I need to set up a VPN for our small office. There will only be one person using it, and they will be transmitting private financial information in many cases.
I know that PPTP has a number of security vulnerabilities, but are any of them critical to the point where I should set up an OpenVPN server instead, assuming both ends of the connection are trusted and a strong password is being used?
I know it clears out /tmp on reboots, but I haven't been able to find any sort of cron job on my server that clears /tmp. I recently set up a script that writes lots of files to /tmp and my server usually goes several months between reboots so I'm concerned about it being cluttered.
I've seen several other distros that have a tmpwatch script installed by default. Ubuntu's repository seems to have replaced tmpwatch with tmpreaper.
Is there any mechanism in place on Ubuntu (8.04 currently, soon to be upgraded to 10.04 when I get around to it) to clean up temp files on a server that doesn't regularly reboot or do I need to install tmpreaper?
This question is split between the realm of SO and SF. It's for a coding project but I believe the error I'm encountering has more to do with system administration than code, so I'll put it here.
I'm trying to make a PHP login page that authenticates users on their pre-existing system user accounts. I installed the php5 pam authentication module and followed the documentation to configure it.
I created /etc/pam.d/php with the following contents:
# /etc/pam.d/php
#
# note: both an auth and account entry are required
auth sufficient /lib/security/pam_pwdb.so shadow nodelay
account sufficient /lib/security/pam_pwdb.so
I added "pam.servicename = "php";" to my /etc/php5/apache2/php.ini file and then restarted my apache service.
Every time my script uses the pam_auth function, the following appears in my auth.log:
Jan 6 08:56:33 cobalt apache2: PAM unable to dlopen(/lib/security/pam_pwdb.so)
Jan 6 08:56:33 cobalt apache2: PAM [error: /lib/security/pam_pwdb.so: cannot open shared object file: No such file or directory]
Jan 6 08:56:33 cobalt apache2: PAM adding faulty module: /lib/security/pam_pwdb.so
How can I fix this? For something as simple (or so I thought), should I just write my own functions to parse /etc/shadow and /etc/passwd? I'm not trying to log the user into the system itself, I just need to let the user log into my script with their system user/password and check that they belong to an appropriate group to run a given report.
I know they say "given root access, everyone will screw up their machine eventually", and I'm discovering how true that is. In an incident of extreme fatfingering, I've managed to wipe out my /etc/passwd file. Now, I have a current backup of it, but I want to make absolutely sure how I should restore it before doing so. Can I just create a file as root, paste the old contents in, and cp the new file over the now corrupt /etc/passwd?
OS is Ubuntu Hardy
EDIT
Erm the problem just took a turn for the much worse. I now cannot use sudo. Can someone PLEASE help me here? I assume I have to mount from a liveCD to edit my /etc/passwd back into place? Now my problem here is that I use a RAID setup. Will an ubuntu live CD autodetect this?
Our office is fairly small. We previously had a 2wire gateway that came when we ordered our DSL connection. I recently decided to upgrade to a router that could support DD-WRT since the 2wire was very lacking in features. I purchased a new router and a new modem (which is actually a DSL modem with 1 port router). I got DD-WRT flashed onto the router successfully, and configured the gateway to work with our ISP (and I confirmed that it is working by connecting it to a single computer and checking out the internet). Additionally, I disabled the modem's DHCP server since I intend for DD-WRT to cover that.
Now, my goal here is to have the DD-WRT router between the gateway and the switch (all servers and workstations are connected to the switch, the gateway is connected to the router's WAN port) where it can act as firewall in addition to everything else. The modem came with a default IP of 192.168.0.1, which is outside my network, so I changed it to 192.168.1.254 (the DD-WRT router is 192.168.1.253). On the initial setup page of DD-WRT, I plugged in a gateway IP of 192.168.1.254.
After doing this and restarting all required equipment, no machines have internet access. They can ping both the router and the gateway successfully. I tried everything I could think of. I noticed that the router is handing out it's own IP of 192.168.1.253 as the gateway address. If I set up a workstation to use a static IP and set the gateway IP to 192.168.1.254, the machine gets internet access, but I don't think that is what I want since I believe that bypasses the router's firewall and such.
What am I doing wrong? I'm not the most knowledgeable networking guy around, I have a feeling I'm missing something really obvious here.
My company is trying to sign up for LexisNexis services. LexisNexis (or more specifically, a service offered by LexisNexis) restricts logins to either a handful of IPs, or a range of IPs. We just have a fairly basic business DSL connection that gives us a dynamic IP.
Obviously, every time our IP changes, we lose LexisNexis service. I've called AT&T's tech support several times hoping to find out what range of IPs we could possibly be assigned. Most people I got on the phone were absolutely clueless (after explaining my problem to the first person she said "oh, you mean like wireless internet?"). The one or two people I talked to that were actually knowledgeable pretty much told me that they couldn't or wouldn't give me that information.
