I need to configure a new VPN configuration on dozens of macOS Siera 10.12.x machines. Obviously automating this is going to be a lot better than trying to get the users to follow the multi-step process manually.
Is it possible to write a bash script that configures the VPN? (In my case, an LT2P over IPSEC VPN).
I have a DNS domain with 3 TXT records:
$ORIGIN example.com.
@ IN TXT "thing one veryveryveryveryveryverylong"
@ IN TXT "thing two veryveryveryveryveryverylong"
@ IN TXT "thing three veryveryveryveryveryverylong"
When I do a DNS query (dig example.com. txt) the reply fits in a UDP packet because the payload is less than 512 bytes (resulting in a packet less than 576 bytes).
However I know that if the reply is long enough, it will be truncated and the DNS client will have to repeat the request using TCP, which has longer length limits.
How can I calculate whether or not I have exceeded the length limit without generating the DNS records and doing a query?
I assume that the formula is something like:
N: the number of TXT records on that label.
P: the number of bytes in all the TXT records.
S: the total number of text segments (TXT records can have multiple text segments per record)
UDP is required if N*a + P*b + S*c is more than 512
What are the values of a, b, and c?
(or am I going in the wrong direction?)
"uname" will tell me the version of the running kernel. How do I know if this is different from the installed kernel (i.e. the one that will be loaded on the next reboot)?
Ideally I'd like to write a script that can output "reboot needed" or "running and installed kernel match".
I'm creating a systemd .service file and I need help understanding the difference between Requires= and After=. The man page says that Requires= "Configures requirement dependencies on other units." and After= "Configures ordering dependencies between units." What's the difference?
I have an old-school daemon that I want to control using systemd. When its configuration file changes, it needs to be killed and restarted. In other words, after editing the config file, systemctl reload MYSERVICE should kill the process and restart it.
Attempt 1: Try the defaults. This tells systemd how to start the daemon, but not how to reload it.
[Service]
ExecStart=/usr/bin/MYSERVICE
Type=simple
As a result, start and restart work, but reload gives this error:
# systemctl reload MYSERVICE
Failed to reload MYSERVICE.service: Job type reload is not applicable for unit MYSERVICE.service.
Attempt 2: Tell it how to kill the process. This kills the process but systemd doesn't restart it for me.
[Service]
ExecStart=/usr/bin/MYSERVICE
Type=simple
ExecReload=/bin/kill -HUP $MAINPID
...followed by...
# systemctl daemon-reload
# systemctl reload MYSERVICE
...kills the process but it is not restarted automatically.
Attempt 3: Use ExecReload to restart the process too. This fails for a few reasons:
ExecReload=/bin/kill -HUP $MAINPID ; /usr/bin/MYSERVICE
...the error message I get...:
# systemctl daemon-reload
# systemctl reload MYSERVICE
Job for MYSERVICE.service failed because the control process exited with error code. See "systemctl status MYSERVICE.service" and "journalctl -xe" for details.
I would expect there to be a ReloadType=kill_and_restart or something but no such luck.
How to tell systemd to kill and restart a daemon on reload?
I build an RPM using fpm for EL6 hosts. It installs a /etc/init.d script. However if that package is installed on an EL7 host, I want it to install a file in /usr/lib/systemd/system instead.
Is there an easy way to tell FPM to make an RPM that will install different files on different operating systems?
If not, is it safe to install both and assume that EL6 hosts will ignore the systemd file, and EL7 hosts will ignore the /etc/init.d script?
I'm trying to transfer a DNS domain from a third-party to our company's account. The third-party used NameCheap.com, also known as enom.com.
Namecheap gave the third-party an authorization code (an "EPP code") which we use to begin the transfer process.
The error message we get is:
We were unable to get authoritative domain information from the registry. This usually means that the domain name or auth code provided was not correct.
More info:
whois shows it is unlocked and has been unlocked for days.What should we do?
I want to return a HTTP 204 error code if anyone tries to access a particular path on my web server. I could set one of my webservers to return a 204 error and point haproxy to it as a backend. However since no information is being sent, I figured this should be possible to do from haproxy itself. No need to bother my actual web servers.
I tried creating a backend that would generate the 204 error as follows:
frontend ...
