Home / user-94415

Selivanov Pavel's questions

Martin Hope
Selivanov Pavel
Asked: 2020-11-24 05:10:10 +0800 CST
  • 5

nginx expires directive sets 2 headers, Expires and Cache-Control:

Config:

expires 1d;

Headers:

Expires: Tue, 24 Nov 2020 12:51:31 GMT
Cache-Control: max-age=86400

I would like to keep Expires header but also set Cache-Control to public, max-age=86400, immutable. But that produces double Cache-Control headers:

Config:

expires 1d;
add_header Cache-Control "public, max-age=86400, immutable"

Headers:

Expires: Tue, 24 Nov 2020 12:57:53 GMT
Cache-Control: max-age=86400
Cache-Control: public, max-age=86400, immutable

I can not just use add_header Expires ..., because it requires exact time in future, not just number of seconds.

I tried using more_set_headers from ngx_headers_more module, but Cache-Control header set by expires directive is still there.

Is there any way to combine correct Expires header with Cache-Control set to immutable?

nginx
Martin Hope
Selivanov Pavel
Asked: 2020-09-12 06:12:00 +0800 CST
  • 1

I have a location in nginx where GET and POST requests should go to different named locations. But this code doesn't work:

if ( $request_method = GET ) {
try_files /NON-EXISTENT @named_location_get
}

if ( $request_method = POST ) {
try_files /NON-EXISTENT @named_location_post
}

Because try_files is not allowed inside if.

Is there any other way to redirect request to named location, that would work inside if?

nginx
Martin Hope
Selivanov Pavel
Asked: 2017-09-30 05:31:19 +0800 CST
  • 3

I am trying to unpack initrd image:

# file /boot/initrd.img-4.11.0-14-generic
/boot/initrd.img-4.11.0-14-generic: ASCII cpio archive (SVR4 with no CRC)
# mkdir /tmp/initrd; cd /tmp/initrd
# cpio -i -d -H newc --no-absolute-filenames -F /boot/initrd.img-4.11.0-14-generic
194 blocks
# ls -R
.:
kernel

./kernel:
x86

./kernel/x86:
microcode

./kernel/x86/microcode:
GenuineIntel.bin

So cpio extracts only ./kernel subdirectory of archive. But lsinitramfs show much more files inside it:

# lsinitramfs /boot/initrd.img-4.11.0-14-generic
/boot/initrd.img-4.11.0-14-generic
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/GenuineIntel.bin
.
lib
lib/libnss_files.so.2
lib/cryptsetup

...

bin/egrep
init
run

How can I get all the archive contents?

initramfs
Martin Hope
Selivanov Pavel
Asked: 2014-04-01 00:15:20 +0800 CST
  • 2

Here is custom fact:

require 'etc'

Etc.passwd do |user|
    Facter.add("homedir_#{user.name}".intern) do
        setcode { user.dir }
    end
end

It determine users home dir locations.

Here is defined type:

define ssh_keys::key ($user) {

    $home = $::homedir_#{user}

    if $home != undef {

    file { "$home/.ssh/":
        ensure => directory,
    }

    file { "$home/.ssh/authorized_keys":
        ensure => file,
        source => "puppet:///modules/ssh_keys/$user",
        }
    }

}

It does not work with $::homedir_#{user}, but works with exactly defined fact: $::homedir_root. What is wrong here?

puppet
Martin Hope
Selivanov Pavel
Asked: 2014-02-16 00:31:19 +0800 CST
  • 1

Ubuntu 12.04 LTS

Apache/2.2.22

http://server/lightsquid/ gives window with username/password request, then «500 Internal Server Error». Error rises whatever username and password were used: valid or not. If line Require valid-user is removed, everything works fine, so problem is in mod_authnz_ldap module.

Module mod_authnz_ldap is enabled. Apache config:

Alias           /lightsquid /usr/lib/cgi-bin/lightsquid
<Directory "/usr/lib/cgi-bin/lightsquid">
        AddHandler cgi-script .cgi
        Options +ExecCGI
        Order allow,deny
        Allow from all

        AuthType Basic
        AuthName "USE YOUR WINDOWS ACCOUNT"
        AuthBasicProvider ldap
        AuthzLDAPAuthoritative on
        #AuthzLDAPAuthoritative off
        #AuthUserFile /dev/null

        AuthLDAPBindDN "CN=squid_auth,DC=domain,DC=ru"
        AuthLDAPBindPassword "*****************"
        AuthLDAPURL "ldap://dc2.domain.ru/dc=domain,dc=ru?sAMAccountName?sub?(objectClass=*)"
        Require valid-user

</Directory>

Changing AuthzLDAPAuthoritative off to 

AuthzLDAPAuthoritative 
AuthUserFile /dev/null

does not help.

