Moduspwnens's questions

For Puppet clients to report results back to the master server, "report = true" needs to be in the "[agent]" section of the client's puppet.conf. But how can I get Puppet to enforce that?

It's disabled by default, but all the resources I can find online seem to suggest doing it manually as if it's no big deal. Maybe it isn't, but isn't automating/enforcing basic server configuration exactly what Puppet is intended to do?

I'm new to Puppet, but this seems like a common and trivial task that I can't seem to find a solution for. Is there something I'm misunderstanding? Or is this really an uncommon/difficult task?

We set up AirPrint using unicast DNS-SD on our campus about a year ago and it turned out to be a big success, so we're looking at trying to get AirPlay working so our faculty and students can wirelessly show content on our classroom projectors.

There are still a couple of other things preventing an ideal implementation (username and password authentication, for starters), but I've been trying to set up a working demo nonetheless. Getting AirPrint working was basically just a matter of advertising the same records over a DNS-SD domain instead of the multicast (.local) one, but doing the same thing for AirPlay doesn't seem to cut it. The devices don't recognize the DNS-SD AirPlay servers as available.

I've uploaded a screenshot of my DNS-SD configuration with the original (from AirServer, which works normally for multicast) here.

I realize this is still a fairly new feature and documentation is lacking, but has anyone been able to get AirPlay working via DNS-SD? If it simply only works over multicast, I can accept that, but its potential is so appealing for us that I thought it'd be worth asking if anyone else has figured it out.

I'm running an Ubuntu 12.04.1 server in a VMware virtualized environment that has a strange issue. Twice now, at seemingly random times, the machine has suddenly been unable to write to the root partition despite plenty of space seemingly available. I'm at a loss trying to figure out what's wrong.

"df -h" shows all mounted volumes with 40% or more free space. Both times this has happened, rebooting resolved it for a few minutes, and then it was back to saying "no space left on device." Restoring it from a snapshot seems to fix it for longer, but since this has now happened again, I'm not sure what to do with it.

If it helps, the machine is a network print server running CUPS 1.5.3 and Samba 3.6.3.

We have a network-wide CUPS server that offers authenticated printer access to all our campus users. We've been pretty disappointed with the way Mac clients handle bad printing authentication, though.

In any other authentication dialog, when a user types in a bad username or password, the window shakes briefly, allowing the user to re-enter. With printers, this isn't the case. It'll happily accept (and even save to the keychain, if specified) bad credentials. The authentication dialog is dismissed, and the user then has to deal with the print jobs showing up as "On hold (authentication required)". To get their job printed, they need to select it in the printer's queue, click "Resume", then re-enter appropriate credentials.

Is there a way to get failed printing authentication to work more intuitively for Mac OS X clients?

We're trying to support a BYOD environment, but our end users have been really confused by this. It's made even worse by the way it pre-populates the user's full login name (e.g. "Smith, John"), which tends to make them think to use their local machine passwords.

Our entire Active Directory forest is currently on a single 10/8 private subnet. We're looking to migrate most of our servers to a cloud provider, but I'm not sure how to set up the first domain controller in the new cloud location.

I've read a lot about trusts (external, shortcuts, and realms) as well as sites (site links, inter-site replication, and subnets) but I can't quite tell which applies to our situation. The end goal is to have two separate private subnets with Active Directory user and group data synchronized between them. We can open whatever port(s) are necessary so the domain controllers can talk to each other over public IP addresses.

I've read through much of (what seems to be) the relevant official documentation, but I'm having trouble reconciling the abstract concepts with what needs to be done in my situation. What steps should be taken to accomplish what I'm trying to do?

I've recently been trying to set up unicast DNS-SD to make printing easier for our Mac users, but I've hit an odd snag.

We use two Windows Server 2008 R2 machines as the DNS servers between end-users and the Internet, but for some reason they return a SERVFAIL response when forwarding printers' TXT records. Other DNS servers (including those running Windows Server 2003) have no problem at all.

