Swader's questions

Hosting a site on OS X from a Vagrant VM (Ubuntu), port forwarded on 6789. I.e. port 6789 in the VM is forwarded to 6789 on the host. Can access from host OS as usual (localhost:6789), via VM IP (192.168.10.10:6789), or via virtual hosts from etc/hosts (someurl.app:6789). Can also access from mobile device connected to same WiFi by going to 192.168.5.11:6789 (Macbook's IP plus forwarded port). Can scan the IP + port from Windows 10 with Nmap, says "Host is up", gives me some values.

Can not access in any browser on Windows 10.

If I try to access 192.168.5.11:6789 from any browser on Windows 10, I get a connection timeout. The server running the site does not register any attempts, so the browsers don't even try it seems. (Though nmap's attempts don't register either, not sure if that's how it works, no experience with it - edit: this is because nmap is scanning OS X, not the VM itself, doh)

So far I have tried the following on the Windows machine:

• disabling the firewall completely; there is no antivirus or third party firewall of any kind on the machine
• adding a site into trusted sites in the internet settings intranet zone
• opening TCP and UDP port 6789, both outgoing and incoming, in the firewall advanced settings
• lowering intranet zone security
• checking if port 6789 is being used on Windows with netstat, is not.

Is there a way to make sure browsers are allowed to issue requests on port 6789 other than opening the port up in advanced settings?

Additional info #1:

Ran tcpdump on OS X, here's a gist of it. The output for when I only try to access the URL from Windows is in the top gist file (failure), the output for when I only try to access the URL from my phone is in the bottom gist file (success). It's odd how much more communication is happening in the failed state, and even more odd how trading blows continues long after the request timed out in the Windows browser.

Additional info #2:

Nmap full return data:

Port: 6789/tcp State: filtered Service: ibm-db2-admin Version: -

Also got back MAC address, and a saying that too many fingerprints are there to give specific OS details. Also got a traceroute saying 1 HOP at 15-30ms.

Additional info #3:

IP addresses of devices:

• iPhone: 192.168.5.12
• Windows: 192.168.5.15
• OS X: 192.168.5.11

We have an entry point from our ISP. It has the subnet 0, it's a MikroTik device over which we have zero control.

We have 2 dumb 4-port switches and 2 wrt54gl routers with DD-WRT installed.

These routers have the subnet of 1 by default, as in, 192.168.1.*. Thus, they give out IPs in that subnet. There are several wall ports throughout the company, so anything connected into those gets a subnet 0 because it basically goes straight to the MikroTik and the huge unmanaged switch it's connected to. I have connected the two WRTs to these wall ports as well, in an attempt to make them APs.

The problem is, the APs give out 192.168.1.* IPs and the rest have 192.168.0.* IPs. Everything on 0 can print, because the printer is also on 0, but the others can't even though they're basically on the same network, since it all goes into the wall ports which go into the MikroTik.

I entered DD-WRT setup and changed the local address to 192.168.0.250 in an attempt to force a 0 subnet, and it works - it gives me a 0.* IP when I connect to it and internet works fine. However, I still cannot see the printer, while others who are connected to it "naturally", without a router in between, can see it and print fine.

What can I do to make the printer appear on my AP's 0 subnet as well?

We have the following setup at our company: a gateway PC with CentOS (gw), running Radius and some traffic filtering programs. All of our employees connect wirelessly, and we have a WPA2 Enterprise encryption in place. The users are in a MySQL database on the gw, and they have their user roles defined there - deciding which user has access to which SSID. We have 4 SSIDs (thus, 4 VLANs), and thus 4 user groups for now - each has its own rules about QoS, bandwidth limits etc.

The network works great, save for one issue - when the user mis-authenticates, he gets no feedback. The WiFi client (everyone is using iMacs and Macbooks, there's only a couple Windows/Linux boxes here in IT) gets stuck in some kind of limbo where he says he's connected, but has no valid IP and thus no internet access. Since MacOS remembers passwords by default, he concluded he was successfully connected and never asks for a password again. Which means anyone who made an invalid login gets stuck with it until they erase the remembered password from the archive. This, as you can imagine, is incredibly tedious for a rapidly growing company of 80+ people.

Our APs are WRT54GL with DD-WRT installed as firmware.

