Tag Info

Hot answers tagged

25

Yes, SELinux is likely the cause. The .ssh dir is probably mislabeled. Look at /var/log/audit/audit.log. It should be labeled ssh_home_t. Check with ls -laZ. Run restorecon -r -vv /root/.ssh if need be.


12

What you are looking for is generally referred to as mutual authentication. Normally a server certificate exists for "server authentication", which means it validates the identity of the server to the client. Note that when pursuing this scheme, you have an additional challenge of certificate renewal for the clients. Here is an example of how it is ...


8

It's possible, but it's not advised, especially when there are better ways. First, switches don't care about your IP addresses, they care about your MAC addresses. They're "layer 2" devices. IP addresses are layer 3, so they're pretty much irrelevant to the switching side of things. To make sure that I've got your infrastructure correct, you have servers ...


6

SSL is public key authentication. Most commonly it's used to authenticate the identify of the remote server...the server presents a certificate, signed by the private key of a certificate authority, and your browser verifies it against the authorities public key. It is also possible to use SSL to authenticate the identify of the client. In this case, you ...


5

You could get an integrated kiosk solution. I've never specced one of these, but there's a whole bunch of suppliers on the net who are more capable and specialised. Ok, maybe that's outside your budget. You could put a standard PC in the view of the public, but you'd have to really lock it down. Physically disable the USB ports, either disconnect the ...


5

If you want private IPv6 addresses then you should use Unique Local Addresses (ULA). ULA addresses are not routed on the internet and their advantage is that everybody can generate their own /48 block of which 40 bits are randomly generated so that your private addresses are very unlikely to overlap with somebody else's private addresses. The ULA addresses ...


4

This is implemented in OpenSSH 6.2: sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option.


3

Postgres: uncertain/doubtful (at this time) LDAP: Openssh LDAP public key (there is currently nothing official for Ubuntu) Puppet also allows for multi-system ssh key management. Not familiar with the details, but that's not it's sole function.


3

I've never heard of Draytek. If you get a midrange router from a major vendor like Cisco, Juniper, Extreme, etc, you shouldn't run into these asinine limitations. You get what you pay for.


3

We have virtually identical vSphere setups all over (actually we use BL490c G6's because they have more memory slots and we use XP/EVAs, but close enough). It's all much simpler than you might think. Firstly all you need to do is configure your two Flex-10 NICs to be either 1Gbps or 10Gbps (depending on switch speed obviously) trunks through to ESX/ESXi (we ...


3

It really sounds like you should just run a simple wiki for this. If the website is internal-only then you don't really have to worry about spam. Set up something like PmWiki and leave it wide open for anyone to update. You should probably also set up email notifications just to make sure nobody accidentally erases a page or posts bogus data. PmWiki is a ...


3

I would edit /etc/network/interfaces to have the following contents: # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # The loopback network interface auto lo iface lo inet loopback address 127.0.0.1 netmask 255.0.0.0 auto eth0 iface eth0 inet static address ...


3

Easiest solution: You will need an additional public IP address for this server and point the MX and A entries to this. Just using a CNAME doesn't work because external systems can't still contact your mail server on it's private address. Other options might be to use the web server as a mail gateway which forwards incoming mail to the actual mail server ...


3

It's obviously possible to do this, and it's no more (or less) risky than putting up any other content on your server and make it public.


3

It's pretty simple: Your MongoDB server is potentially accessible from the public internet. A quick check showed that it's none of your hosts with a DNS entry. Please make sure that the MongoDB port isn't accessible from the public internet by using a firewall and/or binding MongoDB to a private IP. Furthermore, you should use keyfiles and user ...


2

Network configuration is documented at https://help.ubuntu.com/9.10/serverguide/C/network-configuration.html


2

I'd recommend avoiding ping and looking at something like curl or telnet. You need to do this in two parts though, because it could be a nameserver issue. Step 1: Verify functioning nameserver Step 2: use curl, wget, or telnet (on port 80) and search the results for any known text. This is better than pinging since you pretty much KNOW Google is going to ...


2

There are also open source status page dashboards like http://www.stashboard.org/ that you can utilize.


2

Use a proxy server installed on either server 1 or 3, configured to allow connections to the sites in sources.list from the private network servers. As a bonus, if you go with a caching proxy like squid or approx you'll use less bandwidth for downloading packages common to the servers. For regular web proxies like squid, you can either set the $http_proxy ...


1

You could have a shared calendar for holidays but there is no way to add it to every user's individual calendar unless you take advantage of Exchange Web Services. There are a couple articles about this http://gsexdev.blogspot.com/2012/02/ews-managed-api-and-powershell-how-to.html and ...


1

Mail traffic (SMTP) does not flow via webpages. If you want to be able to receive mail on the mail server then it needs to be reachable via the internet. Same for sending mail to the outside world. If you only use it for internal mails then by all means, put it safely on the private net.


1

There is really no way to accomplish your task, because the DNS server can resolve queries in any way it feels is appropriate, and it's a black box to the client. However, it is possible to get close to answering your question. The trick is to set up a subdomain with a special nameserver whose response to any A query simply echoes the IP address of the ...


1

However. If I open the public folder management console on a 2010 server, then I can see the folder hierarchy, but non of the folders actually show any items in them. PFMC is not supposed to list out the contents of the Public Folder. It just displays the top level hierarchy. http://technet.microsoft.com/en-us/library/bb691188.aspx You can use any of ...


1

This problem is a classic when it comes to advanced routing / VPN. The solution would be to define a static route (active, private) with your public IP as destination, give it a C-Class subnet, set it to interface "LAN" and give it the metric 1 (or 0). The problem is that the GUI of this router only allows a metric from 2-15, so the router itself has ...


1

I am suspicious that your transcript above does not in fact represent the actual commands that you typed. Here's how you can set up an http-accessible repository, and the commands (and output) here are exactly what I have typed in: Creating the repository: $ mkdir -p public_html/git $ cd public_html/git $ git init --bare testrepo.git Initialized empty Git ...


1

If the VPS with public IP is the same doing the NAT to the storage pool then yes, you can use NAT to access the storage pool from the public (valid) ip addreess. You can also create a vpn from the public IP VPS to the server doing the NAT to the storage pool and serve content from there. In any case, all content served by the public IP address will be ...


1

Yes, you want to install PFDAVDadmin from Microsoft. It allows all kinds of access/insight into the murky depths of Exchange. Among other things, it will allow you to export permissions of your public folders (but it does so much more...) It's ugly and a little obtuse. Read the instructions (link to the FM on the linked download page.)


1

If your switch will support a regular old network fail-over for a single server (with 2 nics in an active/passive configuration) then it'll support vMotion just as well. The only thing you have to ensure is that all the networks/VLANs you make available on one ESX host, are also available with the same names and VLAN IDs to the other hosts. With 3.5, you'd ...


1

you should take a look at Open vSwitch. From the web site: Open vSwitch is a multilayer virtual switch licensed under the open source Apache 2 license. Our goal is to build a production quality switch for VM environments that supports standard management interfaces (e.g. NetFlow, RSPAN, ERSPAN, IOS-like CLI), and is open to programmatic ...



Only top voted, non community-wiki answers of a minimum length are eligible