Hot answers tagged

87

I've managed large numbers of workstations without AD. I had power tools (Altiris Deployment Solution), but it still hurt in certain situations: Security auditor comes in and says that our default workstation password policy isn't good enough. In order to change password complexity and expiration, etc., on 5,000 machines, we had to write a (nontrivial) ...


85

Since all Linux distributions run the same (yup, it's a bit simplified) Linux kernel and differ only in userland software, it's pretty easy to simulate a different distribution environment - by just installing that userland software and pretending it's another distribution. Being specific, installing CentOS container inside Ubuntu OS will mean that you will ...


71

You basically have three options here. 1. Disconnect your office/users from the internet If they can't get to "the public cloud," they can't upload anything to it. 2. Compile a blacklist of specific services you're worried about users accessing. This is going to be absolutely massive if it's meant to be even remotely effective. Tech-savvy users will ...


36

Containers typically run only a single application and are immutable, i.e. and changes are not preserved across restarts. Containers also don't have their own kernel. VMs on the other hand run the whole Operating System, including the kernel, init scripts, system daemons, etc. And the storage is typically preserved across restarts. VMs and Containers serve ...


31

You can use AWS API Gateway (documentation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


30

There is no way to block it completely, of course, unless the corporate network were to be disconnected from the Internet. If you really want something that should work most of the time while being mostly transparent, you'll need to deep-sniff packets. Set up a man-in-the-middle SSL/TLS proxy, as well as one for unencrypted communication, and block all ...


26

What HopelessN00b said. I just wanted to add that: I have a friend with a job at a government agency where she isn't allowed to bring a cellphone with a camera to the office. She usually phrases that as, "I'm not allowed to own a cellphone with a camera," because, well. If she can't take her cell with her, why own one? She has trouble finding cellphones ...


22

I found this question while Googling for how to diagnose Amazon Elastic Load Balancers (ELBs) and I want to answer it for anyone else like me who has had this trouble without much guidance. ELB Properties ELBs have some interesting properties. For instance: ELBs are made up of 1 or more nodes These nodes are published as A records for the ELB name These ...


20

There are a few reasons, none of which may be especially compelling at your size, but they are important to larger organizations. Driver version control. Since your clients will automatically download the proper driver from the print server, you can be sure that your organization is standardized on a "good" version of whatever drivers you use. There were a ...


19

From the AWS Developer Forum post on this topic: Try stopping the broken instance, detaching the EBS volume, and attaching it as a secondary volume to another instance. Once you've mounted the broken volume somewhere on the other instance, check the /etc/sshd_config file (near the bottom). I had a few RHEL instances where Yum scrogged the ...


19

Actually, there is a simple solution provided you don't also expect your internal network to be exposed to the Internet at the same time. Your PCs simply need to be completely blocked from accessing the Internet. All USB ports blocked, etc. To get on the Internet, people then need to either use a different computer - connected to a different network - or ...


19

Your question is, to some extent, looking at things backwards: EC2 isn't a general-purpose hosting solution that happens to use VMs; it is a service for hosting VMs. As such, there's a few ways to interpret your question. Why wasn't EC2 designed to use containers? The answer to this can be deduced from the timeline: EC2 was launched in beta in 2006, and full ...


18

First off, to be clear, no Elastic Beanstalk is not PaaS in the way you are thinking about it. If you break it into pieces, it's really more like having virtualized instance templates and application deployment automation like puppet or chef. Along with this you get automated access to awe's load balancer service, and cloud watch monitoring, that allows ...


17

Security is definitely a reason. Containers share the same kernel between them and the host. So they are not considered 100% isolated. Yet cloud providers do provide containers also. AWS does it too. I suppose containers are cheaper than VMs, but I haven't checked. In essence what you ask is a more general topic, VMs vs. containers; regardless of platform, ...


16

It seems that on kernels >= 3.13 none is not an alias of noop anymore. It is shown when the blk-mq I/O framework is in use; this means a complete bypass of the old schedulers, as blk-mq has (right now) no schedulers at all to select. On earlier kernels, none really is a poorly-documented alias for noop. See here for more details.


