What is the list of the resources/services that can be deployed to a hybrid Azure Stacks HCI appliance?

Context

I am doing an assessment about whether existing on-public-cloud applications can be deployed to on-prem environments. The ultimate goal is a list of required software changes/reenginering.

Since our apps are currently bound very tight to Azure and its services, I expect the short answer is that they can't be deployed right away. But I need to understand, in particular, what services, especially in PaaS, that Azure currently provides on the cloud can be provided on-prem by adopting Azure private & hybrid solutions.

Azure Stacks Hub is the private cloud solution by MS Azure to deploy Azure apps on premise. Azure Stacks HCI is a hybrid cloud that allows to perform some workload (e.g. sensitive workloads, PII processing) on premise. Running on prem is often a cultural requirement more than regulatory in my experience. I wouldn't like to expand because it will be a long dissertation.

I have found a Marketplace list of services available for Stacks Hub private cloud. I assume they run air-gapped, but it's not the scope of this question.

By narrowing the scope to the PaaS services we require, I will make a list and share my current findings. Today, this is a very high-level analysis.

• Angular FE via static web app: possible. VMs and containers supported
• .NET Core BE: possible as above
• SQL Server: possible, because it is cited everywhere
• Blob storage: Stacks is full about storage. Not sure, however, that the Stacks storage is compatible with existing applications using Blob Storage APIs
• Azure Key Vault: is it possible to deploy an instance of AKV to a private server or is it available only on public? For example, I haven't found it in Hub Marketplace
• Azure Data Factory: probably not available, but I can't find information whether I can deploy ADF privately
• Azure App Insights: can we collect stats on private instances? Probably not, only on the hybrid (and deployed to the public part of the cloud)

I want to ask if it's possible to use Certbot for a semi-automated setup where the underlying infrastructure is controlled by me and not by Certbot.

I understand that Certbot will communicate with Let's Encrypt to issue a challenge, which is basically a token that Certbot will need to find at my IP address or my DNS.

I have full control of Apache server, but it is a very customized multi-hosting setup (SNI required!) and I don't want Certbot to mess up with my Apache configuration, neither to run as root. We will return to sudoers later.

I have already set up the hosting space for mta-sts.example.org, as I am implementing Mail Transfer Agent's Strict Transport Security

I have told Apache, using a macro, that /home/djechelon/srv/www/domains/mta-sts.example.org is my workspace

• htdocs: content served over HTTP
• htdocs-secure: content served over HTTPS
• logs: Apache VHost logs
• ssl: this is where mta-sts.example.org.{key,crt,ca_bundle?} exist

I would like to tell Certbot to do the following for me

1. Obtain the challenge from LE
2. Write the challenge to appropriate file under /home/djechelon/..../htdocs, and Apache is ready to serve it
3. Ask LE to validate challenge, because Apache is ready to serve the challenge
4. Write certificate to /home/djechelon/..../ssl/. If LE provides no ca_bundle no problem, it's optional on my place
5. Issue Apache reload (there will likely be a sudoers setting soon)

I understood that I need to use the webroot plugin in this case, but I was struggling to find command line help for all options, including where to store the files and the certificates.

The documentation assumes that the process is interactive, so I would have to copy the challenge file manually and ask Certbot to contact LE for domain validation.

I believe that there should be a simple way to run the simple script above, which runs under the assumption that the overall IT infrastructure exists (e.g. you really want to run your own server software) and is well configured.

Any help?

[Edit] I managed to invoke this interactively for now

 certbot certonly --webroot -d mta-sts.example.org --preferred-challenges http --work-dir /home/djechelon/etc/letsencrypt --logs-dir /home/djechelon/letsencrypt-logs --config-dir /home/djechelon/etc/letsencrypt

Which asked me for the webroot dir and the email (something I would have loved to pass as a parameter for future renewals). So now the question may become "how do I rerun this in the future non interactively with cron?"

