djsumdog's questions

I'd like to have nginx handle requests to a specific directory by checking to see if that path/file exists in several separate directories. For example, if my directory root had the following:

images/siteA/foo.jpg
images/siteB/b/bar.jpg
images/siteC/example.jpg

I'd like http://example.com/images/foo.jpg to return the file foo.jpg, http://example.com/b/bar.jpg to return the file bar.jpg and so fourth.

I've tried the following, but it just gets locked in redirect loops (and I don't want it to redirect, but actually serve the file to that URL):

  location /images/ {
    try_files /siteA/images/
              /siteB/images/
              /siteC/images/ =404;

  } 

I've also tried using capture groups like location ~/images/(.*)/ and adding $1 to the end of the URLs. I'm a little confused on the documentation and unsure how to accomplish this with nginx.

I'm having some trouble getting spampd to work in OpenBSD. First off, if I try to specify the daemon flags in my /etc/rc.conf.local like so:

spampd_flags="--port=10025 --relayhost=127.0.0.1:10027 --tagall -aw"

The service does not start with those flags at startup. I have to restart the service before it will pick up those flags. I found the following article mentioning the same issue from back in 2015:

http://technoquarter.blogspot.com/2015/02/openbsd-mail-server-part-4-spamassassin.html

As a workaround, I created a /etc/rc.d/spampd_custom script that looks like the following:

#!/bin/ksh

daemon="/usr/local/sbin/spampd --port=10025 --relayhost=127.0.0.1:10027 --tagall -aw"

. /etc/rc.d/rc.subr

rc_cmd $1

..and I added spampd_custom to the pkg_scripts in my /etc/rc.conf/local. This does start up the service with the correct flags, but the service will fail when attempting to make an SMTP connection. I ran it in the foreground and see this in the output:

# /usr/local/sbin/spampd --port=10025 --relayhost=127.0.0.1:10027 --tagall -aw
Jul 14 04:32:24 lori spampd[40465]: Pid_file "/var/run/spampd.pid" already exists.  Overwriting!  
Jul 14 04:32:24 lori spampd[4112]: Process Backgrounded 
lori# Jul 14 04:32:24 lori spampd[4112]: 2018/07/14-04:32:24 SpamPD (type Net::Server::PreForkSimple) starting! pid(4112) 
Jul 14 04:32:24 lori spampd[4112]: Binding to TCP port 10025 on host 127.0.0.1 with IPv4 
Jul 14 04:32:24 lori spampd[4112]: Setting gid to "746 746" 
Jul 14 04:32:24 lori spampd[4112]: Setting uid to "746" 
Jul 14 04:32:39 lori spampd[93147]: WARNING!! Error in process_request eval block: /usr/local/sbin/spampd: socket connect failure: Connection refused 
WARNING!! Error in process_request eval block: /usr/local/sbin/spampd: socket connect failure: Connection refused

I've tried several searches for this and have found some bug reports on the Debian tracker, but can't seem to find a solution. It seems like this is a socket used by the parent spampd to communicate with its children that doesn't seem to be setup correctly.

What is wrong with my configuration?

I currently have HAProxy running in a Docker container. Docker is just running on one host with IPv4 and IPv6 enabled. HAProxy is the only container with host ports shared and only 80/443 come through the firewall on the external/public interface.

Currently web traffic comes in fine. I have forwardfor set in HAProxy and my backends get the real ClientIP for logging and analytics .. except for IPv6. Although port 80/443 get mapped/translated in such a way by docker so that HAProxy gets the real client IP on IPv4, anything over IPv6 somehow gets translated to IPv4! HAProxy gets a private 172.17.0.1 address as the client IP for all IPv6 connections.

My daemon.json for Docker looks like the following:

{
    "tls": true,
    "tlsverify": true,
    "tlscacert": "/etc/docker/ca.pem",
    "tlscert": "/etc/docker/server.crt",
    "tlskey": "/etc/docker/server-key.pem",
    "ipv6": true,
    "fixed-cidr-v6": "2001:19f0:6001:1c12::/80",
    "hosts": ["127.0.0.1:2376", "10.10.6.10:2376", "fd://"]
}

I've assigned Docker a /80 from my IPv6 subnet. I'm using Vultr as a provider and they assign me 2001:19f0:6001:1c12:: for my IPv6 subnet and 2001:19f0:6001:1c12:5400:01ff:fe49:876e for my host IP address (the machine running docker). I also my DEFAULT_FORWARD policy as ACCEPT in ufw, and have ndppd setup with the following configuration:

proxy ens3 {
  timeout 500
  ttl 30000
  rule 2001:19f0:6001:1c12::/80 {
    static
  }
}

So with IPv6 enabled, I realize my containers all get their own IPv6 addresses. So for my HAProxy instance to get a real Client IP, I need to point the DNS to the container IPv6 address and open a firewall rule for it. But the trouble is, I need that address to be static. Of course this means I can't use the default bridge network and I need to have a user defined network.

I realize I should have done this to being with, and then I remembered what my issue was. I keep getting the following:

.gem/ruby/2.2.0/gems/docker-api-1.33.6/lib/docker/connection.rb:50:in `rescue in request': could not find an available, non-overlapping IPv6 address pool among the defaults to assign to the network (Docker::Error::ServerError)

This is from the Ruby Docker-API library, but the I get the exact same error with the command line tool. I've tried various slices of IPv6 subnets, but none seem to work and people have told me I'll have problems if I use less than a /64.

