Hot answers tagged public
11
What you are looking for is generally referred to as mutual authentication. Normally a server certificate exists for "server authentication", which means it validates the identity of the server to the client.
Note that when pursuing this scheme, you have an additional challenge of certificate renewal for the clients.
Here is an example of how it is ...
7
It's possible, but it's not advised, especially when there are better ways.
First, switches don't care about your IP addresses, they care about your MAC addresses. They're "layer 2" devices. IP addresses are layer 3, so they're pretty much irrelevant to the switching side of things.
To make sure that I've got your infrastructure correct, you have servers ...
6
SSL is public key authentication. Most commonly it's used to authenticate the identify of the remote server...the server presents a certificate, signed by the private key of a certificate authority, and your browser verifies it against the authorities public key.
It is also possible to use SSL to authenticate the identify of the client. In this case, you ...
5
You could get an integrated kiosk solution. I've never specced one of these, but there's a whole bunch of suppliers on the net who are more capable and specialised.
Ok, maybe that's outside your budget.
You could put a standard PC in the view of the public, but you'd have to really lock it down.
Physically disable the USB ports, either disconnect the ...
3
This is implemented in OpenSSH 6.2:
sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to
support fetching authorized_keys from a command in addition to (or
instead of) from the filesystem. The command is run under an account
specified by an AuthorizedKeysCommandUser sshd_config(5) option.
3
Easiest solution: You will need an additional public IP address for this server and point the MX and A entries to this.
Just using a CNAME doesn't work because external systems can't still contact your mail server on it's private address.
Other options might be to use the web server as a mail gateway which forwards incoming mail to the actual mail server ...
3
It really sounds like you should just run a simple wiki for this. If the website is internal-only then you don't really have to worry about spam. Set up something like PmWiki and leave it wide open for anyone to update. You should probably also set up email notifications just to make sure nobody accidentally erases a page or posts bogus data.
PmWiki is a ...
3
I would edit /etc/network/interfaces to have the following contents:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
address 127.0.0.1
netmask 255.0.0.0
auto eth0
iface eth0 inet static
address ...
3
We have virtually identical vSphere setups all over (actually we use BL490c G6's because they have more memory slots and we use XP/EVAs, but close enough). It's all much simpler than you might think.
Firstly all you need to do is configure your two Flex-10 NICs to be either 1Gbps or 10Gbps (depending on switch speed obviously) trunks through to ESX/ESXi (we ...
2
I'd recommend avoiding ping and looking at something like curl or telnet. You need to do this in two parts though, because it could be a nameserver issue.
Step 1: Verify functioning nameserver
Step 2: use curl, wget, or telnet (on port 80) and search the results for any known text.
This is better than pinging since you pretty much KNOW Google is going to ...
2
Postgres: uncertain/doubtful (at this time)
LDAP: Openssh LDAP public key (there is currently nothing official for Ubuntu)
Puppet also allows for multi-system ssh key management. Not familiar with the details, but that's not it's sole function.
2
Use a proxy server installed on either server 1 or 3, configured to allow connections to the sites in sources.list from the private network servers. As a bonus, if you go with a caching proxy like squid or approx you'll use less bandwidth for downloading packages common to the servers.
For regular web proxies like squid, you can either set the $http_proxy ...
1
You could have a shared calendar for holidays but there is no way to add it to every user's individual calendar unless you take advantage of Exchange Web Services. There are a couple articles about this
http://gsexdev.blogspot.com/2012/02/ews-managed-api-and-powershell-how-to.html and ...
1
However. If I open the public folder management console on a 2010 server, then I can see the folder hierarchy, but non of the folders actually show any items in them.
PFMC is not supposed to list out the contents of the Public Folder. It just displays the top level hierarchy.
http://technet.microsoft.com/en-us/library/bb691188.aspx
You can use any of ...
1
There is really no way to accomplish your task, because the DNS server can resolve queries in any way it feels is appropriate, and it's a black box to the client. However, it is possible to get close to answering your question.
The trick is to set up a subdomain with a special nameserver whose response to any A query simply echoes the IP address of the ...
1
Mail traffic (SMTP) does not flow via webpages. If you want to be able to receive mail on the mail server then it needs to be reachable via the internet. Same for sending mail to the outside world.
If you only use it for internal mails then by all means, put it safely on the private net.
1
If the VPS with public IP is the same doing the NAT to the storage pool then yes, you can use NAT to access the storage pool from the public (valid) ip addreess.
You can also create a vpn from the public IP VPS to the server doing the NAT to the storage pool and serve content from there.
In any case, all content served by the public IP address will be ...
1
I am suspicious that your transcript above does not in fact represent
the actual commands that you typed. Here's how you can set up an
http-accessible repository, and the commands (and output) here are
exactly what I have typed in:
Creating the repository:
$ mkdir -p public_html/git
$ cd public_html/git
$ git init --bare testrepo.git
Initialized empty Git ...
1
This problem is a classic when it comes to advanced routing / VPN.
The solution would be to define a static route (active, private) with your public IP as destination, give it a C-Class subnet, set it to interface "LAN" and give it the metric 1 (or 0).
The problem is that the GUI of this router only allows a metric from 2-15, so the router itself has ...
1
Yes, you want to install PFDAVDadmin from Microsoft. It allows all kinds of access/insight into the murky depths of Exchange. Among other things, it will allow you to export permissions of your public folders (but it does so much more...)
It's ugly and a little obtuse. Read the instructions (link to the FM on the linked download page.)
1
HP and Dell sell brackets or locks for most of their PC to make them harder to steal. Get a good salesman from either, or a resale outfit like CDW, they'll make the process much easier.
There are also companies that make hardened PC rigs for public use. Usually made out of all steel and acrylic so they're much harder to damage. Again, find a larger resale ...
1
Cable locks for the tower and monitor - I know most laptops have little divots for a standard cable lock to fit into, you should look into monitors and towers that also have them. Then you loop them around the desk if you can. If you already work with someone selling you office furniture, you can buy them with cable-lock-friendly bits on them.
Unless you ...
1
This sounds like a case for NAT forwarding and trusting your switch.
I would keep internal ips for the servers on just one of their ports. The switch will keep server to server traffic from impacting the rest of your network. If you need the bandwidth you might want to get a gigabit switch for the servers if the rest of your network is 100 megabit. If your ...
1
Under some situations, I'd be okay with doing this if the switch were a relatively modern switch that has 802.1q VLAN tag support.
I'd create one vlan for the public traffic and one vlan for the private traffic, and use private addresses for the private traffic. Put one set of ports into one vlan (all untagged), and another set of ports into another vlan. ...
1
The reason I want to do this is because my switch is a few levels down from our company's public-facing router, and I don't want to clog the other switches and router with traffic that only needs to go from one of the 4 servers to another. The public traffic will be minimal, but server-to-server will be huge.
Server-to-server traffic won't magically ...
1
If your switch will support a regular old network fail-over for a single server (with 2 nics in an active/passive configuration) then it'll support vMotion just as well.
The only thing you have to ensure is that all the networks/VLANs you make available on one ESX host, are also available with the same names and VLAN IDs to the other hosts.
With 3.5, you'd ...
Only top voted, non community-wiki answers of a minimum length are eligible
