Nathan Neulinger's questions

I have (had, it's already been swapped out, asking this for future use) a drive that is indicating pending failure with internal SMART tests and bad block remaps.

It is straightforward to mdadm --fail the soon to be bad drive and rebuild to a hot spare, or to pull the drive and put a new one in, then rebuild to that drive.

The problem is this takes the array to degraded state for the entire period of that resync, incurring both the additional failure risk and the performance overhead of running degraded. That's expected if you actually have a drive failure, but it is an unnecessary exposure if the drive hasn't actually failed yet.

How can I pre-emptively replace/rebuild that single drive to a hot spare without taking it out of service first?

I'd like to be able to have a path on an apache server (2.4.18+ on ub16) that primarily authenticates using SAML (using the mod_auth_mellon plugin) for interactive use, but also supports having the caller pre-emptively send Basic auth credentials. (Think REST api endpoint that normally triggers an interactive form login, but will allow bypass if you pre-send basic auth credentials.)

Essentially I'm looking for this behavior:

• If creds are sent with request:
  • Try them, and if they work, allow the request
• If above creds fail, or none were provided
  • Trigger the preferred authentication plugin.

Is such a thing possible? I'd prefer to NOT push this back into the application itself.

What I do NOT want to happen is for the apache server to send back the response triggering the basic auth dialog.

I have a read-only Samba share set up with Samba 4.3.11 on Ubuntu 16.04. This works without issue for publishing some files/tools that need to be available to all hosts.

However, out of the box, this allows for all smb protocol versions. The normal way to address this to make the security guys happy would be to just set min protocol=SMB2 however, that results in:

$ smbclient -N //host.fqdn.com/sharename
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE

Does anyone have any suggestions on how to get this to work?

I've tried the suggestion here (https://www.linuxquestions.org/questions/linux-networking-3/samba-min-protocol-%3D-smb2-causes-protocol-negotiation-failed-nt_status_invalid_network_response-4175597669/) to set 'protocol = SMB3' explicitly, but that doesn't appear to have any effect on the minimum protocol version.

I've got a pair of servers on opposite ends of a fast (1-10Gb depending on the server) but higher latency (40-60ms) link.

Various network tuning options have been set resulting in iperf3 yielding appropriately high transfer rates across the link. However, it doesn't appear that DPM sees the same performance increase from the tuning.

There are information sites for doing tcp tuning with 2010 specifically related to DPM on 2010:

https://technet.microsoft.com/en-us/library/ff634226.aspx

However, those options are no longer supported with 2012 as far as I know. Is anyone aware of any DPM specific tuning for tcp window sizes or other tuning options for performance on higher latency WAN links?

Scenario:

• eth0
  • trunk interface with vlans 10 11 12 13 14 15
  • native vlan on switch configured to 10
• eth0.11
  • vlan interface, sees any traffic that came in on eth0 tagged with vlan 11
• ...
• eth0.15
  • vlan interface, sees any traffic that came in on eth0 tagged with vlan 15

Here's the problem - I want to be able to do a network capture of all traffic on 'eth0' but see ONLY vlan 10 traffic (anything that wasn't tagged).

Right now, a capture on eth0 will give me untagged frames from vlan 10, and tagged frames from vlans 11 through 15.

The workaround has simply been to reconfigure switch to have an unused native vlan on that port, and tag vlan 10, but this makes that ports configuration special/different from all the others. (Think a normal data+voice network port where you have regular traffic on native vlan and tagged frames for voice.) In that case, I'd want to be able to capture data frames, but no voice.

Another related need is when bridging - if I wanted to bridge JUST vlan0 to another port on the linux box - without also bridging all of the tagged frames - the same need would likely come into play.

Is there any way to configure a vlan interface that explicitly sees only the untagged traffic, and not the tagged frames within it?

I have a number of local domains in my resolv.conf search order. I would very much like to forward SSH agent by default when I connect to an unqualified (without DNS suffix) hostname. The best I've been able to come up with is something like the following in ~/.ssh/config:

Host *.edu
    ForwardAgent no
Host *.com
    ForwardAgent no
Host *.net
    ForwardAgent no
Host *.org
    ForwardAgent no
Host *
    ForwardAgent yes

Along with listing known suffixes for edu/com/net/org that I do still want to forward to, such as .srv.example.com.

For a site that has a host naming prefix convention (such as fc-* for fedora systems), a simple wildcard entry matches them, but that doesn't work for generic or non-prefixed names.

Is there any better way to do this than the above ugly hack?

I've got a preseeded install from cdrom working smoothly, except for ONE prompt. It does the scan of the cdrom before installing software, and asks me if I want to insert an additional CD to scan.

Is there any way to force this question to be answered no with preseed?

