Mike DeAngelo's questions

I'm running Linux Mint 19.2 Tina, which should be equivalent to Ubuntu 18.04.

When I issue the command sudo systemctl stop nginx.service then systemctl start nginx.service I frequently get the error

Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.

and

nginx: [error] open() "/run/nginx.pid" failed (2: No such file or directory)

I'm not able to restart nginx with the systemctl command, but checking with ps aux | grep nginx shows that nginx is running. Checking with sudo ss -lnp | grep nginx shows that the process is bound to port 80 and port 443. But /run/nginx.pid does not exist.

I can kill this process manually with sudo kill $PID_OF_MASTER_NGINX_PROCESS but the normal control commands don't work.

I spend most of my time as a developer, so I'm not familiar with all the details...

I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. Some of my clients are on windows clients attached to AD, so they already have a ticket. I understand how to use kinit to get a ticket on my *nix clients, and have verified that I can do so. I have an /etc/krb5.conf file that seems to work on my *nix clients

I understand I need to do the following...

1. Ask the AD admin to generate a keytab for a particular SPN.
2. Place the keytab on my server in a place where the service can find it.
3. the clients to use the ticket and the SPN to get a token from the Kerberos infrastructure.
4. Configure the service to receive the token and decode it using the keytab.

Here is my issue...

The SPN is usually in the form of service_name/FQDN@domain_name. My clients, however, don't construct the SPN using the host name of the service. Instead the SPN is set in a configuration file. It would be easiest for me if I could create a single SPN and use it on each instance of my server.

So I would then do the following...

1. Create an SPN of the form service_name/some_dummy_name@domain_name.
2. Generate the keytab and copy it to svr1.mycompany.mydomain, svr2.mycompany.mydomain, ..., svrX.mycompany.mydomain.
3. Configure my clients with the single SPN.

I seem to think that this will work, in that the same SPN/keytab can be used on several servers with different host names when servers are clustered.

To boil it down - is the FQDN part of an SPN significant to the server, or is it just there so that typical clients can generate the proper SPN? If several servers have the same keytab, can they receive and validate the same tokens, or is something else required?

Just to emphasize, the service is a java app on Linux, the clients are java apps on windows and *nix. AD would provide the Kerberos server infrastructure.

My company has a field engineering force which works onsite at customers. Many of those customers have very restrictive rules. One cannot usually connect a non-customer owned laptop to the network, our employees can't install non-approved software on customer workstations. The customer network frequently has restrictive firewall rules in place that prevent access to external resources. Even our webmail is often blocked.

Meanwhile, we have a large number of useful resources on our internal network. Lots of wikis and similar resources, mostly browser based.

One idea I was thinking of is a browser based VNC that can talk to the my company's web server via http/https. In this way we should be able to access it from a customer machine using a customer web browser over ports that the customer would have open in the firewall. The web server would then forward the VNC connections to a generic Linux box. The Linux box would provide a web browser, rdesktop, and other apps and would be sitting within my company's network, with access to all the internal resources.

My questions are as follows...

1) Is this a good idea, or is there a better solution?

2) What products are available to do this?

3) Are there combinations that are known to work?

Thanks.