Remember, the original problem is that I can't get the client-ip in my web server logs for IPv6 connections. If there's a simpler way to solve this, I'm all open to it. If not, what settings do I need to use for my user defined network? I wish I could just delete the default bridge and use its ranges, but that doesn't seem to be an option. Can I keep the default bridge from getting that IPv6 subnet that's defined in the daemon.json and use that range instead for my user defined network (and then statically assign just the HAProxy container so I could use that container's IP in the DNS/AAAA record?) Or is there a simpler way to get IPv6 host ports to connect directly to the container without translation in the same way IPv4 is done?

I found another answer and looked through the official Docker ipv6 docs, but I'm still having trouble with IPv6 and Docker. If I expose public ports on Docker containers, I can connect to them via IPv6. From within the container, I can ping6 out to other IPv6 hosts on other providers. However if I try to make a TCP connection over IPv6 (http, telnet, nc, etc.) it timesout and fails.

Here is my public adapter:

2: ens3: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 56:00:01:46:4e:fe brd ff:ff:ff:ff:ff:ff
    inet 45.32.64.134/23 brd 45.32.65.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 2001:19f0:6001:1c12:5400:1ff:fe46:4efe/64 scope global mngtmpaddr dynamic 
       valid_lft 2591898sec preferred_lft 604698sec
    inet6 2001:19f0:6001:1e43:5400:1ff:fe46:4efe/64 scope global mngtmpaddr dynamic 
       valid_lft 2591898sec preferred_lft 604698sec
    inet6 fe80::5400:1ff:fe46:4efe/64 scope link 
       valid_lft forever preferred_lft forever

The 2001:19f0:6001:1c12:/64 is the one I care about (Vultr lets you reserve IPv6 addresses that will survive rebuilds, but it also gives you another address for some reason). I setup my daemon.json for Docker like so:

{
    "tls": true,
    "tlsverify": true,
    "tlscacert": "/etc/docker/ca.pem",
    "tlscert": "/etc/docker/server.crt",
    "tlskey": "/etc/docker/server-key.pem",
    "ipv6": true,
    "fixed-cidr-v6": "2001:19f0:6001:1c12::1/80",
    "hosts": ["127.0.0.1:2376", "10.10.6.10:2376", "fd://"]
}

and my ndppd conf like so:

route-ttl 30000
proxy ens3 {
  router yes
  timeout 500
  ttl 30000
  rule 2001:19f0:6001:1c12::/64 {
    static
  }
}

I can ping6 fine:

docker exec -it mycontainer ping6 google.com
PING google.com (2607:f8b0:4007:80b::200e): 56 data bytes
64 bytes from 2607:f8b0:4007:80b::200e: seq=0 ttl=56 time=1.166 ms
64 bytes from 2607:f8b0:4007:80b::200e: seq=1 ttl=56 time=0.575 ms
64 bytes from 2607:f8b0:4007:80b::200e: seq=2 ttl=56 time=0.475 ms
^C
--- google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.475/0.738/1.166 ms

..which I couldn't do before ndppd was running, but I still can't connect via IPv6 outbound:

docker run -it alpine ash -c "ip -6 addr show dev eth0; ip -6 route show"
191: eth0@if192: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 state UP 
    inet6 2001:19f0:6001:1c12::242:ac11:7/80 scope global flags 02 
       valid_lft forever preferred_lft forever
    inet6 fe80::42:acff:fe11:7/64 scope link tentative 
       valid_lft forever preferred_lft forever
2001:19f0:6001:1c12::/80 dev eth0  metric 256 
fe80::/64 dev eth0  metric 256 
default via 2001:19f0:6001:1c12::1 dev eth0  metric 1024 
unreachable default dev lo  metric -1  error -101
ff00::/8 dev eth0  metric 256 
unreachable default dev lo  metric -1  error -101

What am I missing?

This is my current pf.conf on FreeBSD 11.1-RELEASE. It allows incoming connections from OpenVPN/UDP and SSH, as well as allows everything on the private/vpn networks (vtnet1 and tun0 respectively). The trouble is, I can't connect to OpenVPN or SSH via ipv6. If I watch the openvpn logs or use a -v on SSH, I see it times out on the IPv6 address and then drops to IPv4.

block all

# allow all from host itself
pass out inet all keep state
pass out inet6 all keep state

# allow all from private
pass in quick on vtnet1 inet from any to any keep state

# openvpn
pass in quick proto udp to vtnet0 port openvpn keep state
pass in quick on tun0 inet from any to any keep state

# ssh
pass in quick proto tcp to vtnet0 port ssh flags S/SA keep state

I attempted to change my configuration to the following to allow IPv6:

block all

# allow all from host itself
pass out inet all keep state
pass out inet6 all keep state

# allow all from private
pass in quick on vtnet1 inet from any to any keep state

# openvpn
pass in quick inet proto udp to vtnet0 port openvpn keep state
pass in quick inet6 proto udp to vtnet0 port openvpn keep state
pass in quick on tun0 inet from any to any keep state

# ssh
pass in quick inet proto tcp to vtnet0 port ssh flags S/SA keep state
pass in quick inet6 proto tcp to vtnet0 port ssh flags S/SA keep state

But I still can't make IPv6 connections.

