ip - Do anycast addresses imply IPv6?

From what I understand, as a random user on the Internet, you cannot really know if an IPv4 address is unicast or anycast. However if you ping that IPv4 from two hosts physically located on two different continents far apart and get a ping time < 30 ms in both cases for the same IPv4 address, you can be sure it's two different servers answering the ping for that particular IPv4 (*).

So two different servers are answering for the same IPv4 IP: does this mean anycast is used for sure?

If anycast is used, does this mean there's IPv6 somewhere or can anycast be used in an hypothetical network which would be IPv4 only?

Answer

There are two different ways of doing anycast: routing-based and on a single subnet. The routing based one can be done for both IPv4 and IPv6. The single-subnet way cannot be done with IPv4.

Routing based anycast is done by announcing the same IPv4 or IPv6 prefix into a routing protocol from multiple routers. All of them announce they have a direct connection to those addresses. The routing protocol (if used on a global scale BGP, if used within one organisation it might also be e.g. OSPF etc) calculates the shortest path to that prefix and thereby uses the 'closest' instance. What is considered 'closest' depends on the routing protocol's algorithm and metrics.

IPv6 has a subnet based form of anycast for use within a single subnet. It works by letting multiple hosts answer to the same address for Neighbor Discovery queries (think the IPv6 equivalent of IPv4 ARP queries). The sender will use the first answer it gets, which is assumed to be the closest and/or fastest.

I hope this explains the confusion: two different techniques with the same name.

apache 2.2 - How to create a multi-domain self-signed certificate for Apache2?

I've got a little private webserver where I have several virtualhosts. I know that it's impossible to assign a certificate to each individual virtualhost, because the server finds out which virtualhost was requested only AFTER the SSL connection has been established. But is it possible to have a single SSL certificate which lists several domains? Or at least a wildcard domain, like *.example.com. If yes, what Linux commands do I have to write to make such a self-signed certificate?

Added: To clarify - I have just one IP address for all the virtual hosts.

solaris - How can I add one disk to an existing raidz zpool?

I have an OpenSolaris server with a zpool backupz comprised of four SCSI drives:

-bash-3.2# zpool status backupz
  pool: backupz

 state: ONLINE
 scrub: none requested
config:

        NAME        STATE     READ WRITE CKSUM
        backupz     ONLINE       0     0     0
          raidz1    ONLINE       0     0     0
            c7t0d0  ONLINE       0     0     0
            c7t1d0  ONLINE       0     0     0
            c7t2d0  ONLINE       0     0     0

            c7t3d0  ONLINE       0     0     0

errors: No known data errors

I want to add a fifth drive... but zpool add backupz raidz c7t4d0 isn't working...

-bash-3.2# zpool add backupz raidz c7t4d0
invalid vdev specification: raidz requires at least 2 devices

Can I not have a raidz config with 5 devices? Do I have to add two devices at once? or am I doing something incorrect altogether here?

Answer

You can't expand an existing raidz vdev, you have to blow it away and create it again with the new drive(s). See the other answer for better details.

Side note: Someone actually worked out that it's technically possibly to add drives to a raidz, but the functionality hasn't been implemented. The same is true of removing a disk.

ping - Client can't reach my production webserver. It's their ISP's fault, but now what?

I have a customer in Michigan who can't access my production SaaS webserver that is hosted on Slicehost. All other companies across the US/Canada/Europe have no problem reaching the site. This problem is occuring intermittantly, and Slicehost customer service says it's a problem with the client's ISP.

I got the IP address of my client, and ping'ing that IP address from my PROD server fails, but ping'ing the IP address from my dev box or our seperate blog server (also hosted on slicehost) works. How do I debug a problem like this? I asked the client to reach out to their local ISP and ask about this problem.

A traceroute shows that the packets are getting stopped on a Comcast Michigan node which is the client's ISP. Is there anything I can do additionally to fix this problem for my client?

Answer

There is little to nothing you can do. If the ISP has a routing issue on their network that isn't allowing the connection through, then the options are:

1. Client can complain to the ISP to fix their network.


2. Client can use a different connection to access the site.


3. Move the site to another host where the client can access it (not recommended).

Option 1 is usually the best course of action. Unfortunately, the Internet isn't perfect and sometimes there are connection problems. If a traceroute is showing a break within Comcast's network, then Comcast needs to fix it.

Trying to install Mysql on Ubuntu Server 12.04

I am currenty trying to install MySql on my Ubuntu 12.04 server.
But I got problems, When i run sudo apt-get install mysql-server it runs, ask me for a Yes but then.
It returns Temporart failure resolving, Failed to fetch.
I am using PuTTY to manage the server, but I can access it physically.
This is what I get when i run the command.

root@cloud:/home/tek/openstackgeek# sudo apt-get install mysql-server
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  libdbd-mysql-perl libdbi-perl libhtml-template-perl libmysqlclient18
  libnet-daemon-perl libplrpc-perl mysql-client-5.5 mysql-client-core-5.5
  mysql-common mysql-server-5.5 mysql-server-core-5.5
Suggested packages:

  libipc-sharedcache-perl libterm-readkey-perl tinyca mailx
The following NEW packages will be installed
  libdbd-mysql-perl libdbi-perl libhtml-template-perl libmysqlclient18
  libnet-daemon-perl libplrpc-perl mysql-client-5.5 mysql-client-core-5.5
  mysql-common mysql-server mysql-server-5.5 mysql-server-core-5.5
0 upgraded, 12 newly installed, 0 to remove and 0 not upgraded.
Need to get 27.2 MB of archives.
After this operation, 97.1 MB of additional disk space will be used.
Do you want to continue [Y/n]? y
Err http://no.archive.ubuntu.com/ubuntu/ precise-updates/main mysql-common all 5.5.24-0ubuntu0.12.04.1

