I'm setting up a brand new pfsense and it works fine. Then I restore the configuration from another working installation and when I try to reboot it freezes soon after mouting the / partition and detecting the CPU. The last line in my screen is:
TSC: P-state invariant
I'm running windows server 2012 VMs with plenty of RAM assigned under Linux KVM. All 4 servers show almost 0% available memory and do a lot of swaping. The RAM used by applications doesn't add up to even half the assigned RAM. Installing RAMMAP.exe I noticed about 60% or RAM appearing as "driver locked".
What's happening?
When ever I try to scp a file from pfsense I get back what appears to be the help for pfsense's scp:
scp admin@fw:/tmp/test /tmp/
usage: scp [-12346BCpqrv] [-c cipher] [-F ssh_config] [-i identity_file]
[-l limit] [-o ssh_option] [-P port] [-S program]
[[user@]host1:]file1 ... [[user@]host2:]file2
We've successfully migrated from an ancient Microsoft Exchange to dovecot+postfix and everything works fine except from one particular case:
When users of Outlook 2016 hit reply on an old mail from someone within the company ([email protected]) they get a delivery error from Outlook and sometimes I notice that Outlook doesn't even make a connection to the SMTP server and other times it makes one and gets an error (see below). If they hit forward and type the same address ([email protected]) manually everything is OK.
The non-delivery-notification email that comes back is in the lines of (translation from Greek):
We couldn't reach one or more recipients...
'Company S.A. John Smith' at 22/10/2018 1:03 pm
Server error: '501 5.1.3 Bad recipient address syntax'"
and postfix has this line in the logs:
postfix/smtps/smtpd[3905]: warning: Illegal address syntax from xxx.yyy.local[192.168.0.153] in RCPT command: <Company S.A. John Smith>
Users that have Thunderbird have no problem at all. Both Outlook and Thunderbird are using the same connection settings for the server (secure IMAP and SMTP)
Any ideas on what goes wrong here would be highly appreciated.
I tried to migrate my KVM host from a host with AMD cpu to a host with Intel CPU but when I run virsh start guest_name I got error: unsupported configuration: CPU model ... is not supported by hypervisor.
I know that KVM supports such a migration (in the FAQ they even talk about live migration between 64 bit AMD/Intel CPUs). What should I do?
I'm using dyndns with pfsense and I have a router connected on the WAN line (DHCP configuration). Every few days my ISP changes my IP and pfsense fails to update it automatically. If I open the WebUI and visit the dynamic dns service it shows my IP in red color because it knows that it's not the current one. If I click "save and update" it correctly updates the IP.
I'm dealing with Ethernet networks since 1989 and I believed I had seen it all when a few days ago I had this really strange experience that first I have to share with someone and second I'd love to get feedback If anybody has seen anything similar or if you can you think of any other troubleshooting trick or workaround I could try.
The issue
I had two different Oxygen ADSL modem/routers to connect to a PC running pfsense(a FreeBSD based firewall/router). The PC had an HP NC364T quad Ethernet Card that I had used time and time again in the past. All seemed good but I then noticed this bizarre behavior: I could browse the Internet without any delay but ping was giving me a 40-50% packet loss no matter from where and to where I was pinging. Pinging the IP of the ADSL modem from the pfsense PC: 40-50% loss. Pinging from any other PC behind pfsense to any Internet host: 40-50% loss. I know that HTTP can withstand some packet loss but at 40 to 50% it should have been at least painfully slow if not totally unusable. And a RDP connection I tried was also snappy!!! It's as if the incompatibility affected only ICMP traffic.
Things I tried that had no effect
I Changed the cable & the card with another one of the same maker/model and then changed both once more (in total I tried 3 different cards and cables all of them where later proven to work just fine in another setup). Changed the settings for the Ethernet speed to 100Mbit/FD on both the modem and the HP Card. The whole time I was testing with either one or the other or both modem models.
Either of these changes was fixing the issue
changing from HP NC364T to cheap LAN cards
changing the modem to a third model -- again Oxygen but not exactly the same model with any of the other two
inserting a switch between the router and the PC.
Epilogue
It seems that these two specific Oxygen models don't want to talk to this specific LAN card model directly. If it was one modem/router model I would have been less surprised but hitting two cases on the same day seems a very strange coincidence. And the bizarre phenomenon of 50% ping losses while at the same time happily browsing at full speed really drives me insane.
I'm looking for a tool that will scan my GUI-less server and create an easy to digest rough overview of all the block devices and their relationship (disk partitions, mdadm devices, LVM PVs & LVs etc) in some rich visual format (html, pdf, svg, png...).
