Secondary DC did not authenticate users after primary DC went down and Once I get this critical error in secondary dns on secondary dc after pdc down Directly.
Event ID 4015
( The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is . The event data contains the error.)
I have a centos 7 server. I switched from apache 2.4.6 to apache 2.4.25 using IUS repository (https://ius.io/). My goal is to support multiple SSL certificates with a single IP.
I have installed:
Is apache now SNI enabled?
Or do I have to build it from scratch with ./configure --with-ssl=/path/to/your/openssl as in documentation (https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI)?
Thank you for your time.
Answer
The stock CentOS httpd & mod_ssl packages would already have supported SNI. SNI has been supported by openssl since version 0.9.8f and any httpd since version 2.2.12 built with openssl 0.9.8f and newer automatically will support SNI.
But to check if your httpd and mod_ssl support SNI:
Simply test by configuring name based SSL/TLS virtual hosts and check your error log after restarting (from the apache httpd wiki you already linked to):
If you configure multiple name-based virtual hosts for an address where SSL is configured, and SNI isn't built into your Apache, then upon Apache startup a message like
"You should not use name-based virtual hosts in conjunction with SSL!!"
will occur in the error log.
If SNI is built in, then the error log will show
"[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)".
Alternatively use ldd to confirm that mod_ssl is linked against openssl's libssl and confirm the version:
ldd /usr/lib64/httpd/modules/mod_ssl.so
linux-vdso.so.1 => (0x00007fff323f8000)
libssl.so.10 => /lib64/libssl.so.10 (0x00007f3d99792000) <=======
libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007f3d993a8000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f3d9918b000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f3d98f87000)
libc.so.6 => /lib64/libc.so.6 (0x00007f3d98bc6000)
libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f3d98977000)
libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f3d98690000)
libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f3d9848c000)
libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f3d98259000)
libz.so.1 => /lib64/libz.so.1 (0x00007f3d98043000)
/lib64/ld-linux-x86-64.so.2 (0x00007f3d99c3d000)
libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f3d97e34000)
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f3d97c2f000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f3d97a15000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f3d977ed000)
libpcre.so.1 => /lib64/libpcre.so.1 (0x00007f3d9758c000)
rpm -qf /lib64/libssl.so.10
openssl-libs-1.0.1e-60.el7_3.1.x86_64
Is there any way to get a core dump of, or be able to debug a process that has been killed by oom-killer?
Or even set oom-killer to try to kill a process using ABRT instead?
Is it possible to set up email through Google Apps such that a single box, such as info@mailer.mydomain.com, can be used for bulk email without having to migrate all company email across to Google services and if so what would the MX records have to look like to achieve this split?
The desired end result would be that a single email created as a subdomain such as info@mailer.mydomain.com would be sending to an opt-in mailing-list through the Google account but the regular company email accounts would remain under their current hosting provider using the regular @mydomain.com format.
If this can't be done, are their any services that can offer something like this?
I have a HP DL360 server with 4x 146GB SAS disks and a Smart Array P400i RAID controller with 256MB cache. The disks are in RAID 5 (3 disks + 1 hot spare).
The server is running VMware ESX 3i.
The disk write performance is really bad. Here are some numbers:
ns1:~# hdparm -tT /dev/sda
/dev/sda:
Timing cached reads: 3364 MB in 2.00 seconds = 1685.69 MB/sec
Timing buffered disk reads: 18 MB in 3.79 seconds = 4.75 MB/sec
ns1:~# time sh -c "dd if=/dev/zero of=ddfile bs=8k count=125000 && sync"
125000+0 records in
125000+0 records out
1024000000 bytes (1.0 GB) copied, 282.307 s, 3.6 MB/s
real 4m52.003s
user 0m2.160s
sys 3m10.796s
Compared to another server those number are terrible: Dell R200, 2x 500GB SATA disks, PERC raid controller (disks are mirrored).
web4:~# hdparm -tT /dev/sda
/dev/sda:
Timing cached reads: 6584 MB in 2.00 seconds = 3297.79 MB/sec
Timing buffered disk reads: 316 MB in 3.02 seconds = 104.79 MB/sec
web4:~# time sh -c "dd if=/dev/zero of=ddfile bs=8k count=125000 && sync"
125000+0 records in
125000+0 records out
1024000000 bytes (1.0 GB) copied, 35.2919 s, 29.0 MB/s
real 0m36.570s
user 0m0.476s
sys 0m32.298s
The server isn't very loaded and the VMware Infrastructure Client performance monitor is showing 550KBps average read and 1208KBps average write for the last 30 minutes (highest write rate: 6.6MBps).
This has been a problem from the start. Any ideas?
I currently have a website hosting on CPanel which consists of subdomain.example.com and example.com. I'd like to keep the subdomain hosted where it is, but move the main domain to be hosted with Firebase. I'm struggling to work out the required DNS changes to make this work.
If it is relevant, the domain was purchased from 123-reg and points to custom nameservers on my CPanel server.
I read this answer, but I've also read that Firebase no longer allows CNAME records and has to be A records.
Would it work to have an A record pointing to the IP addresses supplied by Firebase and a CNAME record for the subdomain pointing to the server where it is currently hosted?
Answer
You need to create two A records:
I am on a Unix host and am looking for a programatic way to determine the closest DC. Microsoft has an excellent article explaining how to perform the DNS lookup, and I am able to find the list of available DCs easily like this:
dig -t SRV _ldap._tcp.dc._msdcs.example.com
But regarding finding the closest, it explains:
After the client locates a domain controller, it establishes communication by using LDAP to gain access to Active Directory. As part of that negotiation, the domain controller identifies which site the client is in based on the IP subnet of that client. If the client is communicating with a domain controller that is not in the closest (most optimal) site, the domain controller returns the name of the client's site.
So far I have not been able to find where this "returns the name of the client's site" occurs during LDAP queries. Is there a particular query I should perform to get this, or some other technique that can be performed on a Unix host not joined to the domain?
EDIT: Thanks to Sim's pointer, I've learned how to find the correct DC once I know my site (in this example, "mysite" as part of example.com):
dig -t SRV _ldap._tcp.mysite._sites.dc._msdcs.example.com
But this leaves open the question of how to determine my site. Repeatedly the docs indicate that any DC I connect to will work this out for me, but I can't find the doc that says how it returns me the information. I've even tried sending DNS queries directly to DCs to see if they'll order the SRV results with my site on the top, but they don't.
Answer
This TechNet article walks you through the logic of Finding a Domain Controller in the Closest Site if that helps.
Since you are on Unix have you looked at how Samba does this? It looks like this is done with CLDAP. This blog entry - Joining a Samba Domain might provide some more answers.