...
acl is_always204 path_beg /thisone
use_backend always204 if is_always204
...
backend always204
errorfile 404 /etc/haproxy-shared/errors/204.http
The 204.http file contains:
HTTP/1.0 204 No Content
Cache-Control: no-cache
Connection: close
Content-Type: image/png
When I start haproxy, I get this error:
parsing [/etc/haproxy/haproxy:51] : status code 404 not handled, error customization will be ignored.
I think I may be going about this the wrong way. Can anyone suggest a way to force haproxy to return a 204 for a given acl match?
Occasionally yum's cache gets corrupted and we see errors like this:
error: db3 error(-30974) from dbenv->failchk: DB_RUNRECOVERY: Fatal error, run database recovery
error: cannot open Packages index using db3 - (-30974)
error: cannot open Packages database in /var/lib/rpm
The workaround is rm -f /var/lib/rpm/__db* and then the next "yum" command regenerates the data.
My question is: what is likely to be causing this? Is there some common task that ignores locks or has other problem that causes this?
We have hundreds of CentOS machines and there is no pattern to which see this problem. It could be a "one in a million" issue, which at large scale is seen often.
NOTE: I realize this is a very "open ended" question, but if an answer finds the cause, I will go back and turn the question into something more canonical that directly relates to the specific issue.
My DNS server used to be the DNS server for a company's domain. However they moved elsewhere. Oddly enough, years later they were still listing my DNS server in their whois record (or, more properly, in their glue records).
Now I'm curious if there are other domains doing the same thing.
Is there a way I can find which domains list my server as their nameserver?
In the old days one could query for "host records" with whois but I don't see a way to do that now
I have a lot of unused (old, dead) accounts on my machine. Many of them receive literally thousands of emails a day, all spam.
If the account was used by a person, I let the email bounce so that anyone trying to contact them knows something is wrong. However I'm not sure what to do about the hundreds of accounts that were used for other purposes, such as throw-away accounts I used to use for websites that asked for my email address, or address that I used to list on web pages.
Option 1:
Forward all mail to these accounts to /dev/null. The sender doesn't receive a bounce.
Option 2:
Let the email bounce.
The benefit of sending the email to /dev/null is that a spammer can't use me to generate bounce messages (Backscatter spam). i.e.: forge the "from" line to be someone they don't like, then use me to send tons of bounce messages to that person.
The benefit of bouncing them is that it is less maintenance for me. I can just delete the item from my aliases file and the email will bounce. Also, I keep discovering new spam traps and adding them to my "spam black hole" list, which is a waste of time.
What are the pros and cons of each approach?
I would like to create entries for the company's Wifi in every Mac via Puppet. Is this possible? (or if it is possible from the command line, I can figure out how to do it in Puppet)
I have a program that should behave differently if it is being run under "sudo". Is there a way it can find out if it was run under sudo?
Update: Someone asked why would I want to do this. In this case, on a Mac using MacPorts there is output that tells you to cut-and-paste a particular command. If the MacPorts command was run with "sudo", it should include sudo in the sample command:
$ sudo port selfupdate
---> Updating MacPorts base sources using rsync
MacPorts base version 2.2.1 installed,
MacPorts base version 2.2.1 downloaded.
---> Updating the ports tree
---> MacPorts base is already the latest version
The ports tree has been updated. To upgrade your installed ports, you should run
port upgrade outdated
^^^^^^^^^ it would be really sweet if it output "sudo port upgrade outdated" instead. It would be even better if it just did it for you :-)
Is there a name-parsing tool that is part of the official RPM tool package?
I have a list of filenames. Each is the filename of an RPM package. I don't have the actual packages, just the filenames. For each I need to extract the package name and version ($NAME and $VERSION). The reason I need this is I am writing a script that then makes sure that "yum install $VERSION" installs $VERSION. This is part of a system that builds packages and verifies they are properly uploaded.