I'm trying to create a simple ansible template for the packet filter on FreeBSD 11.1-RELEASE. I have vtnet0 (public), vtnet1 (private, 10.10 address) and tun0 (openvpn, fully working/tested from a client to nodes on my network).

My rc.conf looks like the following:

hostname="bastion"
sshd_enable="YES"
static_routes="linklocal"
ifconfig_vtnet0="DHCP"
ifconfig_vtnet0_ipv6="inet6 accept_rtadv"
ipv6_activate_all_interfaces="YES"
rtsold_enable="YES"
rtsold_flags="-aF"
ifconfig_vtnet1="inet 10.10.6.20 netmask 255.255.255.0"
gateway_enable="YES"
openvpn_enable="YES"
pf_enable="YES"

My cloud provider gives me ipv4/ipv6 public addresses via DHCP.

I've looked at the FreeBSD docs and other ansible playbooks and came up with this basic pf.conf:

block all
set skip on lo0
set skip on tun0
pass out all keep state
tcp_services = "{ ssh }"
udp_services = "{ openvpn }"
pass in proto tcp to any port $tcp_services keep state
pass in proto udp to any port $udp_services keep state

However with this configuration, I block all ssh and openvpn access and have to login to my box via the VM web console.

My goal is for this box to only allow in openvpn (udp) and ssh from the public interface, allow all traffic over the vpn (tun0) and all traffic from internal.

I'm running Vagrant 1.7 (from their official 1.7 packages) on Ubuntu 14.04 LTS and I'm trying to provision several private VMs and one public one. My Ansible provisioning scripts change all the vagrant/root passwords and replace the Vagrant stock SSH keys for the security aspect.

All my internal IPs are 10.10.20.0/24. I have one VM that needs the IP 10.42.7.226 (which has a NAT going to it from our real external IP for ports 80/443).

The hypervisor is at 10.42.7.227 and I created a br0 with that IP connected to eth0. My network configuration looks like the following:

auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 10.42.7.227
    netmask 255.255.255.0
    network 10.42.7.0
    broadcast 10.42.7.255
    gateway 10.42.7.1
    dns-nameservers 8.8.8.8


auto br0
iface br0 inet static
    address 10.42.7.227
    netmask 255.255.255.0
    gateway 10.42.7.1
    bridge_ports eth0
    bridge_stp off
    bridge_maxwait 0
    bridge_fd 0

I'm working on this remotely, which is why I was afraid to remove the IP from eth0. I realize that br0 should supersede it (br* have the real IPs and the eth* don't).

In my Vagrent config, I have a block like the following:

  config.vm.define "haproxy" do |haproxy|
    haproxy.vm.network :private_network, ip: 10.10.20.12
    haproxy.vm.network :public_network, ip: 10.42.7.226
    haproxy.vm.hostname = vars.hostname('haproxy')
    haproxy.hostmanager.aliases = vars.aliases('haproxy')
    haproxy.vm.provision "ansible" do |ansible|
      ansible.playbook = "ansible/haproxy.yml"
    end
  end

However in that VM, I only see the following adapters:

eth0      inet addr:192.168.121.189     
eth1      inet addr:10.10.20.12    
eth2      inet addr:10.42.7.169  Bcast:10.42.7.255  Mask:255.255.255.0

and on the hypervisor I see the following on br0:

brctl show
bridge name bridge id       STP enabled interfaces
br0     8000.0022192df5a7   no      eth1
virbr0      8000.000000000000   yes     
virbr1      8000.525400eda938   yes     virbr1-nic
                            vnet0
                            vnet2
                            vnet4
                            vnet6
virbr2      8000.525400c3098d   yes     virbr2-nic
                            vnet1
                            vnet3
                            vnet5
                            vnet7

and the hypervisor's ifconfig for the virbr* devices:

virbr0    inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
virbr1    inet addr:192.168.121.1  Bcast:192.168.121.255  Mask:255.255.255.0        
virbr2    inet addr:10.10.20.1  Bcast:10.10.20.255  Mask:255.255.255.0

It looks like libvirt/kvm are establishing some 192 networks for some reason. I'm not too concerned about those, but I'm guessing my 10.42.7.226 got converted into 10.42.7.169 somehow within the Vagrant/libvirt provisioning.

I'm guessing I need another network in libvirt? All I seem to have is the default:

<network>
  <name>default</name>
  <uuid>baa4b92a-b8ee-4e2f-a31a-bb3112b51dc0</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address='52:54:00:9d:3b:a9'/>
  <ip address='10.10.20.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='10.10.20.2' end='10.10.20.254'/>
    </dhcp>
  </ip>
</network>

I'm a little confused on the documentation for libvirt. I basically need my haproxy VM to have an adapter with the IP address 10.42.7.226 accessible on the physical network connected to eth0 of the host machine. What do I need to do in this configuration to make this happen?

