yield's questions

I am looking to get a list of the support or configurable TLS Cypher that can be use with GCP MySQL 8.x engine. (From GCP UI)

On the configuration page, there is no options to specify, enable or even disable some desired or undesired ones.

Are there any policies I need to change at the top level of the project or there is just no option at all.

It seem to only support TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (or that I was able to connect using) at the moment. Not that it's not a fine solution, just that corpo. wise, this is not a prefered cypher.

This is a ''general'' question. Hear me out.

Let's say I have a MySQL standalone or even a 3 or 5 nodes cluster. Would it be a good practice to have 1 filesystem per schema ?

For example, schema{1..5} would go in /var/lib/mysql/data/schema{1..5}

And I am not talking about RAID level under theses filesystems here... Just, plain FS. Let assume I use XFS here.

What gain would I potentially gain from it ?

• Easier FS backup or even (LVM) backup/snapshot ?
• Performance ?
• Faster node data replication ?

What else...

Good morning !

I am using Vault from HashiCorp and would like to move secrets and secrets structure around.

I have a bunch of secrets under a path, let say:

• boo/foo/
• boo/foo/bar/secret1
• boo/foo/bar/secret2
• boo/foo/bar/secret3
• boo/foo/bar/secretn+

But I need to move all of theses secrets, or even all of foo/ under another path on my Hashi Vault.

Is there any function from the Vault API to achieve that or Ill need to wrap the API with a script to achieve that ?

Regards,

Good day everyone !

I have a simple problem, yet, not able to fix it. May I just need more coffee... Most probably...

Anyway...

I am using the official Docker images for SonarQube and need to connect Sonar to my auth server. That auth server can be called on a TLS route (https).

However, since that server is a internal server, it has a cert signed by our internal CA, so I need the Sonar Image to have my root CA added to the image. Which I did in the Docker file

FROM sonarqube
USER root
COPY cert/*.cer /usr/local/share/ca-certificates/
RUN /usr/sbin/update-ca-certificates
USER sonarqube

The Docker image get built, but I am still not able to call my auth server without having a self signed certificat therefore, not trusted error.....

I know the image is based on Debian, this is why I added the RootCA to /usr/local/share/ca-certificates/ ... So, why is this not working.... ?

May be I need to push my RootCA in .pem format directly in /etc/ssl/certs/ ?

Good day,

I am looking to create a MariaDB cluster in OpenShift/Kubernetes. The caveat, is that my cluster need to be ''spanned'' across 2 seperated OpenShift/Kubernetes clusters.

I am trying to wrap my head around on how to do that.

Doing so on VM is ''easy''... But across 2 separated OpenShift/K8s....

P.S: if there is another solution with MySQL, I am a taker...

Good day !

I have a RabbitMQ container running in a Kubernetes platform. I push it's config via a configMap.

Since, there is sometimes a need to change the config, I would like RabbitMQ to reload it automaticly. Is there any mechanism in Rabbit to check the version of the file in a value somewhere and when it see a +1 or else to reload the changes ?

I am looking to change rabbitMQ default guest user password to something then guest and guest..........

Config look like this:

    [ { rabbit, [
    { loopback_users, [ ] },
    { vm_memory_high_watermark, {absolute, 595276595 }},
    { default_user,  'guest' },
    { default_password, 'somepassword' },
    { disk_free_limit, 52428800 }
] } ].

For some reason, the web interface still accessible via guest guest... It does not seem to apply config.

U syspect loopback_users has something to do with it...

I have a MongoDB cluster in Kubernetes, it's pushed to Kube with a StatefulSet type of deployment.

That part work's good, I can even create 1 DB with variables starting with that...

My question is, how do I create more than 1 DB within Mongo at first run time?

Let's say I have 5 DB to create with their respective user/pass

• db-foo
• db-bar
• db-test
• db-lotr
• db-thedb

How can I make sure these are initiated/created at first deploy time? Do I just create a SHELL script within mongodb/pre-init/ and rebuild my Mongo with my scripts in there?

Do I use another set of variables numbered?

I am confused. Please help me.

I know there is a way, I just don't remind how to. I need to have the IPTables restart the Docker service when I reload, restart the iptables.

I am pretty sure there is a HOOK way to that with systemctl. Can someone light my way please ?

Regards,

I just upgraded a Atomic host (RHEL Atomic Host release 7.4) and the version of Docker went from 1.12.6 to 1.13.1. So far so good.

However, in my /etc/sysconfig/docker-latest config file I HAD a line:

OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --bip=10.20.104.1/24 --mtu=1472'

However, for some reasons, Docker refuse to start with that.

When I change OPTIONS= for DOCKER_OPTS= , it seem to work.

I cant find any documentation on that change, neither if there a behaviour change to expect.

I have a old server that I need to patch. The server is running on Debian 6.0.10. However, apt-get update/upgrade does not work. I have a bunch of 404 not found. I suspect the version is too old and I can update with apt... What are my options here before building a new server and migrating my code and apps ?

Regards,

I have this:

   - stat: path=/etc/pki/tls/certs/{{ item.ServerName }}.crt
     with_items:
       - "{{ prod }}"
     register: sslcheck

   - debug: var=sslcheck

   - name: Create self-signed SSL cert
     command: openssl req -new -nodes -x509 -subj "/C=US/ST=Oregon/L=Portland/O=IT/CN=${item.ServerName}" -days 3650 -keyout /etc/pki/tls/private/{{item.ServerName}}.key -out /etc/pki/tls/certs/{{item.ServerName}}.crt -extensions v3_ca creates=/etc/pki/tls/certs/{{item.ServerName}}.crt
     with_items:
       - "{{ prod }}"
     when: sslcheck.results.stat.exists == False

However, my condition does not work... When I debug, I still see the result: false or true for sslcheck.results.stat.exists

So, why it doesn't work ?

