Huygens's questions

I have problem restoring SELinux on a server and would like some insight.

Context

On our server, I recently changed SELinux from enforcing to permissive, and because it did not solve our problem which was an odd one (unexpected permissions denied), I even set it to disabled... Anyway, SELinux wasn't the problem. We figured it out and it is now solved ... but SELinux is now disabled!

Now I want to restore it. So I was simply changing it to enforcing again and I was expecting the system to detect automatically it needs to relabel (so no needs to touch /.autorelabel) on next boot, that-worked-in-the-past(tm). Sadly it got stuck during boot and after 10 minutes we went back to disabled to restore services. The documentation states it can take a long long time, so I've scheduled the reboot over the weekend. Well after the weekend it was still stuck in boot.

Strangely the server's HDDs do not show any disk activity.

When I do the above on a VM, it boots to the same point and then prints a message that SELinux relabeling needs to be performed and does it. On the server we do not see that message.

Remarks

The server has some CIFS mounts, would that be the reason that SELinux tries to relabel the CIFS filesystems? That could explain the longer time and the no disk activities, but that do not explain the absence of messages on the console.

Technical info

• CentOS 7.6 (1810) x86_64
• Baremetal, Dell server, 6x HDDs RAID6 (hardware)
• No logs is written to disk, last started unit is Update UTMP about System Boot/Shutdown.

Note: There is a RHEL knowledge base article which recommends going from disabled to enforcing via permissive first. And with each reboot, forcing the relabeling by touching /.autorelabel. That's going to be my next try on the weekend. But any insight to what's going on is welcome.

Update 01

I have now done further testing. All of the following boot mode failed:

1. booting with selinux=1, enforcing=0, autorelabel=0
2. booting with selinux=1, enforcing=0, autorelabel=1
3. booting with selinux=1, enforcing=1, autorelabel=0
4. booting with selinux=1, enforcing=1, autorelabel=1

Only booting with selinux=0 is working. When I mean failed, it means there is no error messages on the console while booting nor a message about SELinux relabeling, the system hangs for many hours, no disk activity is visible.

I have now commented out all cifs volumes from my /etc/fstab and rebooted in permissive with autorelabeling. The boot took about 20min but I could see it was doing something (it printed on the console that relabeling was started, showed that FS like sysfs are read-only and be ignored, disk activity was visible, etc.). So SELinux is now enabled in permissive mode. I will now try enforcing mode this weekend.

Obviously it seems that those CIFS mounts were the problem, but I do not understand why. To me it was my understanding that CIFS mounts would be ignored by relabeling, just like sysfs. Have I misunderstood something here?

There is an isolated LAN (completely isolated, does not access outside and outside can't access it). But one of the server has 2 NICs, one of which is on our dev LAN and the other one in the isolated LAN.

The goal is from the dev LAN to access specific TCP services inside the isolated LAN. E.g. from the dev LAN (e.g. dev-laptop-01) I want to access the SSH service of a server inside the isolated LAN (e.g. iso-server-01), the server having the "gateway" role (e.g. gw-server) should expose the SSH service on the dev LAN and forward/redirect it to the provider of the service on the isolated LAN.

I wanted to use iptables with the following configuration:

iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 10022 -j DNAT --to iso-server-01
iptables -t nat -A POSTROUTING -p tcp -m tcp -s iso-server-01 --sport 22 -j SNAT --to-source gw-server
sysctl net.ipv4.ip_forward=1

But it does not work. From my dev-laptop-01 when I issue ssh -p 10022 gw-server I get a Connection timed out error.

What is the best approach to this problem?

PS: I'm running RHEL 6.6.

We have set-up a GitLab server (GitLab 7.0 Community Edition).

It is up and running and our colleagues can use it within the LAN (the IP address and Host are only visible from the LAN).

Some of the projects hosted on this GitLab instance should be "shared" with external users (not part of our company). We would like to let them access the Git repositories in order to be able to clone, pull and push.

The GitLab server will stay within the LAN. But we can setup a server in our DMZ which could reverse-proxy (or some other alternatives) the GitLab server. We would like however that only the ".git" URLs are accessible via HTTPS (so not give access to the GitLab WUI (Web User interface)).

How can we set-up the "reverse-proxy" in the DMZ to provide access for external users (on the internet) to our internal Git repositories hosted on GitLab?