The list of filenames looks like:
$ cat /tmp/packages.txt
/home/builder/packages/testing-dev/CentOS/6/x86_64/emacs-mercurial-2.8-3.el6.x86_64.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/emacs-mercurial-el-2.8-3.el6.x86_64.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/mercurial-2.8-3.el6.x86_64.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/mercurial-hgk-2.8-3.el6.x86_64.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/python-redis-2.8.0-2.el6.noarch.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/redis-2.6.16-1.el6.1.x86_64.rpm
/home/builder/packages/testing-dev/CentOS/6/x86_64/sei_dnsmaster-1.0-99.el6.x86_64.rpm
I found the following code which is a BASH function that does the task:
function parse_rpm() { RPM=$1;B=${RPM##*/};B=${B%.rpm};A=${B##*.};B=${B%.*};R=${B##*-};B=${B%-*};V=${B##*-};B=${B%-*};N=$B;echo "$N $V $R $A"; }
for i in $(</tmp/packages.txt) ; do
parse_rpm $i
done
It works. Mostly. There are some exceptions:
$ parse_rpm CentOS/6/x86_64/sei_dnsmaster-1.0-99.el6.x86_64.rpm
sei_dnsmaster 1.0 99.el6 x86_64
Notice that it didn't get the version correctly (it should be 1.0-99)
I'm wondering (1) if there is a tool in the rpmdev package that does this correctly. (2) If not, is there an official regex I could use. (3) What is the python equivalent of that regex?
Thanks in advance!
There are plenty of websites that explain how to manage a mirror of YUM repos. I want to run a repo for my home-grown packages. Is there a good way to manage such repos?
What I need to do:
Suggestions?
I used to work in a Ubuntu environment. Machines would be pointed at one of three repos: unstable, testing, or stable. To quote the Ubuntu FAQ:
The “stable” distribution contains the latest officially released distribution of Debian. The “testing” distribution contains packages that haven't been accepted into a “stable” release yet, but they are in the queue for that. The main advantage of using this distribution is that it has more recent versions of software. The “unstable” (codenamed sid) distribution is where active development of Debian occurs. Generally, this distribution is run by developers and those who like to live on the edge.
Even more details are here in the Debian Release page.
Now I work in a CentOS environment. Does CentOS use similar names or have an entirely different methodology?
The reason I'm asking is that I want to set up a repo for home-grown packages and I want to have the benefits of unstable/testing/stable but I want to do it in a CentOS-friendly way.
[This is for Debian Squeeze, but applies to Ubuntu and other Linux distros.]
I have a rather complex /etc/network/interfaces file which is generated based on various factors (number of interfaces, are bridges needed, vlans, etc). After the new file is generated, I need to ifup any new interfaces and ifdown any obsolete interfaces; and I might have to reboot if the primary interface changes (for example, it changes from eth0 or br0).
Right now I figure out what to ifup/ifdown manually.
Is there a script that will do this for me?
The blog post "A 'tinyurl' service for your domain" explains how to set up a ShortName service for your domain using Google Apps. For example, if your domain is example.com and you use Google Apps, you can configure it so that http://go.example.com is your enterprise's personal ShortName service.
NOTE: This is not about creating a "tinyurl" service for the world to use. This is for an enterprise.
It is useful to have a shortname service that only your users can use so that you can create links to internal pages. Rather than telling people a long difficult URL, you can say, "Today's lunch menu is at http://go.example.com/lunch". The blog post documents some of the benefits of empowering people to set up their own links. (Most important: they don't have to bother YOU to set up a new link!)
The problem with the system is that the URL is still rather long. People would rather type "go/lunch" into their web browser and have it work. Sadly, Google Apps can't support this because of a technicality of how the HTTP protocol works. The "Host:" header in HTTP 1.1 lists the domain that the user typed into their web browser, not the FQDN. In other words, when Google Apps gets the HTTP request for "http://go/lunch" the webserver receives "go" as the hostname. Since Google Apps is providing this service for many domains, it can't tell if you want go.example.com or go.some-other-example.com.
As a result, users have to type "go.example.com/lunch" every time, which is much longer than "go/lunch".
Google could solve this by using web cookies or some other scheme. None of which are particularly clean or easy. Until they do you can solve the problem by setting up a machine of your own that accepts requests as "go" and redirects them.
The server accepts HTTP requests for a site called "go" and redirect the request to go.example.com. You then create the right DNS records so that it works, and twiddle your DHCP configurations so that your laptops/workstations do the right thing.
The point of this Server Fault document is to explain the process then give configuration examples to help you do this for your site. Since I don't have access to or knowledge of every operating system in the world, I'm making this a "community wiki" so that people can fill in configuration snippets for as they get it working for them. I've put 'TODO' in area that particularly need improvement.
