prd's questions

I'm facing an issue with our server email. Yesterday, our email provider was down for over 20 hours, severely impacting our business operations.

We have approximately 5TB of archived emails, which users frequently search through for past contracts or other information. Despite the large volume, they insist on keeping all emails. The current setup is using postfix/dovecot, using mdbox format.

I've been tasked with improving the server's reliability and performance. My proposed solutions are:

1. Separate old and new emails: Move older emails to separate storage, reducing the sync load on the primary server.

2. Implement high availability: Add a new mail server in a different location. If one server fails, the other should take over and synchronize data upon the first server's recovery.

3. Introduce a mail proxy: Filter incoming emails and forward them to both servers for redundancy.

4. Leverage Amazon S3 for backup: Utilize the existing S3 bucket to store old emails, aligning with the date separation plan.

I'm considering using existing mdbox and rsync for these tasks, because we are currently using mdbox for mail storage, and rsync to backup all mail files and other files to the cloud storage. So, I am trying to use the existing methods. But I still have some questions:

1. Is simple rsync sufficient for syncing email files? Could it create duplicate entries if messages arrive at different times through the proxy?

2. How can I effectively separate email storage by year using mdbox?

3. Is there a more efficient tool for setting up Dovecot replication between two identical mail servers?

I have not been in touch with mail technology, and I would appreciate any recommendations or insights you can provide.

Thank you

I am pulling my hair on this.. Can't seem to point a finger at where it went wrong. All error messages are cryptic, and leads to wrong problem.

I have just installed Windows admin Center to one of my server. I already have PS Remoting working for sometimes, and I can enter my servers using enter-pssession.

After installation, I tried to connect to the computer where I installed the Windows Admin Center and greeted with this screen.

Then I scoured Event Viewer, and found this one

400 - CimException: The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". Stack trace:
at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncObserverProxyBase1.ProcessNativeCallback(OperationCallbackProcessingContext callbackProcessingContext, T currentItem, Boolean moreResults, MiResult operationResult, String errorMessage, InstanceHandle errorDetailsHandle) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.Cim.CimProxy.<>c__DisplayClass7_0.<<Query>b__0>d.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.Cim.CimProxy.<>c__DisplayClass22_01.<b__0>d.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.Security.ImpersonationManager.d__01.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.Cim.CimProxy.<RunInCimSession>d__221.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.Cim.CimProxy.d__7.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.FrontEnd.Controllers.FeatureController.d__14.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Threading.Tasks.TaskHelpersExtensions.d__3`1.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ApiControllerActionInvoker.d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.ManagementExperience.FrontEnd.Handlers.ImpersonationActionInvoker.d__1.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ActionFilterResult.d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Dispatcher.HttpControllerDispatcher.d__1.MoveNext()

So I checked my WinRM service, and found out it is indeed, running

and accepting conneections. Invoke commands is also working properly

The rdp server that I was trying to connect, is the one hosting Windows Admin Center. So it is basically logging in into localhost. The system is freshly installed, and is connected to active directory.

Any idea on where it went wrong? Thank you

2 questions..

1. Can I convert software RAID 1 created in Windows Disk Management, into a Storage Space Mirroring volume? If so, how to do that?
2. is Windows Storage Space at Windows Server 2012 (non R2) stable enough for production server?

Thank you

I was having problem with RDS license. So I checked my license usage, and found out that a user takes 2 license. The user DOMAIN\pajak below is using DOMAIN\PAJAK and DOMAIN\pajak. I can't revoke the license either from one of them.

The license will expire on May, and I am short 2 licenses since there are 2 users having similar problem. When I right click on the name, I got a greyed "Revoke License" option. I am the administrator.

• How can this happened, and how to fix this? i.e, remove double licenses.
• Since it seems RDS CAL are case sensitive, how can I limit user to use only lowercase, and reject uppercase login from windows RDS?

Note: The user Pajak, means tax, is for government login, to check our finance. It is a requrement from our government to give a certain government liaison to audit our ledger in exchange for our special tax privileges. Thus, I can only limit our system not to allow him do something bad. But I can't trust them to put a notice on their system nor organization. I can warn the other user that I've stripped off, but not this user.

Thank you

My Secondary Active Directory server has gone dead, and I am installing its replacement now. Everything will be the same, computer name, IP, everything.

The new server is running now, and ADDS installed, but I am hesitating to promote this new server to ADDS, since I am afraid to disturb the current running server. My question is, how do I replace the old domain controller? Should I just install ADDS, and promote it? Or should I do a cleanup? What is the best practice to reinstall ADDS?

