Brad's questions

An am working with a CentOS 7 system which has a single physical Ethernet port which connects it to a network. This network primarily is on one subnet ("management network"), but also uses a tagged VLAN (VLAN 137) which has a separate subnet for VMs.

When configured "normally" - it appears and works on the management subnet.

However, I want to create a bridge device which connects to the same physical adapter, but for the bridge to use the 137 VLAN.

I can't figure out how to do this. I can either have the NIC on the normal (no tag) LAN, and I can create a bridge device, which is either on the (main) LAN or the VLAN. But I cannot figure out how to get the host on the "main" network and the bridge on the VLAN at the same time.

It appears as though a NIC can only be assigned to a single "bridge" at a time, and that one bridge can be assigned to a single VLAN, or no VLAN.

I'm obviously missing something. Any ideas?

(P.S. Preferably doing this without Network Manager - which I assume is a must).

We have several machines plugged into various ports on a Cisco Nexus 5000. We want to separate the switch into groups, so a handful of machines can see and talk to each other and no one else. So, to create a physically isolated port group.

We (apparently) have no VLAN IDs available, as they are all used (large corporate network), so we cannot just separate these into a VLAN or a PVLAN.

Is there a way to just tell the switch to physically isolate traffic to only a given group of ports?

I just upgraded Apache from it's 2003 build, to a squeaky-clean, brand-new 2.4.1 build. All seems pretty good except for one glaring thing:

In my httpd.conf file I have the following:

<Directory />
    AllowOverride none
    Options FollowSymLinks
    AuthType      Basic
    AuthName      "Enter Password"
    AuthUserFile  /var/www/.htpasswd
    Require     valid-user
</Directory>

This should allow only users in the specified auth file to access the server - just as it had under the older version of Apache. (Right?)

However, it's not working. Requests are granted with no authentication provided. When I switch logging to LogLevel Debug, for the accesses, it says:

[Sat Mar 24 21:32:00.585139 2012] [authz_core:debug] [pid 10733:tid 32771] mod_authz_core.c(783): [client 192.168.1.181:57677] AH01626: authorization result of Require all granted: granted
[Sat Mar 24 21:32:00.585446 2012] [authz_core:debug] [pid 10733:tid 32771] mod_authz_core.c(783): [client 192.168.1.181:57677] AH01626: authorization result of <RequireAny>: granted

I really don't know what this means - and I (to the best of my knowledge) don't have any "Require all granted" or "" statements in any of my files.

Any ideas why this isn't working, or where to debug??

UPDATE:

I have a virtualhost on the SSL port which allows proxying. When I put the same entries inside the

<proxy *> 

clause in the virtualhost config, it works. It doesn't seem to work in the

 <Directory> 

clause. I then tried putting under other Directory clauses (specific for other directories) and that didn't work either.

ALSO

From Shane's questions below - I tried duplicating the root "/" block to a "/tmp" directory. The /tmp directory works CORRECTLY!! So - this problem is specific to the root directory only???

I am using sshd, and allow logins with public key authentication.

I want to allow select users to log in with a PAM two-factor authentication module.

Is there any way I can allow PAM two-factor authentication for a specific user?

By the same token - I only want to enable password authentication for specific accounts. I want my SSH daemon to reject the password authentication attempts to thwart would-be hackers into thinking that I will not accept password authentication - except for the case in which someone knows my heavily guarded secret account, which is password enabled. I want to do this for cases in which my SSH clients will not let me do either secret key, or two-factor authentication.