Brad Morris's questions

I'm currently consulting for a small engineering firm that has been using a single server for all their domain needs and their management has got sick of not being able to access networked shares from the server when the ageing hardware fails

I've procured two new HP ProLiant servers for file serving purposes running Server 2008 R2 Standard, and reconditioned their old hardware to 2 SAN boxes using FreeNAS.

Originally while trialling a solution, I was running a DFS namespace with both servers as nodes. The primary server is connected to the SAN via iSCSI and then the replication service copies the files onto the secondary server (to local drives).

Obviously it wouldn't be possible (or not recommended) to connect the second server to the same iSCSI volume as the primary server because of split brain etc. It seems pointless to use the SAN in the first place if the primary server replicates data onto the secondary servers local disks, and I can't share the iSCSI target to share the data between servers.

I figured using a NAS protocol to connect the two servers to the FreeNAS box at the file level, and configure DFS on the servers to only use the secondary server if the primary server is unavailable. Instead of the servers seeing the drives as local disks (as they would using iSCSI), I was planning to map them as networked drives. Doing this at the file level seems to alleviate the issues with sharing an iSCSI target between two servers.

I'm no stranger to SAN/NAS devices and FreeNAS in particular, but using it in a deployment like this is something new to me so I'm not entirely sure if this would work, or how it would perform etc.

Is this the correct way to go about this?

All the guides for this I can find on the internet are for Virtual Machines, and have some sort of failover manager, so I'm not too confident about following those ideas without having failover management.

Thanks!

Im migrating an apache2 server to Lighttpd, however im having some issues with Mod_Rewrite.

I have a directory /api/, which I need to exclude from the rewriting rules as follows:

url.rewrite-once = (
    ".*\?(.*)$" => "/index.php?$1",
    ".*\.(js|ico|gif|jpg|png|css)$" => "$0",
    "" => "/index.php"
)

I have tried to surround the block with

$HTTP["url"] !~ "^/api/" { }

However this has no effect and just excludes every URL from rewriting. Does anyone know of a way to

a) Exclude /api/ from the rewriting

b) exclude every actual directory present on the server from rewriting

I have seen Lua scripts for Drupal that can do the latter, however im not proficient in Lua and do not know how to configure this for a Zend Framework application.

Entire Configuration: http://pastebin.com/ggjiTFLk

Cheers

I'm wanting to link Samba to Active Directory so that I can apply permissions to a share respective to the OU that windows user belongs to.

Im not entirely sure of where to start, I've currently just got a "default" share:

[BaccData]
    comment = Bacc Admin Access
    path = /baccdata
    browsable = yes
    guest ok = yes
    read only = no
    create mask = 0755

Any starting points would be appreciated, Im shooting in the dark at the moment!

Thanks :)

I'm trying to design a digital signage system and I've hit a stumbling block. I've installed Xorg to run the graphical signage app. By default the server shows the X server on the main display (as intended), however I was wondering if it is possible to log in via SSH and then run a command (start-xibo.sh for arguments sake) and have this run the program on the X display?

I've set up a Postfix/Courier mail server that is not quite mission-critical, but still quite a critical system.

Does anyone know of any systems I can use to thoroughly test the system for any errors - I dont really know how to go about testing it from the perspective of another user.

I want to test whether the system will receive various different emails from various different users, not just the odd test account I use.

Im attempting to secure the mod_userdir module in apache..

Currently the directory structure for my users sites is

/home/{user}/domains/{domain}/public_html/site

The issue is, a number of my users store files that shouldnt be stored in the /domains/ directory (private files), but they do, and id rather work round it than make them move them.

Basically I have denied access to all directories in /{domain}/, except public_html, HOWEVER, files can still be viewed.

Here is my usermod.conf config.

<IfModule mod_userdir.c>
    UserDir /home/*/domains
    UserDir disabled root
    <Directory /home/*/domains/*/*>
            Order allow,deny
            Deny from all
    </Directory>

    <FilesMatch /home/*/domains/*/*>
            Order deny,allow
            Deny from all
    </FilesMatch>
    <Directory /home/*/domains/*/public_html>
            Order allow,deny
            Allow from all
    </Directory>

    <Directory /home/*/domains>
            AllowOverride FileInfo AuthConfig Limit Indexes
            Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
            <Limit GET POST OPTIONS>
                    Order allow,deny
                    Allow from all
            </Limit>
            <LimitExcept GET POST OPTIONS>
                    Order deny,allow
                    Deny from all
            </LimitExcept>
    </Directory>

You can see how I have tried to remove access to the files in /{domain}/ with , however this just isnt working.

Any help would be appreciated.

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4).

The DNS system seems to be hit-and-miss when the firewall is enabled, however when I assign the server as the default DMZ server it works fine.

I do know Bind was never designed to run behind a firewall, however I am a bit weary of running the server open to the wide world all the time (I'm not a security guru, so I'm treading cautiously!)

If anyone could shed light on the situation I'd appreciate it. The server is located at 109.224.135.26 (currently behind a firewall) if anyone wants a play around

Thanks!