16

Update AWS would charge $3300 a month for 35TB of outbound bandwidth. Five of the largest Lightsail instances would cost a bit over $800 and would include 35GB of traffic. I assume that you can use the instance bandwidth if you use a load balancer. Their CDN pricing would get you to $2300 per month. You'd probably need another server as a web server, so the ...


14

Old question, but no one really answered you and I have had the same question: Where does this configuration come from? It originates from cloudinit, precisely in cc_ssh.py within /usr/lib/python2.7/dist-packages/cloudinit/config This in turn is directly dependant on the file /etc/cloud/cloud.cfg. The you find a line disable_root: true. You should be ...


14

The specifics depend on which exact virtualization solution you use, but the idea is that you have a virtual farm, where there are a number of physical hosts with several virtual machines each. You then use some of the efficiency you gained by not needing a physical host for every VM so that you have enough overhead left to cover in the case where a physical ...


14

why would our internal cloud team not buy accounts straight from AWS? They probably get discounts. These large "billing consolidation providers" invoice their customers millions of dollars per month and for that they get decent discounts from AWS, Azure, etc, and pass on some of that to the customers. Typically you get around 5% discount. The big ...


13

AD and GPO will still handle management of workstations. Without it, you're paying for a 3rd party application or really really really trusting your users. If you're doing something like strictly BYOD, or distributing only stateless VMs for working, then this doesn't apply as much.


13

The only possible reason I can think of is that they want to force you to regenerate new keys. As these keys were generated before you had access they may not be trusted. Removing them and restarting sshd will regenerate the keys for you. However the document doesn't really make that clear. This is pure speculation and it would be better to contact them ...


13

All virtual servers running on a physical host will go offline if the host has any sort of failure. That said, most platforms offer a high-availability solution for a single VM. Other times a system is built with multiple nodes to prevent service disruption in the event that one node goes down. If two VM nodes make up a highly available service, it is ...


13

If we are talking about hosting companies selling only Linux VPS, then in most cases they use OpenVZ/Virtuozzo for virtualization, which is not providing virtual machines but virtual containers, inside your VPS you won't have access to kernel options, as it shares kernel with host, and is more vulnerable to disruptions from other containers. VPS can also ...


13

YES Often the backups a provider makes are not accessible to their customers but only to ensure the continuity of the service the provider offers. If, for whatever reason (accident, negligence, malicious intent) your own unique data gets deleted or corrupted that is typically your own mistake/problem and might well be something you will need to recover ...


12

Old topic, but this is for anyone investigating the same scenario. Along with the time it took me, for 20,000+ objects. Running on AWS Linux/Centos, each object being images for the most part, along with some video and various media files. Using the AWS CLI Tools to Copy the files from Bucket A to Bucket B. A. Create the new bucket $ aws s3 mb s3://new-...


12

DHCP only assigns IP addresses. Not only can it not assign MAC addresses, you NEED a MAC address in order to use DHCP. (It's the address used for the lower layer ethernet protocol.) Essentially, to get an IP address, you send a broadcast request, and the response is sent to your MAC address. MAC addresses are usually assigned in hardware, by the ...


12

The critical detail is that the page you've referenced is about creating a new Compute Engine machine image. Specifically, when you create a new virtual machine image, you want to ensure it does NOT include any host keys. That way, when the image is cloned and reconstituted into an actual VM, the sshd startup script will recognize that there are no host ...


12

IMO, you can try to do it like this (I do something similar but with Elastic Network Interfaces). This assumes either a knowledge of AWS CloudFormation service or AWS CLI: Create an EBS volume Create a bare AutoScaling group of min/max size set to 1. This will ensure that the only instance when it gets unhealthy will be replaced by a new and healthy one. ...


12

There's several different approaches to containers, and the current accepted answer only seems to account for the OCI-style (docker-like) containers. There's many other types of containers, such as LXC and BSD jails, which have different approaches. LXC for example can easily contain several applications, and is mutable by default. It also has init scripts ...


11

You don't really need a print server in your situation, given the small number of printers you've described. You've justified it yourself. Nobody is forcing you to use one :) But in general, people use print servers to streamline client deployment, offer central management and to ease print driver maintenance. It's all about scale.


Only top voted, non community-wiki answers of a minimum length are eligible