I am a tad new-ish to k8s and trying to set up Redmine on Amazon EKS cluster using Traefik. I lack a tad of understanding as to how the controller will pick up the ingress, especially given that the ingress is in the redmine namespace and the controller resides in it's own namespace. Below are my settings: Traefik Ingress Controller:

traefik:
  providers:
    kubernetesCRD:
      allowCrossNamespace: false
    kubernetesIngress:
      enabled: false

  logs:
    general:
      level: INFO
    access:
      enabled: true

  ports:
    web:
      redirectTo: websecure

  service:
    annotations:
      "service.beta.kubernetes.io/aws-load-balancer-type": nlb
      "service.beta.kubernetes.io/aws-load-balancer-ssl-cert": "aws-arn-id"
      "service.beta.kubernetes.io/aws-load-balancer-ssl-ports": "443"
    spec:
      externalTrafficPolicy: Local

  ingressRoute:
    dashboard:
      enabled: false

I disabled the ingress that came with the redmine config and created my own as I wanted traffic re-directed to https:

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
spec:
  redirectScheme:
    scheme: https
    permanent: true

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
    traefik.ingress.kubernetes.io/router.middlewares: redmine-redirect-https@kubernetescrd
  name: redmine-ingress
  namespace: redmine
spec:
  rules:
    - host: redmine.mydomain.org
      http:
        paths:
          - backend:
              service:
                name: mydomain-redmine
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific

and my ingress and service deployment file config for Redmine:

redmine:
  fullnameOverride: "mydomain-redmine"

  service:
    type: LoadBalancer
    port: 80
    annotations: {}

  ingress:
    enabled: false

I know there's something amiss but not sure what that is right now. Any pointers will be appreciated.

I'd like to know if it is possible to mix node instance types in an AWS (EKS) cluster. I'd like to host something which requires more resources and add it to the cluster.

I am trying to re-write part of a URL (https://myfirstdomain.com/lool/https:/alf.mydomain.com/service/wopi/files/uuid?query_params) before the proxying takes place and I have this relevant section in my default SSL vhost:

 <IfModule mod_rewrite.c>
    RewriteEngine   On
    LogLevel debug rewrite:trace3

    RewriteRule ^lool/https:/alf.mydomain.com\/(.*) lool/https://alf.mydomain.com/$1 [QSA,NE]
</IfModule>

ProxyPass               /       https://localhost:2323/
ProxyPassReverse        /       https://localhost:2323/

and I see this in the re-write logs:

applying pattern '^lool/https:/alf.mydomain.com' to uri '/lool/https:/alf.mydomain.com/service/wopi/files/uuid

but on the service that receives this I see that the URL hasn't been re-written. Would be grateful for any clues as to what I am doing wrong. I am essentially trying to add the extra / that has been removed by a proxy server somewhere in the infrastructure that I do not have access to.

EDIT: in the logs for the backend WOPI service, it sees the request URL un-modified:

Request from 127.0.0.1:42035: GET /lool/https:/alf.mydomain.com/service/wopi/files/uuid

I have the following error when using Apache Directory Studio to log into an AD server:

[LDAP: error code 49 - 80090308: LdapErr: DSID-0c0904DB, comment: AcceptSecurityContext error, data 57,v1db1]

I have been searching but I haven't found any reference to the hex code 57 on Ldapwiki or anywhere else.

I am trying to edit a file using nano and whenever I open the file for editing it gives me the following message:

File /path/to/file is being edited (by root with nano 2.5.3. PID 12345); continue?

Yet I can not find the process id in the list of running processes when I grep the pid or when I list all processes. I am unsure as to how to get to the bottom of this. I'm on an ubuntu 16.04 VM.

On a remote server, it used to be the case that it was possible to execute a command as another user using the sudo -u command but lately, I have been unable to accomplish this. When I do I receive the following error:

sudo -u lool ./autogen.sh 
/var/tmp/scltjLjKc: line 8: -u: command not found

so I'm having to resort sudo-ing to root then su into the user before being able to execute the command. What could be the possible cause of this?

I was wondering if enabling SSL on the proxy is enough but not on the services being proxied. Would there be issues from the outside (on client side) when comms are supposed to be https?

I just recently deployed tomcat 9 and I would like to inspect the catalina.out log as it is running, however I notice that when stopped it would dump logging output to a catalina.[date].txt file. Is there some additional configuration to be done to enable live logging to catalina.out?

I have searched around but not found a possible solution to this so far. I have an ongoing scan which I thought would've been finished at certain time, but unfortunately it has not. So I am wondering if there's a way to check the scan progress of this ongoing progress.

