zero_r's questions

I'm trying to configure snmpd on my CentOS hosts to monitor the free disk usage in percent.

If I set snmpd.conf to

disk /
disk /var

, the values can be queries with

1.3.6.1.4.1.2021.9.1.1.1 for "/" and

1.3.6.1.4.1.2021.9.1.1.2 for "/var".

I have several servers which don't have a separate "/var" partition. So the disk layout isn't standardized. I figured out, that the disk statement order in snmpd.conf dictates the dskIndex number of the snmp query result. So if I would flip "/" and "/var", "/" would have dskIndex 2.

In my monitoring system, I would have to configure each OID for each server separately because they might be different. So the idea is to have placeholders for non-existing filesystems.

Is it possible to either have placeholders to artificially count the dskIndex up or to somehow influence the dskIndex manually in snmpd.conf?

Thanks in advance

I'm looking into virtualizing a Hylafax server which currently runs on a dedicated hardware running CentOS with a Divalogic card.

The main issue obviously is, how to connect the modem to the VM. There are serial over IP devices available at digi.com. Maybe there are others?

Regarding digi.com devices, as far as I understood one can install the RealPort software and then have a /dev/ttySx device presented to the Linux server. This device then can be used as serial connection to the modem.

Does someone have such a configuration in place? Or does someone have another idea to virtualize a Hylafax server (outbound faxes only).

Thank you in advance

Is it possible to setup a SFTP service with OpenSSH with the use of virtual users (not /etc/passwd)? I'm aware of all the chroot/jail capabilities of OpenSSH. I also read somewhere that the PAM service name is based on sshd argv[0].

The background is, that this service would be run in a failover cluster and I don't like the idea of having to maintain users in each nodes /etc/passwd file. Therefore I would like to run an sshd with it's own configuration and with a independent account management.

E.g. in vsftpd virtual users can be written into a BDB file which is then passed to pam_userdb.so.

Is something like this possible with standard PAM/OpenSSH?

I'm looking for a way to configure vsftpd to use multiple listen_address IPs. I'm aware that if I set it to the default, it will listen on all available interface IPs, but that's not what I'm looking for.

Is there a way to configure something like this?

listen_address=192.168.1.3,192.168.1.4,192.168.1.5

Regards

I have a <Location> within a virtualhost that looks like this:

  <Location /app1/>
    SSLVerifyClient require
    SSLVerifyDepth 2
    SSLRequireSSL
    SSLOptions +OptRenegotiate
    SSLCipherSuite HIGH
    SSLRequire %{SSL_CLIENT_S_DN_OU} eq "Customer1" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer2" \
    or %{SSL_CLIENT_S_DN_OU} eq "Customer3"
 </Location>

This requires everyone who wants to access /app1/ to present a client certificate to the server. Backend server is tomcat.

Is it possible to "route" visitors who don't authenticate to a different location than visitors who have a certificate? E.g. the ones with no certificate get less functionality...

Thank you

I got a linux server that has several dozen users. I also have the cleartext password for every user (i know - bad security).

I would like to know if the passwords are correct. Since the users are all ftp users and have the nologin shell, I cannot just write a script to check if login works.

How can I do a local check on passwords? Script output could look like this:

$ check_userpw < user_pw_list.txt
user1 ok
user2 ok
user3 mismatch!
user4 ok

Thanks

My company wants their "informational" website to be rewritten from HTTP to HTTPS. Technically this is not a big deal for me. But i have doubts if this is state-of-the-art since the only reason they want this, is to encrypt contact and sign up forms. (I could enable HTTPS for site with forms, however, they don't like that approach.)

What are the disadvantages and downturns of having an HTTPS only company website? What is your experience and recommendation?

Webapplications are running on another URL and are encrypted.

Regards

I read that for Cisco devices which run IOS, there's a scheduler (kron) which can be used similar to Linuxs cronjobs. I followed the guide on http://blog.ioshints.info/2007/08/sample-configuration-periodic-upload-of.html and it works as expected.

But this feature doesn't seem to be available on a Cisco ASA (e.g. 5510). Is there a substitute command for scheduled tasks?

Or as a general question: How do you manage your Cisco configs (versioning, archiving, backup)?

I've a question which bothers me since quite some time now. I have several environments and servers. All of them are connected to 1 Gbit ethernet swiches (e.g. Cisco 3560).

My understanding is, that a 1 Gbit link should provide 125Mbyte/s - of course this is theory. But at least it should reach ~100Mbyte/s.

The problem here is, that one copy process only reaches ~20Mbyte/s.

I'm aware of these factors but they don't make any difference:

• Source and Destination on the same switch or not
• Copy utility: SCP, Rsync, Windows copy, Windows robocopy
• SMB/CIFS, NFS, iSCSI
• Disk storage: NetApp FAS, locally attached 15k SCSI

With all of these configurations, I never get more than ~25Mbyte/s throughput. The thing is, that if I start multiple parallel copy streams, like 3 times an rsync, i almost reach 90Mbyte/s. I also did some IOMeter tests and found out that the "chunksize" makes a huge difference, but is normally not tunable with the given tools (or is it?).

Jumbo frames are not enabled but I'm unsure if it would make a difference. TOE is enabled on all NICs.

What are the bottlenecks you would think about? Do you have similar experiences? Are these the expected "natural" values?

Thanks in advance

I need to copy some VMs from one datastore to another. I'm running ESX 3.5 U3, VMs are mostly Windows-based. I don't care about data integrity since it's only to test NetApps deduplication on the target destination and the VMs will never be running from this files. Since the VMs are used, i cannot shut them down. If I try to copy it with 'cp' of course I get errors complaining about locked files.

E.g.: "cp: cannot open ....vmdk' for reading: Device or resource busy"

Is there a trick to do this? With dd or cpio?

Regards

I have the following configuration (beside a ReverseProxy entry) to force clients to deliver a client certificate:

<Location /SSLTest/>
        SSLVerifyClient require
        SSLVerifyDepth 2
        SSLRequireSSL
        SSLOptions +OptRenegotiate
        SSLCipherSuite HIGH
        SSLRequire %{SSL_CLIENT_S_DN_OU} eq "MyClientX"
</Location>

How can i disable this requirement to several IPs. I tried different variants with SetEnvIf like

SetEnvIf Remote_addr 192.168.1.46 is_internal 

and added a <IfDefine !is_internal>

around the Location, but this seems to be parsed on apache startup only. Is there a way around rewrite rules?

I'm using Apache 2.2 on Linux.

Thx in advance