I run my own mail server on Azure for my domain. After deploying a new VM that will replace my existing server I stumbled upon the inability to run trivial email diagnostic tests like port25's DKIM tester. I found this Microsoft article showing that MS decided to shut down the ability for new deployments to run port 25 and that a support request should be made to unlock port 25 outbound.

The article says that the support request must be for a technical issue, however my subscription does not allow technical support requests unless I buy a paid MSDN subscription.

I run my own domain on a very low budget and mostly for fun than for profit, but I am trying to reduce the number of servers after shutting down my ecommerce hosting business. So I wouldn't like to pay for a subscription that is worth more than the two servers I currently run.

How can I request port 25 unlock and go through Microsoft's screening without the ability to issue technical requests?

I just found that my instance of Web Deploy agent stopped working and won't restart because of a missing SSL certificate.

When I try to start service IIS Manager (C:\Windows\system32\inetsrv\wmsvc.exe) it crashes and asks me to view Event Log.

Event log shows error IISWMSVC_STARTUP_UNABLE_TO_READ_CERTIFICATE related to certificate ID 608df89aa81d1ad2d87ee2dfcca76aa8abf92d11, which could be the self-signed certificate I might have deleted

We have an official *.example.com SSL certificate for our company that should be employed for Web Deploy too.

The question is: how do I tell Web Deploy to use a particular certificate?

I'm trying to exploit the power of Apache 2.4's <If> directives to customize a <Macro> by evaluating its parameters.

I'm currently trying to do the following:

• If authenticationMode == "htpasswd" use .htpasswd file
• If authenticationMode == "server" use pwauth
• Else break Apache configuration

The following code (inside of a <Macro> tag) does not work

        SetEnv ROOT_PATH /somewhere #Set outside macro

        <If "$authenticationMode == 'htpasswd'"> # Guilty line!
            AuthUserFile $ROOT_PATH/path/to/.htpasswd
        </If>
        <ElseIf "$authenticationMode == 'server'">
            AuthBasicProvider external
            AuthExternal pwauth
        </ElseIf>
        <Else>
            DO_CRASH
        </Else>

Error message is Cannot parse condition clause: syntax error, unexpected T_OP_STR_EQ, expecting '('

How to fix?

Standard Linux installation provide a maildir in /var/spool/mail/$user (that's actually a single file holding all emails, not a "mail directory"), soft-linked by /var/mail/.

I'm going to set up managed email on my installation, and I want to store mail in a separate partition that can be attached to the file system in case of server reimage (I already enforced this disaster-recovery measure for services such as mysql). The separate filesystem is /home.

So I would like system mail to be delivered to /home/$user/.mail[/] (final / in brackets because I'm not sure whether to include mail in a directory or not).

Currently, I run email for my own domain by redirecting all email to my ISP's email, which will not be forever (in case I change ISP I must migrate all email to the new ISP), so Postfix is instructed to redirect everyting directed to *@example.org to [email protected].

I was thinking about using Dovecot as email server, as it fully supports SSL.

So first, before configuring Dovecot, how do I tell the system to deliver mail in a different directory than /var/spool? Please mind that cron regularly sends email to root when jobs don't write to /dev/null, so the configuration must be system-wide.

Suppose you want to test a mail server for a particular domain before going live with DNS change.

For example, when you want to test an HTTP/HTTPS site you can just change your own machine's hosts file to point to the host-to-be.

With mail, that would be possible only if the server acts as outbound gateway for the particular domain. Let me explain with an example. I have set up authenticated SMTP for example.org on a host that has to be mapped to mail.example.org: I can point my DNS to the IP of that machine and tell my SMTP client to use that server, so it will also match the TLS certificate.

With inbound mail, when I need to test the server to accept mail for domain, perform basic antispam/antivirus checks, and don't perform strange things, I need the MX record. Recently I discovered that due to a bad Postfix/DKIM configuration my server did the following:

• When DNS MX was not live yet, it forwared mail directed to example.org to canonical MX, which was the old still-running MX
• After DNS switch, confident that everything was fine, the server rejected all mails with a routing loop error (Postfix mail for mydomain.com loops back to myself)

I had to dig, dig and dig to find the culprit line, but for future work I'd like to ask if there are best practices for testing mail servers before they go live. Assuming that I might be unable to telnet the server from my local machine because of the antispam checks.

