David's questions

I'd like to get lighttpd working with UCC certificates, but I can't seem to figure out the correct syntax.

Essentially, for each IP address, I have one UCC certificate and a bunch of hostnames.

$SERVER["socket"] == "10.0.0.1:443" {
    ssl.engine                              = "enable"
    ssl.ca-file                             = "/etc/ssl/certs/the.ca.cert.pem"
    ssl.pemfile                             = "/etc/ssl/private/websitegroup1.com.pem"
    $HTTP["host"] =~ "mywebsite.com" {
            server.document-root    = /var/www/mywebsite.com/htdocs"
    }

The above code works fine for one hostname, but as soon as I try to set up another hostname (note the same SSL cert):

$SERVER["socket"] == "10.0.0.1:443" {
    ssl.engine                              = "enable"
    ssl.ca-file                             = "/etc/ssl/certs/the.ca.cert.pem"
    ssl.pemfile                             = "/etc/ssl/private/websitegroup1.com.pem"
    $HTTP["host"] =~ "anotherwebsite.com" {
            server.document-root    = /var/www/anotherwebsite.com/htdocs"
    }

...I get this error: Duplicate config variable in conditional 6 global/SERVERsocket==10.0.0.1:443: ssl.engine

Is there any way I can put a conditional so that only if ssl.engine is not already enabled, enable it? Or do I have to put all my $HTTP["host"]s inside the same $SERVER["socket"] (which will make config file management more difficult for me) or is there some entirely different way to do it?

This has to be repeated for multiple IPs too (so I'll have a bunch of SERVER["socket"] == 10.0.0.2:443" etc), each with one UCC cert and many hostnames.

Am I going about this the wrong way entirely? My goal is to conserve IP addresses when I have many websites that are related and can share an SSL certificate, but still need their own SSL-accessible version from the appropriate hostname (instead of a single secure.mywebsite.com).

I've been having some weird group policy issues lately, so I wanted to test on a clean setup and haven't had any luck, so I'm hoping someone else can shed some light. This is on Windows 2003 R2.

I created a test user and added it to a test global group. I then set up a GPO linked to the root of the domain that has security filtering to only apply to the test group and tried to see if my settings applied.

If I use Group Policy Modeling, everything looks correct, but when I do Group Policy Results or check the actual machine, nothing gets applied. I first thought I had GP issues and tried the usual with rebooting, gpupdate, waiting a day hoping things would apply, etc. I then tried created a different user, tried a different machine, even tried adding the Administrator account to the test group and nothing worked.

Then I noticed that under "Security Group Membership when Group Policy was applied" in GPMC and "The user is a part of the following security groups," the test group is not listed as a group the user is a member of.

I've tried creating a different domain local group. I've tried adding Administrator to the groups and seeing of the GPs will apply to that account, but it doesn't.

However, if I create a share on the domain controller and only give that group access to it, the test user can access it fine, so I know the user is definitely a member of that group.

How can I convince GP that my user is really a member of those groups?

We have two load balanced CentOS 5.3 webservers that handle a decent number (~20) of individualized shopping websites. The end result being that we have to have a separate secure site per product, resulting in a large number of network aliases, one for each IP so that SSL will work.

Obviously managing this stuff manually would not be fun, especially when servers die and you need to rebuild and want to ensure consistency.

However, the IT manager is not comfortable using CLI tools to manage certain things and is adamant about having a GUI tool like system-config-network available in case he wants to change something.

The scripts I have written to manage the machine configurations have tried to take that into account and for most of the network configuration, I use system-config-network-cmd -e > netconfig to dump the config, make changes, and then system-config-network-cmd -i -c -f netconfig to import the changes back in.

The problem I have found is that different versions of s-c-n-cmd have acted differently and often what is imported is not what actually gets stored. Even simply doing system-config-network-cmd -e > netconfig followed immediately by system-config-network -i -c -f netconfig without making any changes results in a different config (running system-config-network-cmd -e > netconfig2 and doing a diff netconfig netconfig2 shows differences).

Whether or not the issues with s-c-n-cmd will get fixed, has anyone else dealt with this issue? I tried modifying /etc/sysconfig/networking/* directly, but that didn’t always seem to work right either.

Is there some Right Way(TM) that ensures the RH GUI tools and /etc/sysconfig/network-scripts can live in harmony while still being script-friendly?

I’m looking at eventually moving to puppet, but it’s far down in the long list of other projects that need to be done so I’m hoping for something that will keep us going until then.