Krystian's questions

The title may be a bit confusing, so a little explanation. I need to configure an application by passing a PKCS1 PEM encoded key using environment variable. The App is configured using a .env file

Locally I just export MY_ENV_VAR=$(cat my_key.pem), but on the server, it needs to be inside the .env file and needs to contain the value, not a command.

I've tried

echo MY_ENV_VAR=`awk 'NF {sub(/\n/, ""); printf "%s\\n",$0;}' my_key.pem` >> .env

But the generated string was not accepted by the application I'm trying to set up, it complains that the key is not PKCS1/8 compliant.

For now, I've added the export MY_ENV_VAR=$(cat my_key.pem) to my .profile and I launch it manually, but I would prefer to just keep the config in the .env.

How can I do this? I'm currently running GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu) but I am fine to switch to other shell if needs be.

this morning I woke up to a 'service down' email I have received from watchdog. After connecting to the server I have found the docker service down. After little investigation, I have found that this morning Ubuntu made an unattended upgrade of the containerd service and after the upgrade, docker service was not started automatically.

How can I make sure that after the upgrade this will not happen again?

I have a docker image, which creates containers for my web app. The details of the web app don't matter at all. What matters is that each time, the container can use a different address ( server1., server2. etc.) and I want to create Let's encrypt keys for each of them. In order to do that, I use the web service authorization, so certbot creates some files which are then accessed by the lets encrypt server to test if I am the owner of the domain. Once tested, it will generate the keys which can be used.

At the moment, I have the nginx configuration file with two server parts, one for http and one for https. I just comment out the https part, start the server, perform the certbot action, uncomment the https section and restart the container.

It is a bit cumbersome, difficult to automate, is there any way I could change the nginx configuration so that it will not crash when there are no SSL certificates available? And then after restart, it would work automatically?

Or maybe there is an even easier way to handle my scenario?

I've got the CoreOS running and I would like to remove the ability to login using passwords to the sshd. I went through the docs of the CoreOS in here, but I am quite new to the systemd. I went through the man page, but I am a bit lost on it. I know I have to create a dropin file inside /etc/system.d/system/, but I have no idea, in which section of the file, should I put the PasswordAuthentication no option. Since I work remotely, I don't want to screw up and not be able to login again...

I would be grateful for some guidance.

I'm in the process of moving my services from virtual machines to docker containers. I have moved several of my web apps, confirmed them working and finally decided to move my nginx.

After moving nginx to docker, none of my webapps respond. I have confirmed, that nginx virtual hosts don't work. Only the default configuration, when accessed using IP address works. It looks like it would not get details about the domain used in request.

A sample of my virtual host config:

server {
  listen 80;
  server_name my_domain.eu;
  access_log  /var/log/nginx/my_domain.eu.access.log;
  error_log /var/log/nginx/my_domain.eu.error.log;
  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://192.168.88.196:8080;
  }
  error_page 500 502 503 504 /default.html;
  location ~* /default\.(jpg|html)$ {
    root /var/www/tomcat/errors;
  }
}

My docker is configured with a custom network using macvlan driver. All of my containers have a static IP address. I use the default nginx docker image. Here's the relevant part of the docker-compose.yml file:

  nginx:
    container_name: nginx
    image: nginx
    volumes:
      - nginx_config:/etc/nginx/
      - nginx_static:/var/www/
    networks:
      pub_net:
        ipv4_address: 192.168.88.193
    ports:
      - "80:80"
    restart: on-failure

As I have said, I have confirmed the nginx working both by checking the logs and by accessing the server using IP address.

I suspect that I have messed something with my docker configuration, since the only changes I have made no changes to the nginx config. I would be grateful for any hints and tips on what could go wrong and where to look at.

When configuring the traffic, I always use the IP address of the container, not the host machine.

I want to upgrade my Proxmox cluster from 2.2 to 4. I think I have this well thought, but there's one thing I am not sure of.

