Is there a way to lock down an account to when it logs in, it runs a specific command/script and then exits after the action is completed, while keeping it locked out of performing any additional operations if it happens to break out of it's script/command?
Would prefer a native way of accomplishing this, but not necessary.
mpstat -P ALL shows high %wa time on a single core from an 8 core CPU and I'm trying to figure out what's writing to disk. So how can I figure out what is running on that CPU core?
From Windows Server 2008+, wuauserv is no longer a service that's ran all of the time and is instead ran as a scheduled task. I'm not sure of the exact behavior of how the scheduled task is created as it seems the schedule is generated and edited by another service. Prior to this, we setup nagios to just check for the running service to ensure it was accepting updates.
My question is, how does one utilize nagios to track the proper execution/running of wuauserv service in Windows Server 2008+ to ensure it is accepting updates?
Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling through all source ports (i.e. 59466, 59467, 59468, then 5 minutes later the next 3 ports) to 3 different ip addresses...:
193.0.6.135, 200.3.14.10, 196.216.2.130
Ripe, Lacnic, and Afrinic
I understand that all 3 companies are internet ip registrars, but how it's cycling through all of our source ports every 5 minutes sending packets seems odd. It looks like reverse port scanning to me. Is this normal?
EDIT:
TCPDUMP Output, this one was only 2 minutes apart. Noticed that there are patches where it'll run 20 times in a row within the same minute. The speed and frequency varies, but haven't seen a gap bigger than 5 minutes.
[user@xxxxxxx xxxxxxx]# tcpdump -v -s 5000 -i eth0 port 35921 or port 35920 or port 35919 or port 35916 or port 35917 or port 35918
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 5000 bytes
08:56:33.517976 IP (tos 0x0, ttl 64, id 8127, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35916 > whois.ripe.net.nicname: S [tcp sum ok] 2154741398:2154741398(0) win 5840 <mss 1460,sackOK,timestamp 67215657 0,nop,wscale 9>
08:56:33.520288 IP (tos 0x0, ttl 64, id 59697, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35917 > registro.lacnic.net.nicname: S [tcp sum ok] 2139834394:2139834394(0) win 5840 <mss 1460,sackOK,timestamp 67215659 0,nop,wscale 9>
08:56:33.522705 IP (tos 0x0, ttl 64, id 33392, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35918 > whois.afrinic.net.nicname: S [tcp sum ok] 2140808030:2140808030(0) win 5840 <mss 1460,sackOK,timestamp 67215662 0,nop,wscale 9>
08:58:32.773110 IP (tos 0x0, ttl 64, id 28764, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35919 > whois.ripe.net.nicname: S [tcp sum ok] 2259878735:2259878735(0) win 5840 <mss 1460,sackOK,timestamp 67334931 0,nop,wscale 9>
08:58:32.776580 IP (tos 0x0, ttl 64, id 44263, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35920 > registro.lacnic.net.nicname: S [tcp sum ok] 2259083248:2259083248(0) win 5840 <mss 1460,sackOK,timestamp 67334935 0,nop,wscale 9>
08:58:32.778395 IP (tos 0x0, ttl 64, id 39072, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35921 > whois.afrinic.net.nicname: S [tcp sum ok] 2267212728:2267212728(0) win 5840 <mss 1460,sackOK,timestamp 67334936 0,nop,wscale 9>
The following message showed up in my logwatch:
--------------------- SSHD Begin ------------------------
SFTP subsystem requests: 1 Time(s)
---------------------- SSHD End -------------------------
I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?
What method is the most script-friendly for moving files between servers?
The only methods I know of are SSH and rsync, but I don't want to jump into them if there is something else that is a standard.
EDIT:
The servers in question run on Red Hat Enterprise and Centos5
Possible Duplicate:
What Are Some Good Open Source Alternatives to Active Directory?
Is there an alternative (preferably FREE/Open Source) to Active Directory. Either managed via Windows or Linux environment.
This is a request for 2 different types of information:
By server storage, I mean choosing between getting SSDs (consumer or enterprise grade), consumer spindles, raptors, sans, etc.
I want to be able to run cgi scripts from other locations besides /var/www/cgi-bin, examples:
/var/www/folder1/cgi-bin
/var/www/folder2/cgi-bin
/var/www/folder3/cgi-bin
How do I go about configuring the server to do this?
EDIT: This is to run cgi scripts from a website on my personally hosted webserver.
We host our own web server, and we're trying to see exactly what our clients are seeing for an error on the website. Reason being, being connected to the network, the domain resolves correctly, however, all of our clients are receiving a 404 error.
Any way to view the website as a computer on the outside? Or maybe a trusted website resource that proxies a connection to do so?
EDIT:
First off, apologies for not giving the site name as it is a private site that's not even crawled.
Got back from my lunch break, went home and attempted a connection to it, and it gave the 404 error as well. I may go ahead and create a new post on the actual issue.
What's the difference between an MT ethernet connection and a PM ethernet connection? Intel server board has two ethernet ports that are named in that manner.
Using PSEXEC to call CMD for a DEL command on a remote computer through a batch script.
PSEXEC \\hostname -u username -p password CMD /C DEL /Q /F C:\Folder\File.txt
The script pauses with a new CMD window popped up connected to the remote machine.
Why will psexec not automatically pass my DEL command via CMD?
EDIT:
The command works fine when sent directly through the CLI and not in a batch script
I have a .bat file to perform maintenance on machines. I put the .bat file on a network attached server for all workstations to access it.
If I were to use the windows scheduler to make that .bat file run at 12:00:00.000 on say... 50 workstations, will they all be able to run it or will it error out?
P.S. don't ask me to try it =P
Is there a way to query the printer queue on the server from a client to retrieve the name of the file being printed?
Code example would be something like:
FOR /F "tokens=* USEBACKQ" %%F IN (`COMMAND TO QUERY PRINT JOBS ^| FIND "FILENAME"`) DO (
SET var=%%F
)
IF NOT DEFINED var (
ECHO Print Job Does Not Exist
) ELSE (
ECHO Print Job Completed
)