I even set up a fresh Windows Server 2008 R2 instance (on EC2) to rule out firewall and network configuration issues. The issue still occurs. My research revealed some issues with 2008 R2 and EDNS, but the command that others claim fixed the issue hasn't helped.

Has anyone else set up unicast DNS-SD sharing that works through a Windows 2008 R2 DNS server? Any idea what could be causing this?

We're looking at doing a cloud migration and considering shifting to a new Active Directory forest in the process.

On-site, our AD root forest matches our top-level domain (myschool.edu). We've been using it for several years, but it could have been managed better. There are plenty of objects and groups that we're not sure are being used any more (many of which were inherited), and while it isn't directly impacting performance, it's a problem we'd like to resolve.

Ideally, though, we'd like our AD root forest to be a sub-domain of our top-level domain (ad.myschool.edu). Since this could potentially involve a big change, I thought it might be easier to just start that as a new root forest in the cloud. If we can just synchronize the users (and maybe some groups) from the old AD forest to the new one, we could just make switching the domain the machine is bound to part of the cloud migration process. This way, there's no single day a bunch of things break... we just move closer to the day that we get rid of the old forest (at myschool.edu).

I may be thinking about this wrong, though. What would be the best way of going about doing this? If it helps, we're not using an Exchange server.

We have split DNS set up for our domain, which causes internal clients to resolve different DNS records from external clients.

As it is right now, the two zones are managed completely separately. For records that differ between internal and external, it's no problem, but for everything else, all of the records have to be duplicated in both places. Most CNAME records, MX records, SPF records, and some A records all need to be entered and maintained in both places.

While this isn't inherently unacceptable, data duplication like this is less than ideal from a design perspective. I feel like ideally, the internal nameserver would simply forward results from the external nameserver, but allow for us to override or add additional records. While it looks like I could use a designated forwarder (like dnsmasq) to do something like this, the flat file configuration would make it difficult to sell the idea to the rest of the team.

Aside from that, the best solution I've been able to come up with consists of PowerDNS with a MySQL backend and web interface. This makes it fairly easy to add a zone and root A record for each sub-domain we'd like to override (e.g. www.example.com), which means other records on the root domain (e.g. example.com) will still be forwarded from the external nameserver.

That still seems like I'm straying kind of far from the norm for something that's supposedly very common, right? Is there a cleaner way to manage Split DNS without maintaining duplicate records? Or is there something I'm missing?

After a recent power outage, we've been re-evaluating how we can most effectively provide, maintain, and support our IT resources.

One idea we've been considering is to move our non-critical infrastructure into the cloud. For example, we could maintain only the following services on-campus:

• DNS (perhaps just a forwarder)
• DHCP (with failover)
• Directory and Kerberos (for network authentication)

...and that's all. With a plan like this, even in the case of a disaster, we'd simply focus on keeping our Internet connection up, and all of our other services would still be available.

I was looking into Amazon EC2, but I'm not committed to anything yet. How have other colleges or businesses gone about doing something like this? Is there a "catch" or hurdle that we should know about? Are there any blogs/forums that might detail an enterprise-level cloud migration?

We're wanting to be able to offer students a basic web development environment for anyone who's interested, but I'm having trouble finding a good solution for something like this.

We currently have an old Windows Server machine that hosts outdated versions of PHP and MySQL, but are looking to provide a higher level of service. I suppose ideally, I'd want the system to:

• Run PHP (more?).
• Offer MySQL databases.
• FTP (and/or SFTP) access.
• Included automated account creation/management ability (SSO, API).

Also, preferably:

• Hosted and managed off-site.
• No maintenance required.
• Latest versions always available.

We've recently switched to Google Apps and feel like we'd prefer something like a "GoDaddy Apps" model. I could be wrong, though. What are other colleges / universities doing to address this need?