Currently, my installation runs on LVM A. I have added few new disks and created LVM B. I would like to install the new system on LVM B, migrate the virtual servers there and only after I make sure everything works [it's kind of a big leap] I will want to salvage the old drives.

After installing the new system, I understand that I will be editing the /etc/grub.d/10_linux file on the old system in order to be able to boot the new installation. Once everything works, how do I move the config to the new installation and ensure that it works after I remove the old drives?

I have received a .bak file from MSSql database from a friend of mine. He is quite desperate because his system failed, and he was able to recover the last database backup. This should be enough to get things going, but he cannot recover the file using latest MSSql 2016. When restoring, he gets an error message [sorry, the message is in polish language, so I'm doing my best with translation]:

Database cannot be restored on Your SQL Server 12.0.4100.1.
(Version of SQL Server which created the backp: -1.-1 file format: -1, preferred file format: 782).

At the moment, where I am it is after midnight, and the only computer I have is my macbook with storage shortage, so I can't just install Windows and SQL Server on it to have a go at trial and error with the database restore.

I am wondering, if there's something obvious I am try on a windows machine with SQL Server?

My best bet is to try and get the version of SQL Server which created the archive, hoping it will be able to restore it. Howver how can I learn about the version? -1 is not helping me much...

Is there something else I could do to restore the database or to learn the version this backup originates from?

I've got a very old internal server where I'm changing drives and was thinking it would be useful to upgrade proxmox from 2.2 to current 4.4. Is it possible to just install 4.4 and reuse the same images as I used with 2.2? How can I do that?

Thanks Krystian

I've got a LAN behind OpenVPN client (mikrotik router) which connects to a server, and allows access to the machines inside LAN for every other client that connects to the server. The LAN has its own subnet, other than other clients which connect to this server. I am unable to configure this client to force server to add route, which will properly route traffic for this subnet. Currently I have to manually go to the server and run:

route del -net <client's subnet> netmask 255.255.255.0 gw <old client's ip>
route add -net <client's subnet> netmask 255.255.255.0 gw <new client's ip>

Is there anyway I could change server's settings to make it do that automatically?

Clients' ips are dynamic, and I would prefer to leave it this way. I've tried adding: The open vpn client settings on mikrotik router are quite limited, so there's not much I can do on the client's side, but I hoped there's something I could do on the server side to set the route upon client connection + push this route to other clients connecting. I have actually tried adding

push “route <client's subnet> 255.255.255.0”

on the server, but I still have to manually set the route on other clients. However the most important thing for me, is to set the OpenVPN server [system] route upon client's connection.

I've got a Mikrotik Routerboard RB750GL which I bought to configure as an openvpn gateway for lan at the office. Unfortunately I was lured by the openvpn promise, I didn't read to carefully to know, that it only supports user/password authentication... Anyway, I have to deal with that. My idea is to have a LAN where every client will be on our vpn network + to have clients using software vpn clients who can connect from anywhere using their private keys. I'm not sure openvpn can be configured to use both,from what I understand it's one way or the other, is that right?

A sample/example of ovpn server configuration to handle both user authentication methods would be welcome.

I want to setup FreeNAS as a central file repository for all my employees to access company related data. A lot of our infrastructure operates on Google Apps including Android phones. I would like to use the same login for them to access the files.

If it is not possible straight in FreeNAS, maybe Crowd could be used in between? I have a license for Atlassian Crowd, which should be able to authenticate users using Google Apps and act as LDAP server. It seems so.

I'm not really looking for someone to hand me over a tutorial on how to do this from start to end, I would just like to know if this is even possible, or am I going to waste my time trying to build something that won't work.

I'm trying to update my dns servers after openvpn connection, but netconfig won't do that for me.

