ndbroadbent's questions

I have an old IBM System X3250 server that I'm using to run Home Assistant, etc. I have a SyncMaster BX2240 screen that I've plugged in with a VGA cable. The screen has a resolution of 1920x1080.

The server is running a fresh install of Debian 11. I chose the Gnome option for the desktop environment, which is using Wayland.

The resolution of the monitor is 1920x1080, but the max resolution I can get with Debian is 1024x768. This also seems to be the resolution that is used when booting the server - it looks like the BIOS and IBM System X server firmware screens are also using 1024x786.

I ran lspci | fgrep 'VGA':

$ lspci | fgrep 'VGA'
04:00.0 VGA compatible controller: Matrox Electronics Systems Ltd. G200eR2

I found this article: How to configure Matrox Graphics MGA G200 AGP on Debian and Ubuntu Linux, and installed the xserver-xorg-video-mga package. I was hoping that Debian would find and use the MGA driver automatically, but after I rebooted the server, the resolution was still stuck at 1024x768. The blog post I linked also included a MGA G200 recommended xorg.conf, but the resolutions in here are still 1024x768 so I'm not sure if that helps.

I also found this blog post: Enabling higher resolutions on Matrox G200eW. So it looks like this is possible, and I should be able to get my Matrox G200eR2 graphics card to produce a 1920x1080 screen resolution. But I don't know how to configure this for Debian 11 running Gnome / Wayland. I would be happy to change my display server if it's the only way to fix the resolution. Or can it be fixed with Wayland?

I would appreciate any help figuring this out. Thanks! (I mostly use SSH and VNC, but it's been bugging me for a while so I just want to see if I can solve it.)

I am working on a multi-tenant web application that is hosted on AWS. It is written in Ruby on Rails, and each app server runs Nginx. We have an EC2 instance that runs HAProxy. We originally set up HAProxy because some of our customers could only set up A records on their root domain (pointing to a static IP), and ELB only offers dynamic IPs.

So our requests look like: HAProxy => Nginx => Rails

Our customers can configure a custom domain, so they can access our service via their own domain (through A or CNAME DNS records.) We will need to support around 1,000 domains.

I was planning to write a script that would request SSL certificates from LetsEncrypt for all of our custom domains. Then I would configure either Nginx or HAProxy to use these SSL certificates (they can use the right one based on SNI).

Would it better/easier to terminate SSL at HAProxy or Nginx? Will loading 1,000 SSL certificates impact performance?

Finally, are there any open-source projects that can accomplish some or all of what I'm looking for?

I've got dhcpd pushing updates to bind, and it seems to be working fine:

named[24161]: client 192.168.10.1#59141: signer "dhcp_updater" approved
named[24161]: client 192.168.10.1#59141: updating zone 'office.lan/IN': adding an RR at 'Examples-MBP.office.lan' A
named[24161]: client 192.168.10.1#59141: updating zone 'office.lan/IN': adding an RR at 'Examples-MBP.office.lan' TXT
named[24161]: client 192.168.10.1#47923: signer "dhcp_updater" approved
named[24161]: client 192.168.10.1#47923: updating zone '10.168.192.in-addr.arpa/IN': deleting rrset at '7.10.168.192.in-addr.arpa' PTR
named[24161]: client 192.168.10.1#47923: updating zone '10.168.192.in-addr.arpa/IN': adding an RR at '7.10.168.192.in-addr.arpa' PTR

However, our MacBooks are often on WiFi and plugged in via ethernet at the same time. This means that bind rejects the update, because of duplicate hostnames:

named[24161]: client 192.168.10.1#34165: updating zone 'office.lan/IN': update unsuccessful: Examples-MBP.office.lan: 'name not in use' prerequisite not satisfied (YXDOMAIN)
named[24161]: client 192.168.10.1#35832: updating zone 'office.lan/IN': update unsuccessful: Examples-MBP.office.lan/TXT: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)

I don't actually care too much about the forward lookup, I just want the reverse lookup on both IPs, so that both IP addresses point to the same hostname.

