thelsdj's questions

I'm having issues with permissions on Windows Server 2008 R2.

I'm used to (from Windows Server 2003) being able to open up a CMD prompt and type something like: `copy \some\file /y' and overwrite a file in the current directory.

The permissions on the directory/file allow modifying by 'Administrators', but I get Access is denied. unless I specifically run the cmd.exe 'as Administrator' which is unacceptable for how I need to manage my server. I need to be able to on-the-fly perform tasks without having to go and open a new cmd prompt, switch to the directory, retype the command, etc.

So how can I make it so my user who is a member of Administrators can by-default, run commands as an Administrator?

I've got some servers with iDRAC7 Enterprise and I want to add my existing wildcard SSL certificate for my domain so that when I load the iDRAC webpage I get a valid certificate.

I've tried the "Upload Server Certificate" option but I can't seem to find the required format. If this was possible I would assume the format would be PEM or PKCS12, something that included the key as well as the certificate. And allowed intermediate certificates as well, but I can't seem to figure it out.

The other option that comes to mind is that IDRAC7 just doesn't support using an existing certificate, and you have to generate a new one, using its built in key, but that seems like a useless feature.

Edit: When I try to upload a PEM file that contains: key/cert/intermediate certs I get the following error: "RAC0508: An unexpected error occured. Wait for a few minutes and refresh the page. If the problem persists, contact service provider."

So, is it possible to upload an existing certificate to a server with iDRAC7, and if so how?

The SMART attributes on the drive are:

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   200   200   051    Pre-fail  Always       -       391
  3 Spin_Up_Time            0x0003   181   165   021    Pre-fail  Always       -       5916
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       259
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000e   200   200   051    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   068   068   000    Old_age   Always       -       23804
 10 Spin_Retry_Count        0x0012   100   100   051    Old_age   Always       -       0
 11 Calibration_Retry_Count 0x0012   100   100   051    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       259
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       99
193 Load_Cycle_Count        0x0032   200   200   000    Old_age   Always       -       309
194 Temperature_Celsius     0x0022   123   097   000    Old_age   Always       -       27
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0012   200   200   000    Old_age   Always       -       2
198 Offline_Uncorrectable   0x0010   200   200   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0008   200   200   051    Old_age   Offline      -       1

But running a long test reports:

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Extended offline    Completed without error       00%     23734         -

So what am I supposed to do now to clear the Current Pending Sector count? The error log doesn't provide any LBA's either.

Edit: The Current Pending Sector count was previously at 0 and I had previously had this drive have a few sectors that were bad and I was able to locate and write them to clear the pending sector count. So the real question is, what is the explanation for why the pending sector count would go up without telling me what the location is?

I'm using the IIS 6 smart host setting to forward all email sent through IIS to SendGrid.

It works fine if I set the Outbound Security and smart host settings at the top level of the Default SMTP Virtual Server properties.

But the downside with that is if I want to switch it off or change the smart host, I have to also edit the Outbound Security at the same time.

I thought I could get around this by creating a domain smtp.sendgrid.net and setting the Outbound Security on that while leaving the smart host setting at the top level.

My understanding was when it tried to forward through the smart host it would pick up the Outbound Security settings from the specific domains properties.

So my question is, does this just not work or am I forgetting some extra step to get this working?

I saw some reference to having to restart the SMTP service before it would pick up settings on the domain, but I tried that to no avail.

I have an OpenBSD firewall where I have to change the IP on the admin interface (including changing subnet/gateway) and I'm looking for how to do this remotely without losing my SSH (so I can fix things if there are problems).

Here is how I imaging being able to do it:

1. Add the new IP as an alias to my network interface. (Question: How do I properly add an IP on a different subnet than the orignal IP? http://www.openbsd.org/faq/faq6.html#Setup.aliases is unclear on whether there is anything special to do for a different subnet besides specify the netmask)

2. Add the new gateway with route. (Question: Should I add it as a 'default' gateway or just for the new subnet?)

3. SSH to the new IP.

4. Write a script to if down both the old and new IPs and up the new IP as the main interface IP, At this point I most definitely need to add the new gateway as a default gw right? Run it from within screen so it keeps going if network temporarily drops. (Question: Should this do the job? Are there any special gotchas I should keep my eye out for? Any tips on what commands to run to do this properly?)

I'm in the process of changing the IP address of my nameserver and I want a way to tell how many queries I am still receiving on the old IP address to track how well the change is being picked up.

Is this something I can do in BIND9 logging or would I have to go outside it to something like tcpdump to track this? I want to still process queries on multiple IPs but I want some sign of the relative quantity of queries between the 2 IPs.

I have an ASP.net 3.5 application running on Windows Server 2003 and IIS 6.0 that when my code reads a 16MB file I sometimes get an OutOfMemory exception. Usually if you try to perform the same read again I continue to get the exception.

If I restart w3svc then the exception goes away. Also it tends to go away if I leave it alone for a few hours and try running the code later.

The exception comes from a call to ReadToEnd on the file stream, so it's not something in my code leaking memory.

The w3wp.exe process on my website is usually using about 250-350MB of memory under normal load.

