I believe are relevant:

.....
ServerRoot /etc/httpd
LockFile /var/run/httpd.lock
CoreDumpDirectory /var/run
ScoreBoardFile /var/run/httpd.scoreboard

PidFile /var/run/httpd.pid
ChrootDir "/chroot/httpd"
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule substitute_module modules/mod_substitute.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule version_module modules/mod_version.so
LoadModule chroot_module      /usr/lib/httpd/modules/mod_chroot.so

Include conf.d/*.conf


User apache
Group apache
....

A while ago I promoted our DNS server (running 2003) from being a member server to a domain controller so I could enable AD integrated DNS. Often, I am seeing error 9906 (Event ID 4512) pop up in the logs. The body of the message error is:

The DNS server was unable to create the built-in directory partition ForestDnsZones.sub.domain.com.The error was 9906.

Based on what I've read so far people seem to indicate that it is an issue with the server not being able to find the FSMO role holder. However, this doesn't seem to be the case with my scenario as all the domain controllers pass all the tests successfully. I haven't seen any glaring reasons for this but what I've been able to find out is an old value in the Application Partition using ADSIEdit.

Running dcdiag /test:crossrefvalidation, the results are:

  Starting test: CrossRefValidation

         This cross-ref has a non-standard dNSRoot attribute.

          Cross-ref DN:

         CN=0e4820e2-35e2-4fcf-bae9-789ca2003a6b,CN=Partitions,CN=Configuration,DC=sub,DC=domain,DC=com

          nCName attribute (Partition name):

         DC=ForestDnsZones,DC=sub,DC=domain,DC=com

          Bad dNSRoot attribute: xxxx.xxxxx.sub.domain.com

          Check with your network administrator to make sure this dNSRoot

         attribute is correct, and if not please change the attribute to the

         value below.

           dNSRoot should be: ForestDnsZones.sub.domain.com 
            It appears this partition

            (DC=ForestDnsZones,DC=sub,DC=domain,DC=com) failed to get

            completely created.  This cross-ref

            (CN=0e4820e2-35e2-4fcf-bae9-789ca2003a6b,CN=Partitions,CN=Configuration,DC=sub,DC=domain,DC=com)

             is dead and should be removed from the directory. 
         ......................... ForestDnsZones failed test

         CrossRefValidation

I suspect that the xxxxx.xxxxx.sub.domain.com is an entry from an old domain that one of the previous admins created.

I looked at this thread and looked at the Configuration Partition using ADSIEdit and indeed I can see that the dnsRoot value for partition DC=ForestDnsZones,DC=sub,DC=domain,DC=com is xxxxx.xxxxx.sub.domain.com.

This is strange because I don't see any reference to xxxx.xxxxx anywhere in the DNS console.

So the questions are:

1. Is it safe to change the dnsRoot value using ADSIEdit from xxxxx.xxxxx.sub.domain.com to ForestDnsZones.sub.domain.com?
2. If I can do that, will it be a problem that the old ID will be attached to the new value?
3. Is there a clean way I can go about removing any such old references and recreating the ForestDnsZones records?

I hope everybody had a good July 4th!

Looking through my DNS entries, I see the following:

My questions are:

1. How do I identify which of these belongs to the current domain?
2. Is it safe to delete the rest of them or should I just leave them all alone? Is there any harm done in keeping them?
3. How are these ids generated?

The reason I'm asking these is because I have had to rebuild Active Directory on a domain controller a few times and have had to use the same name. What I've been left with is a single _ldap record of that domain controller inside the _tcp record for every one of those entries. I suspect that some of these are remnants of that process and I'm trying to cleanup stale records. I've tried scavenging but they persist.

Thank you.

I'm trying to clarify the relationship between SOA records and AD based DNS since we are switching towards an all AD integrated DNS scenario in our environment.

We have 2 DCs running Win 2008. The goal is to ensure DNS redundancy and give domain client machines the ability to update their records directly on whatever server is available if one goes down...or both servers if they are both available.

1. Should both DCs host these primary integrated zones? Or should one host a primary integrated and the other a secondary (and hence integrated) version of it?

2. How does this work with SOA records? If you have two primary integrated zones does that not imply the possibility of two SOA records since both zones are directly updateable? Can you have more than one SOA record per domain?

3. Or can you only have one SOA record corresponding to the DC that hosted the integrated primary zone first, independent of whether the other DC has a primary or secondary zone of the same domain?

What is the best setup for such situation? What would you do?

Thank you in advance.

How do you hide the domain clients from seeing one another in the Network Browser? I don't want to disable Network Discovery because I would like to be able to maintain them, access their administrative shares and run installations remotely.

This command does not work.

net config server /hidden:yes

How do you guys get around this?

I am trying to understand how RRAS and NPS work together so I can see if it would make sense to implement the two in our environment and I see references in one of the Sybex books using the term "Remote Access Profile".

I have also come across statements such as "Link a Day-And-Time-Restrictions policy to an active Remote Access Profile". I have not been able to find such an explicit "profile" item in either RRAS or NPS.

1.What is it referring to?

Furthermore, in the NPS console, there are connection request policies and network access policies. I find this topic, or at least the way it's explained in the book confusing.

2.Does the first refer to rules for establishing a connection to begin with and the second to allowing access to resources if and after the connection is established?

3.With NPS being the Microsoft implementation of RADIUS, why would you need a RADIUS Client/Proxy if you can send the authentication requests directly to the RADIUS Server?

Windows 2008, IIS7 environment.

Have a site running on our Web Server where I'm trying to simplify the URL in the form of http://test-machine-name.sub.example.com to be http://live.sub.example.com.

I have created a CNAME of live for test-machine-name.sub.example.com in our DNS but I am unable to browse to it using that URL.