LexisNexis refuses to relax their security requirements, and told me that I either have to find the applicable range or buy a static IP. Unfortunately, the cheapest static IP package from AT&T is something around $75/month, and we absolutely cannot afford that.
What should I do here? Was I fed misinformation from AT&T? Is it actually possible for them to give me a range or should I be looking elsewhere for solutions? This service is vital to our doing business.
Specifically, I'm trying to keep a nice clean cron.log under Ubuntu Server (hardy LTS). In addition to the 4 or 5 cron jobs that come pre-installed, I've added 4 of my own jobs (using the cron.d method). Now, one of the automatically installed jobs is the PHP session expiration script that runs every hour.
It needs to be executed, sure, but frankly I don't care about when it executes. It runs every hour and outputs an entry similar to the one below.
Oct 18 02:17:01 cobalt /USR/SBIN/CRON[18160]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Oct 18 02:39:01 cobalt /USR/SBIN/CRON[18233]: (root) CMD ( [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -r -0 rm)
Since this executes every single hour and produces a comparatively lengthy log entry, it accounts for 90% of my cron.log. If I'm thumbing through the log file to make sure my daily backup scripts and such got executed, they get swallowed by all these entries.
Is there any way for me to exclude this process from being logged?
I realize that I can use grep or a log reader program to search through, but that isn't really what I'm looking for. I'd like to just be able to "cat cron.log | less" and thumb through without log spam from processes I don't care about (and I also realize that this process would be important on most web servers, but this isn't primarily a webserver and doesn't even allow connection from outside the company).
In other words, should I leave a spare disk on the shelf or set it up as a hot spare?
If the server has a little bit of downtime, it isn't the end of the world. It's not a webserver or anything that needs to serve stuff up 24/7. Are there any downsides (drive life/wear, etc) to keeping the extra hard drive set up as a hot spare or is it better to leave it packaged on a shelf somewhere if I don't require the immediate recovery time of a hotspare?
I'm using a hardware HP RAID controller. My server came with one 250GB drive. I purchased three additional 250GB drives with the intent of having one as a cold-spare.
I put the two additional drives in the server and powered it up. I went into the BIOS, enabled the RAID controller, then rebooted. It brought me to the HP raid controller setup. I went in and deleted the three pre-existing arrays (which were just three drives operating independently of each other). I then selected the array configuration option, selected all three drives together, and told it to initialize. It did its thing, then I went into "create array" and again selected all three drives. It presents me with a dialog asking what kind of RAID that I want to set up, but the problem is that it doesn't present RAID 5 as an option. All I can choose is 0, 1, and 10.
I know RAID 5 is possible with 3 drives, so what gives? I've never set up a RAID array before so if there is something obvious I'm missing here don't hesitate to tell me...
I know they say that given root access, someone will eventually type before they think and fubar their machine, and I just did.
I did a recursive chmod changing everything to 775 thinking I was in a sub directory, but alas, I was in /. Is there any magical way to undo this, or at the very least, get a list of default directory permissions and manually restore them?
When I ordered the internet connection for work, they threw on a "bonus" router. It's a a 2wire gateway "every service we can cram in a box" type of thing. This is not what I preferred to work with, but seeing as how my company has a limited budget, I get to use what costs the least.
Now, the thing works fine for what I want it to (a pppoe device/router/gateway), but it throws in some extra features that I don't like. Most specifically, it includes a DHCP server and does not allow for any configuration of said server. I want to run the DHCP service on one of my actual servers so I can have granular control over everything (specifically I want to do static assignments based on MAC addresses, this thing doesn't even let me so much as choose what ranges to use).
If I set up my dhcpd server alongside the gateway's built-in DHCP service, it is my understanding that they will conflict with each other and dish out IPs in an almost random fashion, which obviously isn't good. What are my options here? There is no way to disable the gateway's DHCP function (well, there is, but it also disables PPPoE which turns the thing into glorified paperweight).
So far, two ideas have come to my head:
Does anyone have any more elegant solutions?
I searched and found a couple similar questions, but they all seemed to be dealing with intentionally having multiple DHCP servers and don't really have any good solutions for my problem.
I'm trying to set up the backup service for a server at work. Specifically, we are using the online backup service SpiderOak. It seems like a fantastic program except for one fact: it uses a graphical interface to do all account setup and management. This isn't a problem in the long run since it runs in the background to do all backups, but right now I'm struggling to get it configured.
My server, of course, doesn't have X or any GUI installed. It seems like a no-brainer to use SSH (with the -X flag for X forwarding) from a GUI-enabled Linux workstation to set it up (in fact this is recommended in the official documentation for the program). The problem here is, it doesn't work.
This is my output:
dan@cobalt:~$ SpiderOak Fontconfig error: Cannot load default config file SpiderOak: cannot connect to X server
So, how do I forward X output from my GUIless server to my workstation?
I just had to run a total of 12 cat5 cables into a patch panel. This was the first time I'd actually done that. I'm reasonably confident that I got all the wires in the right order after some initial A/B confusion, but I'm not entirely confident that all the physical connections are fine. I don't have a reason to suspect that since all the connections I've tested so far have worked perfectly.