I have no backup of this secondary server, since it was dead only within 2 days after operational. Perhaps hardware defect, malfunction or something else.

Thank you.

Ok.. this is rather strange, but I need to replace X-forwarded-for value.

We are using SAP B1, and for some various reason, it needs x-forwarded-for contains only one string "https://sap.domain.tld:443" and only that value. No other hosts, and no comma. Exactly as that.

Now, I am using various proxies and cloudflare, thus adding some values in X-forwarded-for that I have to remove to access SAP B1 Web Access. I need all those values removed.

Below is my configuration in apache:

    SSLEngine On
    SSLCertificateFile      /etc/ssl/crt/sap.crt
    SSLCertificateKeyFile /etc/ssl/private/4096.key
    SSLCACertificateFile    /etc/ssl/ca/ca.crt

    SSLProxyEngine On
    SSLProxyCheckPeerCN off
    SSLProxyVerify none
    SSLProxyCheckPeerName off
    SSLProtocol -all +TLSv1.2 +TLSv1.1 +TLSv1
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA$

    ProxyPreserveHost On
    ProxyVia full
    ProxyPass / https://10.1.1.1:8100/
    ProxyPassReverse / https://10.1.1.1:8100/
    ProxyAddHeaders off
    RequestHeader unset X-forwarded-for
    RequestHeader set X-Forwarded-For "https://sap.domain.tld:443"

I have added ProxyAddHeaders off but apache still adds new X-Forwarded-For. How can I remove them all?

I have some problem with Windows 2016 HyperV Edition. It is Core only, and no GUI. Problem is that the mainboard is broken, and I need to replace it. But after replacing it, Windows doesn't recognize anything. Onboard LAN dead, GPU is not recognized, and PCIe LAN is also dead. Even USB is not working. Network and internet is out of question. Keyboard is PS/2 only, no USB flash drive. So it must be something inside Windows Server itself. Therefore Devcon is also out of question.

How to perform hardware rescan? Any idea to revive this? Reinstall HyperV? Running an upgrade? Anything without reinstalling virtual machines will do.

Thank you.

I am trying to setup a Linux, for some kind like Remote Desktop proxy.

My network setup is something like this:

I drew only 3 sites and 3 servers to illustrate, but in fact, we have about 7 sites in a mesh, and about 2-3 servers per site. All of those sites are connected through L2TP/IPSEC tunnels through various media, from fiber, to 3G or EDGE connection.

Right now, I am using DDNS to connect to those remote locations, but this is getting tedious, since I have to maintain multiple DDNS, while I have multiple IP blocks at our data center unused. So I think I need something like an RD gateway, to proxy my requests to Server A, Server B, and Server C through one Static IP at Server A. Problem is, servers in A site are all Linux based. But some in site B and C are Windows based, especially that we are now using Windows 2016 Hyper-V Edition for our newest site.

Now, is there a way so I can Remote Desktop to ALL servers in ALL sites, using Server A as a proxy?

Thank you

We are currently running VMWare ESXi, with 1 Windows 2008 R2 Standard instance, 1 Windows 7 instance and 2 Linux instances.

So, recently I wanted to upgrade my server, because there were a lot of things happened. I couldn't find Intel 1GB multiport adapter, so I get Dlink's adapter, but it was not supported by VMWare. Another issue is that our hardware NAS is extremely slow, and their technical support is dud at best. 20MB/s of RAID5 with NIC teaming and only iSCSI really can't say much in term of performance. So I have encountered Starwind VirtualSAN which can only run only under Windows. Therefore I plan to migrate my VMWare into HyperV.

We have only 1 Windows 2008 R2 Standard license available. But as I read on Microsoft site, Windows 2008 R2 Standard is eligible for 1 VM and 1 host. This Windows 2008 R2 is responsible for Citrix Remote Desktop.

I have successfully performed the migration, but I have a few question remains before performing the live migration.

1. Since I can run 2 Windows 2008 R2 Standard total (host + VM), should I run Windows 2008 R2 Standard on top of Windows 2008 R2 Standard host, or is it better with Windows 2012 R2 HyperV host? Is there any new features in 2012 R2 I should know about than 2008 R2 counterpart?
2. VMWare's Ubuntu support has been excellent, and it is very fast. How about HyperV performance? Anyone ever tried to compare Ubuntu server on HyperV and on VMWare?
3. Is it better to let them VMs access iSCSI from their host, or just allocate fixed VHD to them? i.e, 100GB for VHD + 2TB of iSCSI, or just put 100GB VHD and 2TB VHD? The iSCSI will be cached by about 16GB cache RAM on the host. I really have to install Starwind on HyperV host, since I have another server which currently accessing iSCSI too.