I would like people to be able to reach the server using the simpler live address.

The site bindings are for the test.sub.example.com and all available ip addresses of the web server. If I can get this to work internally, then I can do the same for the external ip address. I feel like this is a very simple configuration but I can't get it to work. What am I missing?

What are the correct steps to configuring an ASA5505 to be its own CA without a Microsoft CA being available and giving users the ability to self-enroll?

Specifically, I would like our ASA to use certificates for both VPN and SSL connections and I've managed to configure the Local Certificate Authority via ASDM but I cannot figure out what the URL the ASA uses for users to download their certificates is.

Also, do you need separate key pairs for VPN and SSL? Can you use certificates for SSH connections to the ASA?

Thank you in advance.

Splunk has this capability via its Google Maps addon that allows you to map IP addresses that show up in your syslog. That way you can pinpoint geo locations of attacks such as scans.

Do you guys have any suggestions as to if and how this can be done with just a regular syslog server such as syslog-ng or a syslog software collecting the logs? How would you go about performing reverse lookups on the syslogs?

We have an ASA device that we want to analyze syslogs from to get a better idea about the location of external attacks.

The logs that reach our Kiwi syslog server from windows machines appear like below:

EventLog 1 System 483 Thu Nov 18 04:51:53 2010 7036 Service Control Manager Unknown User N/A Information host.domain.com None 0000: 57 00 69 00 6e 00 48 00 .... 0008: 74 00 74 00 70 00 41 00 .... 0010: 75 00 74 00 6f 00 50 00 .... 0018: 72 00 6f 00 78 00 79 00 .... 0020: 53 00 76 00 63 00 2f 00 .... 0028: 34 00 00 00 6e 69 6e 67 ... The WinHTTP Web Proxy Auto-Discovery Service service entered the running state. 125

Is there a way to remove the extra info (hex, dots etc,) and have just the readable portion of the messages displayed? We are using Snare for the clients.

Thank you.

Hey guys. I'm working with the following scenario. There are 3 servers in this domain.

• 1 runs Win2003 and is the current name server and DHCP server, joined to the domain.
• 1 runs Win2003 and is a secondary DC
• 1 runs Win2008 and is the primary DC.

The domain currently has about 10 clients that run on DHCP and 30 on static. I want to transfer the DNS role over to the two DCs.

What is the best way to do this to make sure that the DHCP clients register their records with the DCs? I also want the records to update on both DCs so that if one of them goes down, the clients are still able to resolve queries and get on the internet.

Having an issue with a network card on a server today. If I restart the service via "service network restart" the card never comes back, the command prompt just hangs. I suspect it's a bad network card but wanted to run the output of dmesg by someone that might have come across these errors before. The output contains many lines like the one below.

NETDEV WATCHDOG: eth2: transmit timed out
eth2: tx_timeout: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: after: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: ns83820_tx_watch: 98 89 119
eth2: tx_timeout: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: after: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: ns83820_tx_watch: 98 89 119
eth2: tx_timeout: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: after: tx_done_idx=98 free_idx=89 cmdsts=8000005a
eth2: ns83820_tx_watch: 98 89 119

Any input would be appreciated. Thank you.

Edit:

lspci -vv output:

02:05.0 Ethernet controller: National Semiconductor Corporation DP83820 10/100/1000 Ethernet Controller
    Subsystem: National Semiconductor Corporation DP83820 10/100/1000 Ethernet Controller
    Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr+ Stepping- SERR+ FastB2B-
    Status: Cap+ 66Mhz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
    Latency: 64 (2750ns min, 13000ns max), Cache Line Size 10
    Interrupt: pin A routed to IRQ 209
    Region 0: I/O ports at 2400 [size=256]
    Region 1: Memory at fe040000 (32-bit, non-prefetchable) [size=4K]
    Capabilities: [40] Power Management version 2
        Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold-)
        Status: D0 PME-Enable- DSel=0 DScale=0 PME-

What is the best way to setup Retrospect to recycle tapes automatically? I would have thought this to be very straight forward but everything I have come across so far seems to indicate otherwise.

Example: I have a backup set named Daily Users that consists of two member tapes. What I want Retrospect to do is Automatically reuse tape 1 when tape 2 gets full. What is the best way to do this without having to go in and manually recycle the tape?

Also, if you could share what your retrospect backup settings are that would be great.

Thank you.

I was wondering if anybody had any advice on this.

I had a network printer that was deployed via GPO to client machines running Windows 7 in a mixed 2003-2008 environment. There was also a local startup script that was making the printer be the default one for users. Just to provide more context, the client machines were imaged, so when the first user logged on, they got the "install printer driver prompt" and it was installed for everyone.

The printer died so I removed it from GPO and from the domain but individual users still see the printer as offline under Devices. How do I completely remove any trace of this printer for all users on a machine?

These are the things I have tried:

1. Used psexec to run printui.dll to remove per machine connections. It fails saying it is unable to remove it and asks me to check the connection to the printer.

2. I deployed a vbs script via GPO that looked like below:

      Option Explicit

      Dim objNetwork, objPrinters
      Set objNetwork = CreateObject("WScript.Network")
      Set objPrinters = objNetwork.EnumPrinterConnections

      ' ### Delete selected network printer
      Dim sPrinterName
      sPrinterName = "\\PDC\HP LaserJet 8000 Series PCL 5"
      objNetwork.RemovePrinterConnection sPrinterName, True, True

No luck.

3. I also tried deleting the key HKEY_CURRENT_USER\Printers\Connections with the value ,,PDC,HP LaserJet 8000 Series PCL 5 for all users. It still shows up under some users.

Is there a way to wipe every record for this printer from the local machines?

Thank you.