LogLevel is debug.

error.log does not have any entries ablut error. In access.log I can see

192.168.0.1 - selivanov [15/Feb/2014:11:51:00 +0400] "GET /lightsquid/index.cgi HTTP/1.1" 500 814 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0"

How can I force it to give me normal problem diagnostics? Logs are almost empty.

apache-2.2
Martin Hope
Selivanov Pavel
Asked: 2013-09-16 02:44:58 +0800 CST
  • 4

There is tc queue discipline DRR(Dificite Round Robin) .

It has same capabilities, as HTB, but instead of using buckets, filled with tokens, it just assignes every queue some Dificit Counter. On packet sending DC is decreased by packet size. If DC is less than packet size, DC is increased by queue's quantum and next queue is processed. So, it can divide outgoing traffec in some ratio, without knowing channel width(which is required for HTB). See http://www.unix.com/man-page/linux/8/tc-drr/

Setup: two hosts, 172.16.1.1 и 172.16.1.2.

On first host we are listening to traffic:

nc -l 8111
nc -l 8112

On second host we check speed:

pv /dev/zero | nc 172.16.1.1 8111
pv /dev/zero | nc 172.16.1.1 8112

Now speed is equal(pv is utility allowing to measure speed of data tranfering via pipeline). Add DRR on second host(HTB at top is used to emulate real channel speed limits):

tc qdisc add dev eth0 root handle 1: htb
tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit ceil 100mbit
tc qdisc add dev eth0 parent 1:1 handle 2: drr
tc class add dev eth0 parent 2: classid 2:1 drr quantum 600
tc class add dev eth0 parent 2: classid 2:2 drr quantum 1400
tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dport 8111 0xffff classid 2:1
tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dport 8112 0xffff classid 2:2

Speed remains equal :( What am I doing wrong?

linux
Martin Hope
Selivanov Pavel
Asked: 2013-05-17 03:19:33 +0800 CST
  • 2

I'm using PostgreSQL 9.1 with streaming replication for failover and WAL for archiving.

If I use the archive_command configuration directive on my standby server it will always fail (because the WAL segments it is trying to archive are already archived by master), so I'm using an empty archive_command on standby server.
The problem is when my master server is down and the standby server becomes the new master archiving stops. Is there any way to know in archive_command script if server is running in master mode?

I can make an archive_command script that returns 0 if file with name of segment I'm trying to archive already exists, but I'm not sure if this is right behavior for archive_command.

postgresql
Martin Hope
Selivanov Pavel
Asked: 2012-09-26 11:46:22 +0800 CST
  • 0

Server has 2 interfaces:

  • eth1 with address 13.0.0.254/24
  • eth0 with address 172.20.203.4/24.

It's routing traffic between this two networks. Task is to limit bandwidth between this two networks to 1Vbit/sec, but not to limit bandwidth between server and network hosts(i. e. limit all packets going though FORWARD)

iptables -t mangle -A POSTROUTING -s 13.0.0.0/24 -d 172.20.203.0/24 -j MARK --set-mark 0x0001
iptables -t mangle -A POSTROUTING -s 172.20.203.0/24 -d 13.0.0.0/24 -j MARK --set-mark 0x0002

# eth1
tc qdisc add dev eth1 root handle 1:0 htb default 2

tc class add dev eth1 parent 1:0 classid 1:1 htb rate 1000mbps ceil 1000mbps
tc class add dev eth1 parent 1:1 classid 1:2 htb rate 999mbps ceil 1000mbps
tc class add dev eth1 parent 1:1 classid 1:3 htb rate 1mbps

tc qdisc add dev eth1 parent 1:2 handle 2:0 sfq perturb 10
tc qdisc add dev eth1 parent 1:3 handle 3:0 sfq perturb 10

tc filter add dev eth1 parent 1:0 handle 1 fw flowid 1:3
tc filter add dev eth1 parent 1:0 handle 2 fw flowid 1:3