I am trying to rewrite the domain url that targets my site such that all domain names are rewritten to www.example.com and have the following config:

mysite block

  server {      
        listen       80 default_server;
        listen   [::]:80 default_server ipv6only=on;

            server_name _;
            rewrite ^ $scheme://www.example.com$request_uri permanent;

    location / {

            # Allow for large file uploads
              client_max_body_size 0;

                proxy_http_version 1.1;
                proxy_pass http://mysite;
                proxy_buffering    off;

                proxy_set_header   X-Real-IP $remote_addr;
                proxy_set_header   X-Scheme $scheme;
                proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header   Host $http_host;
    }
}

The tomcat server block

server {
        listen        80;

        root /opt/site2/www;
        index index.html index.htm;

        # Redirecto root requests to Share
        rewrite ^/$ /share;

        location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ /index.html;
        }

        # redirect server error pages to the static page /50x.html
        error_page 502 503 504 /maintenance.html;
            location = /maintenance.html {
            root   /opt/site2/www;
        }

        location /share {

            # Allow for large file uploads
            client_max_body_size 0;

            # Proxy all the requests to Tomcat
            proxy_http_version 1.1;
            #proxy_buffering off;
            proxy_pass http://backend;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $http_host;
            proxy_set_header X-Forwarded-Server $host;
        }

}

in the server block but I am getting a "too many redirects" error.

I have a "catch-all certificate" that I would like to use on another server that resides in another VM. How can I achieve this? I haven't seen any docs that explain otherwise.

I have the following settings ( as grabbed from my postconf -n output)

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
inet_interfaces = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
maximal_backoff_time = 8000s
maximal_queue_lifetime = 7d
minimal_backoff_time = 1000s
mydestination = $mydomain, localhost.$mydomain, localhost
myhostname = //redacted
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_helo_timeout = 60s
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_hard_error_limit = 12
smtpd_recipient_limit = 10
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_soft_error_limit = 3
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
unknown_local_recipient_reject_code = 450
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf, mysql:/etc/postfix/mysql_virtual_alias_domainaliases_maps.cf
virtual_gid_maps = static:8
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf, mysql:/etc/postfix/mysql_virtual_mailbox_domainaliases_maps.cf
virtual_transport = virtual
virtual_uid_maps = static:5000
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_overquota_bounce=yes
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_mailbox_limit_maps=mysql:/etc/postfix/mysql_virtual_mailbox_limit_maps.cf
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_maildir_limit_message=Sorry, the your maildir has overdrawn your diskspace quota, please free up some of spaces of your mailbox try again.
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_create_maildirsize=yes
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_mailbox_extended=yes
postconf: warning: /etc/postfix/main.cf: unused parameter: virtual_mailbox_limit_override=yes
postconf: warning: /etc/postfix/main.cf: unused parameter: smtpd_relay_restrictions=reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit

I am nwe to mail server configurations but as I understand it from this message: status=deferred (mail transport unavailable) It means it can't deliver to the LDA. I am using postifx 2.9.6 on ubuntu 12.04 with dovecot 2.0.19

edit : mail arrival log

Jun 12 12:18:59 mailserve postfix/smtpd[1215]: warning: database /etc/aliases.db is older than source file /etc/aliases
Jun 12 12:19:00 mailserve postfix/smtpd[1215]: connect from redacted
Jun 12 12:19:00 mailserve postfix/smtpd[1215]: 6788268E01E9: client=redacted
Jun 12 12:19:00 mailserve postfix/cleanup[1196]: 6788268E01E9: message-id=<[email protected]>
Jun 12 12:19:00 mailserve postfix/qmgr[678]: 6788268E01E9: from=<redacted>, size=17120, nrcpt=1 (queue active)
Jun 12 12:19:00 mailserve postfix/qmgr[678]: warning: connect to transport private/smtp-amavis: No such file or directory
Jun 12 12:19:00 mailserve postfix/smtpd[1215]: disconnect from redacted
Jun 12 12:19:01 mailserve postfix/error[1223]: 6788268E01E9: to=<redacted>, relay=none, delay=0.75, delays=0.38/0/0/0.36, dsn=4.3.0, status=deferred (mail transport unavailable)

I set up apache to proxy for tomcat but I am getting the following error when I target the page. I sometimes get a blank page or a 503:

[Error]

[Mon Dec 03 04:58:16 2012] [error] proxy: ap_get_scoreboard_lb(2) failed in child 29611 for worker proxy:reverse
[Mon Dec 03 04:58:16 2012] [error] proxy: ap_get_scoreboard_lb(1) failed in child 29611 for worker https://localhost:8443/
[Mon Dec 03 04:58:16 2012] [error] proxy: ap_get_scoreboard_lb(0) failed in child 29611 for worker http://localhost:8080/

I have two vhosts configured on the vm as follows:

[http host]

<VirtualHost *:80>
  ServerName www.mysite.net
  ServerAlias mysite.net

  ProxyRequests Off
  ProxyPreserveHost On

  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

  ProxyPass / http://localhost:8080/ retry=0
  ProxyPassReverse / http://localhost:8080/ retry=0
</VirtualHost>