I'm currently working on a project where I use Vagrant with Ansible provisioning to create local environments in VirtualBox. I'm currently working with a University and we have a XenServer Hypervisor (free edition). I can't access the hypervisor directly from my location, but I can ssh into a Ubuntu server on the same network and forward ports so I can connect to it with XenCenter:

ssh <remote machine> -L80:<xen-server>:80 -L443:<xen-server>:443 -L5900:<xenserver>:5900 -L59001...etc to 5910

The 59xx ports are because XenCenter puts VNC Consoles on those ports. (I'm actually using putty on Windows because I can't get OpenXenCenter/Linux to connect at all with this type of tunnel). Citrix XenCenter connects fine and I can create a new VM, but I cannot get to the console, either via XenCenter or another VNC client.

If I could get the VNC console to work, I could create a base box and just copy it and re-provision the copies with different ansible playbooks as needed.

But I really don't care about being able to get a console so long as I could auto-provision the individual VMs. It'd be nice if I could point at the hypervisor with a client on another machine and script the creation of VMs with specific IP addresses. Vagrant doesn't support Xen as a provider. I've found some limited Xen support using libvirt, but even that seems to be more geared at Xen installed on a standard distribution like Ubuntu or OpenSUSE and not as the standalone Citrix Hypervisor. There is xen-tools, but that seems to also be geared on xen on a local linux distribution.

Is there anyway to remotely provision XenServer instances using either Vagrant or some other type of provisioning tool?

So we have Alfresco running at work and I like to have our repository mounted via CIFS:

mount /mnt/alfresco/ -v
mount.cifs kernel mount options: ip=192.168.8.91,unc=\\alfresco.example.com\alfresco,dir_mode=0755,nounix,sec=ntlm,uid=1001,gid=1000,user=me,pass=********

The first time this runs, it works fine. I can use it for a few hours, but then it completely locks up. If I try to ls /mnt/alfresco, it just hangs for several minutes. The only thing I can do is umount -lf /mnt/alfresco But then, if I try to mount it again, it just hangs. When I do a Ctrl+C, I see the following:

[86897.151480] CIFS VFS: cifs_mount failed w/return code = -512
[86897.155297] CIFS VFS: No task to wake, unknown frame received! NumMids 6
[86897.155302] Received Data is: : dump of 37 bytes of data at 0xffff88023366fb80
[86897.155307]  23000000 424d53ff 00000da4 c00188c0 . . . # \xffffffff S M B \xffffffa4 . . . \xffffffc0 . . \xffffffc0
[86897.155311]  00000000 00000000 00000000 31c60001 . . . . . . . . . . . . . . \xffffffc6 1
[86897.155313]  02260001 08000000 . . & . .

My /etc/fstab line looks like the following:

//example.com/alfresco /mnt/alfresco cifs user=me,uid=me,gid=me,credentials=/home/me/.smbcredentials,dir_mode=0755,nounix,auto,sec=ntlm 0 0

I'm on kernel Linux-3.10.25-gentoo, but I had the same problem with 3.10.8-gentoo. If I reboot my computer, I can remount the share and use it for a couple of hours again. Is there anyway I can get more debugging information on what's going on here?

Recently we moved our primary external DNS server. It has three caching DNS slaves in front of it provided by our ISP. They've told us they've started getting access denied requests when doing zone transfers (AXFR). If I add in my own IPs to the allow-transfer list, I also get a transfer failed when using dig with the AXFR argument. Here is what my bind configuration looks like:

options {
    directory "/var/lib/named";
    dump-file "/var/log/named_dump.db";
    zone-statistics yes;
    statistics-file "/var/log/named.stats";
    listen-on-v6 { any; };
    notify-source 10.19.0.68 port 53;

    querylog yes;
    notify yes;
    allow-transfer { 
        127.0.0.1;  //localhost
        1.1.1.1;    //public dns slave 1
        2.2.2.2;    //public dns slave 2
        3.3.3.3;    //public dns slave 3
    };
    also-notify {
            1.1.1.1;  //public dns slave 1
            2.2.2.2;  //public dns slave 2
            3.3.3.3;  //public dns slave 3
    };
    include "/etc/named.d/forwarders.conf";
};
logging {
    channel simple_log {
        file "/var/log/bind.log" versions 10 size 3m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
  };
    category default{ simple_log; };
    channel log_zone_transfers {
            file "/var/log/axfr.log" versions 10 size 3m;
            print-time yes;
            print-category yes;
            print-severity yes;
            };
    category xfer-out { log_zone_transfers; };
    channel log_notify {
            file "/var/log/notify.log" versions 10 size 3m;
            print-time yes;
            print-category yes;
            print-severity yes;
            };
    category notify { log_notify; };
    channel queries {
            file "/var/log/queries.log" versions 10 size 30m;
            print-time yes;
        severity info;
            print-category yes;
            print-severity yes;
            };
    category queries { queries; };
  };
zone "." in {
    type hint;
    file "root.hint";
};
zone "localhost" in {
    type master;
    file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" in {
    type master;
    file "127.0.0.zone";
};

include "/etc/named.conf.include";

zone "example.net " {
    type master;
    file "/var/lib/named/master/example.net.hosts";
    };
zone "example.com " {
    type master;
    file "/var/lib/named/master/example.com.hosts";
};

## -- other master files --

And the errors in the xfer log look like the following:

29-Oct-2012 14:20:02.806 xfer-out: info: client 1.1.1.1#59069: bad zone transfer request: 'example.com./IN': non-authoritative zone (NOTAUTH)

I've tried adding allow-transfer parameters directly on the zone files and still get failed transfers. Any idea what I'm doing wrong?