# eth0
tc qdisc add dev eth0 root handle 1:0 htb default 2

tc class add dev eth0 parent 1:0 classid 1:1 htb rate 1000mbps ceil 1000mbps
tc class add dev eth0 parent 1:1 classid 1:2 htb rate 999mbps ceil 1000mbps
tc class add dev eth0 parent 1:1 classid 1:3 htb rate 1mbps

tc qdisc add dev eth0 parent 1:2 handle 2:0 sfq perturb 10
tc qdisc add dev eth0 parent 1:3 handle 3:0 sfq perturb 10

tc filter add dev eth0 parent 1:0 handle 2 fw flowid 1:3
tc filter add dev eth0 parent 1:0 handle 1 fw flowid 1:3

This doesn't work. If I use this at the beginning:

tc qdisc add dev eth1 root handle 1:0 htb default 3
tc qdisc add dev eth0 root handle 1:0 htb default 3

it works. So problem is in filter settings.

iptables -L -v -n -t mangle

shows, that packets are going though MARK rules. I tried to mark packets not in POSTROUTING, but in FORWARD or PREROUTING - this does not work too. What am I doing wrong?

Here is some diagnostics:

# tc -s -d -r filter show dev eth0
filter parent 1: protocol [768] pref 49151 fw
filter parent 1: protocol [768] pref 49151 fw handle 0x1 classid 1:3
filter parent 1: protocol [768] pref 49152 fw
filter parent 1: protocol [768] pref 49152 fw handle 0x2 classid 1:3
# tc -s -d -r filter show dev eth1
filter parent 1: protocol [768] pref 49151 fw
filter parent 1: protocol [768] pref 49151 fw handle 0x2 classid 1:3
filter parent 1: protocol [768] pref 49152 fw
filter parent 1: protocol [768] pref 49152 fw handle 0x1 classid 1:3
linux
Martin Hope
Selivanov Pavel
Asked: 2012-08-15 03:12:13 +0800 CST
  • 3

Rough solution:

iptables -A FORWARD -i br200 -j ACCEPT
iptables -A FORWARD -o br200 -j ACCEPT

I still don't understand what's happening. Bridging is made on L2, iptables shouldn't touch that packets.

Configuration:

Debian 6.0 Squeeze

OpenVPN 2.2.1(from backports)

My task is to connect remote clients with local network on data link layer, so that they stay in one broadcast domain and have the same network/netmask as local clients. I'm using TAP interfaces and bridging. All related interfaces(ethernet(local network), TAP(VPN) and bridge) are set to promiscuous mode. Network/netmask is 172.20.200.0/24. Server address is 172.20.200.2.

Both local and remote clients can ping server, but there is no connection between local and remote clients. Using packet capturing program tshark on server (tshark -i br200 -f "icmp" ) I see icmp echo requests from from remote client to local. On local client I don't see that requests(using Wireshark). Moreover, local client have remote client arp address in arp cache, and remote client have local client arp address in arp cache. So, they see each other on data link network layer. But they just can't ping each other! Firewall and antivirus are disabled on both clients. Where is the problem? I don't understand.

/etc/network/interfaces

auto bond0.200
  iface bond0.200 inet manual
        vlan_raw_device bond0
        up ifconfig bond0.200 0.0.0.0 promisc up

  auto br200
  iface br200 inet static
        bridge_ports bond0.200
        bridge_stp off
        bridge_fd 1
        address 172.20.200.2
        netmask 255.255.255.0
        post-up ifconfig br200 promisc

/etc/openvpn/server.conf

mode server
tls-server
port *****
proto tcp-server
dev tap200

script-security 2

up /etc/openvpn/bridge-start
down /etc/openvpn/bridge-stop

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
#crl-verify crl.pem

auth sha1
cipher AES-256-CBC

; !!!
; comp-lzo

tun-mtu 1500
mssfix 1450

client-config-dir /etc/openvpn/ccd
ccd-exclusive

client-to-client
keepalive 10 120

persist-key
persist-tun

status /var/log/openvpn/server-arm.status
log-append  /var/log/openvpn/server-arm.log