Here's how I'm trying to do it [manually now]:

/sbin/netconfig modify -v -i tap0 -s openvpn <<-EOF
INTERFACE='tap0'
DNSSERVERS='10.10.0.1'
EOF

And here's the verbose output:

debug: lockfile created (/var/run/netconfig.pid) for PID 5530
debug: lockfile created
debug: write new STATE file /var/run/netconfig//tap0/netconfig0
debug: Module order: dns-resolver dns-bind dns-dnsmasq nis ntp-runtime
debug: dns-resolver module called
debug: Static Fallback
debug: Use NetworkManager policy merged settings
debug: exec get_dns_settings: /var/run/netconfig/NetworkManager.netconfig
debug:      get_dns_settings: service 'NetworkManager' => rank '1'
debug:      get_dns_settings: DNS_SEARCHLIST_1='mydomain.com'
debug:      get_dns_settings: DNS_SERVERS_1='192.168.0.1'
debug: exit get_dns_settings: /var/run/netconfig/NetworkManager.netconfig
debug: write_resolv_conf: ' mydomain.com ' ' 192.168.0.1 '
debug: No changes for /etc/resolv.conf
debug: dns-bind Module called
debug: dns-dnsmasq Module called
debug: nis Module called
debug: Static Fallback
debug: Use NetworkManager policy merged settings
debug: exec get_nis_settings: /var/run/netconfig/NetworkManager.netconfig
debug: exit get_nis_settings: /var/run/netconfig/NetworkManager.netconfig
debug: set_nisdomainname:  eth0 24
debug: set_nisdomainname: => yes
debug: set_nisdomainname: old[]=, new[24]=
debug: format_yp_conf called with :
debug: Using static fallback
debug: format_static[0] called
debug: No changes for /etc/yp.conf
debug: nis domainname '' is up to date
debug: ntp-runtime Module called
debug: Static Fallback
debug: Use NetworkManager policy merged settings
debug: exec get_ntp_settings: /var/run/netconfig/NetworkManager.netconfig
debug:      get_ntp_settings: NTP_SERVER_LIST=''
debug: exit get_ntp_settings: /var/run/netconfig/NetworkManager.netconfig

I've been trying to find something relevant on the web, but failed to do so. I have no other clue on how to progress with this issue.

Any thoughts?

I've got a dual xeon e5504 server, with [for now] only 8GB of ram. Storage is'n impressive either: 3x 146GB sas in raid5 + 500GB sata drives. Currently it works as a development server, but it's over speced for our needs and since our development methods changed through last 2 years we decided it will work as a production system for some of our applications + we would like to have a separate system for testing/research. Our apps are mainly web apps deployed on tomcats [plural as some of the apps require older versions] and connected to Postgres.

I would like to have a production system, where only httpd+tomcat+db are setup and nothing else runs there. Sterile system. Apart from that, I would like a test system, where I can play with different JVM settings, deploy my test apps, play with tomcat/httpd settings and restart them without interfering with the production system.

Apart from that, I would like to be able to play with different linux flavors, with newer kernels to test how they work etc. I know, this is not possible with OpenVZ and I would have to choose KVM for that. I am thinking about merging the two, and setting up a KVM to be able to work with different systems [linux only to be frank] + use openVZ to setup separate machines for my development needs. I would simply go with that, but reading here and there about the performance impact full virtualization has over containers and looking at the specs of my server makes me think twice about it. I don't want to loose too much performance, especially because of the nature of my apps [few JVMs running at the same time].

It will be my first time with virtualization, apart from using desktop virtualbox/vmserver. Although I am a fast learner I don't want to mess with the main system so much that it will break the production apps or make them crawl. Although they are more or less internal apps and they don't produce much load, they need to be stable.

I've read, that KVM host is a normal linux installation and it allows to run normal processes on it. If that is so, does it allow to run openVZ as well? I mean... can I have KVM and OpenVZ running on the same system/kernel? Or do I have to setup another system to run OpenVZ containers? How much performance impact can this have for me? Will my hardware suffice?

oh and one more thing... unfortunately I'm quite limited with the funds... I'm looking for a free solution only :/