E. Jaep's questions

We currently have a kubernetes cluster (using calico) where all worker nodes are connected together with lacp bonds (2x10GB links with LACP Mode 4 - 802.3ad).

However, the maximum throughput we manage to get between 2 pods is 10 GB/s. According to some documentation, we should be able to achieve 20 GB/s. According to wikipedia, it seems to be a normal behavior:

This selects the same NIC slave for each destination MAC address, IP address, or IP address and port combination, respectively

This leads to understand that only one link is used for a given destination IP + Port combination.

My question is the following: Should we be able to reach a throughput of 20 GB/s between pods? Or is it normal that we are stuck at 10 GB/s?

Intent

We are trying to use the sender_dependent_default_transport_maps feature of postfix to use different SMTP relays based on the from address of a mail. The goals are:

• allow our partners to use their own domain name as from email address for automated messages (e.g. [email protected])
• make sure that emails sent from [email protected] actually reach their users (e.g. [email protected])

Current configuration

Our current configuration is working fine but only uses our own SMTP server.

The /etc/postfix/master.cf is simple and looks like:

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
smtp      inet  n       -       y       -       -       smtpd
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp

The /etc/postfix/main.cf is the following:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_tls_cert_file=<path to PEM>
smtpd_tls_key_file=<path to KEY>
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = appserver.provider.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, appserver, localhost.localdomain, , localhost
relayhost = mail.provider.com:465
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl/passwd
smtp_sasl_mechanism_filter =
smtp_sasl_security_options =
smtp_tls_security_level = encrypt
smtp_tls_wrappermode = yes
smtp_tls_mandatory_ciphers = high
canonical_maps = hash:/etc/postfix/canonical_maps
sender_canonical_maps = hash:/etc/postfix/sender_canonical_maps
header_checks = regexp:/etc/postfix/header_checks

Attempted configuration

I tried the following configuration in order to achieve the goal.

• Update the main.cf:
  • remove the line relayhost = mail.provider.com:465
  • add a line sender_dependant_default_transport_maps = hash:/etc/postfix/sender_dependant_default_transport.map

• Add a /etc/postfix/sender_dependant_default_transport.map with the following content:

  @partner1.com     : smtp.partner1.com
  @provider.com     : mail.provider.com:465
  

• generate the map db: sudo postmap /etc/postfix/sender_dependant_default_transport.map

• restart the service: sudo service postfix restart

Outcome

Sending from @provider.com to @provider.com

The email does not get sent:

postfix/smtpd[3011]: connect from localhost[127.0.0.1]
postfix/smtpd[3011]: 3BE61178E1E: client=localhost[127.0.0.1]
postfix/cleanup[3032]: 3BE61178E1E: message-id=<[email protected]>
postfix/qmgr[2997]: 3BE61178E1E: from=<[email protected]>, size=376, nrcpt=1 (queue active) postfix/smtp[3033]: connect to mx2.provider.com[<IPv6>]:25: Network is unreachable
postfix/smtp[3033]: SSL_connect error to mx1.provider.com[<IPv4>]:25:
postfix/smtp[3033]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: postfix/smtp[3033]: 3BE61178E1E: Cannot start TLS: handshake failure postfix/smtp[3033]: SSL_connect error to mx2.provider.com[<IPv4>]:25: -1 postfix/smtp[3033]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
postfix/smtp[3033]: 3BE61178E1E: Cannot start TLS: handshake failure
postfix/smtp[3033]: SSL_connect error to mx3.provider.com[<IPv4>]:25:
postfix/smtp[3033]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: postfix/smtp[3033]: 3BE61178E1E: Cannot start TLS: handshake failure postfix/smtp[3033]: connect to mx1.provider.com[<IPv6>]:25: Network is unreachable
postfix/smtp[3033]: 3BE61178E1E: to=<[email protected]>, relay=none, delay=19, delays=18/0.01/0.54/0, dsn=4.4.1, status=deferred (connect to mx1.provider.com[<IPv6>]:25: Network is unreachable)

Sending from @partner1.com to @provider.com

The email does not get sent:

postfix/smtpd[3237]: connect from localhost[127.0.0.1]
postfix/smtpd[3237]: 6234B178E1E: client=localhost[127.0.0.1]
postfix/cleanup[3252]: 6234B178E1E: message-id=<[email protected]>
postfix/qmgr[2997]: 6234B178E1E: from=<[email protected]>, size=368, nrcpt=1 (queue active) postfix/smtp[3253]: connect to mx3.provider.com[<IPv6>]:25: Network is unreachable
postfix/smtp[3253]: SSL_connect error to mx2.provider.com[<IPv4>]:25: -1
postfix/smtp[3253]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: postfix/smtp[3253]: 6234B178E1E: Cannot start TLS: handshake failure postfix/smtp[3253]: connect to mx1.provider.com[<IPv6>]:25: Network is unreachable
postfix/smtp[3253]: SSL_connect error to mx3.provider.com[<IPv4>]:25: -1
postfix/smtp[3253]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: postfix/smtp[3253]: 6234B178E1E: Cannot start TLS: handshake failure postfix/smtp[3253]: connect to mx2.provider.com[<IPv6>]:25: Network is unreachable
postfix/smtp[3253]: 6234B178E1E: to=<[email protected]>, relay=none, delay=16, delays=16/0.01/0.33/0, dsn=4.4.1, status=deferred (connect to mx2.provider.com[<IPv6>]:25: Network is unreachable)

Actual question

Sorry for the very long introduction but I wanted to make sure I was thorough.

It seems that:

• the config change in the main.cf was picked up because postfix does not try to use the default relay anymore mail.provider.com but defaults to the MX records
• The sender_dependant_default_transport_maps is not used at all

How to make sure it is actually used? Could it be another cause?

