Luke's questions

I'm using the CentOS 6 netinstall ISO with some kickstart files on an http server. When the ISO boots I hit TAB and enter the boot options asknetwork ks=http://<ip-address>/path/to/kickstart.ks.

My kickstart files do not have a network parameter, so it should be prompting. When I leave out asknetwork it tries to use DHCP. With asknetwork it only prompts for IP information.

Unfortunately anaconda is hell bent on automatically discovering the hostname, which ends up being a reverse DNS lookup of the IP, or localhost.localdomain if nothing was found.

Is there a way to make anaconda prompt for the hostname, or some way to pre-enter it through a custom boot option?

There used to be network --bootproto=query for CentOS 5, but this no longer works in 6.

When you see "!Z" or "!X" in a traceroute, what does that mean?

Where is it coming from, and how do I fix it?

I have 3 ESXi hosts, each with 4 uplinks dedicated to a port group. I want to utilize each of these uplinks for incoming/outgoing traffic (load balancing).

From what I understand I need to setup link aggregation and on my Force10 switches (stacked) and set IP Hash based load balancing.

VMware KB article 1021492 shows how to do this with Force10.

What isn't clear to me is, how many port channels do I need to setup?

One per ESXi host, or one for the entire port group? Does it matter?

I need to deploy vSphere Server Appliance 5.1. I have vSphere Client running locally and my internet upload is capped at 3 Mbps. It says it's going to take about 200 minutes to upload.

When selecting a URL as opposed to a local file, does vSphere Client download it locally and then upload, or does it download the OVA directly to the server?

My goal is to avoid waiting 3 1/2 hours for this to upload.

If specifying a URL isn't any faster, are there any other methods that would allow me to deploy from the datacenter instead of my office?

We don't have any Windows VM's installed on our cluster. So unfortunately I don't have a Windows machine with faster upload speed.

Can vCenter authenticate against FreeIPA instead of Active Directory? If so, how would you set it up?

We have a pure Linux environment (CentOS) and need to have vCenter and our VM's have the same users. vCenter is deployed as a Linux appliance. Would prefer not to have a Windows machine in our environment.

I'm following this guide in setting up a nested ESXi 5 lab on a single box. It has you create 4 ports for each virtual ESXi box, 1 on VMNetwork and 3 on a Trunk port group. It says you need to do this to be able to create VLANs on the virtual ESXi boxes.

How does this work exactly? Is the VM Network port any different than the Trunk ports? The virtual ESXi boxes don't show the same distinction.

I'm having trouble wrapping my head around why/how this is necessary.

Can I assign individual ports on a single adapter to different vSwitches? In other words can I assign 2 ports for SAN and 2 ports for LAN on a 4 port nic?

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster.

Our environment consists of 3 server nodes (16 cores w/ 64 GB RAM each) over 2x 1 GB switches w/ an iSCSI shared storage array.

Assuming that we would be dedicating resources to the VMWare appliances, would we have any benefit of choosing a hardware firewall over a virtual one?

If we choose to use a hardware firewall, how would a dedicated server firewall w/ something like ClearOS compare to a Cisco firewall?

I'm setting up a VMWare ESXi 5 environment with 3 server nodes. Dell recommended 2x Force10 S60 switches shared (iSCSI SAN, LAN/WAN). The S60 switches are extremely powerful. They have 1.25 GB of buffer cache, < 9us latency. But they are very expensive (online price ~$15k per switch, actual quote a little less).

I've been told that "by the book" you should at least have 2 internal switches for SAN, and 2 switches for LAN/WAN (each with a redundant). I know some of the pros and cons of each approach. What I'm wondering is, would it be more cost effective to disjoin the SAN from LAN with less expensive switches?

The answer to this question highlights what I should be looking for in a switch for the SAN. What should I be looking for in a LAN/WAN switch, in comparison to the SAN?

With the above linked question for the SAN:

• How is buffer latency measured? When you see 36 MB of buffer cache, is that shared or per port? So 36 MB would be 768kb or 36MB per port?
• With 3 to 6 servers how much buffer cache do you really need?
• What else should I be looking at?