My web hosting server features a Postfix setup up and running. That postfix is also open with STARTTLS on port 587 for authorized users (only me, myself and I right now) to send emails to any domain after signing it with DKIM.

Every email I send via Outlook authenticating myself is fine. All DMARC reports display no error. The problem is when web applications send email via that Postfix.

Since I use Apache's mod-itk for PHP hosting, all emails are generated by [email protected] and submitted to Postfix via standard means (sendmail???).

But in that way they are not DKIM-signed. Consider the following:

$ mail [email protected]
Subject: Test DKIM
Hello
.
EOT

Port25 responded:

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: [email protected]
DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: 

Postfix logs don't show dkimproxy interaction.

Before posting my configuration, let's repeat the situation and ask the question.

Currently, when I send an email via SMTP/TLS on port 587 it gets DKIM-signed. When a process on the server sends an email using mail command or PHP builtin mail function, the mail dorsn't get signed by dkimproxy.

The question is: how to sign every email coming from the server itself with dkimproxy?

Configuration is pasted to http://pastebin.ca/2374363. Please note that I have only dkimproxy.out enabled for the moment

I have mydomain.com that is hosted on an Azure VM instance called mymachine.cloudapp.net

I need to configure DNS so that both www.mydomain.com and mydomain.com get mapped to the same host. I'm using GoDaddy as registrar.

Currently GoDaddy offers me to create an empty (@) A record, so that if I ping mymachine.cloudapp.net and resolve its VIP address I can store it in the A record.

Unfortunately, if the VIP changes and I forget to re-ping I get mydomain.com unreachable, and that's normal.

When I try to move that @ record to the CNAME section so it best points to the VM hostname, I get the following error:

A record of a different type exists for the hostname @, could not create CNAME

This occurs both if I delete the A record and write CNAME, and if there is no @ record in the A section.

How can one set a @ CNAME record in a GoDaddy managed domain?

This morning I found that my Azure VM was dead dead. It was impossible for me to reboot or shut it down.

Anyway I managed to delete the VM instance and make a snapshot copy of the VHD (who never knows...). After creating a new VM and mounting the existing disk I found that all files were in order, so I want to suspect a cluster failure at Azure.

Anyway I have a whole file system full of applications waiting to run again. Surely, reinstalling all software, cloning /etc, /home and other directories to a fresh new VM could be a feasible idea, but I'd like to go back online ASAP.

The problem is that when I go creating a new VM I find no available disk in the Personal Disks tab. But I was able to attach that disk to the fresh new VM. I can also see that disk in the Virtual Machines/Disks tab on Management Console. Actually, I'll have to report Microsoft that a few strange things are happening in that screen (out of question scope and suggesting a problem at Azure), like non-existing disk connecting to already-deleted VM.

So, the question is. Starting from a non-damaged VHD that already ran an Azure Linux VM image (openSuse 12.1, not patched according to this blog post), how do I create a new machine instance that boots with that disk?

I have tried to create a custom Linux VM image based on openSuse 12.2 with Suse Studio. I have used Studio's upload to Azure feature to deploy the image to my BLOB container. I have made sure I installed WALinuxAgent package.

I then deployed the whole thing to Azure using Studio's uploader and created a VM with the newly uploaded image. The machine is still under provisioning status. I left it for a few minutes then tried to start the machine, no result.

DNS is reachable but the VM won't respond to port 22. It's still a few hours that the machine is under provisioning status.

How can I let a simple Suse image run on Azure before customizing it with my software?

After recently upgrading Apache2 to version 2.2.31 I found a strange behaviour in SSL VirtualHost setup.

A few of the website I'm hosting were showing the certificate for the default host even if the client was Server Name Identification aware, and this happened only with a few of them. This shows as the common Firefox's/Chrome's passport-warning about you being possibly scammed if you're browsing your home banking, but that simply was not the case.

