RainyRat's questions

We've recently changed VPNs from OpenVPN to SoftEther; it's working great so far, with one exception: SQL Server Management Studio. For some reason, either SSMS or the SQL Server seems to drop the connection after a short amount of time (~30 seconds). Trying to run a query after that (even a simple SELECT) returns this:

Hitting F5 at that point re-establishes the connection and everything works OK...for another 30 seconds or so. Not a deal-breaker, but massively annoying if you're a DBA (like several of my users).

Everything else works fine over SoftEther: file + print, SSH/RDP sessions, MySQL Workbench, whatever. It just seems to be SSMS that doesn't like it, but I don't know why. The issue is common across all SQL Servers that I've tested it with; I've adjusted timeout/keepalive settings on the server and client, but nothing seems to have any effect. A packet trace of SQL Server traffic shows the server sending a RST after about 30 seconds:

(192.168.30.30 is my VPN IP, 172.16.1.132 is the SQL Server I'm testing with)

Does anyone have any idea how I might persuade this thing to stay connected? Angry DBAs are no fun to be around.

EDIT, in response to Greg's comment: traffic on the server shows no RST, just a FIN/ACK:

(150.150.10.39 is the LAN-side IP of the VPN server, which is NAT-ing my traffic)

Further updates, 14/3/22: Adjusting the MTU on the client, VPN server or SQL server appears to have no effect. What does have an effect is using DBeaver as the client instead of SSMS; that's rock-solid, with no timeouts or disconnections.

I have a load-balanced set of apache servers, running 20-odd vhosts, behind an HAProxy load balancer. I'm trying to get the Apache servers to record the actual client IPs in the log files, in order to use fail2ban effectively. There's plenty of articles on this around the net like this, or this, but the solutions that they describe don't seem to work in our case.

I've got HAProxy sending the x-forwarded-for header, which contains the IP of the actual client (I've checked the traffic with tcpdump, and it's definitely there), but the original client IP isn't appearing in the access_log, just the IP of the loadbalancer. The logging configuration for the vhost I'm using to test this is:

CustomLog "/var/log/apache2/www.sitename.co.uk-access_log" "%h %{x-forwarded-for}i %a %l %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\""

But the log data stubbornly shows the LB IP and nothing else, like:

<HAProxy IP> - <HAProxy IP> - - [29/Oct/2020:13:37:08 +0000] "GET /wp-content/uploads//path/to/file.png HTTP/1.1" 304 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0; Zoom 3.6.0; Microsoft Outlook 15.0.5285; Microsoft Outlook 15.0.5285; ms-office; MSOffice 15)"

...so I'm obviously missing something. But can anyone tell me what?

Software used: Apache/2.4.43 (OpenSSL/1.1.1d PHP/7.4.6), HAProxy 2.0.14, all running on OpenSuse 15.2

Does VMware DRS log the VM migration events that it generates to anywhere? I'm trying to get a list of all the VM migrations over the last month or so, and am coming up dry. We're on vSphere 4.0, running on a cluster of 13 ESX blades.

We have two Sharp MX-2310U network printers in our office building. They're both in the same subnet, and both set up in the print services console on our file & print box (Server 2008) with the standard Sharp postscript driver. Energy saving settings are identical for both units, and yet one of them is showing up as "offline", both on the print server and to any client PCs that it's set up on (a mixture of XP and Win7 clients).

The weird part is, jobs that get sent to the "offline" printer still get printed! Does anyone have any idea why this might be? It's not much of a problem, as most of my users don't even notice the status, but it's definitely bugging me.

We're about to do a major office move, which will involve re-cabling everything in our premises. We're in two floors of a single office building, with 2-4 comms cabinets on each floor; each of these cabinets contains a Catalyst 3560; currently these are all connected to a single "core" switch (also a 3560) that joins everything together. Each floor currently has its own structured cabling setup, with all cabling run back to the patch panel in the cabinet for that floor.

During the move/re-cable, we're going to do away with this setup, cable everything into a single comms rack and move all the switches into there, so I'm wondering about the best way to connect five or six Catalyst 3560s together.

I notice that Cisco sell an SPF interconnect cable for the 3560, but should I go for these? If I'm reading the spec properly, they provide a gigabit connection between two or more Catalysts; why is this better than just connecting two of the standard gigabit ports, or etherchanneling several of them together to provide a multi-gigabit "backbone"?