I'm trying to get awstats installed on a new server and I can get it to generate the data files, but they're all labels as awstatsMMYYYY.txt instead of awstats.example.com.MMMMYY.txt. If I rename them after they're created, they show up correctly in the web interface. I'm using awstats 7.1. I'm invoking it using the following:

./awstats.pl -config=example.com -debug=5
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Awstats - 7.0 (build 1.976) - Perl /usr/bin/perl 5.012003
Wed Oct 17 22:50:53 2012 - DEBUG 2 - DIR=. PROG=awstats Extension=pl
Wed Oct 17 22:50:53 2012 - DEBUG 2 - QUERY_STRING=config=example.com&debug=5
Wed Oct 17 22:50:53 2012 - DEBUG 1 - HTMLOutput=
Wed Oct 17 22:50:53 2012 - DEBUG 2 - YearRequired=2012, MonthRequired=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 - DayRequired=, HourRequired=
Wed Oct 17 22:50:53 2012 - DEBUG 2 - UpdateFor=0
Wed Oct 17 22:50:53 2012 - DEBUG 2 - PluginMode=
Wed Oct 17 22:50:53 2012 - DEBUG 2 - DirConfig=
Wed Oct 17 22:50:53 2012 - DEBUG 2 - Opened config: ./awstats.example.com.conf
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Config file read was "./awstats.example.com.conf" (level 1)
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Search an available language among HTTP_ACCEPT_LANGUAGE=
Wed Oct 17 22:50:53 2012 - DEBUG 1 -  No language defined or available. Will use Lang=en
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Check_Config
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogFile='/srv/www/awstats/tools/logresolvemerge.pl /var/log/apache2/example.log* |'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogType='W'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogFormat='1'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogSeparator=' '
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DNSLookup='1'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirData='/srv/awstats-data'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirCgi='/cgi-bin'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirIcons='/icon'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  NotPageList css,bmp,png,ico,swf,xml,js,jpg,jpeg,rss,class,gif
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  ValidHTTPCodes 304,200
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  ValidSMTPCodes 1,250
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  UseFramesWhenCGI=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  BuildReportFormat=html
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  BuildHistoryFormat=text
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  URLWithQueryWithOnlyFollowingParameters=
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  URLWithQueryWithoutFollowingParameters=
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Substitute_Tags on /srv/www/awstats/tools/logresolvemerge.pl /var/log/apache2/example.log* |
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogFile='/srv/www/awstats/tools/logresolvemerge.pl /var/log/apache2/example.log* |'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogFormat='1'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  LogSeparator=' '
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DNSLookup='1'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirData='/srv/awstats-data'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirCgi='/cgi-bin'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  DirIcons='/icon'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  SiteDomain='example.com'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MiscTrackerUrl='/js/awstats_misc_tracker.js'
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{WormsShown}=5
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{ScreenSizesShown}=5
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{Domain}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{WindowSizesShown}=5
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{OsShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{PageShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{DownloadsShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{LoginShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{EMailsShown}=20
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{KeyphrasesShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{RefererShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{RobotShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{KeywordsShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{HostsShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MaxNbOf{BrowsersShown}=10
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Robot}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Worm}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{ScreenSize}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Browser}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Domain}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Os}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{EMail}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Login}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Refer}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Keyphrase}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{WindowSize}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{File}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Keyword}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Host}=1
Wed Oct 17 22:50:53 2012 - DEBUG 2 -  MinHit{Downloads}=1
Wed Oct 17 22:50:53 2012 - DEBUG 1 - FrameName=main
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Language_Data [FileLang="./lang/awstats-en.txt"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data with files to load: search_engines.pm,operating_systems.pm,robots.pm,browsers.pm,mime.pm
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data [FilePath{search_engines.pm}="./lib/search_engines.pm"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data [FilePath{operating_systems.pm}="./lib/operating_systems.pm"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data [FilePath{robots.pm}="./lib/robots.pm"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data [FilePath{browsers.pm}="./lib/browsers.pm"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Ref_Data [FilePath{mime.pm}="./lib/mime.pm"]
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Read_Plugins with list: 
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Scan for last history files into DirData='/srv/awstats-data' with mask='(\d\d)(\d\d\d\d)'
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Last year=0 - Last month=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Last day=0 - Last hour=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - LastLine=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - LastLineNumber=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - LastLineOffset=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - LastLineChecksum=0
Wed Oct 17 22:50:53 2012 - DEBUG 1 - Call to Init_HashArray
Wed Oct 17 22:50:53 2012 - DEBUG 2 - UpdateStats is 1
Create/Update database for config "./awstats.example.com.conf" by AWStats version 7.0 (build 1.976)
From data in log file "/srv/www/awstats/tools/logresolvemerge.pl /var/log/apache2/example.log* |"...