Here's a simple example visualization:
+--------+---------------------+ +-------------------+
| sda1 | | | sdc1 |
+--------+---------------------+ +-------------------+
+ + +
+--------+---------------------+ +-------------------+
| sdb1 | | | sdd1 |
+--------+---------------------+ +-------------------+
| | |
v v v
+---+---+ +---------+----------+ +--------+----------+
| md0 | | md1 | | md2 |
+-------+ +---------+----------+ +--------+----------+
| /boot | \ /
ext4 \ /
\ /
+
|
v
+------------------------------------------+
| vgmain |
+------+-----------------+-----------------+
|/root | /home | /var |
ext4 btrfs ext4
I don't need detail (I can get that from the CLI tools like lsbls, fdisk, mdadm, pvdisplay, lvdisplay, df)
I have a KVM/Qemu host running 4 Windows Server 2012 guests and after upgrading the host from Ubuntu 12.04 to 14.04 I get blue screens with a bug check string of "driver_irql_not_less_or_equal" that is caused by driver "viostore.sys". I don't want to stay on 12.04 for ever. What can I do?
I've added the line "Port 110" in /etc/ssh/sshd_config just bellow the existing line "Port 22" and then did an /etc/init.d/sshd restart expecting to see sshd listening on both ports (22 and 110). However netstat -anp showed that sshd was only listening to the default port (22).
Later I tried bash -x /etc/init.d/sshd restart and was amazed to see sshd bind to port 110 immediately!!! Issuing a second /etc/init.d/sshd restart again ignored my change. Rebooting also ignores my change so I'm stuck and utterly puzzled.
UPDATE this strange behaviour appears only on low ports (<1024)
This is on a CentOS 6 server.
Details
Here is my modification to /etc/ssh/sshd_config:
grep ^Port /etc/ssh/sshd_config
Port 22
Port 110
Output of netstat after bash -x /etc/init.d/sshd restart
netstat -anp | grep -i listen|grep sshd|grep -v :::
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 7031/sshd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 7031/sshd
Output of netstat after /etc/init.d/sshd restart
netstat -anp | grep -i listen|grep sshd|grep -v :::
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 8962/sshd
Another way to convince sshd to bind to port 110 is by running it in debug mode with /usr/sbin/sshd -de (note the listening on port 22,110 lines but I've also tested by connecting to both ports):
/usr/sbin/sshd -de
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-de'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Bind to port 110 on 0.0.0.0.
Server listening on 0.0.0.0 port 110.
debug1: Bind to port 110 on ::.
Server listening on :: port 110.
I have a few servers with public Internet IP addresses like A.B.C.x. One of my hosts (A.B.C.10) runs ntpd and I have it syncing it's time from europe.pool.ntp.org.
Now I only want to allow hosts from my subnet (A.B.C.x) to be able to sync to A.B.C.10. By default the whole world can sync to my NTP server. How do I accomplish this?
All examples I can find assume that I'm syncing to specific IP addresses but I sync to DNS names and as far as I can tell the IP addresses that the DNS names x.europe.pool.ntp.org point to are variable. So I can't setup exceptions in my firewall and I can't use the restrict option in ntp.conf because it too only accepts IP addresses and not DNS names (Oh! and restrict applies both to clients and to servers as firewall rules do!)
I have about 20 Linux servers in a small network and I need their clocks decently close to each other (e.g. within 20msec). I've started with every one of them synced to europe.pool.ntp.org and the job is done.
Now I have two questions:
I'm using fail2ban on all servers with publicly visible services and I wonder:
I've been getting countless login attempts since day 1 of setting up this server.
I know that a process generates persistent network card names based on rules found in /lib/udev/rules.d/75-persistent-net-generator.rules. I also know how to completely disable this process with a simple
echo '#' > /etc/udev/rules.d/75-persistent-net-generator.rules
but I've read that I "could also write my own rules file to give the interface a name — the persistent rules generator ignores the interface if a name has already been set" (/etc/udev/rules.d/README confirms that this is possible).
Can you provide instructions and/or examples on how to write such rules? (I mostly care about Debian/Ubuntu and a bit less for CentOS). In my case I would like to add rules like the following:
As a specific example of why I want to write custom rules: I have two identical servers with one onboard LAN and one PCI LAN. In case of HW failure I want to be able to move disks from HW#1 to HW#2 and it's important for eth0 to continue pointing to the onboard card and eth1 to the PCI card (no one wants to mess with cabling in the middle of a HW failure panic). My current workaround works but is a lot of work[1] so I wonder if writing custom rules would allow me to express the above rules
[1] install the OS in HW#1 and keep a copy of /etc/udev/rules.d/70-persistent-net.rules. Move the disks to HW#2 and keep a second copy of the same file. Concatenate the two copies and manually edit the NAME="ethX" part. Replace /etc/udev/rules.d/70-persistent-net.rules with my version. Finally disable auto-creation of a new 70-persistent-net.rules using
echo '#' > /etc/udev/rules.d/75-persistent-net-generator.rules