Hot answers tagged

88

I've managed large numbers of workstations without AD. I had power tools (Altiris Deployment Solution), but it still hurt in certain situations: Security auditor comes in and says that our default workstation password policy isn't good enough. In order to change password complexity and expiration, etc., on 5,000 machines, we had to write a (nontrivial) ...


71

You basically have three options here. 1. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. 2. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users will ...


67

I am going to orient this answer as if the question was "what are the advantages of chef-solo" because that's the best way I know to cover the differences between the approaches. My summary recommendation is in line with others: use a chef-server if you need to manage a dynamic, virtualized environment where you will be adding and removing nodes often. A ...


67

Since all Linux distributions run the same (yup, it's a bit simplified) Linux kernel and differ only in userland software, it's pretty easy to simulate a different distribution environment - by just installing that userland software and pretending it's another distribution. Being specific, installing CentOS container inside Ubuntu OS will mean that you will ...


57

What they're talking about is that when you use a CNAME to point to their services (which is only possible on subdomain, not the zone root - it can't coexist with the SOA and NS records that are required on the root of your zone), they can make a change to their own DNS records to work around some kind of availability issue. With a zone root, you must use ...


52

Millions is a big number - I'll get back to that later. Regardless of your approach, the underlying mechanism needs to be copying directly from one bucket to another - in this way (since your buckets are in the same region) you do not incur any charge for bandwidth. Any other approach is simply inefficient (e.g. downloading and reuploading the files). ...


31

VPS and Cloud are the same damn thing. A dedicated server is a physical box sitting in a rack somewhere that is not shared with anyone else, that you can do whatever you want with.


30

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


28

A dedicated server is a full server to which you have exclusive, guaranteed access. A VPS provides you with similar levels of administrative control as a dedicated server, but is powered by one of a number of technologies, either full virtualization (Xen, VMWare) or single-image segmentation (OpenVZ) to give you the illusion of exclusive access to what is ...


27

Disclosure: I work for Opscode. The major benefit of Chef Server over Solo is the ability to use search with your infrastructure. The classic example is a load balancer with web servers. The load balancer can automatically update its configuration as web servers are added and removed to the infrastructure, simply by searching for them. Solo is just that, ...


26

What HopelessN00b said. I just wanted to add that: I have a friend with a job at a government agency where she isn't allowed to bring a cellphone with a camera to the office. She usually phrases that as, "I'm not allowed to own a cellphone with a camera," because, well. If she can't take her cell with her, why own one? She has trouble finding cellphones ...


24

Not knowing what exactly your problem is, I can recommend pscp from parallel-ssh as a tool to upload small files to multiple servers. You prepare a list of servers to upload to and let it know what to take locally and where to put it remotely. For example: $ pscp -h list-of-servers file.torrent /tmp/ [1] 02:11:22 [SUCCESS] 10.0.0.21 [2] 02:11:22 [SUCCESS] ...


24

You can use AWS API Gateway (documentation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


23

Key pairs should be generated by the user. The user retains the private half - you should never see it. If you have someone's private key in a form where you can read/use it you're doing security wrong. The public half is given to you (by whatever mechanism you'd like: Web form, email, give-it-to-me-on-a-CD), to be centralized however you want. Some ...


21

I found this question while Googling for how to diagnose Amazon Elastic Load Balancers (ELBs) and I want to answer it for anyone else like me who has had this trouble without much guidance. ELB Properties ELBs have some interesting properties. For instance: ELBs are made up of 1 or more nodes These nodes are published as A records for the ELB name These ...


20

There are a few reasons, none of which may be especially compelling at your size, but they are important to larger organizations. Driver version control. Since your clients will automatically download the proper driver from the print server, you can be sure that your organization is standardized on a "good" version of whatever drivers you use. There were a ...


19

Actually, there is a simple solution provided you don't also expect your internal network to be exposed to the Internet at the same time. Your PCs simply need to be completely blocked from accessing the Internet. All USB ports blocked, etc. To get on the Internet, people then need to either use a different computer - connected to a different network - or ...


18

First off, to be clear, no Elastic Beanstalk is not PaaS in the way you are thinking about it. If you break it into pieces, it's really more like having virtualized instance templates and application deployment automation like puppet or chef. Along with this you get automated access to awe's load balancer service, and cloud watch monitoring, that allows ...


17

From the AWS Developer Forum post on this topic: Try stopping the broken instance, detaching the EBS volume, and attaching it as a secondary volume to another instance. Once you've mounted the broken volume somewhere on the other instance, check the /etc/sshd_config file (near the bottom). I had a few RHEL instances where Yum scrogged the ...


15

Given they're very small files typically couldn't you just have a 'dropbox' using HTTP with a cron'ed script doing a curl/wget with wildcard?


15

It seems that on kernels >= 3.13 none is not an alias of noop anymore. It is shown when the blk-mq I/O framework is in use; this means a complete bypass of the old schedulers, as blk-mq has (right now) no schedulers at all to select. On earlier kernels, none really is a poorly-documented alias for noop. See here for more details.


14

The specifics depend on which exact virtualization solution you use, but the idea is that you have a virtual farm, where there are a number of physical hosts with several virtual machines each. You then use some of the efficiency you gained by not needing a physical host for every VM so that you have enough overhead left to cover in the case where a physical ...


13

Old question, but no one really answered you and I have had the same question: Where does this configuration come from? It originates from cloudinit, precisely in cc_ssh.py within /usr/lib/python2.7/dist-packages/cloudinit/config This in turn is directly dependant on the file /etc/cloud/cloud.cfg. The you find a line disable_root: true. You should be ...


13

Roaming user profiles are going to be painful to use via the Internet. Any significant number of files in folders (which the AppData folder is notorious for having) is going to cause painful delays in profile synchronization during logon and logoff. Due to the way profiles are copied (file for file) latency will impact this, though as long as you're using ...


13

As an addition to @ShaneMadden's answer, one workaround is for the third-party platform to also manage your DNS zone. For example, if you use AWS's Elastic Load Balancer service, and their Route 53 DNS service, you can reliably point the zone apex at an ELB instance using their custom alias records, which allows them to update your DNS zone in response to ...


13

The only possible reason I can think of is that they want to force you to regenerate new keys. As these keys were generated before you had access they may not be trusted. Removing them and restarting sshd will regenerate the keys for you. However the document doesn't really make that clear. This is pure speculation and it would be better to contact them ...


13

All virtual servers running on a physical host will go offline if the host has any sort of failure. That said, most platforms offer a high-availability solution for a single VM. Other times a system is built with multiple nodes to prevent service disruption in the event that one node goes down. If two VM nodes make up a highly available service, it is ...


13

If we are talking about hosting companies selling only Linux VPS, then in most cases they use OpenVZ/Virtuozzo for virtualization, which is not providing virtual machines but virtual containers, inside your VPS you won't have access to kernel options, as it shares kernel with host, and is more vulnerable to disruptions from other containers. VPS can also ...


13

YES Often the backups a provider makes are not accessible to their customers but only to ensure the continuity of the service the provider offers. If, for whatever reason (accident, negligence, malicious intent) your own unique data gets deleted or corrupted that is typically your own mistake/problem and might well be something you will need to recover ...


12

The approach I take to decreasing an EBS root volume is as follows: Stop (not terminate) the target instance, and detach the root EBS volume. Alternatively, you can snapshot the root volume (or use an existing snapshot) and create a new EBS volume from that. (e.g. /dev/xvda1) Note: the volume you use from the step above will be altered - so you may want to ...


Only top voted, non community-wiki answers of a minimum length are eligible