Our application will be heavily using HTML5 websockets (high number of persistent connections). The amount of data being sent is small; Data sent between client <-> server isn't broadcasted (not a chat/IM service). We will be doing some database reporting too (csv export, sums, some joins).

We are a small business and on a budget. We'd probably only be able to spend no more than $20k on switches total (2 or 4).

About six months ago we transitioned from an in-house Exchange 2003 server to a hosted Exchange 2010 service.

For the most part this has worked well, but the providers OWA constantly times out. About 6/10 requests time out or more, and it's gotten to the point where OWA is just unusable. To give you an example: I'll login, read an email, choose reply and the window for replying gives me a request has timed out message. After a few attempts I'll get it to work and reply. After that I'll read another email and it'll timeout.

I contacted the provider about this and they said it's a known issue with Exchange 2010, for all providers, they're working with Microsoft to correct the issue, and there is no ETA.

To be clear this isn't a session issue. I don't have to login, it just says the request timed out and to try again. After a few attempts it does work. It's just extremely annoying.

I've spent a litte time researching the problem and I can't find anything that would suggest it's a common issue. Exchange 2010 has been around for a while, so I would suspect that if it was a huge problem it would have been corrected by now.

So is my provider full of crap, or is there really an issue that has yet to be corrected? If the issue does exist, is there any docs on it?

We're in the planning/development stage for our new platform and with everything separated out we'll need to setup between 9 to 16 servers, a load balancer, 2 or 3 hardware firewalls, and a VPN.

During development we need to simulate all of this as cheaply as possible. Ideally I'd like to be able to setup a single machine with a lot of RAM and virtualize all of this to figure out what works and what doesn't.

What are my better options as far as virtualization? VMWare? Other? How can I virtualize all the appliances as well?

The appliances our data center offers: Cisco ASA 5510 (firewall), Foundry FCSLB8 Serveriron XL (load balancer)

(We'll be running CentOS 6 64bit on our servers)

Looking for something super easy. Something that will help me learn the real environment for later on.

The company I use ranges from $136-$495 per month, per server, ranging from low-end (AMD Athlon 64 X2 4600+) to enterprise (Intel Dual Xeon X5650, A/B Power).

The biggest pro for renting a server is if hardware fails they replace it for you. But if you have enterprise servers, $400+ a month can get expensive.

At what point would colocation be more cost effective? As in, how many servers would have have to be renting for colocation to be better? Any other pros and cons?

I was reading an article on Linux Journal about Memcached and it mentions Netbooting multiple servers off a single root image:

LiveJournal's Web nodes are all diskless, Netbooting off a common yet redundant NFS root image. Not only is this cheaper, but it requires significantly less maintenance.

How does this work with logging? Does each node write to the same place? What about configuring static ip addresses? If machine A writes to the disk, does machine B pick it up? When he says "web node" does he mean just the web server? I'm assuming this means the web application as well (PHP/Perl), correct?

Is this even a good idea (with mostly using RAM)?

Can this same thing be done with iSCISI?

I have a write-heavy application. The application is best compared to surveys - the customer creates custom questionares and this is saved to the database. Most of the requests are from their users submitting these forms. Later on our customers do complex reports and graphs on these submissions.

Making sure our application server (PHP) and the web server (Nginx) scales is quite easy, the trouble is scaling the database server onto multiple servers.

A lot of applications are more read heavy, so typically you'll have a master-slave replication setup where all writes go to a single master, but reads are distributed to the slaves. For us this doesn't work because we're doing writes most of the time.

I've seen mention of a master-master setup, but this typically hits a snag with auto incremented primary keys. The solution is typically to have one server do odd numbers, and the other do evens. I want to avoid that.

On some similar questions I've seen mention of the Tungsten Replicator and how it gives you a lot more flexibility with replication. Would this help me at all? What kind of benefits would this give me that MySQL's built in replication can not provide?

There is also MySQL Cluster, but this typically hits a snag with very large databases and complex queries (joins). I need to be able to run complex reports, so this probably won't work for me.

I'm looking for redundancy, automatic fail over, distributing requests, and data integrity.