According to the postfix logs while restarting, the parameter is not used:

postfix[4582]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: unused parameter: sender_dependant_default_transport_maps=hash:/etc/postfix/sender_dependant_default_transport_maps

but it does tell me why it is not used..

In our current environment, the haproxy.cfg has two conflicting options:

option httplog
option tcplog

The resulting log (/var/log/haproxy.log) looks like:

Jul 16 09:39:05 campus-deploy haproxy[9862]: client_ip:client_port [16/Jul/2018:09:39:01.238] https~ backend/backend_server 0/1/3999 420
-- 12/12/0/0/0 0/0

To me, the log looks more like a tcplog than a httplog (even though the fields are not exactly the same as in the documentation and we do not have custom logs in place).

My questions is the following:

• How does haproxy treat conflicting options?
  • Does it take the first fitting option?
  • Does it apply the last option (overriding the previous option)?

Thanks in advance for you insights.

Some of our users are complaining about the fact that the receive a notification (system tray icon of the print queue) about consumable being low into the printer they are printing to.

Even if it does not prevent them from printing (as long as they acknowledge the warning), they consider this as annoying. As this behavior only occurs with some printers, I believe that it must be some configuration on the print server, but I can't figure out which one. Do someone know how to turn that off?

For reference, the print server is running Windows 2008 R2, the client workstation are running Windows 7 and the printers are Xerox WorkCentre MFPs.

I'm currently trying to put together a proof of concept on mixing various technologies onto one web site in order to ease migrations and add flexibility. The idea is to create one 'mashup' site behind an IIS 7.5 ARR reverse proxy.

For the time being the ARR reverse proxy forwards all request to our main site. The request are as follow:

 client -> ARR: Get /
 ARR -> Server 1: Get /
 Server 1 -> ARR: 200: /index.htm
 ARR -> client: 200: /index.htm

...so far so good.

Let's say, I want to add a new site (root of another server) as a subsite of my main website. a simple inbound rule does the trick:

<rule name="sub1" stopProcessing="true">
  <match url="^mySubsite(.*)" />
  <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
  <action type="Rewrite" url="http://server2/{R:1}" />
</rule>

The requests now are:

 client -> ARR: Get /mySubsite
 ARR -> Server 2: Get /
 Server 2 -> ARR: 200: /index.htm
 ARR -> client: 200: /index.htm

... still ok.

The issue comes when the site on server2 sends a redirection (e.g. to a login page). In the case of SharePoint, it will redirect the user to: /_layouts/Authenticate.aspx?Source=%2F ...which does not exists:

client -> ARR: Get /mySubsite
ARR -> Server 2: Get /
Server 2 -> ARR: 301: /_layouts/Authenticate.aspx?Source=%2F
ARR -> client: 301: /_layouts/Authenticate.aspx?Source=%2F
client -> ARR: Get /_layouts/Authenticate.aspx?Source=%2F
ARR -> client: 404: Not Found

Does anyone know a way write the outbound rule to rewrite the response from server 2 "301: /_layouts/Authenticate.aspx?Source=%2F" to "301: /mySubsite/_layouts/Authenticate.aspx?Source=%2FmySubsite%2F"?

We are currently facing a debate regarding the Internet Explorer's setting 'Initialize and script ActiveX controls not marked as safe for scripting'.

I have been maintaining an in-house application that uses Outlook's and Word's automation to send email and generate letters. As it is an internal application, the url of the application is detected as 'Local Intranet'.

Our Sysadmins have changed the GPO of our workstation and disabled this setting. Unfortunately, this broke the script that was automating Office. Now we have a debate around the questions:

1. should we change this setting back?
2. or change the security of the local intranet zone to low (which would allow the script to run - with a prompt)?
3. or should we re-develop the application in order not to use office automation?

Of course, as a developer, I would recommend the first or the second solution. But, I'd like to make sure that I'm not asking for something that would put our company's security at stake.

Does anyone have any experience? feedback on such a topic?

I have a very weird behavior from Coldfusion 8 and IIS 7.

On the IIS, a site is declared and one of the subsirectories is a virtual directory poiting to a local filesystem. Everything is working except for a subdirectory. All of the sudden, I get an error 403 Access Denied as soon as I try to access a subfolder.

I place a simple CFM page to make my tests:

<html>
   <head>
   </head>
   <body>
      <cfoutput>Test</cfoutput>
   </body>
</html>

This request works: http://myserver/vDir/fckeditor/editor/test.cfm

While this one triggers a 403: http://myserver/vDir/fckeditor/editor/filemanager/test.cfm

I checked the following and could not find any difference:

• NTFS rights -> same on both directories. The user running the ColdFusion service has 'Full Control'
• IIS Authentication -> same on both folders
• Authorization Rules -> same on both folders
• Handler Mappings -> same on both folders

I turned on the Failed Request Tracing and added a rule to capture the event. It appears that the wildcard Coldfusion ISAPI filter is actually throwing the exception:

CALL_ISAPI_EXTENSION:

DllName ColdfusionInstallationPath\runtime\lib\wsconfig\1\jrun_iis6_wildcard.dll

MODULE_SET_RESPONSE_ERROR_STATUS:

ModuleName IsapiModule

Notification 128

HttpStatus 403

HttpReason Access denied.

HttpSubStatus 0

ErrorCode 0

ConfigExceptionInfo Notification

EXECUTE_REQUEST_HANDLER ErrorCode The operation completed successfully. (0x0)

Do anyone have a clue on how to solve this?

P.S. This question is cross-posted on StackOverflow at https://stackoverflow.com/questions/7270560/error-403-while-getting-cfm-page