Tag Info

Hot answers tagged

73

As you mentioned, the environment variables are removed by sudo, for security reasons. But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers. For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, ...


18

It turns out my key was not in the agent, and this fixed it: ssh-add -K


16

You are asking it to listen on your local port 22 and forward connections to a remote system's port 8090. You can't do that as your local port 22 is already taken by your local SSH server. I think what you are looking for is remote forwarding. Replacing -L 22:localhost:8090 with -R 8090:localhost:22 will tell the remote host to listen on port 8090 and ...


14

Allow otheruser to access $SSH_AUTH_SOCK file and it's directory, for example by correct ACL, before switching to them. The example assumes Defaults:user env_keep += SSH_AUTH_SOCK in /etc/sudoers on host machine: $ ssh -A user@host user@host$ setfacl -m otheruser:x $(dirname "$SSH_AUTH_SOCK") user@host$ setfacl -m otheruser:rwx "$SSH_AUTH_SOCK" user@host$ ...


14

You don't. Otherwise the machines would all have WAN-ip's and firewall/NAT would be useless.


10

Postfix is extremely flexible (and therefore, complex) in its configuration, so there are various ways to achieve this. The simplest way would probably be to use a transport(5) table. First, enable the use of a transport table in postfix: /etc/postfix/main.cf: transport_maps = hash:/etc/postfix/transport You'll also have to make sure that Postfix ...


9

From sshd_config(5): GatewayPorts Specifies whether remote hosts are allowed to connect to ports forwarded for the client. By default, sshd(8) binds remote port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that sshd should allow remote port ...


8

According to google it is better to use 301 Redirect. Excerpt from Google Webmaster Central answer: People access your site through several different URLs. If, for example, your home page can be reached in multiple ways - for instance, http://example.com/home, http://home.example.com, or http://www.example.com - it's a good idea to pick one of those URLs ...


7

The reason you can't do this is because you're trying to forward port 22 on the local computer to port 8090 on the remote server and something is already running on port 22 on the local server. Mostly likely you have an SSH server running. You can fix this by changing the 22 to a different value. You can check to see if a port is free by running: # netstat ...


7

Make an effort, 1 minute of Googling would give you the answer. In no particular order, you could use: Xinetd Rinetd IPTables SSH tunnel Netcat Layer 4-7 balancing (eg haproxy) Or do a simple grep for localhost and replace it with a hostname that you can change. iptables sysctl -w net.ipv4.ip_forward=1 iptables -t nat -A POSTROUTING -j MASQUERADE ...


6

I'm not completely sure if I understood, but I think you're just in the wrong chain. :-) I was confused, too, when I used iptables the first time. But the way to forward the local port ${LOCAL UNPRIV PORT} is the statement below: $IPT -t nat -A PREROUTING -i eth0 -p tcp --dport ${LOCAL UNPRIV PORT} -j DNAT --to ${ANOTHER SYSTEM}:${REMOTE PORT} It is ...


6

A router or firewall can't do what you want, because it only handles TCP/IP traffic, and thus can only forward a given port to a given internal server; what you need is a reverse proxy, which, being able to understand HTTP(S) requests, can forward them to the right web server based on host headers. Microsoft TMG is a product which will happily perform this ...


5

I have found that this also works. sudo su -l -c "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK; bash" As others have noted, this won't work if the user you are switching to doesn't have read permissions on $SSH_AUTH_SOCK (which is pretty much any user besides root). You can get around this by setting $SSH_AUTH_SOCK and the directory it is in to have the ...


5

sudo -E -s -E will preserve the environment -s runs a command, defaults to a shell This will give you a root shell with the original keys still loaded


5

Forwarding, in a mail client (MUA), usually means sending a new mail, with the original mail included in the body or as an attachment. Depending on the client, the headers of the original mail may be included verbatim (e.g., mutt) or only in a highly abridged fashion (e.g., outlook). Some MUAs offer a remail command (it could be called something else such ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

Switches usually don't know anything about IP addresses. They only keep a table with MAC addresses and the ports where they are located. Even if they use VLANs, they still just use MAC-port combination in their tables, and don't use IP's at all. If it has the mac in the mac table, it sends only to the port where that mac is located. If it doesn't (yet) ...


5

No - an HTTP redirect (the kind that changes the address bar) can never be done in DNS alone; DNS providers who offer this kind of service simply point the name to their own HTTP server and configure the redirect there. You will need to configure this on your web server - let us know what kind of server it is and we can help you through configuring the ...


5

You shouldn't have a reason to forward to other AD servers, as DNS should be replicating between them already. The only reason I can think of for this would be if you wanted only one DNS server to be the one querying the internet for non-authoritative FQDNs. Usually the forwarders (used to resolve non-authoritative lookups) are set to external DNS servers ...


5

Router advertisements are not supposed to be forwarded. So when you find that they are not being forwarded, then at least that part is working as intended. You are supposed to be running your own router advertisement daemon in your router, such that it advertises itself to the LANs. You should have three separate /64 prefixes for your three LANs. So you ...


4

This is called a "catch-all" address: there is information on setting this up at http://www.google.com/support/a/bin/answer.py?hl=en&answer=33962 Note that this is a good way to get a lot of spam, but hopefully that will all get filtered.


4

The rule for the FORWARD chain needs to use the target port, because it is executed after the prerouting chain, i.e. after the DNAT has been done. iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT A good overview diagram of how the various tables and chains are linked together is here: ...


4

Without knowing what distro you're using I can't tell you how to integrate everything with your distro's config, but a standalone script to jury-rig this together might look something like: brctl addbr vpnbridge ifconfig tun0 0.0.0.0 brctl addif vpnbridge tun0 ifconfig vpnbridge 10.0.0.50 netmask 255.255.255.0 echo 1 >/proc/sys/net/ipv4/ip_forward iptables ...


4

Have a look at this page. You can use the forward and forwarders statements inside your zone block. forward ( only | first ) forwarders { ipv4_addr }


4

I'm not sure, but try to Squid cache_peer. First, add C: cache_peer C_ADDRESS parent 8080 0 no-query no-digest never_direct allow all Then try change cache_peer to B address: cache_peer B_ADDRESS parent 8080 0 no-query no-digest never_direct allow all


4

For simplicity append `/etc/aliases' with an entry like this will which will duplicate all mail to a user: jonathan: jonathanross@gmail.com This is slightly different and will also copy it to the local user's Maildir/box: jonathan: jonathan, jonathanross@gmail.com You get the idea. Follow that with newaliases to build a .db version of that file. AFAIK ...


4

My guess is that it isn't an MX problem as much as NetSOL still has website.com configured in their mail servers, and when other_website.com goes to forward, it bypasses the MX lookup as it is local. ONly way to fix it would be to get in touch with NetSol and ask Them what is going on. Not sure if there is some way in their control panel to disable all ...


4

You might need to change the servers config. Set GatewayPorts to 'on' or 'clientspecified'. Otherwise the remote interface is restricted to localhost


4

More of the config would be good; I'm going to guess you're missing one of the following items: recursion yes; or allow-recursion { 10.x.x.x/8; }; (where 10.x.x.x/8 is your internal network)


4

You cannot do this. Each DNS server must either contain a complete copy of the DNS zone, or have the entire DNS zone forwarded to the other server. You cannot have bits and pieces on different servers (unless you create sub-zones and delegate using NS records, but I digress). So either make your internet and intranet servers the same, or forward one to the ...



Only top voted, non community-wiki answers of a minimum length are eligible