I am fairly sure this is not possible but just wanted to find out if anyone has managed to get this to work.
I wanted to find out if you can have One Drive running on a server, updating without the user profile that it was installed under needing to login.
The reason for this is I would like to automatically sync certain file shares directly to Sharepoint or One Drive.
I am trying to set up a new check in Nagios 3.5.0, making sure that my mail server is contactable on port 25 over the internet.
I am using the check_smtp command. When I run this command from the command line I get this:
[root@cwp-nagios-03 libexec]# ./check_smtp -H mail.****.com
SMTP OK - 0.068 sec. response time|time=0.068033s;;;0.000000
This looks like everything working correctly, so I added a new service definition:
define service{
use generic-service
host_name CL_WEB_CHECKS_DR
service_description Mail Server
check_command check_smtp!mail.***.com
}
When this command is run by Nagios, I get the following result instead:
Status Information: Connection refused
SMTP CRITICAL - 0.001 sec. response time
Performance Data: time=0.001362s;;;0.000000
I am a bit lost as to why this is happening, so any help would be great!
Also, I am sure you will want to see it, so here is the command definition for check_smtp:
# 'check_smtp' command definition
define command{
command_name check_smtp
command_line $USER1$/check_smtp -H $HOSTADDRESS$
}
I am struggling to get two different subnets routing along a IPSec tunnel.
The tunnel is between a Vyatta (6.5) and a Juniper firewall.
The tunnel was initially created to route between a subnet in our office behind the Vyatta (10.150.0.0/24) to a subnet in our offsite DR (10.250.0.0/24). However, I now also want to route another subnet in our office to the offsite DR (192.168.47.0/24).
I have added another tunnel on the Vyatta to allow this:
tunnel 1 {
allow-nat-networks disable
allow-public-networks disable
esp-group ***
local {
prefix 10.150.0.0/24
}
remote {
prefix 10.250.0.0/24
}
}
tunnel 2 {
allow-nat-networks disable
allow-public-networks disable
esp-group ***
local {
prefix 192.168.47.0/24
}
remote {
prefix 10.250.0.0/24
}
}
Also I have modified the security and routing on the Juniper to allow this traffic.
The strange thing is, this seems to work but for only one tunnel at a time. Both tunnels show as up and connected however I can only ever receive responses from the 10.250.0.0 subnet from either the 10.150.0.0 or the 192.168.47.0, not both at the same time.
Not quite sure where I am going wrong here!
This may be a duplicate but I think the situation is different.
We were having problems with a HP MSA2000 SAN, speaking to support they suggested that we upgraded the firmware to the latest version and clear out one of the VDISKS which had a problem.
Patched the firmware and then 3 days later removed the VDISK, however there was a bug in the firmware which meant the meta data for the disks was being written across multiple VDISKS, this meant when I removed the failing VDISK, it deleted 2 healthy ones.
I thought this would not be a problem, but it looks like 2 of my VM's hosted on the healthy VDISKS did not have backups of one specific file and the VM level backups had become corrupted.
My question is, is it possible to rebuild the array that these disks where on, as the data should all still be there.
There where 8 disks setup in RAID 10. I have been looking at data recovery companies and this seems to be an option but I feel as the data should still be held on the disks as they have not been over written. Is there a way I can get this data back ASAP? Again, one issue I am facing is that other than a SAN unit, I do not have space to put 8 disks and a boot disk into a server so any suggestions would be great.
And yes, I know the backup policy needs to include testing the backups have worked correctly.
I am trying to setup WebADM to use two factor authentication with a VPN tunnel. I managed to get this all working last week however there is a slight issue. WebADM will detect registered users by checking in the objectClass attribute of Active Directory for a value of webadmAccount. I managed to get this working by making it search for the value "user" instead, which obviously registered all my users to be able to use this, however I do want to be able to control who can access the VPN.
So the problem seems to be in adding a value to the objectClass of a user. If I attempt to manually add the class created by WebADM or ones created by myself, I get the following error:
---------------------------
ADSIEdit
---------------------------
Operation failed. Error code: 0x2040
The specified method is not supported.
00002040: SvcErr: DSID-030F0E51, problem 5003 (WILL_NOT_PERFORM), data 0
---------------------------
OK
---------------------------
Even if I try to add inetOrgUser to a users objectClass I will get exactly the same error. Googling around has not shed much light on this issue, so I am hoping someone can help me out here.