To be clear, if server host.hostingdomain.org has its own SSL, attempting to access https://www.hostedsite.org reports certificate for host.hostingdomain.org, but a few https://www.hostedsite.me reported the correct certificate.

All sites are hosted on the same IP address, on port 443. The truth is that VirtualHosting works on the HTTP side and redirects SNI-aware clients to SSL automatically, so it's backward compatible with SNI-unaware clients.

Examining error logs for the offending VirtualHosts shown the following text

[Tue Dec 25 16:02:45 2012] [error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] (/path/to/www.site.org.conf:20)

and in fact the vhost was correctly configured with SSLCertificateFile.

The question is obvious: how to fix that?

I'm trying to start a test MVC4 application on Mono 2.10

$ xsp --version
xsp2.exe 2.10.2.0
Copyright (C) 2002-2011 Novell, Inc.
Minimalistic web server for testing System.Web

$ mod-mono-server4 --version  
mod-mono-server4.exe 2.10.2.0
(c) (c) 2002-2011 Novell, Inc.
Mod_mono backend for XSP

When I start mod-mono-server4 and perform a request I get this

$ mod-mono-server4 --port 8080
mod-mono-server4
mod-mono-server4
Listening on port: 8080
Listening on address: 0.0.0.0
Root directory: /path/to/htdocs
Hit Return to stop the server.
mod_mono and xsp have different versions. Expected '9', got 71
mod_mono and xsp have different versions. Expected '9', got 71
System.InvalidOperationException: mod_mono and xsp have different versions. Expected '9', got 71
  at Mono.WebServer.ModMonoRequest.GetInitialData () [0x00000] in <filename unknown>:0 
  at Mono.WebServer.ModMonoRequest..ctor (System.Net.Sockets.Socket client) [0x00000] in <filename unknown>:0 
  at Mono.WebServer.RequestReader..ctor (System.Net.Sockets.Socket client) [0x00000] in <filename unknown>:0 
  at Mono.WebServer.ModMonoWorker.InnerRun (System.Object state) [0x00000] in <filename unknown>:0 
  at Mono.WebServer.ModMonoWorker.Run (System.Object state) [0x00000] in <filename unknown>:0 

I have read that it could be due to a version conflict between xsp and apache2-mod_mono packages, but I reinstalled them from the Novell's official repository, forcing reinstallation from YaST, and then rebooted. The error persists.

How can I fix this problem?

My customer is using a very outdated ecommerce management system on my hosting service. For that product, no support is being provided anymore by the vendor.

Brief explanation: the shop website, that claims to run under LAMP stack, is built by an old Visual Basic Windows application running on MS Access. The user constructs the shop, defines the HTML template, adds products and categories, etc.

Then the VB exe builds the PHP pages (one for each template page) and the SQL script to run on MySQL. It also uploads everything via FTP and runs the installation/upgrade script on its own.

The problem

Browsing the website, many products' descriptions are cut before the euro sign. For example, what was supposed to be "Product price €1000" becomes "Product price"

The analysis

• MySQL contains a cutted description until the € sign, so it's not PHP fault
• The Access databases contain full description with € sign, so it's not fault of the webmaster writing bad description or eDisplay cutting them
• The SQL that will run once the site gets uploaded, stored on my local machine before upload, contains the € sign
• The same script, after being FTPed by eDisplay and opened with nano from SSH, shows the € sign messed up like this: ^À
• vsftpd log reports (obfuscated for privacy) Sat Dec 15 11:16:57 2012 22 xxx.xxx.128.13 1112727 /srv/www/domains/xxxxxx.it/htdocs/db.sql b _ i r xxxxxxx ftp 0 * c which seems to be a binary transfer (and also a huge security vulnerability because you can download the whole database from unauthenticated HTTP)
• The eDisplay internal FTP client provides no option for ascii/binary transfer modes
• [Add] Trying to manually upload the SQL file via SFTP shows messing up euro
• [Add2] Trying to manually upload using Xftp client with explicit ASCII mode doesn't fix too

It looks like the file gets uploaded as binary. Perhaps on the customer's previous host it all worked fine because that was a Windows host.