What I don't know here is the degree to which connections could fail. If I mess it up just a little bit will nothing work at all or will there be intermittent problems that are near impossible to trace? My company has a very limited budget so we don't have any proper network testing equipment and I'm using a bargain bin $5 manual punch down tool, not one of the fancy expensive ones that tries to eliminate human error.
My testing process so far has been to plug each patched port into the switch then take my personal laptop around to the wall jack I just patched. I plug my laptop into the wall jack and see if it can get an IP from the DHCP server and access the router's DD-WRT management interface. If it can properly send the management interface to me (which is a rather detailed webpage), I've been crossing that off as a working jack.
Is this a decent enough testing process, or is there another (and more accurate) way to test each jack (without network tools, remember).
At work, we inherited an old (and I mean old) HP ProCurve 4000m 48+ port switch (although only a quarter of those will be used). This thing is a MONSTER. I'm pretty inexperienced in professional tier networking, and am attempting to get it configured.
It has been reset to factory defaults, which means that it does not grab an IP or network mask for me to log into its management interface. According to the manual, I need to log into it via terminal to give it an IP. The manual is vague on exactly HOW to do this, though. The terminal port on the switch appears to be a standard serial port, but a serial-to-RJ45 adapter came with the switch (The label on the adapter reads something like "UTP Grounding Tap" if that's important to anyone).
Now, assuming I plug a patch cable into that adapter and into my laptop, how do I proceed to get terminal access to the switch using my terminal emulation program (which happens to be xfce-terminal but I can use pretty much any linux terminal on it if it matters)?
I'm turning a workstation into a internal mediawiki webserver for my small business (limited budget and too many workstations). The workstation has both a CD and floppy drive, neither of which are needed at all. Is there any measurable power saved in removing the drives as opposed to just letting them sit there idle all the time?
I'm going to get my new small business database server in a couple days. It comes with one hard drive, but I plan on setting it up initially with a 3 disk RAID 5 system. Unfortunately, the extra drives won't be in for a few days after I get the server.
I'm using a hardware RAID controller. I want to get a head start on configuration. How "smart" is RAID in this sense? If I install and configure the OS on the single drive and then add the other two drives later to have it rebuild my data across the 3 disks?
If this is possible, is there any special procedure I need to follow?
I ask because the software my company is about to start using requires a single (windows) workstation to run a small automation program each night to increment several fields in the database. I'm sure I'm not the only one who thinks this is terrible design, but there's not much I can do about it for the moment (at least until I have time to figure out what exactly it's doing and replace it with a cron-able perl script).
In the past, my only dealings with the Windows task scheduler wizard were for miscellaneous home tasks several years ago. I recall some tasks not getting executed at all, or some others only running intermittently.
Assuming the task is configured correctly, can I trust the Windows XP task scheduler to ALWAYS run this job or is it unreliable?
I'm going to be purchasing, setting up, and maintaining a small office network in about a month. I have most of the software side figured out, but I'm still a bit fuzzy on the hardware details.
First off, a bit of information about the network:
My biggest unknown factor here is the internet connection. Most of my networking knowledge comes from classes/books, and I have limited experience in this kind of thing so I'm a little lost here.
The most cost effective connection in our price range is a 6mbit business DSL connection. During business hours, Skype and basic internet research/browsing will account for the vast majority of internet traffic (our website is hosted offsite). After hours, the connection will be consumed by scheduled backups and such. I assume 6mbit is enough to cover this with 5 users. If I'm incorrect in this assumption than I would appreciate someone pointing that out.
What I'm confused about now is how the internet will be set up physically. I believe I want to use a Squid proxy server to provide fine-tuned control over user's access and caching services (I anticipate most users will be using the same 5 websites primarily, so caching could cut down on bandwidth usage).
How will this all be set up though? Obviously the DSL will come in via a phone line. I assume from there it goes into a DSL modem. From there, would it go directly to the squid server or would it go into the main switch/router, then circling back through the squid server then out to workstations?
I'm going to be setting up a network for a small office soon. The network will consist of about 5 workstations (soon to be more) and 2-3 servers (one "real" server and a couple workstations-turned-servers to take some load off the main machine).
I've been asking around to see what server Linux distros people prefer, and it seems like everyone is biased towards using traditional RedHat-like server distros. Every time I mention running an Ubuntu server, everyone says I should run Red Hat instead, but I have yet to hear any reasons not to run Ubuntu servers.
I'm more familiar with using Ubuntu/Debian servers, are there any significant reasons why I should run another server distro that outweigh being familiar with an OS?
I'm setting up a network for a new small business and we need a MySQL server. The business has a very limited budget. As I understand it, small businesses are still allowed to use the free edition of MySQL.
Other than official support (which I really don't foresee needing), what advantages are there? Is there anything worth justifying $600/year to a company that can barely afford that?