Reputation
3,624
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
5 20
Newest
 Good Answer
Impact
~90k people reached

Jan
5
comment OpenVPN Tunnel not working for subnets after some time
What does the routing table on the server look like when you are having the error? When you tcpdump on the server while the client's network (192.168.0.3) is pinging, do you see the packets go out on the wire to 10.0.96.253? Do you see them come back (viz. are you sure openvpn is the problem)?
Jan
3
reviewed Reject run rsync as root but keep user ownership
Jan
3
reviewed Approve How to set sysctl variables at CoreOS cloud-init?
Jan
3
reviewed Reject Force disabled server selection when using cookie based session persistence?
Jan
1
awarded  Good Answer
Dec
31
comment Is it viable to run very lightweight services straight off a Raspberry Pi 2?
@FrancisNorton That's cool! At the risk of moving the goal posts, is this use really a server? It sounds more like an industrial sensor or industrial control system remote terminal in that it attaches a single user/station to an ICS network.
Dec
31
answered KVM: Need multiple Virtual Machines to share a VLAN'ed interface
Dec
31
comment Private DNS in VPN
Did you check if friend's PC is making dns queries after the VPN comes up and not regurgitating cache? ipconfig /flushdns and restart browser?
Dec
31
comment resolve a previously failing url without editing resolv.conf
Use nslookup or host from a different machine. Use this IP address with mtr. No need to resolve anything on the troubled machine itself.
Dec
31
comment KVM: Need multiple Virtual Machines to share a VLAN'ed interface
If you bridge to the vlan interface (as opposed to the hw interface), the bridged packets from your VMs will be tagged as they are bridged out onto the wire. If you bridge to the hw interface, all traffic will be bridged regardless of tag and you will have to move your vlan interface to be off the bridge (base interface vlan is now meaningless). Any number of VMs can share a bridge. Typically, you would handle the vlans at the host so the guests don't have to manually configure vlans. A number of different permutations of this sounds like they would work for you.
Dec
31
comment Order of search for name resolution in Unix/Linux
debian jessie seems to stop. freebsd 10.2 applies search after nxdomain on the root. Tested by calling host foo<n> with tcpdump -vv -ni <if> 'port 53' running in another shell. That should result in using gethostbyname() and following the system name resolution rules.
Dec
30
awarded  Nice Answer
Dec
30
comment What is the best IP subnet to avoid subnet collisions?
Correct me if I'm wrong; your appliance has a service port used on-site by your service staff. The IPs are only used on-site and do not connect back to your corporate network. Optimally for you, each appliance would have exactly the same service-side network config at every customer site. The server cannot run DHCP or ipv6 of any kind. Your service application cannot be made smart enough to autodetect the service-side IP based on broadcast/multicast. You cannot use policy routing or ip-specific route with a device attached (eg. route add resolver.ip.ad.dr/32 gateway cust.con.fig.gw dev eth0)
Dec
30
comment Is it viable to run very lightweight services straight off a Raspberry Pi 2?
Please consider your answer within the scope of business computing when compared against cost-comparable alternatives. What advantages does it have against a 3k USD server doing 30 (or more) times as much work? How would you make it rock solid without doubling or more the price in either parts or labor? How do you negate the intrinsic problems of the platform (embedded system with NDA-walled documentation, limited peripheral selection, limited compute performance, poor IO performance)?
Dec
30
comment Route content using nginx if a specific condition is met
Put large files on a separate domain (eg. static-cdn.example.com). Have DNS for each network point your users at the right IP. Or use 1 dns server and implement split-horizon.
Dec
30
comment How to call ftp script from main script
Have you tried putting EOF immediately after bye?
Dec
30
comment How well does haproxy scale for handling client certificate authentication?
Another thing to note is haproxy is designed to tier. It doesn't have to do ssl verification at its level. It can forward the whole connection to a (cluster of) separate server(s) to terminate the ssl connection and perform verification there. In this way, if you can't do it in one, you can do it in many.
Dec
30
comment How well does haproxy scale for handling client certificate authentication?
Does it need to do more than verify the certificate is signed by a trusted (ie, your in-house issuing) CA? 200k files of any kind in a directory would have to be tuned. If the certs are not signed by a common CA, haproxy and nginx may require all certs to be in a single PEM; I don't believe either will let you verify from a directory.
Dec
30
revised Is it viable to run very lightweight services straight off a Raspberry Pi 2?
add reasons *for* using rpi as a server.
Dec
30
answered Is it viable to run very lightweight services straight off a Raspberry Pi 2?