The server

It's an Azure virtual machine running openSUSE 12.2 with both vsftpd and openSSH

The question

Without asking the customer to manually upload files using FileZilla or replacing € with €, because he refuses, what can I do on server side to prevent vsftpd to screw up euro sign?

How to run a passive FTP server on an Azure Linux Virtual Machine?

Configuring the endpoints on Azure firewall and the PASV ports isn't enough because the client hangs on "Entering passive mode"

I want to enable MySQL SSL. I have all the certificates and keys in /etc/ssl/private/myhost. They are also (successfully) used by Apache2.

I don't have SELinux or AppArmor running.

I configured my.cnf as follows

#ssl
ssl-ca=/etc/ssl/private/myhost/myhost.ca_bundle
ssl-cert=/etc/ssl/private/myhost/myhost.crt
ssl-key=/etc/ssl/private/myhost/myhost.key
ssl-cipher=DHE-RSA-AES256-SHA

I have set permissions so that users in the ssl-private group can read the files, and added all required daemons (ie. wwwrun, mysql, postfix) to that group. Permissions look like follows

myhost:/etc/ssl/private/myhost # l
total 32K
drwxr-xr-x 2 root ssl-private 4,0K lug 14 13:11 .
drwxrwx--- 4 root ssl-private 4,0K lug 14 12:32 ..
-rw-r--r-- 1 root ssl-private 1,5K mag 30  2000 AddTrustExternalCARoot.crt
-rw-r--r-- 1 root ssl-private 3,3K lug 14 13:11 myhost.ca_bundle
-rw-r--r-- 1 root ssl-private 2,1K lug 13 22:00 myhost.crt
-rw-r--r-- 1 root ssl-private 1,8K lug 14 12:41 myhost.csr
-rw-r----- 1 root ssl-private 3,2K lug 14 12:36 myhost.key
-rw-r--r-- 1 root ssl-private 1,8K feb 15 23:00 PositiveSSLCA2.crt

I also copied and pasted path of certificate file from my.cnf into command sudo -u mysql cat /etc/ssl/private/myhost/myhost.crt and it displayed my certificate. The same command worked for the key.

But finally when I start MySQL I get the following error:

SSL error: Unable to get certificate from '/etc/ssl/private/myhost/myhost.crt'
120814 14:20:37 [Warning] Failed to setup SSL
120814 14:20:37 [Warning] SSL error: Unable to get certificate

How can I fix that?

Suppose I have 5 users and 100 Linux machines with remote shell enabled. How do I set the environments up to allow these few users to log in to any of the machines with the same credentials?

I just found this error in my server logs

May 17 14:55:07 marcus dkimproxy.out[1005]: signing error: Error: cannot read /etc/ssl/private/dkim_server/dkim_server.key: Permission denied

dkimproxy runs as dkim user, member of both dkim and ssl-private groups. The key file is chmodded as follows

# l /etc/ssl/private/dkim_server/

drwxr-x---  2 dkim ssl-private 4096 12 dic  2009 ./
drwxr-x--- 10 root ssl-private 4096 11 apr 16.37 ../
-rw-r-----  1 dkim ssl-private  891 12 dic  2009 dkim_server.key
-rw-r-----  1 dkim ssl-private  272 12 dic  2009 dkim_server.pub

I also did as root sudo -u dkim cat /etc/ssl/private/dkim_server/dkim_server.key and it works.

I had the same problem yesterday but I simply forgot to add dkim to ssl-private group. After I fixed that I thought I was done

Now seems that dkimproxy is still unable to read the private key.

What could I do to fix this problem?

I have Apache 2.2 with mod_ssl and a bunch of sites in HTTPS on the same IP/port with VirtualHosting, so client must support SNI to connect to those virtual hosts.

I would like to configure my server the following way:

When a user types www.dummysite.com and his browser supports SNI (Server Name Indication), any HTTP request is redirected to https:// where an HSTS header is sent. But if the browser doesn't support SNI then the request is served by HTTP.