  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://no.archive.ubuntu.com/ubuntu/ precise/main libnet-daemon-perl all 0.48-1
  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://no.archive.ubuntu.com/ubuntu/ precise/main libplrpc-perl all 0.2020-2
  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://no.archive.ubuntu.com/ubuntu/ precise/main libdbi-perl amd64 1.616-1build2
  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://no.archive.ubuntu.com/ubuntu/ precise/main libdbd-mysql-perl amd64 4.020-1build2
  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-common all 5.5.24-0ubuntu0.12.04.1

  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main libmysqlclient18 amd64 5.5.24-0ubuntu0.12.04.1
  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://no.archive.ubuntu.com/ubuntu/ precise/main libhtml-template-perl all 2.10-1
  Temporary failure resolving âno.archive.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-client-core-5.5 amd64 5.5.24-0ubuntu0.12.04.1
  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-client-5.5 amd64 5.5.24-0ubuntu0.12.04.1
  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-server-core-5.5 amd64 5.5.24-0ubuntu0.12.04.1

  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-server-5.5 amd64 5.5.24-0ubuntu0.12.04.1
  Temporary failure resolving âsecurity.ubuntu.comâ
Err http://security.ubuntu.com/ubuntu/ precise-security/main mysql-server all 5.5.24-0ubuntu0.12.04.1
  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-common_5.5.24-0ubuntu0.12.04.1_all.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/libmysqlclient18_5.5.24-0ubuntu0.12.04.1_amd64.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://no.archive.ubuntu.com/ubuntu/pool/main/libn/libnet-daemon-perl/libnet-daemon-perl_0.48-1_all.deb  Temporary failure resolving âno.archive.ubuntu.comâ
Failed to fetch http://no.archive.ubuntu.com/ubuntu/pool/main/libp/libplrpc-perl/libplrpc-perl_0.2020-2_all.deb  Temporary failure resolving âno.archive.ubuntu.comâ
Failed to fetch http://no.archive.ubuntu.com/ubuntu/pool/main/libd/libdbi-perl/libdbi-perl_1.616-1build2_amd64.deb  Temporary failure resolving âno.archive.ubuntu.comâ

Failed to fetch http://no.archive.ubuntu.com/ubuntu/pool/main/libd/libdbd-mysql-perl/libdbd-mysql-perl_4.020-1build2_amd64.deb  Temporary failure resolving âno.archive.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-client-core-5.5_5.5.24-0ubuntu0.12.04.1_amd64.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-client-5.5_5.5.24-0ubuntu0.12.04.1_amd64.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-server-core-5.5_5.5.24-0ubuntu0.12.04.1_amd64.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-server-5.5_5.5.24-0ubuntu0.12.04.1_amd64.deb  Temporary failure resolving âsecurity.ubuntu.comâ
Failed to fetch http://no.archive.ubuntu.com/ubuntu/pool/main/libh/libhtml-template-perl/libhtml-template-perl_2.10-1_all.deb  Temporary failure resolving âno.archive.ubuntu.comâ
Failed to fetch http://security.ubuntu.com/ubuntu/pool/main/m/mysql-5.5/mysql-server_5.5.24-0ubuntu0.12.04.1_all.deb  Temporary failure resolving âsecurity.ubuntu.comâ
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

I am trying to install OpenStack on the server, and came to the Mysql step.

Answer

I can resolve security.ubuntu.com so you may have limited network connectivity or your name resolution is incorrectly configured. Make sure you have valid nameservers in /etc/resolv.conf and DNS is enabled on the hosts line of /etc/nsswitch.conf. Then try pinging www.yahoo.com.

security - MySQL through SSH Tunnel

I have a php web application (Server A) that accesses MySQL on a remote server (Server B) through an SSH tunnel. Once the tunnel is set up, I can log in and run queries on Server B from Server A exactly as you would expect. However, when the web application tries to query the server I get the error:

[PDOException] SQLSTATE[HY000] [3159] Connections using insecure transport are prohibited while --require_secure_transport=ON.

Sure enough if I set the require_secure_transport system variable to OFF, it all works as expected but I do not understand why the web application connection triggers this exception but a normal connection does not.

ssl - Single certificate for a single domain & multiple domains - Apache

I am hosting multiple websites on a server with a single IP address. I have a single certificate for one of the domain names. Is there a way to configure Apache so that the certificate applies only to that single domain and not others on a single IP address? Right now the setup works, but that same certificate is used for all, which is obviously not what I want. I don't want to set up SSL for these other domains, rather, just disable SSL functionality for all except that one domain.

An example would be really helpful!

Thanks!

Answer

Because of the way SSL typically works, what you want is not feasible. When you understand how https works, its easy to understand why. When a browser makes an HTTP connection, what happens is to first create a TCP connection, then start talking the HTTP protocol over that TCP connection. The HTTP protocol provides a way for the client to say "I'm intending to fetch pages from the server named 'www.example.com'", This server name is what is being used by apache to decide which VirtualHost to use.

With HTTPS, what happens is, a TCP connection is made, then SSL is negotiated (the server sends the certificate to the client, the client verifies that the certificate is legitimate, they exchange session keys), then they talk HTTP over this SSL encrypted TCP connection, and only then can the client say which server name they are intending to talk to.

So here the problem is that they have already negotiated the SSL connection before the server knows which server they are trying to talk to.

Server Name Identification intends to extend SSL/TLS in order to let the client specify a server name as part of the SSL negotiation, but it is not supported widely enough in browsers to rely upon yet.