And my config file looks like this:

LogFile="/srv/www/awstats/tools/logresolvemerge.pl /var/log/apache2/example.log* |"
LogType=W
LogFormat=1
LogSeparator=" "
SiteDomain="example.com"
HostAliases="www.example.com example.com localhost 127.0.0.1 REGEX[example\.com$]"
DNSLookup=1
DirData="/srv/awstats-data"
DirCgi="/cgi-bin"
DirIcons="/icon"
AllowToUpdateStatsFromBrowser=0
AllowFullYearView=2
EnableLockForUpdate=0
DNSStaticCacheFile="dnscache.txt"
DNSLastUpdateCacheFile="dnscachelastupdate.txt"
SkipDNSLookupFor=""
AllowAccessFromWebToAuthenticatedUsersOnly=0
AllowAccessFromWebToFollowingAuthenticatedUsers=""
AllowAccessFromWebToFollowingIPAddresses=""
CreateDirDataIfNotExists=0
BuildHistoryFormat=text
BuildReportFormat=html
SaveDatabaseFilesWithPermissionsForEveryone=0
PurgeLogFile=0
ArchiveLogRecords=0
KeepBackupOfHistoricFiles=0
DefaultFile="index.php index.html"
SkipHosts=""
SkipUserAgents=""
SkipFiles=""
SkipReferrersBlackList=""
OnlyHosts=""
OnlyUserAgents=""
OnlyUsers=""
OnlyFiles=""
NotPageList="css js class gif jpg jpeg png bmp ico rss xml swf"
ValidHTTPCodes="200 304"
ValidSMTPCodes="1 250"
AuthenticatedUsersNotCaseSensitive=0
URLNotCaseSensitive=0
URLWithAnchor=0
URLQuerySeparators="?;"
URLWithQuery=0
URLWithQueryWithOnlyFollowingParameters=""
URLWithQueryWithoutFollowingParameters=""
URLReferrerWithQuery=0
WarningMessages=1
ErrorMessages=""
DebugMessages=1
NbOfLinesForCorruptedLog=50
WrapperScript=""
DecodeUA=0
MiscTrackerUrl="/js/awstats_misc_tracker.js"
UseFramesWhenCGI=1
DetailedReportsOnNewWindows=1
Expires=0
MaxRowsInHTMLOutput=1000
Lang="auto"
DirLang="./lang"
ShowMenu=1                  
ShowSummary=UVPHB
ShowMonthStats=UVPHB
ShowDaysOfMonthStats=VPHB
ShowDaysOfWeekStats=PHB
ShowHoursStats=PHB
ShowDomainsStats=PHB
ShowHostsStats=PHBL
ShowAuthenticatedUsers=0
ShowRobotsStats=HBL
ShowWormsStats=0
ShowEMailSenders=0
ShowEMailReceivers=0
ShowSessionsStats=1
ShowPagesStats=PBEX
ShowFileTypesStats=HB
ShowFileSizesStats=0    
ShowDownloadsStats=HB   
ShowOSStats=1
ShowBrowsersStats=1
ShowScreenSizeStats=0
ShowOriginStats=PH
ShowKeyphrasesStats=1
ShowKeywordsStats=1
ShowMiscStats=a
ShowHTTPErrorsStats=1
ShowSMTPErrorsStats=0
ShowClusterStats=0
AddDataArrayMonthStats=1
AddDataArrayShowDaysOfMonthStats=1
AddDataArrayShowDaysOfWeekStats=1
AddDataArrayShowHoursStats=1
IncludeInternalLinksInOriginSection=0
MaxNbOfDomain = 10
MinHitDomain  = 1
MaxNbOfHostsShown = 10
MinHitHost    = 1
MaxNbOfLoginShown = 10
MinHitLogin   = 1
MaxNbOfRobotShown = 10
MinHitRobot   = 1
MaxNbOfDownloadsShown = 10
MinHitDownloads = 1
MaxNbOfPageShown = 10
MinHitFile    = 1
MaxNbOfOsShown = 10
MinHitOs      = 1
MaxNbOfBrowsersShown = 10
MinHitBrowser = 1
MaxNbOfScreenSizesShown = 5
MinHitScreenSize = 1
MaxNbOfWindowSizesShown = 5
MinHitWindowSize = 1
MaxNbOfRefererShown = 10
MinHitRefer   = 1
MaxNbOfKeyphrasesShown = 10
MinHitKeyphrase = 1
MaxNbOfKeywordsShown = 10
MinHitKeyword = 1
MaxNbOfEMailsShown = 20
MinHitEMail   = 1
FirstDayOfWeek=1
ShowFlagLinks=""
ShowLinksOnUrl=1
UseHTTPSLinkForUrl=""
MaxLengthOfShownURL=64
HTMLHeadSection=""
HTMLEndSection=""
MetaRobot=0
Logo="awstats_logo6.png"
LogoLink="http://www.awstats.org"
BarWidth   = 260
BarHeight  = 90
StyleSheet=""
ExtraTrackedRowsLimit=500

We've been moving data centers and I have a lot of old records that were not correctly but in DNS as CNAME records, but A records that have a direct IP (e.g. 192.168.100.n) and they're all moving to a new subnet (10.19.100.n).