Wishes:

• Only https://*/*.git/* URLs should be allowed externally;
• HTTP basic authentication on the reverse proxy would be a plus;
• But GitLab authentication mechanism over HTTPS shall remain;
• Local user on our LAN should still be able to use SSH for Git operations;
• GitLab Web UI should not be accessible externally;

Note: we do have already a server in our DMZ with NGINX running. If we can use this "software stack" to do the reverse-proxying, that would be great.

Note2: this question already had a bounty of 100 which has expired and the points were lost. If I get an answer which solve my problem, I will open a bounty and reward the answer with it.

For our project, we would like to have all servers and systems synchronised to a linear time reference (without leap second).

Therefore, we would discard UTC but are very interested in advertising TAI time (or GPS time).

Our time server will be connected to an atomic clock (or possibly a GPS receiver).

Is NTP suitable to advertise TAI or GPS time? If yes how to configure it?

Should we use other protocol to advertise such time?

Final note: AFAIK there is no TAI or GPS time configurable for the Linux kernel. I guess our best option is to "fake" it by configuring the kernel time to be UTC and providing it a TAI or GPS time instead. Or is there a better alternative?

Is there a way on Linux to get statistics about the various reasons packets were dropped?

On all network interfaces (openSUSE 12.3) on several servers, ifconfig and netstat -i are reporting dropped packets at the reception. When I do a tcpdump, the number of dropped packets stop increasing, meaning that the interfaces queues are not full and dropping the data. So there must be other reasons why this is happening (e.g. multicast pkts received whereas the interface is not part of this multicast group).

Where can I find such information? (/proc? /sys? some logs?)

Example of statistics (merge of the /sys/class/net/<dev>/statistics and ethtool output):

alloc_rx_buff_failed: 0
collisions: 0
dropped_smbus: 0
multicast: 1644
rx_align_errors: 0
rx_broadcast: 23626
rx_bytes: 1897203
rx_compressed: 0
rx_crc_errors: 0
rx_csum_offload_errors: 0
rx_csum_offload_good: 0
rx_dropped: 4738
rx_errors: 0
rx_fifo_errors: 0
rx_flow_control_xoff: 0
rx_flow_control_xon: 0
rx_frame_errors: 0
rx_length_errors: 0
rx_long_byte_count: 1998731
rx_long_length_errors: 0
rx_missed_errors: 0
rx_multicast: 1644
rx_no_buffer_count: 0
rx_over_errors: 0
rx_packets: 25382
rx_short_length_errors: 0
rx_smbus: 0
tx_aborted_errors: 0
tx_abort_late_coll: 0
tx_broadcast: 7
tx_bytes: 11300
tx_carrier_errors: 0
tx_compressed: 0
tx_deferred_ok: 0
tx_dropped: 0
tx_errors: 0
tx_fifo_errors: 0
tx_flow_control_xoff: 0
tx_flow_control_xon: 0
tx_heartbeat_errors: 0
tx_multicast: 43
tx_multi_coll_ok: 0
tx_packets: 63
tx_restart_queue: 0
tx_single_coll_ok: 0
tx_smbus: 0
tx_tcp_seg_failed: 0
tx_tcp_seg_good: 0
tx_timeout_count: 0
tx_window_errors: 0

Context

We have a Windows server with an Active Directory domain and a network share.

I have a Linux machine and I want to mount the share.

sudo mount -t cifs //server/share /mnt/share -o user=[act-dir user],domain=[domain],uid=[linux user],gid=[linux group]

It's more or less OK. My Linux user gets mapped to all files on the share and some of the ACL are translated. But I want to go a level further:

• More than one user is connected to the Linux box
• Each Linux user has a dedicated Active Directory account
• I want each Windows owner to be mapped to the corresponding Linux owner if it exists

A solution and the problem

Samba offers the mount option cifsacl which requires to set-up cifs.idmap and winbindd. Both are installed, I've read both man pages and tried to configure them but it does not work. The newly mount command is now:

sudo mount -t cifs //server/share /mnt/share -o user=[act-dir user],domain=[domain],cifsacl

But everything is mapped to root:root, which means the cifs.idmap could not be performed.

Actually, I'm not all surprised because I did not understand where to write the actual mapping so where should I write that Windows userX actually maps to Linux userY? And I'm not sure that the winbindd configuration is correct, what should be the minimum set of parameters and is smbd and/or nmbd require to run? Do I need to open the port in the firewall?

Background infos

Share structure

The shared directory has several sub directories, some commons and some "privates" (although the private ones are actually readable by everyone). Each user would need to access from time to time the common space, and also other user private directories, but mainly/often their own directory.

Tech data

• RHEL 6, Samba 3.5.6
• Ubuntu 12.04, Samba 3.6.3