It seems as if the radius client on the AP doesn't send any proper feedback to the WiFi client on the employees' computers. Does anyone have any experience with this sort of setup? How would one fix this no-feedback issue? Would better APs be the answer? I've been looking at Cisco's WAP2000. The cost is not an issue.

This is the comment above mschapv2 in our eap.conf file:

  #
                #  This takes no configuration.
                #
                #  Note that it is the EAP MS-CHAPv2 sub-module, not
                #  the main 'mschap' module.
                #
                #  Note also that in order for this sub-module to work,
                #  the main 'mschap' module MUST ALSO be configured.
                #
                #  This module is the *Microsoft* implementation of MS-CHAPv2
                #  in EAP.  There is another (incompatible) implementation
                #  of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not
                #  currently support.
                #

Really not sure if this is the place to be asking this, but here goes..

Our company has grown exponentially in the last year. As such, our internet connection needs some serious managing and limiting to not only ban facebook and other stupification sites, but also to limit the bandwidth that is dedicated to certain services like youtube.

Setting up new firmware and limits on every single one of our routers is, naturally, out of the question, and I would now like to know if there is some kind of hardware device that would offer me this functionality (both limiting and throttling the bandwidth to and from certain resources) without fail. I would install this device between our ISP's line and our building switch, in order to control the entire company's bandwidth allocation.

Googling revealed nothing useful, except some software solutions which are inadequate for our situation.

Update:

We are in one building. The building has two entry point connections on the ground floor, which connect to the building switch. That is, we have two synchronous (up = down) ADSL connections, once for each floor basically. This switch then branches out and connects to each of the two current floors we own (that is, to each of the several routers on each floor). 99% of the company works on Macs (I know...), and those Macs are connected wirelessly to the aforementioned routers. The WANs themselves are not interconnected in any way other than the fact that they all go back to the same building switch eventually.

I had originally thought about flashing every router with new firmware and then putting some serious limiting on those, but not only is that not very safe for the routers, it is also tedious - especially if I need to change a condition later on. This would require me to run around again and deal with each one. What I'm basically aiming for here is a single device able to both limit the bandwidth to some sites (i.e. limit Youtube to 100kb/s) and block others completely (facebook), preferably by subnet (for example, 192.168.3.x would have only bandwidth throttling, while 192.168.2.x would have a complete blockade on facebook). If you could just point to such a device if it exists, we will pay up to $5,000 for it, this is how important it is to us to do this instantly and hassle free for an indefinite amount of time.

Update 2:

Info on current routers: Right now we use LinkSys WRT54GL for our routers. There are 5 in total, three on the ground floor and two on the first floor.

Update 3:

We are in a rented building. The building has a master rack to which I have no access, and must hunt down the network admin of the building. We are a part of a university campus, and we occupied 50% of a building, for now. The structure is as follows - there is a floor rack on the ground floor, into which our internet connection is plugged. From there, we branch it out to VoIP and internet access for users, in the following manner: the ground floor gets one channel, which makes a total of 3 of those SOHO routers. The ground floor rack is connected to the main building rack, which in turn spreads this connection out among the first floor rooms, of which each has its own router. So, basically, I have no control over or access to the main building rack.

Bart suggested we replace those SOHOs. What would be the optimal setup? Should I just get one strong access point for each floor? How is this usually done, what kind of hardware/software combo would you suggest? I am open to everything, even completely restructuring the entire company network if need be. I would like to learn how to do this properly from the get-go.

Greetings,

the server admin for our company suddenly left, and left the rest of us IT folk somewhat clueless about Linux and setting up servers and such. The setup is as follows:

Our local server, which we use for development and as a security tunnel through which we reach our live servers in Germany, is on the first floor of our company. It has Ubuntu and OpenSSH installed. It contains our SVN repository, and our live servers update from this server. It has a dyndns set up, and works perfectly. The updating workflow is as such: Make change, Commit, SSH to local server as root user, SSH to live servers, execute update. This all works real nice through dyndns, and used to work real nice through our local network -> while we were on the first floor (with the server) we had some kind of IP based filtering. Out of 5 WAN's in the company, only ours could SSH to the server. However, we now moved to the second floor and the server acts as if it doesn't know us. I assume the local IP changed when we switched the cables from one part of the switch in the rack to the other part (are different parts of a switch on different IPs? I assume so..), and now we are unable to SSH to it locally (dyndns still works). The people that took over our abandoned office can SSH to it, just like we used to, and yet they shouldn't.