/etc/openvpn/ccd/client-arm23

ifconfig-push 172.20.200.132 255.255.255.0

/etc/openvpn/bridge-start

#!/bin/bash
#set -x
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

br="br200"
tap="tap200"

openvpn --mktun --dev $tap
ifconfig $tap 0.0.0.0 promisc up

brctl addif $br $tap

exit 0

/etc/openvpn/bridge-stop

#!/bin/bash
#set -x
####################################
# Tear Down Ethernet bridge on Linux
####################################

br="br200"
tap="tap200"

brctl delif $br $tap

openvpn --rmtun --dev $tap

exit 0

MTU and MRU on all interfaces coincide.

bond0.200 is vlan device over bond device. Maybe this in some strange way causes errors?

openvpn
Martin Hope
Selivanov Pavel
Asked: 2012-05-24 05:50:49 +0800 CST
  • 7

I have RouterOS 5.14 on RB493G. I need to write script, that launches

/tool fetch ...

Execution of fetch may result in error, this is OK(URL may be sometimes unavailable). Script hangs on error. Is there any way to ignore it?

Solution:

[admin@Mikrotik] >> /system script
0 name=safe-fetch source=
:global done
:global url

/tool fetch $url
:Set done=true

1 name=test source=
:global done
:global url="google.com"

:set done false
:execute safe-fetch
:local counter 0
:while ( $done != true && $counter < 10 ) do={
    :set counter ($counter+1)
    :delay 0.2
    }

if ($done = "true") do={
   :put "Fetch OK"
   } else={
   :put "Fetch ERROR"
   }

Warning: not documented ":execute" is used.

scripting mikrotik
Martin Hope
Selivanov Pavel
Asked: 2011-11-30 11:19:34 +0800 CST
  • 4

I failed to configure AgentForwarding with PuTTY :(

PuTTY is newest 0.61 version. I have created public/private key pair for PuTTY, converted them to openssh format, added them to /root/.ssh/authorized_keys on both host1 and host2. On both hosts in /etc/ssh/sshd_config:

PermitRootLogin without-password
AuthorizedKeysFile      %h/.ssh/authorized_keys
AllowAgentForwarding yes

On both hosts /root/.ssh/config contains

Host *
    ForwardAgent yes

In PuTTY configuration, option Connection/SSH/Auth/Allow agent forwarding [x] is checked on.

Whan I'm running pagent.exe with loaded keyfile, I can connect to host1 and host2 without password. But when I am connected to host1 and try to ssh root@host2, I'm prompted for password. Variable $SSH_AUTH_SOCK is not set in my host1 session. What am I doing wrong?

ssh putty
Martin Hope
Selivanov Pavel
Asked: 2011-11-22 15:17:02 +0800 CST
  • 2

I'm trying to configure OpenVPN with openvpn-auth-ldap plugin to authorize users via Active Directory LDAP. When I use the same server config without plugin option, and add client config with generated client key and cert, connection is successful, so problem is in the plugin.

server.conf:

plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn-test/openvpn-auth-ldap.conf"
port 1194
proto tcp
dev tun
keepalive 10 60
topology subnet
server 10.0.2.0 255.255.255.0
tls-server
ca ca.crt
dh dh1024.pem
cert server.crt
key server.key
#crl-verify crl.pem
persist-key
persist-tun
user nobody
group nogroup
verb 3
mute 20

openvpn-auth-ldap.conf:

<LDAP>
    URL             ldap://dc1.domain:389
    TLSEnable       no
    BindDN          cn=bot_auth,cn=Users,dc=domain
    Password        bot_auth
    Timeout         15
    FollowReferrals yes
</LDAP>

<Authorization>
        BaseDN          "cn=Users,dc=domain"
        SearchFilter    "(sAMAccountName=%u)"
        RequireGroup    false
#        <Group>
#                BaseDN          "ou=groups,dc=mycompany,dc=local"
#                SearchFilter    "(|(cn=developers)(cn=artists))"
#                MemberAttribute uniqueMember
#        </Group>
</Authorization>

Top-level domain in AD is used by historical reasons. Analogue configuration is working for Apache 2.2 in mod-authzn-ldap. User and password are correct.

client.conf:

remote server_name
port 1194
proto tcp
client
pull
remote-cert-tls server
dev tun
resolv-retry infinite
nobind
ca ca.crt
; with keys - works fine
#cert test.crt
#key test.key
; without keys - by password
auth-user-pass
persist-tun
verb 3
mute 20