This is with a 7.5.0-wheezy installed solely from CD1.

Updated 6/11/2014: Wound up just switching to the netinstall instead of from CD, so don't actually know if the below answer worked, but I've accepted it since it looks like the right approach.

Synology has a customized version the md driver and mdadm toolsets that adds a 'DriveError' flag to the rdev->flags structure in the kernel.

Net effect - if you are unfortunate enough to get a array failure (first drive), combined with an error on a second drive - the array gets into the state of not letting you repair/reconstruct the array even though reads from the drive are working fine.

At this point, I'm not really worried about this question from the point of view of THIS array, since I've already pulled content off and am intending to reconstruct, but more from wanting to have a resolution path for this in the future, since it's the second time I've been bit by it, and I know I've seen others asking similar questions in forums.

Synology support has been less than helpful (and mostly non-responsive), and won't share any information AT ALL on dealing with the raidsets on the box.

Contents of /proc/mdstat:

ds1512-ent> cat /proc/mdstat 
Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4] 
md2 : active raid5 sdb5[1] sda5[5](S) sde5[4](E) sdd5[3] sdc5[2]
      11702126592 blocks super 1.2 level 5, 64k chunk, algorithm 2 [5/4] [_UUUE]

md1 : active raid1 sdb2[1] sdd2[3] sdc2[2] sde2[4] sda2[0]
      2097088 blocks [5/5] [UUUUU]

md0 : active raid1 sdb1[1] sdd1[3] sdc1[2] sde1[4] sda1[0]
      2490176 blocks [5/5] [UUUUU]

unused devices: <none>

Status from an mdadm --detail /dev/md2:

/dev/md2:
        Version : 1.2
  Creation Time : Tue Aug  7 18:51:30 2012
     Raid Level : raid5
     Array Size : 11702126592 (11160.02 GiB 11982.98 GB)
  Used Dev Size : 2925531648 (2790.00 GiB 2995.74 GB)
   Raid Devices : 5
  Total Devices : 5
    Persistence : Superblock is persistent

    Update Time : Fri Jan 17 20:48:12 2014
          State : clean, degraded
 Active Devices : 4
Working Devices : 5
 Failed Devices : 0
  Spare Devices : 1

         Layout : left-symmetric
     Chunk Size : 64K

           Name : MyStorage:2
           UUID : cbfdc4d8:3b78a6dd:49991e1a:2c2dc81f
         Events : 427234

    Number   Major   Minor   RaidDevice State
       0       0        0        0      removed
       1       8       21        1      active sync   /dev/sdb5
       2       8       37        2      active sync   /dev/sdc5
       3       8       53        3      active sync   /dev/sdd5
       4       8       69        4      active sync   /dev/sde5

       5       8        5        -      spare   /dev/sda5

As you can see - /dev/sda5 has been re-added to the array. (It was the drive that outright failed) - but even though md sees the drive as a spare, it won't rebuild to it. /dev/sde5 in this case is the problem drive with the (E) DiskError state.

I have tried stopping the md device, running force reassembles, removing/readding sda5 from the device/etc. No change in behavior.

I was able to completely recreate the array with the following command:

mdadm --stop /dev/md2
mdadm --verbose \
   --create /dev/md2 --chunk=64 --level=5 \
   --raid-devices=5 missing /dev/sdb5 /dev/sdc5 /dev/sdd5 /dev/sde5

which brought the array back to this state:

md2 : active raid5 sde5[4] sdd5[3] sdc5[2] sdb5[1]
      11702126592 blocks super 1.2 level 5, 64k chunk, algorithm 2 [5/4] [_UUUU]

I then re-added /dev/sda5:

mdadm --manage /dev/md2 --add /dev/sda5

after which it started a rebuild:

md2 : active raid5 sda5[5] sde5[4] sdd5[3] sdc5[2] sdb5[1]
      11702126592 blocks super 1.2 level 5, 64k chunk, algorithm 2 [5/4] [_UUUU]
      [>....................]  recovery =  0.1% (4569508/2925531648) finish=908.3min speed=53595K/sec

Note the position of the "missing" drive matching the exact position of the missing slot.

Once this finishes, I think I'll probably pull the questionable drive and have it rebuild again.

I am looking for any suggestions as to whether there is any "less scary" way to do this repair - or if anyone has gone through this experience with a Synology array and knows how to force it to rebuild other than taking the md device offline and recreating the array from scratch.

Is it possible to run a dual power supply server with one PS plugged into 110V, and the other power supply plugged into 208V? We've asked the vendors and they say they've never tested it or some other "i dunno" type of answer. The power supplies both work at 110 and 208 without any issue, it's the 'mixed' operation that is in question.