Are there other RDMS that provide better solutions that are suitable for the web?

On one of my servers a .mozilla folder was created while adding a user. I found it in one other user folder, but not the initial user that I created.

Where did it come from?

Im using CentOS 5.x.

Edit: This is what "locate mozilla" turns up:

/etc/selinux/targeted/modules/active/modules/mozilla.pp
/etc/selinux/targeted/modules/previous/modules/mozilla.pp
/etc/skel/.mozilla
/etc/skel/.mozilla/extensions
/etc/skel/.mozilla/plugins
/home/refwcx/.mozilla
/home/refwcx/.mozilla/extensions
/home/refwcx/.mozilla/plugins
/usr/lib64/mozilla
/usr/lib64/mozilla/extensions
/usr/lib64/mozilla/plugins
/usr/lib64/xulrunner-1.9/mozilla-xremote-client
/usr/lib64/xulrunner-1.9/run-mozilla.sh
/usr/share/mozilla
/usr/share/doc/selinux-policy-2.4.6/html/apps_mozilla.html
/usr/share/mime/application/vnd.mozilla.xul+xml.xml
/usr/share/mime/application/x-mozilla-bookmarks.xml
/usr/share/mozilla/extensions
/usr/share/selinux/targeted/mozilla.pp

A yum package "xulrunner" was installed. Anyone know what this is? Did someone install this, or did it come with an update, or is it a dependency of some package?

I've setup a port knocking scheme to protect port 22 using iptable rules. On top of that I've setup some "honey pot" rules to disable port knocking for the client for several minutes if they hit common ports that are not used (port 21 for example) or ports around the knocking sequence. This seems to work well (I believe it's a better option than changing the port to something obscure). For SSHD password logins are disabled anyway - an encrypted private/public key combo is required.

On this page there is a "drip pan" scheme that if unused ports are hit the client cannot communicate with anything (even open ports) for 60 seconds. My biggest concern is "--hitcount 3" seems to be triggered by any simple request to a single port.

So my question is, what do you think about this kind of setup? Is the "drip pan" too much on a web server, or just right? Other than keeping a drop in-out policy and only opening what is needed, do you guys have any other firewall security advice?

Edit: I'm using CentOS 5.7. We're assuming as "secure as possible within reason". A server would have to pass PCI/SAS compliances (and other similar standards). Focus would be the firewall, not necessarily vulnerabilities with individual services that could come be discovered (that's another topic). Anything that I'm missing related to the firewall or anything on the outside. Want to make it as difficult as possible for an attacker to gain access.

I know that /var/log/btmp is for failed login attempts. Typically having a file this large indicates brute force attempts. The 6GB is an accumulation over the past 3 years. I've taken steps to hide sshd so it is not accessible to anyone besides myself. These steps should drastically decrease the amount of log entires in this file.

The current entires up until this point is just noise - bots trying to brute force the server.

My question is, how do I safely empty this file, or trim it down to the last month? I know the format of this file isn't plain text, so I don't want to break the file (want to be able to review it later).

I'm using "-A INPUT -j LOG" as my last rule to see packets coming in other than what my firewall rules allow. The logging works, but it doesn't tell me what port numbers are being connected to. How do I get this information so I can identify where these packets are coming from?

I've been looking into using port knocking as a way to conceal/protect SSHD. I'm aware of knockd and other implementations, but I want something portable and simple. So I've decided iptables with the recent module is good enough.

I've already disabled password based login and require a public/private key. I just want it to appear like SSHD is not on the server, even to a port scanner.

I've seen many iptables rule examples, and I'm not quite clear how they're supposed to work.

What I want is to knock on a single obscure port to open port 22. At the same time I want to disable port knocking for a while if ports around it are accessed. So if my knocking port was 123, knocking on this port would open port 22 for 5 seconds for just the knocker. But if port 122 or 124 was knocked on it would disable port knocking for the knocker for 15 minutes (so even if they knocked on 123 nothing would happen in that time frame).

What iptables rules would achieve this?

Edit: I should add that I'm using CentOS 5.5. iptable modules can be used.

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)