The DC was originally 2000 -> 2003 -> 2008 (current version)
I am trialing using a distributed file system as the backend storage for my Xen Servers.
I have set up the DFS (distributed file system) (using CentOS and GlusterFS) and everything is working perfectly with suprisingly good IOPS speed, however I am now running into an issue with the VHD's (virtual hard disks) which are being synced to my planned DR (desaster recovery) storage.
My VHD's are being written to two local SAN (storage area network) servers and these are then synced using geo-replication to an offsite SAN server. I also have two xen servers connected to the offsite SAN servers.
I can see the VHD's in my offsite storage and I have found that if:
Does anyone know why this is happening and what I can do to try and fix this issue. I know I can import the VHD into XenServer using XenCenter, but I am looking for something which I can do with a script, rather than manually.
Thanks.
Having a bit of a problem getting Shibboleth (SSO) working with ADFS and Pound.
The main problem seems to be that:
I have set up Shibboleth to protect the address http://server.domain.com:8888, which allows me to retrieve metadata and it all seems to be working fine. However the problem seems to be that ADFS is configured to protect the https website, so when Shibboleth attempts to recieve information from ADFS I get nothing except the following error:
A token request was received for a relying party identified by the key
'https://msstagrevproxy.cwpintranet.com/shibboleth', but the request could not
be fulfilled because the key does not identify any known relying party trust.
Key: https://msstagrevproxy.cwpintranet.com/shibboleth
I am not really sure how I can work around this as to retrieve the metadata from Shibboleth I have to use the https address but this does not actually exist in Shibboleth or IIS.
Has anyone had any experience with this before or using any other SSO with a reverse proxy that works?
I am trying to find the best way to migrate my VHD's to my DataCenter offsite for DR purposes.
Currently I have a number of Xen Stacks setup as the following:
Below is an example diagram:
One option I have been testing and researching is:
I have managed to get this setup and it is working great, however I am very concerned about Disk I/O. Testing a disk created on a NFS share in Gluster I seem to be getting 10MB/S write and about 5MB/S read, which seems quite slow. It is quite important to have high disk I/O as most of the VM's will be running SQL servers.
One important factor is that my Dev equipment only has slow disks (7k) so I am aware this might be effecting the speed a little bit.
What better methods might there be in achieving a redundant storage system for my VHD's?
UPDATE
Well, I migrated my gluster cluster onto some decent hardware with some decent disks and sequential write has increased to 100MB/S and read to 80 MB/S, I seem to loose about 30-40MB/S than running direct from iSCSI storage but I guess this is to be expected with NFS.
A few months ago I setup a Citrix XenApp cluster running on Windows Server 2008 R2 Standard Edition using the temporary 180 day license key.
Recently the company bought a Windows Server 2008 R2 Enterprise DataCenter license. This means I need to upgrade the Windows edition from Standard to Enterprise.
I attach the disk to the VM and start the upgrade process through XenCenter, it runs through all checks and unpacks all Windows files and seems to create a Windows Setup partition, it then reboots and trys to boot into this partition and I get a blue screen telling me to CHKDSK the hard drive with the following error message:
STOP: 0x0000007B
As XenApp is already setup and working I really do not want to go down the route of rebuilding this server (as I already had to do this once down to issues with XenApp).
The server did have 8GB of RAM assigned to it, I have tried reducing this down to 2GB's as I read this can cause an issue.
Also I can boot back into the Windows Server 2008 R2 Standard partition without any problems.
UPDATE
I have managed to get round the urgency by re-arming the license, giving me another 180 day trial..but would be nice to work out why this is happening!
I am currently in the process of modifying how internet reaches my front end servers and I am having a strange issue with one of the existing stacks.
There is one physical firewall which is above the server, if I use this, I start recieving packet loss across the entire subnet, if I use wireshark I can see arp requests but I still get packet loss. The second I take this firewall out, the problem dissapear. If I route around the firewall straight to the front end server, I still do not get any issue.
