Reputation
489
Top tag
Next privilege 500 Rep.
Access review queues
Badges
5 18
Impact
~19k people reached

  • 0 posts edited
  • 0 helpful flags
  • 9 votes cast
Aug
25
comment Is it valid to have several IP addresses resolving back (PTR) to one name that doesn't match either of the relevant A records?
@AndrewB: I agree with you. I have plenty of bogus PTRs for IP addresses provided by hosters which point to old domains and our scans routinely seem to be scanning www.clearly-not-our-company.com (from the results, which include a reverse DNS, the scans being based on IP ranges). This is horrendous and I very much prefer to have bare IPs in that case. My question's background is quite specific, though, as i want to use DNS names as PTRs as a mean to communicate with the receiving operator of a system. My key concern was about MUST NOT in RFC terms.
Aug
25
comment Is it valid to have several IP addresses resolving back (PTR) to one name that doesn't match either of the relevant A records?
Yes, I am aware of mail related issues. Some services (notably ssh) were also very sensitive to that (it was taking an awful long time to get the prompt after the key exchange). None of the cases would apply in my case - I was rather looking for possible cases where such a setting would break bind. Thanks for the RFC pointer.
Jul
1
comment how to turn a rescue kernel into a working one?
@MichaelHampton: The documentation states however that GRUB 2 reads its configuration from the /boot/grub2/grub.cfg file on traditional BIOS-based machines and from the /boot/efi/EFI/redhat/grub.cfg file on UEFI machines.
Jun
30
comment how to turn a rescue kernel into a working one?
@MichaelHampton: the file is straight from the server, without modifications.
Jun
30
comment how to turn a rescue kernel into a working one?
@Brian: as I mentioned, none of the previous kernels worked (they crash the same way), except for the rescue one.
Jun
29
comment how to turn a rescue kernel into a working one?
Sorry, I forgot about that : yes, there is space left on /boot (about 200 MB)
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
I completely understand that the provider of an NTP host may not want to have it published (I probably would have had the same concerns). I do not want to overuse the NTP service and since the visibility of the hosts does not seem to be provided outside of DNS queries I will leave my quest there. The 13 hosts I gathered are enough for a test (which is a one shot one (or seldom-shot one so to speak)). Thank you for providing resources to the community, BTW :)
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
@ott--: I could, yes, but even right now when querying the pool (fr.pool.ntp.org, not the servers 0.pool...) 100 times in a row I get 13 distinct servers. By seeding the DNS servers I could try to go around the cache -- but what I am looking for is a straight list of servers, not one which is built up indirectly.
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
I understand why I am getting a limited number of servers (and this is fine and expected). My question was about the direct availability of a larger list (as opposed to one built-up from DNS queries). I will make that clear in the question.
Feb
6
comment syslog-ng error on CentOS, works fine on other distributions
Thank you, this is a life saver. I was suspecting a problem with the versions, now I know. As for the format: I saw this but need to have raw JSON logs (a JSON per line) which was not obvious to have with the built-in formatter
Jan
1
comment Reverse DNS Lookups
This would work if the hosts are always-on. If the machines are also laptops then some (or a lot, depends on the activity) may get lost.
Jun
14
comment how to manage the whole /var/log for centralization?
I use splunk extensively, including forwarders. This is a fantastic tool.
Jun
13
comment how to manage the whole /var/log for centralization?
I will end up building a wrapper around text File Input Monitor to dynamically create configuration entries for each non-rsyslogd-managed file. Thanks!
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: I do not know about your case but mine, details aside, is that I need to have these logs centralized without relying on the admins to always configure the forwarding - and a technical solution to that.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
@Iain: true, but having experienced that on many servers when such attacks became fashionable years ago I saw a drastic reduction (almost to zero) of this noise in the logs.
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: no, this is not a fairly urgent issue. The systems are handled by various people (they do know what will appear), the servers are peripheral helpers, not key servers etc. The background story is long but the TLDR; version is that it would be good to be able to feed these various logs to splunk> in a reasonably simple way, with the constraints mentioned in my question.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
Another solution is to move the ssh server to a port other than 22. That should remove most of the messages (and break the standard "22/ssh", whether it is important or not depends on your system)
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks for the comments, but as mentioned in the comment of the first answer I do not know which files will be present in /var/log - this is why I need to handle it as a whole. I will stress and highlight this in my question.
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks - but the Text File Input Monitor module forces me to handle each file separately. I do not know which files will be created, this is why I wanted to handle /var/log as a whole (including all the changes: files appearing and disappearing)
Jun
13
comment how to manage the whole /var/log for centralization?
@Iain: that would have been the easiest solution (and directly implemented in splunk from the receiving side) but all of the logs are not created by rsyslog. Some are updated by the application itself (like the example I gave - Apache) and I also cannot assume that I will know all the services which log to a file in /var/log.