In this example we'll use "example.com" as the domain.
Configure the service for go.example.com as normal. Test it and make sure a URL like http://go.example.com/foo works. Don't continue if this isn't complete. That would be like trying to repair your car before you own one.
If your shortname service is go.example.com, ideally you'd make your redirector's name go.example.com. Sadly, physics prevents two bodies from being in the same place at the same time, and DNS obeys the laws of physics.
The trick is to have the redirector be the same hostname as the ShortName service, but in a different domain. For example, go.corp.example.com, go.ext.google.com, or go.this-is-different.example.com.
Large companies usually have an internal subdomain that is not exposed to the outside world. Usually internal hosts are INSIDEHOST.corp.google.com. That is where you put the redirector.
Some companies allocate a subdomain that is full of CNAMEs pointing to services that should be accessed from both inside and outside the company. That way there is one subdomain that needs to be put in people's DNS searchpath. (Unix people can think of this as having /usr/local/bin be a subdirectory full of symlinks) Traditionally this subdomain is ext.example.com. In that subdomain are CNAMEs like mail.ext.example.com, calendar.ext.example.com, vpn.ext.example.com, and so on.)
Warning: Adding yet another item to your DNS search path is yet another way to make your computers run slower. Doing an additional DNS query EVERY TIME is slow and surfing the web will be noticeably slower. It is much better to add this redirector to a subdomain that is already in your machine's DNS search path, even if this means adding a CNAME in multiple subdomains. For example, if your internal machines and machines connected to your VPN have corp.example.com in their search path already, add the CNAME there. If you want external machines not VPNed in to be able to access the redirector, it might be weird to hard code corp.example.com into their search path if that is the subdomain for machines never accessed from the outside. In that case, another CNAME can be added to an external subdomain (like ext.example.com) to point to the redirector. Update the web server configuration to support both.
For this example, let's assume you've selected that the redirector will be go.ext.example.com. The machine can be called anything you want, we'll do all the magic in DNS and the web server configuration.
The web server you are going to set up can be on an existing web server or a new one built just for this purpose. The key is that the machine has to be accessible from anywhere you want the ShortName service to work: inside the company, outside the company, when the user is connected via VPN. (You may choose to forego having this working from outside the company for security reasons. You may also, for security reasons, set up one machine on the inside and another on the outside.)
Note: You don't have to set up a new web server for this. You can add this to a pre-existing web server as long as the configuration doesn't exist.
Note: This can be rather complicated. You might want to focus on getting this working in the most simple case, then once working and tested, get it working for other situations. In particular, get it working in this order: 1. workstations/laptops inside the company 2. THEN machines connected by VPN, then machines outside the company (for example, at an Internet cafe). 3. THEN machines outside the network, without the VPN up 4. THEN test this for other operating systems
In this example, we'll assume there is a web server that is accessible at the same IP address whether you are inside or outside the company.
In our "go.corp.example.com" example, this means the "go" is in a subdomain that is only accessible to insiders, and requires a VPN to use the ShortName service. Since Google Apps is usually configured to work without a VPN (because all access is HTTPS), this is sub-optimal.
In our "go.ext.example.com" example, this means the subdomain is accessible from both inside and outside the company, and the A record points to an external IP address.
Here are the DNS records required:
go.example.com. IN CNAME ghs.google.com.
go.ext.example.com. IN A 64.32.179.5
go-redirector.example.com IN A 64.32.179.5
The first DNS record (go.example.com) should exist already as part of Step 1.
The second DNS record (go.ext.example.com) is an A record pointing at the IP address of the new web server you are configuring.
The third DNS record (go-redirector) is to help you when debugging.
Add the redirect to the web server. (This assumes the web server is already installed and running).
Here is the Apache configuration snippet:
<VirtualHost *:80>
ServerName go-redirector.example.com
ServerAlias go, go.ext, go.ext.example
RewriteEngine on
RewriteRule ^(.*)$ http://go.example.com$1 [R=permanent]
</VirtualHost>
How to test this. http://go-redirector.example.com should work at this point.
Do not proceed until this test works. Baby steps.