We've been thinking through re-arranging the end-user network and VLAN configuration. We're currently doing things in a way that isn't quite typical, but given that it is working, we're hesitant to try things a different way.

Our primary goal is limiting broadcast traffic, so we need to separate them into VLANs based on something. If we wanted to, we could probably do it based on the last character of the device's MAC address... or the registered user's birthdate... or a random number generator... or even put them all on their own VLANs.

Obviously broadcast traffic would be shared differently, but what would be the practical downsides of grouping VLANs strangely for our end-users? Or would they even notice?

According to Princeton University, the iPad (and perhaps other iOS devices?) seems to have had various issues with DHCP that exist even on the current version (4.3.3). The current one involves the device keeping (and using) an expired DHCP lease under certain circumstances.

• iPhone OS 3.2 on iPad Stops Renewing DHCP Lease, Keeps Using IP Address
• iOS 3.2.1 - 4.0.2 Requests a DHCP Lease Too Often
• iOS 4.1 - 4.3.3 Allows DHCP Lease to Expire, Keeps Using IP Address

It looks like Princeton's course of action is to let the user know of the workaround they've devised and ban them from the network if the issue still persists. Their article also mentions:

Sites that do monitor for these problems closely are unlikely to encounter the issue if they assign DHCP leases with expiration times longer than about an hour.

I saw one article (having trouble finding it now) that mentioned configuring your DHCP server to ping addresses (to ensure no client is claiming it) before offering them to clients.

That said, these issues have supposedly existed for over a year now and I don't see much discussion (on here or Google) about dealing with it on a medium/large scale network.

• Have you experienced any issues related to this on your network?
• If so, how have you dealt with them?

We've been thinking through re-arranging our network and VLAN configuration. Here's the situation.

We already have our servers, VoIP phones, and printers on their own VLANs, but our problem lies with end user devices. There are just too many to lump on the same VLAN without being hammered with broadcasts! Our current segmentation strategy has them split into VLANs like this:

• Student iPads
• Staff iPads
• Student Macbooks
• Staff Macbooks
• Gaming devices
• Staff (Other)
• Student (Other)

**Note that our network has many more iPads and MacBooks than most.*

Since the primary reason we're splitting them is just to put them in smaller groups, this has been working for us (for the most part). However, this required our staff to maintain access control lists (MAC addresses) of all devices belonging in these groups. It also has the unfortunate side effect of illogically grouping broadcast traffic. For example, using this setup, students on opposite ends of campus using iPads will share broadcasts, but two devices belonging to the same user (in the same room) will likely be on completely separate VLANs.

I feel like there must be a better way of doing this.

I've done a lot of research and I'm having trouble finding instances of this kind of segmentation being recommended. The feedback on the most relevant SO question seems to point toward VLAN segmentation by building/physical location. I feel like that makes sense because logically, at least among miscellaneous end users, broadcasts will typically be intended for nearby devices.

• Are there other campuses/large-scale networks out there segmenting VLANs based on end-system OS?
• Is this a typical configuration?
• Would VLAN segmentation based on physical location (or some other criteria) be more effective?

EDIT: I've been told that we will soon be able to dynamically determine device OS without maintaining access lists, although I'm not sure how much that affects the answers to the questions.

Over the past few weeks I've been working to create a flawless Google Apps test pilot for our users despite Google's lack of official support for Exchange 2010 in all migration utilities. So far, I've been able to work out all kinks except one.

The last hurdle is the synchronizing of users' free/busy data between Exchange and Google Apps. Google provides the calendar connector kit with official support for Exchange 2003 and 2007, but I'm seeing WebDAV-related error messages in the logs and that's one of the big things removed between 2007 and 2010.

I don't mind diving back into troubleshooting, but since it's not officially supported, I thought I'd check here first to see if what I'm trying to do is at least possible. Has anyone else found a working solution for the synchronization of free/busy data between Exchange 2010 and Google Apps?