The above rule, stated as is, is actually a fallback rule for those people that still run old browsers, as Mozilla and Chrome don't have this problem, just to avoid leaving these users out of the site.

I would like to do this redirecting at the Apache config level, perhaps with a filter on the user agent. I wouldn't like to touch running applications except making sure that no direct http:// references are present (otherwise they imply a security warning)

[Edit] (while editing the question I forgot the question): what is the list of SNI-enabled user agents to redirect?

I have been warned that my server broke its transfer limit. I thougt that my Tor node became popular so I chose to disable it this month (not the best choice for the community but I need to go down). Then I noticed that the server transferred around 4GBs this night. I have checked Apache logs with Awstats, no relevant traffic (and I don't host so popular sites there). I have checked mail logs, no one tried to send garbage. I have checked messages logs and found tons of these

Apr 29 10:17:53 marcus sshd[9281]: Did not receive identification string from 85.170.189.156
Apr 29 10:18:07 marcus sshd[9283]: Did not receive identification string from 86.208.123.132
Apr 29 10:18:24 marcus sshd[9298]: Did not receive identification string from 85.170.189.156
Apr 29 10:18:39 marcus sshd[9303]: Did not receive identification string from 86.208.123.132
Apr 29 10:18:56 marcus sshd[9306]: Did not receive identification string from 85.170.189.156
Apr 29 10:19:11 marcus sshd[9309]: Did not receive identification string from 86.208.123.132
Apr 29 10:19:18 marcus sshd[9312]: Did not receive identification string from 101.98.178.92
Apr 29 10:19:27 marcus sshd[9314]: Did not receive identification string from 85.170.189.156
Apr 29 10:19:41 marcus sshd[9317]: Did not receive identification string from 86.208.123.132
Apr 29 10:20:01 marcus sshd[9321]: Did not receive identification string from 85.170.189.156
Apr 29 10:20:13 marcus sshd[9324]: Did not receive identification string from 86.208.123.132
Apr 29 10:20:32 marcus sshd[9327]: Did not receive identification string from 85.170.189.156
Apr 29 10:20:48 marcus sshd[9331]: Did not receive identification string from 86.208.123.132
Apr 29 10:21:07 marcus sshd[9336]: Did not receive identification string from 85.170.189.156
Apr 29 10:21:20 marcus sshd[9338]: Did not receive identification string from 86.208.123.132
Apr 29 10:21:35 marcus sshd[9341]: Did not receive identification string from 85.170.189.156
Apr 29 10:21:51 marcus sshd[9344]: Did not receive identification string from 86.208.123.132
Apr 29 10:22:06 marcus sshd[9349]: Did not receive identification string from 85.170.189.156
Apr 29 10:22:23 marcus sshd[9353]: Did not receive identification string from 86.208.123.132
Apr 29 10:22:39 marcus sshd[9359]: Did not receive identification string from 85.170.189.156
Apr 29 10:22:54 marcus sshd[9361]: Did not receive identification string from 86.208.123.132
Apr 29 10:23:10 marcus sshd[9367]: Did not receive identification string from 85.170.189.156
Apr 29 10:23:29 marcus sshd[9369]: Did not receive identification string from 86.208.123.132
Apr 29 10:23:45 marcus sshd[9375]: Did not receive identification string from 85.170.189.156
Apr 29 10:24:10 marcus sshd[9387]: Did not receive identification string from 86.208.123.132
Apr 29 10:24:16 marcus sshd[9388]: Did not receive identification string from 85.170.189.156

Every few seconds a bot is trying to hack my SSH, which is impossible because I require pubkey authentication. My question is: can this traffic, at this frequency, consume 4GBs (let's say 3.5) in 10 hours of continuous attack?

I have changed my SSH port and stopped these attacks, but I'm unsure about my network consumption. I don't have services out of control running -my firewall is kinda restrictive-, or share the server with someone abusively doing P2P or whatever. My concern is to go below 400GB/month.

Any tips?