Thank you for helping

As title suggests. We are migrating from OpenLDAP as user authentication to Samba 4 AD Domain. But I can't find any information on how to transfer passwords and users to Samba 4 AD. How to migrate all LDAP user base at ou=People,dc=company,dc=com to samba 4 AD domain?

I don't need to assistance transferring everything, I only need to transfer user accounts. I've finished migrating them all but user/passwords. Can it be done? If so, how?

I have a strange problem with postfix. This first screenshot is captured by tcpdump on postfix. This one gave me "501 Domain must resolve" error.

I tried to connect manually, and enter information as captured on tcpdump on putty, but got different result.

Using putty, server responds as 250, Sender Ok

SMTP Server is MDaemon, and our mail server is Postfix

Any idea why it happened and how to solve it?

Thank you

I have suddenly ran out of my VMWare server memory, and VMware said that I can't make 2GB VM. I only have 3 VM. 3GB, 1GB, and 512MB. I turns out that ESX has less than 6GB

I am sure that I have 8GB RAM, and VMWare also said so as shown here.

I understand that I would have 7774 usable RAM, but less than 6GB, where is my 2GB go? Why do I only have 6GB, and not 8GB or 7.7GB? and how to fix this?

Another same problem on another machine. This time with ESX 5.1

And physical memory

Any idea?

For anyone care to vote down this question, I think you should put a more light as why my available RAM is 6GB instead of 8GB, and answer me where does my 2GB go? I've search all google and all VMware for past 3 months, and I haven't seen any explanation.

I am new to traffic shaping, but I need a quick simple shaping. I have a free internet service on my place using wifi. All www traffic has been routed to transparent proxy. We have a 10mbps connection, and our usual client is around 100-130 clients. Internal interface is eth1, and external is eth0.

The problem is that people start abusing our service and downloads many things with multiple connection download clients, thus choking our bandwidth and causing problem to other user. http data can flow just fine because some served from our proxy, but https has their problem on connecting. Sometimes I saw one IP address opened up 40 connection to download 10 files simultaneously. I have tried to put acl maxconn 4 on squid, but maxconn has problem with firefox with maximum connection reached error every now and then. So, currently when I saw some people start doing that, all I can do is ban that user.

So I think I should statically limit all clients to maximum 64kbps per IP despite how many connection they make, except only youtube movies for 360p movies should run just fine. I plan to use 2mbps for other than youtube, and 8mbps for youtube.

This is my current script

tc qdisc add dev eth0 handle 1: root htb default 11
tc class add dev eth0 parent 1: classid 1:1 htb rate 10mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 8mbit
tc class add dev eth0 parent 1:1 classid 1:11 htb rate 64kbit burst 1mb ceil 384kbit
tc qdisc add dev eth0 parent 1:10 sfq perturb 10
tc qdisc add dev eth0 parent 1:11 sfq perturb 10
tc filter add dev eth0 protocol ip parent 1:10 match src 142.176.121.192/27 flowid 1:10
tc filter add dev eth0 protocol ip parent 1:10 match src 173.194.0.0/16 flowid 1:10

I can't seem to stop those multiple connection clients. Is there something I did wrong? Also, how can I capture youtube? Are those IP correct?

Thank you

I have 2 subnets on 2 different network. Both are connected to internet, and linked via site-to-site openvpn like this:

1. Subnet A
   • IP: 192.168.1.0/24
   • Gateway: 192.168.1.1
   • Client: 192.168.1.10
   • Public IP: Dynamic
2. Subnet B
   • IP: 192.168.2.0/24
   • Gateway: 192.168.2.1
   • Public IP: Let's say, 1.1.1.1
3. OpenVPN tunnel
   • IP: 192.168.3.1 - 192.168.3.2

Now, the problem is one of our computer at subnet A needs to connect to a site, that require a static IP, since that particular site locked their firewall to only open to predefined IP address. The site itself has a couple of randomly allocated IP address, and my client needs to connect to a portal for verification, then get redirected to another random IP.

I think the only way is to move the default gateway to 192.168.2.1, so I put route 192.168.3.2 via 192.168.1.1, and 0.0.0.0/0 via 192.168.3.2. I got error that 192.168.3.2 is unreachable. Is there a way to use 192.168.2.1 as default gateway for that particular computer?