Now we are going to configure machines (anything running a web browser) so that the DNS search path includes "ext.example.com"
On your DHCP server and VPN server send a DNS search path that is:
corp.example.com .
(the subdomain with the redirect host, followed by ".")
Alternatively you could use a search path like:
corp.example.com example.com .
However that is going to add an additional DNS lookup for EVERY darn web page we go to. Since they will fail 99% of the time, that's just going to make web surfing slow.
On workstations and laptops you need to make sure that the subdomain is included in their DNS search path. That way when the user types "go", the software will find it in the domain.
We want to configure the search path of the machine to include this subdomain every way that the search path can possibly be set:
Originally the DNS search path couldn't be set via DHCP. This is a newly added feature and not all DHCP clients support it. Even DHCP clients that do support it need to be modified because when a laptop is at (for example) an Internet cafe, it is talking to a DHCP server that you don't control. When a laptop uses a VPN, the VPN client software doesn't actually use DHCP but there is usually some way that the VPN server transmits the settings that one would usually get from a DHCP server.
Therefore you want to set the DNS search path in all these places:
corp.example.com domain to their search path if the DHCP server didn't include it already.Below are instructions on how to do this on various DHCP servers and operating systems.
TODO
If the search path is just the domain that the machine should be in, then:
option domain-name "corp.example.com";
If the clients support RFC 3397 to supply a search path, then you can do this, but it's awkward as there's no native support for a data type which is a sequence of DNS hosts, each encoded as length-prefixed labels as in DNS. There's no way to write the values of an option defined as an array of records, where the record contains an array of another record, so you're down to using a data-string to encode things manually.
option dns-search-domains code 119 = string;
option dns-search-domains concat(
encode-int(4,1), "corp", encode-int(7,1), "example", encode-int(3,1), "com", encode-int(0,1),
encode-int(7,1), "example", encode-int(3,1), "com", encode-int(0,1)
);
which should (untested) generate a two item search list.
TODO
TODO
Edit /etc/resolv.conf and make sure (1) the "domain corp.example.com" is the first line, (2) add/edit the "search" line to include the corp.example.com domain, (3) add an "options ndotes:2" line to reduce the load on your DNS servers.
domain corp.example.com
search corp.example.com exmaple.com
options ndots:2
TODO fill in for Windows, Linux, etc.
Now users should be able to specify:
http://go/foo http://go.example/foo http://go.example.com/foo
In fact, as a confidence test, you'll want to test those URLs in all situations:
( each OS you support ) * ( internal LAN / at an Internet cafe / while on the VPN )
And lastly, one bit of advice: Even if you'd done a perfect job of this, you are still at risk of a http://go/foo link not working when a person tries to type it on a computer you didn't configure to force the DNS search path to include your domain. You should, therefore, publish links using the full URL: http://go.example.com/foo; and take the time to educate your company's PR department and others to always specify it that way.
Or at least encode them in HTML so that "go" is visible in the link text, but the actual HREF goes to the FQDN:
<a href="http://go.example.com/lunch">go/lunch</a>
Teaching people in the PR department to do this may be difficult. You might just want to tell them they have to use the long version (go.example.com) in anything they write because the short "go/lunch" only works by accident.
TODO: Work out how to do with with HTTPS (the certifications are going to be very difficult, if not impossible, to get right).
Are there any Linux DHCP servers that will listen to what Cisco calls an "unnumbered" interface, or what others might call a "NBMA" (non-broadcast) interface.
I have a Linux system that connects to a number of others using GRE tunnels. The machines on the other end send DHCP requests to this machine, I can see them with tcpdump. However, ISC DHCP 3.0.3 refuses to listen to the interface because it is non-broadcast.
The interface I'd like DHCP to listen to is:
tap2 Link encap:Ethernet HWaddr removed-for-privacy
inet6 addr: removed-for-privacy/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:518 errors:0 dropped:0 overruns:0 frame:0
TX packets:510 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:196242 (191.6 KiB) TX bytes:52425 (51.1 KiB)
Suppose I wanted to monitor 1,000 hosts. For each host, there is 100 or more variables I want to monitor: ping, disk IO/latency, RAM free/swap/etc, and so on. 100,000 data points every 5-10 minutes, stored for 5 years.
What system scales this large?
What if I had 10x the number of hosts? What would you select then?