I would guess that something about per-connection memory usage or something is causing this problem, though I don't know enough about the IIS / ASP.net memory management to know where to look for a way to track this down or tweak it to not cause the problem.

I almost always have 2+GB free RAM on this server, and am never below 1.5GB free.

I've run this same application / code for years on these servers and this exception only started recently. My guess is that it started when the file slowly grew above 16M, but that could just be a coincidence. The file most definitely slowly grows so a few months ago when I was never having this problem, it was most definitely a bit smaller than it is now.

The offending code is probably run 5-6 times a day (reading in a cache) and seems to error once or twice a week so it does not always error, but its frequent enough that it is becoming a problem.

Is there some sort of limit to the IIS connection or the ASP.net website that I'm hitting and if so is there a way to increase the limit when I know I have loads of free RAM?

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker).

I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the servers behind my firewall. They all have public IP addresses (I'm not using any sort of NAT). So I want to be able to give them IPv6 addresses on the routed IPv6 prefix given by the Tunnel and have traffic properly routed through the tunnel (gif0 interface) on OpenBSD.

Some other details. This is basically a transparent firewall, though the external interface does have an IP address for administration. Would I need to add an IPv6 address to the internal interface as well to provide routing or could I just transparently route everything through the tunnel interface? What would PF rules look like for IPv6 traffic and how would they differ from normal IPv4 PF rules?

I've found this page, but it is so old (for OpenBSD 2.9, almost 10 years old). I'm looking for updated instructions that would fit my situation.

Edit: Along with the below accepted answer I needed to add the following PF rule to get incoming traffic to work:

tunnelserveripv4address="xx.xx.xx.xx" # This is the IPv4 HE.net tunnel endpoint
ext_if="em0"
pass in proto 41 from $tunnelserveripv4address to $ext_if keep state
pass out proto 41 from $ext_if to $tunnelserveripv4address keep state

I'm trying to access a SuperMicro IPMI card that is behind an OpenBSD bridged firewall.

A couple pieces of information:

• The OpenBSD firewall itself has a SuperMicro IPMI that I can access across the internet.
• The IPMI I'm trying to reach can be reached from behind the firewall.

• My gateway does arp request the IPMI and it does appear to respond (this is from the external interface of the firewall)

  16:57:45.548892 arp who-has ipminame tell gwname

  16:57:45.549500 arp reply ipminame is-at ipmimac

But when I make a request to the IPMI IP from outside the firewall the external interface of the firewall shows no traffic with the IPMI ip as its destination.

Any idea what might be causing this problem? Is there something about IPMI traffic that my gateway wouldn't like (the gateway is provided by my colocation provider so I can't easily debug it).

When I do an initial login to Windows Server 2003 after a reboot it hangs on blank desktop (no icons or taskbar) for 15-20 seconds. This doesn't happen if I close the RDP window and login to the same session. But if I login to a second session it hangs again.

Any idea why the initial login hangs for so long before displaying anything but desktop background?

After running for a month or so the svchost.exe that contains the DHCP as well as DNSCache services is showing a Mem Usage of above 400M in task manager. My network interfaces are all static IPs and not running a DHCP server so I'm guessing the usage is from the DNSCache.

Is there any reason that the memory usage for this process should be so high? I still have over a gig of free memory but I don't want to be worrying that if I need a lot of RAM at short notice (which does happen on these servers), that I'll run out. Maybe svchost is smart enough to give memory back under pressure but should I count on that?

From ipconfig /displaydns the cache itself only has around 64 entries so it can't possibly need all that RAM can it?

Edit: I wanted to add a note that while the below answer is useful, it did not fix my problem. My problem is specific to either the DNSCache (dns client) or DHCP (dhcp client) services. The below hotfix is for DNS Server memory leak.

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?

We currently use AR Soft RAM Disk on some Windows 2003 servers for storing short lived temporary files.

Looking forward to a move to 64-bit Windows Server 2008 I'm wondering what options there are for a RAM disk since it appears AR Soft RAM Disk was discontinued in 2005.

I'm not looking for any physical disk backing, just a pure RAM disk that appears like a normal drive to Windows.

Does anyone have any experience with RAM disks on Windows Server 2008, especially for 64-bit?

In the past month or so I noticed that lsass.exe has started to leak memory, getting to 500MB+ of ram in under a week after reboot. Before this I had never noticed it using any significant amount of memory compared to other processes on the system.

This is happening on 2 identical servers, neither of which has anything to do with Active Directory.

Maybe a recent Windows Update has caused this? Any thoughts on things to check?

As a side question is there some way to recycle the memory usage of lsass.exe without rebooting?

Edit:

Here is what I'm seeing in Process Monitor, there are thousands of registry open/query/close a minute from lsass.exe. How can I track down what is triggering these?

Does anyone have experience running Xen dom0 on a more recent kernel than the stock 2.6.18?

What host distro are you running? What release of Xen (or hg/git changeset)? What set of patches are you using on kernel source? (Has anyone got the pvops dom0 stuff working in production or is it better to stick with something like the SUSE patches?

Any other tips and tricks to running a more recent kernel version as dom0 would be helpful.