I just need to write a powershell script to change all those records. I found this site:

http://www.indented.co.uk/index.php/2008/12/30/administering-microsoft-dns-in-powershell/

and from it I made this simple script:

$dnsServer = "meldc2"

$scope = New-Object Management.ManagementScope("\\$dnsServer\root\MicrosoftDNS")
$path = New-Object Management.ManagementPath("MicrosoftDNS_Zone")
$options = New-Object Management.ObjectGetOptions($Null,[System.TimeSpan]::MaxValue, $True)
$ZoneClass= New-Object Management.ManagementClass($scope,$path,$options)
$Zones = Get-WMIObject -Computer $dnsServer -Namespace "root\MicrosoftDNS" -Class "MicrosoftDNS_Zone"
$Zones | Get-Member
foreach($Z in $Zones) {
  $Z | Select-Object Name,DsIntegrated,ZoneType,Reverse,Data
}

but that only gets me a listing of root zones. I don't understand how to iterate over all the entries in each of the zones. Also, all the examples I've seen involve adding new zones, but there aren't any examples I can find on modifying existing A records.

I have a client (which is also a gateway for a 192.168.203.0/24 network) that is trying to connect to a remote server (that is a gateway for a 192.168.150.0/24 network) and make a fully bridge between them.

The client has the following OpenVPN Configuraiton:

dev tun
remote gs.example.com
ca OurCompany-CA.crt
client
port 5800
proto udp 
comp-lzo 
verb 3
cipher BF-CBC
ca /etc/openvpn/gs-keys/ca.crt
cert /etc/openvpn/gs-keys/kang.crt
key  /etc/openvpn/gs-keys/kang.key
keepalive 10 60
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log

The server has the following:

port 5800
proto udp
dev tun
push "route 192.168.150.0 255.255.255.0"
    push "route 192.168.203.0 255.255.255.0"
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/kang-server.crt
key /etc/openvpn/keys/kang-server.key 
dh /etc/openvpn/keys/dh1024.pem
server 192.168.155.0 255.255.255.0
keepalive 10 120
comp-lzo
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3
persist-key
persist-tun
client-config-dir /etc/openvpn/ccd

The /etc/openvpn/ccd/kang.exmaple.org file has the following:

    iroute 192.168.203.0 255.255.255.0

From kang (192.168.203.1), I can ping 192.168.150.1, but nothing else (150.10, 150.11, etc all give me "Destination Port Unreachable"). From gs (192.168.150.1) I can ping anything in the 203 subnet fine.

From anywhere on the 203 network, I can ping 192.168.150.1, but not anything else on that subnet (get "Destination Port Unreachable when I ping 192.168.150.10). From anything on the 150 subnet (for example if I'm on 192.168.150.10) I can't even ping 192.168.203.1.

The firewall on kang has an ACCEPT rule for anything coming through its tun adapter. On gs, I also have an ACCEPT for tun0, but I still have these problems even if I completely turn the firewall off.

I'm wondering if the iroute rules are even being read from the ccd files. How should those show up in the logs?

EDIT:

ip_forwarding (/proc/sys/net/ipv4/ip_forward) is set to 1 on both machines.

On gs gateway (192.168.150.1) if I do a traceroute:

traceroute 192.168.203.40
traceroute to 192.168.203.40 (192.168.203.40), 30 hops max, 38 byte packets
 1  192.168.155.6 (192.168.155.6)  396.019 ms  372.837 ms  362.607 ms
 2  192.168.203.40 (192.168.203.40)  364.324 ms  387.439 ms  366.329 ms

Same traceroute from 192.168.150.10:

traceroute 192.168.203.40
traceroute to 192.168.203.40 (192.168.203.40), 30 hops max, 38 byte packets
 1  192.168.150.1 (192.168.150.1)  1.409 ms  1.173 ms  1.958 ms
 2  192.168.150.1 (192.168.150.1)  1.475 ms  1.222 ms  1.068 ms

And 192.168.150.10's routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.11.0    *               255.255.255.0   U     0      0        0 br-lan
192.168.150.0   *               255.255.255.0   U     0      0        0 eth0.2
default         192.168.150.1   0.0.0.0         UG    0      0        0 eth0.2

Similar traceroutes from 192.168.203.1 (kang):

traceroute 192.168.150.1
traceroute to 192.168.150.1 (192.168.150.1), 30 hops max, 40 byte packets using UDP
 1  192.168.150.1 (192.168.150.1)  51.687 ms   50.260 ms   54.513 ms
kang:~ # traceroute 192.168.150.10
traceroute to 192.168.150.10 (192.168.150.10), 30 hops max, 40 byte packets using UDP
 1  192.168.155.1 (192.168.155.1)  48.623 ms   55.955 ms   54.684 ms
 2  192.168.155.1 (192.168.155.1)  57.062 ms   55.816 ms   57.978 ms

Kang's routes (Kang is also a VPN server for individual users. They can get to 192.168.203.0/24 and 192.168.150.1, but nothing else on 192.168.150.0/24). That VPN uses the 192.168.137.0/24 subnet:

