1,219 reputation
819
bio website
location
age
visits member for 5 years, 6 months
seen Dec 17 at 19:46

Sep
18
comment Set up an NTP server to allow local machines to be syncronised for Linux
umm, not sure what you mean by completely different setting. It's different in one sense but not in the goal. The setup addresses your two goals of (1) "a machine to act as an ntp server to which the other local machines will syncronise their times to." (2) "This needs to happen regardless of whether the ntp server machine is connected to the internet". So you could omit the firewall stuff I mentioned and still glean something from this could you not?
Jun
6
comment Relationship between /etc/hosts and iptables?
@Steve: You're not making sense. Just remove the two iptables lines and let GlassFish listen on the unpriv ports 8080 and 8181; you will need to append 8080 and 8181 accordingly to your URIs. Maybe I assumed you understood that point. If you insist on using 80 and 443 or no URI modifications you might be able to do an HTTP redirect if GlassFish supports that but then you're back to SOMETHING needing to camp out on 80 and 443 to either do the redirect or GlassFish..
Jun
6
comment Relationship between /etc/hosts and iptables?
I suggested changing to 80/443 before I knew of your constraint to not run as priv account. What I say above is get rid of the iptables -t nat rules if this is the case and connect directly to the GlassFish server without going through a PAT. Remove the two iptables -t nat lines and it should work. I say above that if you need to block off more ports from public Internet, use filter chain.
Jun
6
comment Relationship between /etc/hosts and iptables?
You do not need a priv account if you can change your GlassFish configuration to start up and use 8080 and 8181...
Jun
6
comment Relationship between /etc/hosts and iptables?
I thought you had stated that you can change GlassFish configuration to listen on a non-priv port. What does "Yes I can do that." refer too?
Jun
6
comment Relationship between /etc/hosts and iptables?
@Steve: Why will you have to grant its user account to listen on a privileged port if you "can do that" means you can change the GlassFish server to listen on an unpriv port? Many Linux processes often are launched by root but then switch to a jailed or regular/unpriv user account. But if you claim you can change the port, then you should be all set. No need to run as root...
Jun
5
comment Relationship between /etc/hosts and iptables?
@Steve: Not familiar with GlassFish; but can't you change the port GlassFish listens on from 80 & 443 to 8080 and 8181 somewhere?
Jun
5
comment Relationship between /etc/hosts and iptables?
oh-I-C: You want to connect TO this server. This VPS box is listening on an IP address bound to ETH0 and port 80 & 443 which you are PATing the connection. Why do you need PAT if, presumably, the ETH0 is public facing? If you're looking to limit port exposure, you should just stick with iptables -t filter rules and just get rid of the PREROUTING stuff. IPTABLES -A INPUT is changing the filter table.
Feb
14
comment GLUSTERFS or DFSR
Looked but can't find the article. Been running DFSR since I made this post & it has been very hands-off. IE it just works. One thing that got me into a little trouble was forgetting to set priority on DFS shares. I keep data on both servers and run full mesh. Some apps access data on srvr1 while other apps use srvr2 and so priorities should be set to prevent workstations from using less preferred node for a given app. Being a huge Linux advocate, I must say it was nice not mucking around in .conf files and ./configure;make;make install; not typical of M$ to work this well out of the box.
Aug
12
comment OpenVPN not Routing correctly on CentOS 6
you have two default routes with the preferred (lower metric) pointing to something other than your VPN interface. I would fix this problem if you want all traffic to be routed over the VPN when it's up.
Aug
11
comment OpenVPN not Routing correctly on CentOS 6
is windows firewall on? Why are you using a well known port (443) not that this is a problem but seems odd. What does "route print" and "ipconfig" show on your windows client? Does your default GW IP match your TUN address?
Aug
10
comment Win2K8 R2 Scheduled Task Fault Tolerance
Hopeless: My thoughts exactly. I reckoned there has to be a cleaner solution though? One of the problems I forsee is the attempting to fence the correct server to allow the scheduled task to complete on which sever (assuming if I launch it on both servers at same time). My other thought was to just stagger the jobs in time so that the DFS replication is not trying to resolve concurrent changes to the replicated space.
Aug
10
comment kill -9 a postgres process
@Craig: What a superb response; and to include a demonstration, I wish I could up vote this 100x. I'm a software developer who works with PG daily and since the 6.x days and your response is spot on! Nice!
May
25
comment GLUSTERFS or DFSR
Ah, very cool. Like you I tend to goto Linux as my first choice but two things causing me to look closer to Windows besides DFSR. (1) Customer wants centralized Antivirus and the Windows product just seems painless. (2) Some workstations have roaming profiles and they don't always roam; always assumed incompatibility with Samba being domain controller. My thought is to put Samba and GLUSTERFS on same host and if the main server fails, I can fail over Samba and would hope GLUSTERFS would just take care of things.
Oct
3
comment 100% uptime for a web application
I beg to differ. "Not useful at all?" It was most certainly useful for me and contrary to your "hire someone else to do it" comment, I suppose with your reasoning the guy should trench his own fiber optic cable and design his own switches rather than buy them too? Are you serious, Yves? You sound like someone who has not spent much time in the IT field.
Apr
8
comment Using NTP to sync a group of linux servers to a common time source
@MattBianco: No. We use a custom script for that. It is an implementation detail specific to the environment. To shed some light on this, the script runs on our masters and requests the time from each client node out there. It knows of the clients as all our hosts use central LDAP. This script is part of many we run as a daily "morning report" we call it. Variables in the script allow us to set thresh holds which we report out through a nagios dashboard.
Mar
11
comment Is it normal to get hundreds of break-in attempts per day?
while I agree with others this is normal on common ports required (80, 443) I practically eliminated these attempts against my SSH port by simply changing the default port from 22 to something obscure like 6022 for example. Just doing that, alone, nearly eliminated 99% of that type of attack.
Feb
18
comment Best VoIP VPS Location?
QoS does you no good against in-bound traffic, keep in mind. It's good to have but it's not a complete solution by itself. The answer, however, to #1 should be obvious. Lower latency is always better.
Dec
25
comment Apache RewriteRule with a RewriteMap variable substitution for the VAL argument to environment variable
I solved it. I overlooked the fact that the md5digesthex.pl had to be a long running app. So I change the perl code run inside a while(<STDIN>) loop instead and I now get the desired results... Thanks for the help.
Dec
24
comment Apache RewriteRule with a RewriteMap variable substitution for the VAL argument to environment variable
Yes, wish I was around to slap the original developers. Anyway, the output of the md5inhex is just a hex string. I pass it the name of a file, it computes the MD5 and returns the hex value i.e. 0xBADBEEF.... I've tested it on the command line and it works and a browser test prompts me to download the file but HTTP header never gets set.