All of this leads me to believe there must be something wrong with my config but I cannot see what for the life of me:
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4
enable password ************ encrypted
passwd ************ encrypted
hostname sbc-cfw-02
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
no fixup protocol h323 h225 1720
no fixup protocol h323 ras 1718-1719
fixup protocol http 80
no fixup protocol rsh 514
no fixup protocol rtsp 554
no fixup protocol sip 5060
no fixup protocol sip udp 5060
no fixup protocol skinny 2000
no fixup protocol smtp 25
no fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.17.2.0 as-net
name 10.17.2.1 sbc-fw-02-E1
name 10.17.2.2 sbc-as-01-E0
name 10.150.0.0 fe-net
name 10.150.0.221 sbc-fe-01-E1
name 10.150.0.222 sbc-fw-02-E0
name 10.150.0.223 sbc-as-01-nat
object-group service webstuff tcp
port-object eq www
port-object eq https
port-object eq 8888
access-list inside_access_in permit icmp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit tcp any any
access-list inside_access_in permit udp any any
access-list inside_access_in permit tcp any host sbc-as-01-nat
access-list acl-web permit icmp any any
access-list acl-web permit tcp any any
access-list acl-web permit tcp any any object-group webstuff
access-list acl-web permit tcp any host sbc-as-01-nat eq ssh
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside sbc-fw-02-E0 255.255.255.0
ip address inside sbc-fw-02-E1 255.255.255.0
no ip address intf2
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 10.150.0.1-10.150.0.210
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) sbc-as-01-nat sbc-as-01-E0 netmask 255.255.255.255 0 0
access-group acl-web in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 10.150.0.27 1
route outside 10.0.0.0 255.255.255.0 10.150.0.12 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
The front end webserver (sbc-as-01) is on the 10.17.2.0 range, and the side having problems is the 10.150.0.* subnet.
Let me know if you need more information!
I have a vyatta set up as the top layer of security on a website.
The vyatta is running IPS which then outputs to a log file.
What I would like to do is to set the Vyatta to email me this log file daily so I will be aware of any events without having to physically check on the box.
The vyatta is connected straight to the internet so it can access my webserver via IP.
I can guess I will have to create a cron job to do this but I am not sure how to send an email from the vyatta.
FYI Vyatta is based on Debian 6.
I have a problem with a new install of a XenApp Citrix server.
Everything was working fine, but I was setting up Citrix Access Gateway and single sign in. Now, on the main server I am getting an error:
The licenses required by this edition of Citrix XenApp are not present on the license server CWP-CITRIX-02.
I have a fundamental license installed and as far as I can tell this is all set up and working fine because the second server in this farm is using the license server on this machine with no problems.
Not really sure where to go from here!
UPDATE:
Dan, thought it would be better to put the info you requested here:
There are two servers in the farm, CWP-CITRIX-02 and CWP-CITRIX-03.
CWP-CITRIX-02 is the master server, it hosts the license server.
I am running XenApp Fundamentals 6.0.
CWP-CITRIX-03 is currently working, I can launch applications which are hosted on this server, however any applications hosted on CWP-CITRIX-02 fail with the following error:
An error occurred while making the requested connection.
And qfarm /load shows:
CWP-CITRIX-02 - 20000 CWP-CITRIX-03 - 100
If you need any more information let me know.
I have a real problem with a layer 3 Linksys switch.
First, every time it looses power, it seems to reset back to an older config. Not only this, but when this happens it looses interface settings on one subnet.
This would not be a problem but I am completely unable to get to the interface on the working side. It allows me to log on and then just displays a blank screen. I have tried this on:
IE6 IE7 IE8 IE9 Firefox 3.5 Opera Chrome
All with the same results, except for Opera, which loads half the interface but nothing I can really use. I really need to get onto this switch so I can sort out routing and VLAN tagged ports, so if anyone has any ideas on either of these issues please let me know ASAP!
Thanks!
Also, due to its location and my lack of laptops with serial connections I cannot putty into it.
UPDATE:
Looked into this a bit more and it looks like this model of switch does not save the current config to boot unless you make sure to save it yourself, which explains the first issue, however the broken interface is more worrying!
So I am currently migrating our office away from the current proxy (Squid running in Windows on our Mail server...I did not set it up...) to a new one, Squid running on Vyatta.
So far I have everything setup and working perfectly, however im having trouble getting it to use two different DNS servers, one for internet (8.8.8.8) and another for internal domain name sites.
If I set our internal DNS ip first with:
set system name-server 192.168.47.1
set system name-server 8.8.8.8
Then it does seem to resolve everything, however any public websites on the internet take an incredibly long time to resolve. However, if I switch it around so the public DNS is first, websites load incredibly quick but it will only load records in the public DNS.