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.137.2   *               255.255.255.255 UH    0      0        0 tun0
192.168.155.5   *               255.255.255.255 UH    0      0        0 tun1
192.168.155.1   192.168.155.5   255.255.255.255 UGH   0      0        0 tun1
10.42.7.0       *               255.255.255.0   U     0      0        0 eth1
192.168.137.0   192.168.137.2   255.255.255.0   UG    0      0        0 tun0
192.168.203.0   *               255.255.255.0   U     0      0        0 eth0
192.168.150.0   192.168.155.5   255.255.255.0   UG    0      0        0 tun1
link-local      *               255.255.0.0     U     0      0        0 eth0
loopback        *               255.0.0.0       U     0      0        0 lo
default         10.42.7.1       0.0.0.0         UG    0      0        0 eth1

I'm seeing some really odd behavior with HAProxy. I have the following setup below designed to allow example.com/wiki to go to one server and example.com/ go to another. The trouble is that it seems like the /wiki only works half the time and the / webserver only works half the time as well. Upon closer examination, it seems like it's switching between the two backends; possibly load balancing them, instead of going to a specific backend based on the ACL rules!

Another oddity is that both services-staging.example.com/greenoven and staging.example.com both would go to kumquat, even though the rules specifically say that only the services-staging host should go to that backend.

Is something wrong with my HAProxy configuration? Am I using acls or backends incorrectly?

global
        log 127.0.0.1   local1 debug
        maxconn 200000
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        maxconn 200000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000

        stats uri /monitor
        stats auth admin:GS01
        stats refresh 5s
        stats enable


frontend http-in
        bind *:80

        option forwardfor

        #Staging Hosts

        acl host_staging hdr(host) -i staging.example.com
        acl host_staging_services hdr(host) -i staging-services.example.com

        #Production Hosts

        acl host_prod hdr(host) -i example.com www.example.com
        acl host_prod_services hdr(host) -i services.urbanatla.com

        #URL Paths

        acl url_wiki url_beg /wiki
        acl url_go   url_beg /greenoven
        acl url_arcgis url_beg /ArcGIS

        #Staging Backends

        use_backend pluto if host_staging_services url_arcgis
        use_backend kumquat if host_staging_services url_go
        use_backend kumquat if host_staging url_wiki
        use_backend cumberland if host_staging

        #Production Backends

        use_backend saturn if host_prod_services url_arcgis
        use_backend willow if host_prod_services url_go
        use_backend willow if host_prod url_wiki
        use_backend ganges if host_prod


backend kumquat
        server kumquat kumquat.example.com:8080 maxconn 5000

backend cumberland
        server cumberland cumberland.example.com:80 maxconn 5000

backend ganges
        server ganges ganges.example.com:80 maxconn 5000

backend articdata
        server articdata  articdata.example.com:80 maxconn  5000

backend saturn
        server saturn saturn.example.com:80 maxconn 5000

backend willow
        server willow willow.example.com:8080 maxconn 5000

backend pluto
        server pluto pluto.example.com:80 maxconn 5000        

I'm using openSUSE 11.4 which has Active Directory configuration built-in to Yast (which does all the pam_winbind, Kerberos, nss, Samba-client stuff for you) and I can successfully authenticate against my AD domain.

I created an AD group called LinuxAdmins and I'd like to have a way for people in that group to either be able to su on certain Linux servers without the root password or sudo on those machines using their own passwords.

The way openSUSE configures AD, it sets the username with the domain prefixed. So my username would be MYDOMAN\djsumdog. If I try adding either of the following lines to the sudoers file, I still can't sudo with my user. I keep getting "MYDOMAIN\djsumdog is not in the sudoers file. This incident will be reported." I've tried both single and double slashes for the user and group names.

%MYDOMAIN\LinuxAdmins ALL=(ALL) ALL
MYDOMAIN\djsumdog ALL=(ALL) ALL 

I know on my Gentoo box, the following line in /etc/pam.d/su allows users in the wheel group to su without a password:

auth       sufficient   pam_wheel.so use_uid trust

But this doesn't seem to work in openSUSE (even with local users), much less AD users. I tried using the pam_winbind.so module as well:

#%PAM-1.0
auth     sufficient     pam_rootok.so
auth     include        common-auth
auth     sufficient     pam_winbind.so require_membership_of=MYDOMAIN\\LinuxAdmins
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional       pam_xauth.so

But I don't think that will work as the require_membership_of parameter seems to be for the primary authentication against the entire machine.

I know sudo with the user's password is more secure, but I would happy if I could get either su or sudo working by validating the user against his or her AD group.

My HAProxy instance isn't even under any serious load right now, but occasionally it will start refusing to accept connections, even though the backend servers are up and running fine. I didn't see anything in the logs either. Am I missing something important from my configuraiton?

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        #log loghost    local0 info
        maxconn 4096
        chroot /var/lib/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        maxconn 2000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000

frontend http-in
        bind *:80
        acl host_staging hdr_end(host) -i staging.example.com
        acl host_prod hdr_end(host) -i example.com

        acl url_wiki url_beg /wiki
        acl url_go   url_beg /greenapp

        use_backend kumquat if host_staging url_wiki
        use_backend kumquat if host_staging url_go
        use_backend cumberland if host_staging

        default_backend cumberland

backend kumquat
        server kumquat kumquat.example.com:8080 maxconn 1000

backend cumberland
        server cumberland cumberland.example.com:80 maxconn 1000