We have a decent-sized server estate: several ProLiants, plus IBM BladeCentre and SANs running a VMWare environment. Due to an imminent premises move, we're not going to have enough space for a server room, so I've been looking at moving everything out to a colo. My boss is more keen on the idea of cloud-hosting everything, which would include a couple of high-traffic websites (about 9m pageviews/month), our Exchange sever (about a million clean emails sent/received monthly), as well as file/print/AD/all the ususal stuff. This doesn;t sound like a good idea to me, but I'm new to the ways of the cloud. Can anyone offer any advice?

We have a requirement to use a single browser homepage across our whole organisation. This isn't a problem for our IE users, thanks to group policy, but we have several Firefox/Opera/Chrome users, and as far as I can tell, there isn't a way of administratively setting the homepages on those browsers, either through the registry or by adding/manipulating files on the user's PC.

Does anyone know any different?

Occasionally, I stop being able to access our Exchange server from my PC. Just my PC - everyone else carries on without incident, but I can't ping the Exchange box, log in with Outlook or get to the OWA page (also hosted on the same server).

This behaviour would persist for a few minutes, or until I rebooted. Based on that, I grabbed a copy of my ARP cache while the Exchange box was being unresponsive (to me, anyway), to discover that the MAC address of the Exchange box (Exchange 2007, running on VMWare) had been replaced by that of the LAN interface on our firewall.

Clearing the ARP and DNS caches resolved the problem, but I've got no idea why this is happening in the first place - my PC and the Exchange box are both on the same subnet and the default gateway is another address entirely, so the firewall (a PIX 515E) shouldn't see any Exchange-bound traffic from my PC in the first place, much less be answering ARP requests for the Exchange server.

It's not a major problem now that I know what's going on, but it's baffling the hell out of me. Does anyone have any idea what might be going on here?

I'm putting in a list server to manage all the marketing mailshots that we send out. The solution I'm using (PHPList) has some nice functionality for handling bounces, but I need to get the bounces to get to the server first. The list server sends out through our ISP's smart host, but using our main domain name in the "from" field for the list emails.

The problem is, mail to that domain goes to our Exchange server; I therefore need some way of grabbing email to that address and getting it to go to the list server rather than the Exchange server. This doesn't seem to be possible using only Hub Transport rules, so does anyone know how I might accomplish this? Or am I going about it in entirely the wrong way?

We're using SugarCRM community edition 5.2.0f (Build 5688 running on OpenSuSE 11.1), and have the LDAP stuff set up so that users can log in with their AD credentials by contacting our DC (Server 2008).

We're having an issue with a couple of users; they've recently (a week or so ago) changed their AD passwords, and now can't log in to Sugar. Other users can still do LDAP logins, and if I set the problem users' passwords manually then they can log in too, but LDAP just doesn't want to know about them. I get the following in the log when they try:

Mon Sep 21 16:16:16 2009 [17854][-none-][FATAL] [LDAP ERROR][1]Operations error
Mon Sep 21 16:16:16 2009 [17854][-none-][FATAL] SECURITY: ldapauth: failed LDAP bind (login) by user@domain, could not construct bind_user
Mon Sep 21 16:16:16 2009 [17854][-none-][FATAL] SECURITY: User authentication for user@domain failed
Mon Sep 21 16:16:16 2009 [17854][-none-][FATAL] SECURITY: User authentication for user@domain failed
Mon Sep 21 16:16:16 2009 [17854][-none-][FATAL] FAILED LOGIN:attempts[1] - user@domain

Does anyone have any idea what might be going on here? Are there any restrictions on the allowable password - length, presence of special characters, etc? I know the user's new password ends with a single-quote, which is a SQL delimiter, but I assumed that the login code would correctly escape that.

We have a Server 2008 / Exchange 2007 box, where all our users' mailboxes live. We also have a number of distribution lists, both static and dynamic. One dynamic DL is called "Everyone" and contains, predictably enough, all the users with Exchange mailboxes.

The problem is, we also have a small number of users in a separate mailbox DB who don't technically work for us and shouldn't appear in the "Everyone" list. Even though I've checked the "Hide from exchange address lists" on all the offending users, they still show up in the preview and also (as I've just found out) receive any mail sent to it.

Is there any way of excluding these users from the DDL's filter, possibly using some PowerShell-fu, or am I going to have to create a static DL and keep it up-to-date?