Network Diagram

To other gateway

traceroute to 192.168.2.1 (192.168.2.1), 30 hops max, 40 byte packets
 1  192.168.1.1 (192.168.1.1)  0.695 ms  0.635 ms  0.611 ms
 2  192.168.2.1 (192.168.2.1)  16.102 ms  16.183 ms  16.778 ms

Traceroute for the specific route:

traceroute to 202.3.210.1 (202.3.210.1), 30 hops max, 40 byte packets
 1  192.168.1.1 (192.168.1.1)  0.783 ms  0.719 ms  0.688 ms
 2  192.168.3.2 (192.168.3.2)  12.611 ms  12.768 ms  12.778 ms
 3  linknet-ip-1.1.1.1.link.net.id (1.1.1.1)  28.095 ms  28.741 ms  28.952 ms
 4  202.137.2.5 (202.137.2.5)  28.882 ms  28.861 ms  28.950 ms
 5  202.137.2.25 (202.137.2.25)  28.931 ms  28.909 ms  57.159 ms
 6  telkomsel.openixp.net (218.100.27.187)  57.231 ms  14.208 ms  17.469 ms
 7  114.127.254.1 (114.127.254.1)  17.774 ms  18.123 ms  18.099 ms
 8  114.127.254.9 (114.127.254.9)  18.233 ms  18.217 ms  18.250 ms
 9  * * *
10  * * *
11  * * *
.
.
30  * * *

Normal traceroute to their public network.

traceroute to www.telkomsel.net (68.178.232.99), 30 hops max, 40 byte packets
 1  192.168.1.1 (192.168.1.1)  0.220 ms  0.158 ms  0.169 ms
 2  10.36.192.1 (10.36.192.1)  17.535 ms  17.572 ms  17.549 ms
 3  fm-ip-202.73.96.73.fast.net.id (202.73.96.73)  21.125 ms  21.105 ms  26.445 ms
 4  fm-ip-202.73.96.73.fast.net.id (202.73.96.73)  26.422 ms  26.400 ms  26.377 ms
 5  fm-ip-202.73.96.70.fast.net.id (202.73.96.70)  26.310 ms  26.294 ms  26.271 ms
 6  IP-125-33.MCS.napinfo.net (119.110.125.33)  26.248 ms  26.234 ms  26.212 ms
 7  IP-112-245.MCS.napinfo.net (119.110.112.245)  26.198 ms  20.678 ms  17.875 ms
 8  203.208.131.53 (203.208.131.53)  27.957 ms  27.780 ms  27.628 ms
 9  203.208.152.205 (203.208.152.205)  27.583 ms 203.208.152.209 (203.208.152.209)  27.551 ms 203.208.166.165 (203.208.166.165)  27.365 ms
10  203.208.153.162 (203.208.153.162)  222.498 ms so-3-0-1-0.plapx-cr2.ix.singtel.com (203.208.151.246)  219.745 ms 203.208.153.126 (203.208.153.126)  205.572 ms
11  xe-1-0-0-0.plapx-cr2.ix.singtel.com (203.208.183.169)  220.307 ms 203.208.171.154 (203.208.171.154)  194.131 ms ge-0-0-0-0.plapx-dr1.ix.singtel.com (203.208.149.1)  195.132 ms
12  203.208.169.26 (203.208.169.26)  225.739 ms  220.137 ms  248.199 ms
13  * * *
14  phn-edge-06.inet.qwest.net (205.171.12.142)  209.196 ms  209.183 ms  225.736 ms
15  63-234-235-102.dia.static.qwest.net (63.234.235.102)  209.023 ms  216.370 ms  223.680 ms
16  ip-208-109-112-141.ip.secureserver.net (208.109.112.141)  233.784 ms  223.442 ms  216.054 ms
17  ip-208-109-112-141.ip.secureserver.net (208.109.112.141)  226.400 ms  212.813 ms  214.883 ms
18  * * *
.
.
30  * * *

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.3.2     0.0.0.0         255.255.255.255 UH    0      0        0 tun0
202.3.210.1     192.168.3.2     255.255.255.255 UGH   0      0        0 tun0
118.137.103.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.2.0     192.168.3.2     255.255.255.0   UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth1
0.0.0.0         118.137.103.1   0.0.0.0         UG    0      0        0 eth1

Sorry, I had to remove the diagram again to be able to save

202.3.210.1 is the portal in question.

I have accidentally upgraded the hard drive on my XenServer machine, and didn't remember to transfer my database VM. All machines has been restored, but this one machine. All I have are 2 virtual disks, and I need to recover my mysql files inside. SR has been recognized, and attached, but I can't make it to boot from the vdi. The Xen server gave me blank screen, not even the black console screen, but a blank white screen without console.

Please help.. I really need those files, and I don't care how. Only those mysql files.

Thank you