Tag Info

Hot answers tagged

22

Yes, SELinux is likely the cause. The .ssh dir is probably mislabeled. Look at /var/log/audit/audit.log. It should be labeled ssh_home_t. Check with ls -laZ. Run restorecon -r -vv /root/.ssh if need be.


12

What you are looking for is generally referred to as mutual authentication. Normally a server certificate exists for "server authentication", which means it validates the identity of the server to the client. Note that when pursuing this scheme, you have an additional challenge of certificate renewal for the clients. Here is an example of how it is ...


8

It's possible, but it's not advised, especially when there are better ways. First, switches don't care about your IP addresses, they care about your MAC addresses. They're "layer 2" devices. IP addresses are layer 3, so they're pretty much irrelevant to the switching side of things. To make sure that I've got your infrastructure correct, you have servers ...


6

SSL is public key authentication. Most commonly it's used to authenticate the identify of the remote server...the server presents a certificate, signed by the private key of a certificate authority, and your browser verifies it against the authorities public key. It is also possible to use SSL to authenticate the identify of the client. In this case, you ...


5

You could get an integrated kiosk solution. I've never specced one of these, but there's a whole bunch of suppliers on the net who are more capable and specialised. Ok, maybe that's outside your budget. You could put a standard PC in the view of the public, but you'd have to really lock it down. Physically disable the USB ports, either disconnect the ...


5

If you want private IPv6 addresses then you should use Unique Local Addresses (ULA). ULA addresses are not routed on the internet and their advantage is that everybody can generate their own /48 block of which 40 bits are randomly generated so that your private addresses are very unlikely to overlap with somebody else's private addresses. The ULA addresses ...


3

Easiest solution: You will need an additional public IP address for this server and point the MX and A entries to this. Just using a CNAME doesn't work because external systems can't still contact your mail server on it's private address. Other options might be to use the web server as a mail gateway which forwards incoming mail to the actual mail server ...


3

I've never heard of Draytek. If you get a midrange router from a major vendor like Cisco, Juniper, Extreme, etc, you shouldn't run into these asinine limitations. You get what you pay for.


3

This is implemented in OpenSSH 6.2: sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option.


3

I would edit /etc/network/interfaces to have the following contents: # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # The loopback network interface auto lo iface lo inet loopback address 127.0.0.1 netmask 255.0.0.0 auto eth0 iface eth0 inet static address ...


3

We have virtually identical vSphere setups all over (actually we use BL490c G6's because they have more memory slots and we use XP/EVAs, but close enough). It's all much simpler than you might think. Firstly all you need to do is configure your two Flex-10 NICs to be either 1Gbps or 10Gbps (depending on switch speed obviously) trunks through to ESX/ESXi (we ...


3

It really sounds like you should just run a simple wiki for this. If the website is internal-only then you don't really have to worry about spam. Set up something like PmWiki and leave it wide open for anyone to update. You should probably also set up email notifications just to make sure nobody accidentally erases a page or posts bogus data. PmWiki is a ...


2

There are also open source status page dashboards like http://www.stashboard.org/ that you can utilize.


2

I'd recommend avoiding ping and looking at something like curl or telnet. You need to do this in two parts though, because it could be a nameserver issue. Step 1: Verify functioning nameserver Step 2: use curl, wget, or telnet (on port 80) and search the results for any known text. This is better than pinging since you pretty much KNOW Google is going to ...


2

Network configuration is documented at https://help.ubuntu.com/9.10/serverguide/C/network-configuration.html


2

Postgres: uncertain/doubtful (at this time) LDAP: Openssh LDAP public key (there is currently nothing official for Ubuntu) Puppet also allows for multi-system ssh key management. Not familiar with the details, but that's not it's sole function.


2

Use a proxy server installed on either server 1 or 3, configured to allow connections to the sites in sources.list from the private network servers. As a bonus, if you go with a caching proxy like squid or approx you'll use less bandwidth for downloading packages common to the servers. For regular web proxies like squid, you can either set the $http_proxy ...


2

It's obviously possible to do this, and it's no more (or less) risky than putting up any other content on your server and make it public.


1

You can accomplish this with a router/firewall with a feature called Policy Based Routing. With this you could make a rule like: When traffic is coming from my mail server AND the destination port is 25, send the traffic through this ISP.


1

You could have a shared calendar for holidays but there is no way to add it to every user's individual calendar unless you take advantage of Exchange Web Services. There are a couple articles about this http://gsexdev.blogspot.com/2012/02/ews-managed-api-and-powershell-how-to.html and ...


1

You are using a tap-style interface. This will not be assigned an address by OpenVPN itself by default but is meant to be bridged into a current network, where the address will be assigned by the means used for address assignment in this network. Apparently, you have not yet set up the bridging part yet, so if you want to continue with the tap-style setup, ...


1

It is indeed possible. Try one of the two options provided below... server { listen 80; server_name myapp.* root /srv/myapp/current/public; location /blog { # option 1 return 444; # option 2 # rewrite /blog/(.*) $scheme://blog.myapp.tld/$1 permanent; } } server { listen 80; server_name blog.myapp.* root ...


1

I am suspicious that your transcript above does not in fact represent the actual commands that you typed. Here's how you can set up an http-accessible repository, and the commands (and output) here are exactly what I have typed in: Creating the repository: $ mkdir -p public_html/git $ cd public_html/git $ git init --bare testrepo.git Initialized empty Git ...


1

However. If I open the public folder management console on a 2010 server, then I can see the folder hierarchy, but non of the folders actually show any items in them. PFMC is not supposed to list out the contents of the Public Folder. It just displays the top level hierarchy. http://technet.microsoft.com/en-us/library/bb691188.aspx You can use any of ...


1

There is really no way to accomplish your task, because the DNS server can resolve queries in any way it feels is appropriate, and it's a black box to the client. However, it is possible to get close to answering your question. The trick is to set up a subdomain with a special nameserver whose response to any A query simply echoes the IP address of the ...


1

Mail traffic (SMTP) does not flow via webpages. If you want to be able to receive mail on the mail server then it needs to be reachable via the internet. Same for sending mail to the outside world. If you only use it for internal mails then by all means, put it safely on the private net.


1

HP and Dell sell brackets or locks for most of their PC to make them harder to steal. Get a good salesman from either, or a resale outfit like CDW, they'll make the process much easier. There are also companies that make hardened PC rigs for public use. Usually made out of all steel and acrylic so they're much harder to damage. Again, find a larger resale ...


1

Cable locks for the tower and monitor - I know most laptops have little divots for a standard cable lock to fit into, you should look into monitors and towers that also have them. Then you loop them around the desk if you can. If you already work with someone selling you office furniture, you can buy them with cable-lock-friendly bits on them. Unless you ...


1

This sounds like a case for NAT forwarding and trusting your switch. I would keep internal ips for the servers on just one of their ports. The switch will keep server to server traffic from impacting the rest of your network. If you need the bandwidth you might want to get a gigabit switch for the servers if the rest of your network is 100 megabit. If your ...



Only top voted, non community-wiki answers of a minimum length are eligible