[ssl vhost]

<VirtualHost *:443>
        ServerName www.mysite.net
        ServerAlias mysite.net

        ErrorLog /var/log/apache2/error.log

        LogLevel warn

        CustomLog /var/log/apache2/access.log combined
        ServerSignature On

        SSLEngine on
        SSLProxyEngine on
        SSLCertificateFile /etc/apache2/ssl/server.crt
        SSLCertificateKeyFile /etc/apache2/ssl/server.key

        ProxyRequests Off
        ProxyPreserveHost On
        ProxyPass / https://localhost:8443/ retry=0
        ProxyPassReverse / https://localhost:8443/ retry=0

</VirtualHost>

My system details are: Apache/2.2.22 (Ubuntu) mod_jk/1.2.32 mod_ssl/2.2.22 OpenSSL/1.0.1 mod proxy_http is also enabled.

I have the following ldif file which I am trying to load into openLDAP:

Custom schema being created for the Monas project

dn: cn=testSchemas,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: testSchemas
olcAttributeTypes ( 1.3.6.1.4.1.4203.666.1.90 
 NAME 'competence'
 DESC 'The field an individual is qualified'
 EQUALITY caseIgnoreMatch
 SUBSTR caseIgnoreSubStringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )

olcAttributeTypes ( 1.3.6.1.4.1.4203.666.1.91 
 NAME 'spokenLanguage'
 DESC 'The language spoken by a person.'
 SUP preferredLanguage
 EQUALITY caseIgnoreMatch
 SUBSTR caseIgnoreSubStringsMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )

olcObjectClasses ( 1.3.6.1.4.1.4203.666.2012.1 
 NAME 'inetOrgTestPerson'
 DESC 'An extension of the inetOrgPerson objectClass to add some additional attributes'
 SUP inetOrgPerson
 STRUCTURAL
 MUST competence
 MAY spokenLanguage )

I keep geting the error: ldapadd: invalid format (line 4) entry: cn=testSchemas,cn=schema,cn=config" and I can't figure out for the life of me what's wrong. I am on ubuntu 12.04 with openldap 2.4.28

Edit: After fixing the syntatic error of the missing ':', I managed to add the object and attributes (or so I thought) but I can't see them when I execute a search I get the error:

ldap_modify: Type or value exists (20)
    additional info: modify/add: olcAttributeTypes: value #0 already exists

when I try to add the objects again which means they're in the db, but nothing turns up in search.

I am trying to add another naming context to my ldap server using the olc, but so far I am new to this and haven't found a example explaining this. I guess I could use a tool like apacheDS but I want to understand what is going on.

I recently installed tomcat via an installation script from the apache solr typo3 community and spent the last 3 days trying to figure out why it won't work until by chance I noticed that when I queried the process listening on the port via "lsof -i", it was bound to the ipv6 protocol.

I have googled everywhere and most say that setting address to 0.0.0.0 in the tomcat connector resolves this issue, others say setting JAVA_OPTS="-Djava.net.preferIPv4Stack=true".

I have tried the former which doesn't work but the latter I am unsure of where to put it. One solution I read somewhere suggested to put it in setenv.sh but I can't find this file in my tomcat installation. I would appreciate any help at the moment regarding this.

The tomcat version is 6.x and the OS is ubuntu 11.10.

Thanks

Well I haven't had to do this before until now, but I created an account on a remote server purely for shared git repo access and now need to setup seamless logins via ssh on each dev machine. I have read several articles on this, however I do no have a .ssh folder on the account of the created user so can not install the client key in the authorized_keys file. Do I just create these folder&files in order to be able to install the key because I don't think it'll be that simple. I am following this link for the tutorial and below is the sshd_config file as it stands at the moment. (currently password authenticated logins). Thanks for any pointers.

    # This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

#Port 22
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6

RSAAuthentication yes
#PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner /some/path

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server

I have two virtual servers with the same host provider. After regenerating my SSH keys on my client machine (local) I con only connect to one of the virtual servers. When I connect to the other (both are being done via the terminal) it just hangs. It's not timing out and I see nothing in the SSH logs that indicates a connection error. Any ideas?

My first time trying to marry LDAP as a backend to Samba. I'm following the instructions at: this site and I'm stumbling when I get to the part 5 with the following error: "ldap_bind: Invalid credentials (49)" Googling has pointed me towards the slapd.conf file but I don't have one in the /etc/ldap directory or anywhere on disk despite having installed ldap twice and running a dpkg-reconfigure twice. Has the configuration file for slapd been changed recently?

I'm having problems with the character encoding of my webapp and would like to know how I can go about changing the default encoding of tomcat on the Linux production server to match the cp 1252 encoding of the dev server on windows (or at least experiment with different encoding until I can find the right one).

Thanks