RESULT:

fatal: [httpd1] => error while evaluating conditional: sslcheck.results.stat.exists
fatal: [httpd2] => error while evaluating conditional: sslcheck.results.stat.exists
fatal: [httpd3] => error while evaluating conditional: sslcheck.results.stat.exists

Ok,

Let's say I have 2 BIND servers (master & slave), the master fail's. The slave still answer to the queries... However, they do not have the zone files on the file system...

If I reboot the slave, will it still be aware about the content of the zones ?

Is there a procedure to rewrite the zone file on that slave and then I just change the config to make it the master ?

Ansible question here.

I did build a play with a template for a vhost (ssl and non ssl). This vHost will be use in DEV, QUAL and Production server.

I have a variable file with variables for each env. However, in production, I have 2 servers, with, obviously, 2 different ip.

How do I manage to have the same template with the 2 variables set to be pushed on each server with specific set of theses variables.

I am sure it is easy, I just can't wrap my mind around it.

Thanks.

p.s: Sorry for my bad english writing.

I try to deploy a VMWare guest via Ansible. Unfortunately

ansible-playbook -i inventory.local vmware.yml    

 PLAY [all] ******************************************************************** 

 GATHERING FACTS *************************************************************** 
 ok: [vmcenter00]
 ok: [127.0.0.1]

 TASK: [vsphere_guest ] ******************************************************** 
 failed: [127.0.0.1] => {"failed": true, "parsed": false}
 Traceback (most recent call last):
  File "/Users/some_user/.ansible/tmp/ansible-tmp-1447432699.52-19521550866442/vsphere_guest", line 2936, in <module>
     main()
   File "/Users/some_user/.ansible/tmp/ansible-tmp-1447432699.52-19521550866442/vsphere_guest", line 1207, in main
     viserver.connect(vcenter_hostname, username, password)
   File "/Library/Python/2.7/site-packages/pysphere/vi_server.py", line 101, in connect
    request)._returnval
   File "/Library/Python/2.7/site-packages/pysphere/resources/VimService_services.py", line 2170, in RetrieveServiceContent
     self.binding.Send(None, None, request, soapaction="urn:vim25/5.0", **kw)
   File "/Library/Python/2.7/site-packages/pysphere/ZSI/client.py", line 295, in Send
     self.local.h.connect()
   File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1274, in connect
     server_hostname=server_hostname)
   File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 352, in wrap_socket
     _context=self)
   File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 579, in __init__
     self.do_handshake()
   File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 808, in do_handshake
     self._sslobj.do_handshake()
 ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)

 FATAL: all hosts have already failed -- aborting

 PLAY RECAP ******************************************************************** 
        to retry, use: --limit @/Users/some_user/vmware.retry

 127.0.0.1                  : ok=1    changed=0    unreachable=0    failed=1   
 vmcenter00                 : ok=1    changed=0    unreachable=0    failed=0   

What you should know.

I run OS X 10.11. I have ansible 1.9.3 I have pysphere (0.1.7) The output of:

python -c 'import ssl; print(ssl.OPENSSL_VERSION)'
OpenSSL 0.9.8zg 14 July 2015...

Am I missing something here?

In ansible, I would like to manipulate files/directories/archive that are composed or to composed like this:

How would I do that. It seem Ansible is not able to handler that. (I doubt). So, what I do wrong ?

Ex:

- name: create file with a date in name
  file: path=/path/somefile.`date +%y_%m_%d`

- name: unzip a file
  unarchive: path=/path/zomezip.`date +%y_%m_%d`.tar.gz bla bla....

I need to compile a software from the sources.

./config && make && make install

On that, it does install a bunch of stuff everywhere(Libraries, etc)

But the thing is, that I also need to copy that software after to another set of machines that I do not want to install gcc on.

How could I make that software install in one "directory" to then just copy to the other machines ?

I am looking to convert a XEN VM (SLES11 SP1 kernel vmlinuz-3.0.13-0.27-xen) to a VMware guest using the VMware converter tool.

The VMware tool tell me conversion went fine. 100% OK, however, when I boot the VM on my VMware server, I get this error:

root (hdo,0) Filesystem type is ext2fs. partition typo 0x83
Kernel /boot/vmlinuz-3.0.13-0.27-xen root=/dev/sda1 xencons=tty splash=silent
Error 13: Invalid or unsupported executable format
Press any key to continue...

Then it loop's...

Any one ? Lost here... Not sure if I just give it another kernel.....

I would like to make the following route info persistent.

I know how to do it for the default, but how about this line:

10.27.74.0      *               255.255.255.0   U     0      0        0 eth0



Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.27.74.0      *               255.255.255.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     1002   0        0 eth0
default         10.27.74.253    0.0.0.0         UG    0      0        0 eth0

I have MediaWiki 1.19 with MySQL 5.1.58 and php-5.3.6 installed in a SANDBOX. On the MediaWiki, I do a search with the word ''Québec'' or ''Quebec'' and I have different results...

Is there anything I can change in Apache or MySQL to fix that issue? Like adding AddDefaultCharset utf-8 to Apache (which I did and does not fix anything)..?