Here's the relevant part of dhcpd.conf:

ddns-update-style interim;
ddns-domainname "office.lan.";
ddns-rev-domainname "in-addr.arpa";
key DHCP_UPDATER { algorithm hmac-md5; secret "{{secret key}}"; };
zone 10.168.192.in-addr.arpa. { primary 192.168.10.2; key DHCP_UPDATER; }
zone office.lan. { primary 192.168.10.2; key DHCP_UPDATER; }

and the relevant parts of named.conf.local:

zone "office.lan" IN {
    type master;
    file "/var/lib/bind/office.lan.db";
    allow-update { key DHCP_UPDATER; };
};

zone "10.168.192.in-addr.arpa" {
    type master;
    file "/var/lib/bind/10.168.192.in-addr.arpa";
    allow-update { key DHCP_UPDATER; };
};

I tried commenting out the zone office.lan. and ddns-domainname lines in dhcpd.conf, but then I was just getting these error messages:

dhcpd: Unable to add forward map from Examples-MBP.office.lan. to 192.168.10.7: timed out

So the question is: How can I get dhcpd to just update the records in 10.168.192.in-addr.arpa, and not worry about duplicate hostnames in office.lan.db? Alternatively, is there some way to ignore duplicate hostnames, or alter the hostnames to make them unique?

Please let me know if you need any further information.

We have a public DNS provider, a private DNS master, and a private DNS slave. The public DNS provides the "example.com" zone, and all of it's subdomains. Our private DNS also provides the "example.com" zone, but some A records point to internal IPs on our LAN instead of public IPs. The annoying thing about this configuration is that we need to duplicate all of our CNAME and MX records on both DNS masters.

On the private DNS master, it would be really cool if I could configure a few known subdomains on our private network, and then fall back to the public master for any undefined records. AFAIK, this could be done with a wildcard NS record, but those aren't allowed.

Examples:

• example.com

  • Web server is publicly accessible
  • Some pages on the web server are only available to requests from the private LAN

• cdn.example.com

  • Is a CNAME pointing to amazon cloudfront

I don't want to define the cdn.example.com zone on our private DNS server. (And we have many other records that are duplicated.) It would be great if the private DNS server could be a master/slave hybrid for a particular zone, so that it can override certain records, but fetch the rest from the public DNS server.

If bind9 can't do this, is there something else that can? Or maybe I should do this with a shell script that pulls down the master DNS records, before appending or overriding with our custom records?

I found some hardened SSL settings in github.com/ioerror/duraconf.

Here is the header from the config:

This is an example of a high security, somewhat compatible SSLv3 and TLSv1 enabled HTTPS proxy server. The server only allows modes that provide perfect forward secrecy; no other modes are offered. Anonymous cipher modes are disabled. This configuation does not include the HSTS header to ensure that users do not accidentally connect to an insecure HTTP service after their first visit.

It only supports strong ciphers in PFS mode:

ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

# Only strong ciphers in PFS mode
ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
ssl_protocols SSLv3 TLSv1;

If we were to use these settings on our website, what does "somewhat compatible" mean? For example, would IE6 still be able to connect?

We use Chef to set up our servers, but I'm looking for a way to consolidate our server dependencies into a single config file that lives in source control.

We use capistrano for deployments, a custom build script for continuous integration, and now we want a Nagios poll to check that all dependencies are present (rvm installed, correct ruby version, gems installed, etc.)

This means that we would be duplicating the dependency config in 3 places, and I would like to refactor this. I want to be able to use the same code from both my deploy script and my build script, to handle the installation of packages and setting up the environment. We were thinking about using our capistrano scripts within the build script, but that seems too convoluted. I'm also looking for code that can inspect the environment and check that it meets the app's requirements.

I image that the configuration would be something like .environment.yml in the root directory of the application. The scripts could be something like './script/environment setup' and './script/environment check'.

I'm posting this as a question because I don't want to reinvent the wheel. I would like to ask if there is already a convention in place, or if anyone has any better suggestions.