Using nslookup with either setting only seems to use the first name server.
Anyone dealt with this before?
Having a small issue setting up a vyatta.
The company internet and two different websites are both on the same IP.
Server 1 - Has websites hosted on ports 1000 and 3000 and also has a proxy server installed to provide internet connection to the domain
Server 2 - Has a website hosted on ports 80 and 433
The vyatta is correctly natting the appropriate traffic to each server, and allowing the proxy to get internet traffic, however I have a problem getting to the websites hosted on these two servers inside the domain.
I believe the problem is that the HTTP request is being sent with an IP, eg: 12.34.56.78. The request will reach the website and the server will attempt to send the request back to the IP, however this is the IP of the Vyatta, so it has nowhere else to go.
I thought the solution would be something like this:
rule 50 {
destination {
address 12.34.56.78
port 1000
}
inbound-interface eth1
inside-address {
address 10.19.2.3
}
protocol tcp
type destination
}
But this doesnt seem to do it!
UPDATE
I changed the rules to the following:
rule 50 {
destination {
address 12.34.56.78
port 443
}
outbound-interface eth1
protocol tcp
source {
address 10.19.2.3
}
type masquerade
}
rule 51 {
destination {
address 12.34.56.78
port 443
}
inbound-interface eth1
inside-address {
address 10.19.2.2
}
protocol tcp
type destination
}
I am now seeing traffic going between the two with Wireshark, but the website will still fail to load.
Im having a problem setting up Radius with Citrix Access Gateway.
I had it all set up and working fine when I had the Citrix Access Gateway (CAG) on our main LAN but I want to move it into DMZ.
I have set up a Vyatta firewall inbetween the Radius server and the Gateway. The firewall is set up to only allow HTTP, HTTPS, and Radius traffic through (1812 and 1813). The firewall also provides all the NAT'ing I need, i.e.: I have setup CAG to point at the ip of the firewall with the port, and the firewall then forwards this traffic onto the Radius server, masking the IP address as the IP of the firewall. The firewall should then forward any traffic it recieves coming from inside to the CAG.
The problem seems to be with the traffic going back to the CAG. If I run wireshark I can see the Radius request reaching the server but then the Radius server seems to send an ICMP request back to the firewall which fails and says the port is not open:
23 3.145816 11.1.1.1 11.1.1.2 RADIUS 104 Access-Request(1) (id=0, l=62)
24 3.145883 11.1.1.2 11.1.1.1 ICMP 132 Destination unreachable (Port unreachable)
The traffic going back into the firewall is not filtered at all and it should be passing the data straight to the CAG.
Vyatta NAT config:
service {
nat {
rule 10 {
destination {
address 11.1.1.1
}
inbound-interface eth1
inside-address {
address 192.168.60.2
}
type destination
}
rule 20 {
destination {
address 192.168.60.1
port 1812
}
inbound-interface eth0
inside-address {
address 11.1.1.2
}
protocol udp
type destination
}
rule 21 {
destination {
address 192.168.60.1
port 1813
}
inbound-interface eth0
inside-address {
address 11.1.1.2
}
protocol udp
type destination
}
rule 30 {
outbound-interface eth1
outside-address {
address 11.1.1.1
}
source {
address 192.168.60.2
}
type source
}
Any idea's why this is failing?
I have a problem at the moment with one of our main shared folders.
The network speeds to this drive will suddenly slow right down and occasionally completely stop. The shared folder is an iSCSI drive stored on a SAN connected to one of our servers.
The backend of the SAN does not seem to be a problem and you can connect to the server with the drive attached and see the drive with no speed issues, however at the same time the share is inaccessible from anywhere else on the network. The NIC on the server is not reporting lots of traffic and you can remote onto the server with no issues.
I have detached the iSCSI and reattached it onto another server and have the same issues there. Not really sure what else I can do to troubleshoot this or how I can progress any further so any help would be great!
I am trying to schedule a perl script to run daily, but I am not sure if I am doing everything right.
The script I want to run is to update AWStats each day, without manually having to press update.
Currently, I created a file in the cron.d folder with the following text inside:
00 09 * * * /usr/local/awstats/cgi-bin/awstats.pl -config=cwp-dev-02
If I run:
/usr/local/awstats/cgi-bin/awstats.pl -config=cwp-dev-02
The stats update succesfully, but nothing seems to happen with the scheduled task...