The question is this -> where and how does one set up this local-IP based filtering for SSH connections on a local server? I read several SSH tutorials and strolled through sshd_config filed and such, and could find nothing. If you can help me, please be specific, I am completely clueless about the whole process, so saying something like "generate a public key and upload it to the machine" will just confuse me :)

Thanks a bunch..

Edit:

netstat -plutn | grep sshd

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 758/sshd
tcp6 0 0 :::22 :::* LISTEN 758/sshd

iptables -n -L

Chain INPUT (policy ACCEPT) target prot opt source destination

Chain FORWARD (policy ACCEPT) target prot opt source destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

SSHD_config

HostbasedAuthentication no

IgnoreUserKnownHosts yes

ListenAddress ::

ListenAddress 0.0.0.0

Match -> not specified, line does not exist

Edit 2: Problem solved.

It was plain old human error. The guy who connected our first floor rack to the second floor didn't do that at all. He actually redirected the ethernet socket to their own switch and told us he did it. Thus, we were online, but through their network. A younger network admin for the building came in today, and when I asked him about it he just sighed in disappointment and connected everything the way it should have been connected in the first place. Now everything is perfectly fine.

The need has arisen for a clustered server setup (is that what it's called?) in my company. We have our hosting rented abroad, and as such have limited access to the actual hardware, but we have total freedom and are not restrained by financial resources (provided we avoid overkill, of course - no need for 300 servers if 3 can handle things).

We are an international online publisher serving free online readable books. This means we have a ton of static content - primarily many, many gigabytes of flash documents. We recently went and upgraded the server OS to CentOS x64, and changed the server software from Apache to Nginx(for static content)+Apache. There were some problems, however, and we faced some unexpected downtime, which damaged us pretty severely, even if it was only for a couple hours.

My thoughts on a cluster setup were as follows:
- server 1: our current MySQL database.
- server 2, server 3, server 4: our Application, that is, our PHP code on Apache
- server 4: static content only (images from 5kb to 3mb, PDFs from 5mb to 100MB, flash files from 200kb to 20MB, etc..) powered by Cherokee

I believe this setup would help us avoid downtime should one of the three application servers fail, in addition to sharing the load among three servers unlike now when everything (static + DB + application) was on one machine.

What I would like from you veterans is some helpful links about server load sharing, hints and tips regarding this issue and my proposed setup above.. I have limited experience with Apache as a PHP developer, and not much more, so if anyone can offer any valuable insight into their setups or experiences with different hardware/software, I would be much obliged.

Also, what is the correct terminology? Cloud? Cluster? Any other terms I should be aware of. Please be gentle, I'm only beginning to tread into the server world.

Thank you

Edit: new plan is as follows, please let me know what you think:

Application Cluster:

• 3 servers running Nginx (or Cherokee) and Apache with PHP. Nginx would handle requests for static content on the same server (CSS, JS, thumbnails, sprites, images)
• Since we currently have 2 web sites with rather large traffic (one high on DB updates, the other high on static content serving), we were thinking of putting both on this application server.
• The two applications would have two load balancers to distribute traffic among the three servers. The servers would be identical clones, and easily scalable later on.

Database Cluster

• Two servers running MySQL, clones. Load balancer. Backups would be done on themselves, as it is highly unlikely both would die at the same time. Both applications on App cluster will use this cluster - one will perform an average read load, the other a high read-write load.

Static Cluster

• Two servers with static content exclusively, basically just storage for thousands of PDFs, Zips and Flash files. No backup, impossible to perform efficiently. Servers are each other's backup. This static cluster will serve larger static content for both applications on the App cluster.

Is this realistic? What would you advise against, if anything? What would you add?

I'm optimizing our system for some faster static content delivery, and was wondering if anyone has any proper experience with the fastest web servers out there for such a purpose.

From the three main candidates I've considered, Nginx, Cherokee and Lighttpd, each seems to have its own problems - but the reports I've read online are somewhat biased and lean towards whichever server the user is currently using.

Any ideas on where to see a proper benchmark for this specific purpose, or at least a non-biased list of pros and cons? Any personal experiences and pitfalls I should be vary of?

Thanks

Edit: Serverfault.com gave the answer as nginx. I'd still like to hear some developer thoughts from this end of the universe.