Tag Info

Hot answers tagged

9

You should use TCP ports 389 and/or 636. Port 636 is for LDAPS, which is LDAP over SSL. Encryption on port 389 is also possible using the STARTTLS mechanism, but in that case you should explicitly verify that encryption is being done. Microsoft's KB article says: Start TLS extended request LDAPS communication occurs over port TCP 636. LDAPS ...


4

There appears to be no way around it. LXC uses cgroups to do its RAM-limiting, and non-virtualization aware tools read stats like /proc/meminfo which is not contained within LXC and will output the overall RAM in the system. You can see this behavior with free or top as well when run inside the container. Source: ...


4

Most likely, you can't do this as many (most) providers will not delegate reverse DNS to their customers and offer some other way to edit reverse entries (if at all). When in doubt, check with your providers docs/support.


4

If you're trying to mitigate DDOS attacks, then you need to have your ISP block the bad actors at their level. Once the DDOS traffic has hit your router/firewall/server, it's already eating up your bandwidth.


4

By default cloud-init expects to receive metadata from an Amazon EC2-compatible metadata service, such as that included with OpenStack and possibly other services. If you aren't running your VM under such a service, you have two options: Disable or uninstall cloud-init. This is the easiest option and if you aren't running in a cloud service then you ...


3

Currently the proc filesystem is not "container aware" in mount namespaces, so tools basing their logic on this will get host-related values instead of container-related values. But a work is in progess, it's called lxc-fs and few releases are available here. This is a user-space workaround that will make possible a bind mount over /proc to get things ...


3

As long as it LDAP auth only (and not AD/Kerberos etc.), 389 should be sufficient.


2

If mysqld is running (check your process table), you should probably stop it via a kill command (dont use kill -9 as that will do an un-graceful stop of the service). When mysqld is no longer present in the process table, start the service normally.


2

If SELinux is in Enforcing mode, it won't let you do that... Try changing this boolean to true: setsebool -P httpd_enable_homedirs on Please note, I don't recommend disabling SELinux! There are many tools out there which can help you use SELinux to secure your system. Please see the CentOS documentation here: http://wiki.centos.org/HowTos/SELinux ...


2

It would have been helpful to see the state of your iptables while you are experiencing the problem. fail2ban doesnt actually perform the blocking of connection requests, it only adds the rules to the iptables firewall when it detects a bannable action, as defined in your jail.conf.local. So you should first be checking the state of iptables sudo iptables ...


2

You can not attach two different security labels to the same directories. So, you had to select a single label and let the other process to read/write the files with that label. Problem is that doing that you are effectively granting the second process read/write access to the files owned by the first process, which is exactly what you don't want to do. ...


2

Replace -i eth0:1 with -d 1.1.1.1/32 I believe you have used ifconfig to create interface alias. Actually you can assign more than one IP for interface with iproute2 utility(ip addr add ..). It's better to use IP addresses in iptables rules.


1

Use yum history list to see recent yum transactions. Use yum history info <ID> to view the details of a transaction. Use yum history undo last to revert the most recent transaction, or yum history undo <ID> to revert a specific transaction.


1

Boot to just a command line by adding init=/bin/bash to the kernel arguments in the boot loader. Open a shell in a new VT by typing openvt -- /bin/bash Continue the original boot sequence by typing exec /sbin/init in the first bash shell. Once the boot sequence stall you can switch to the shell opened by openvt and start collecting information about the ...


1

In case someone has a similar problem, this is what I did. I hope it's the correct approach but I am not sure. The + in the permissions drwxrwxr-x+ indicates that there is an access control list in effect on the directory. I changed the permissions recursively for ACL as per below as well as included execution permission for the user. setfacl -Rm ...


1

Connection timeouts are most often caused by packet filter or NAT device timing out your TCP connection due to inactivity. There is no one golden rule regarding ssh settings. Much depends on your systems and connections. Generally you should set keep-alive interval value to less than it usually takes for your connection to time out (be kicked off from the ...


1

Well, I would start off with the naive approach like so: $ top |grep %pid On ubuntu 12.04, it outputs the line for the PID once per update of top: username@usrver / $ top |grep 2593 2593 username 20 0 1103m 170m 16m S 30 2.2 67:25.38 chrome 2593 username 20 0 1103m 170m 16m S 28 2.2 67:26.24 chrome 2593 ...



Only top voted, non community-wiki answers of a minimum length are eligible