In server log there is string PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-ldap.so '[/usr/lib/openvpn/openvpn-auth-ldap.so] [/etc/openvpn-test/openvpn-auth-ldap.conf]' which indicates, that plugin failed. I can telnet to dc1.domain:389, so this is not network/firewall problem. Later server says TLS Error: TLS object -> incoming plaintext read error TLS handshake failed - without plugin it tryes to do usal key authentification.

server log:

Tue Nov 22 03:06:20 2011 OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 21 2010
Tue Nov 22 03:06:20 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Nov 22 03:06:20 2011 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-ldap.so '[/usr/lib/openvpn/openvpn-auth-ldap.so] [/etc/openvpn-test/openvpn-auth-ldap.conf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY|PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT
Tue Nov 22 03:06:20 2011 Diffie-Hellman initialized with 1024 bit key
Tue Nov 22 03:06:20 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Tue Nov 22 03:06:20 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Nov 22 03:06:20 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 22 03:06:20 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 22 03:06:20 2011 TLS-Auth MTU parms [ L:1543 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Nov 22 03:06:20 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Nov 22 03:06:20 2011 TUN/TAP device tun1 opened
Tue Nov 22 03:06:20 2011 TUN/TAP TX queue length set to 100
Tue Nov 22 03:06:20 2011 /sbin/ifconfig tun1 10.0.2.1 netmask 255.255.255.0 mtu 1500 broadcast 10.0.2.255
Tue Nov 22 03:06:20 2011 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Tue Nov 22 03:06:20 2011 GID set to nogroup
Tue Nov 22 03:06:20 2011 UID set to nobody
Tue Nov 22 03:06:20 2011 Listening for incoming TCP connection on [undef]
Tue Nov 22 03:06:20 2011 TCPv4_SERVER link local (bound): [undef]
Tue Nov 22 03:06:20 2011 TCPv4_SERVER link remote: [undef]
Tue Nov 22 03:06:20 2011 MULTI: multi_init called, r=256 v=256
Tue Nov 22 03:06:20 2011 IFCONFIG POOL: base=10.0.2.2 size=252
Tue Nov 22 03:06:20 2011 MULTI: TCP INIT maxclients=1024 maxevents=1028
Tue Nov 22 03:06:20 2011 Initialization Sequence Completed
Tue Nov 22 03:07:10 2011 MULTI: multi_create_instance called
Tue Nov 22 03:07:10 2011 Re-using SSL/TLS context
Tue Nov 22 03:07:10 2011 Control Channel MTU parms [ L:1543 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Nov 22 03:07:10 2011 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Tue Nov 22 03:07:10 2011 Local Options hash (VER=V4): 'c413e92e'
Tue Nov 22 03:07:10 2011 Expected Remote Options hash (VER=V4): 'd8421bb0'
Tue Nov 22 03:07:10 2011 TCP connection established with [AF_INET]10.0.0.9:47808
Tue Nov 22 03:07:10 2011 TCPv4_SERVER link local: [undef]
Tue Nov 22 03:07:10 2011 TCPv4_SERVER link remote: [AF_INET]10.0.0.9:47808
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 TLS: Initial packet from [AF_INET]10.0.0.9:47808, sid=a2cd4052 84b47108
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 TLS Error: TLS object -> incoming plaintext read error
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 TLS Error: TLS handshake failed
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 Fatal TLS error (check_tls_errors_co), restarting
Tue Nov 22 03:07:11 2011 10.0.0.9:47808 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Nov 22 03:07:11 2011 TCP/UDP: Closing socket

client log:

Tue Nov 22 03:06:18 2011 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22 2010
Enter Auth Username:user
Enter Auth Password:
Tue Nov 22 03:06:25 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Nov 22 03:06:25 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Nov 22 03:06:25 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 22 03:06:25 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 22 03:06:25 2011 Control Channel MTU parms [ L:1543 D:168 EF:68 EB:0 ET:0 EL:0 ]
Tue Nov 22 03:06:25 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Nov 22 03:06:25 2011 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Tue Nov 22 03:06:25 2011 Local Options hash (VER=V4): 'd8421bb0'
Tue Nov 22 03:06:25 2011 Expected Remote Options hash (VER=V4): 'c413e92e'
Tue Nov 22 03:06:25 2011 Attempting to establish TCP connection with [AF_INET]10.0.0.2:1194 [nonblock]
Tue Nov 22 03:06:26 2011 TCP connection established with [AF_INET]10.0.0.2:1194
Tue Nov 22 03:06:26 2011 TCPv4_CLIENT link local: [undef]
Tue Nov 22 03:06:26 2011 TCPv4_CLIENT link remote: [AF_INET]10.0.0.2:1194
Tue Nov 22 03:06:26 2011 TLS: Initial packet from [AF_INET]10.0.0.2:1194, sid=7a3c2a0f bd35bca7
Tue Nov 22 03:06:26 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Nov 22 03:06:26 2011 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/[email protected]
Tue Nov 22 03:06:26 2011 Validating certificate key usage
Tue Nov 22 03:06:26 2011 ++ Certificate has key usage  00a0, expects 00a0
Tue Nov 22 03:06:26 2011 VERIFY KU OK
Tue Nov 22 03:06:26 2011 Validating certificate extended key usage
Tue Nov 22 03:06:26 2011 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Nov 22 03:06:26 2011 VERIFY EKU OK
Tue Nov 22 03:06:26 2011 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/[email protected]
Tue Nov 22 03:06:26 2011 Connection reset, restarting [0]
Tue Nov 22 03:06:26 2011 TCP/UDP: Closing socket
Tue Nov 22 03:06:26 2011 SIGUSR1[soft,connection-reset] received, process restarting
Tue Nov 22 03:06:26 2011 Restart pause, 5 second(s)
^CTue Nov 22 03:06:27 2011 SIGINT[hard,init_instance] received, process exiting

Does anybody know how to get openvpn-auth-ldap wirking?

openvpn
Martin Hope
Selivanov Pavel
Asked: 2011-10-07 05:58:38 +0800 CST
  • 12

I have Mercurial repositories running on Apache with mod_wsgi. Repositories have all filenames encoded in windows-1251. This encoding is used for historically reasons: they were converted to mercurial from svn, windows-1251 is default windows encoding for russian locale.

Now programmers want to use Crucible tool for code review. It can't undersand filenames in any other encoding than utf-8. So I need to convert them from windows-1251 to utf-8. Does anyone know how to do this? Mercurial convert extension doesn't have options to convert encodings.

hgweb.config:

[web]
#encoding = UTF-8
encoding = windows-1251
#allow_archive = gz, zip, bz2
allow_archive = zip
allow_push = *
push_ssl = false

[extensions]

[collections]
/data/mercurial = /data/mercurial
mercurial encoding crucible
Martin Hope
Selivanov Pavel
Asked: 2011-09-17 09:28:05 +0800 CST
  • 2

I'm running Apache 2 and I need to authentificate users from multiple AD domains in one <Location/>. I tried using mod_authn_alias

ОС: Debian GNU/Linux Squueze with lastest updates
Apache/2.2.16

Modules

/etc/apache2/apache.conf:

<AuthnProviderAlias ldap first-ldap>
    AuthLDAPURL "ldap://win2003server:389/DC=first,DC=domain?sAMAccountName?sub?(objectClass=*)" NONE
    AuthLDAPBindDN "cn=user1,cn=Users,dc=first,dc=domain"
    AuthLDAPBindPassword "user1"
</AuthnProviderAlias>

<AuthnProviderAlias ldap second-ldap>
    AuthLDAPURL "ldap://win2008server:3268/DC=second,DC=domain?sAMAccountName?sub?(objectClass=*)" NONE
    AuthLDAPBindDN "cn=user2,cn=Users,dc=second,dc=domain"
    AuthLDAPBindPassword "user2"
</AuthnProviderAlias>

/etc/apache2/sites-enabled/000default:

<Location /test>

    Order allow,deny
    Allow from all

    Authtype Basic
    AuthBasicProvider first-ldap second-ldap
    AuthName "TEST"
    AuthzLDAPAuthoritative off
    require valid-user

</Location>

With this configuration it authentificates users from first domain, and for users from second domain it igves an error:

 [Fri Sep 16 20:54:39 2011] [info] [client 10.0.0.62] [25672] auth_ldap authenticate: user2 user2 authentication failed; URI /test/ [ldap_simple_bind_s() to check user2 credentials failed][Invalid credentials]

When I leave only AuthBasicProvider second-ldap users from second domain can authntificate successfully, so second domain LDAP is OK.

Does any one know solution to force mod_authn_alias to work?

apache-2.2 mod-auth-ldap mod-authn-alias