windows server 2008 - Domain rename with Exchange 2010

I have taken over all IT responsibilities for a company that is using Active Directory (2008 R2 native level) and Exchange 2010. I have come to find out that their internal Active Directory domain name is the same as an external internet domain name that they do not own. I understand that domain rename with Exchange 2010 / server 2008 r2 is not possible as far as I have read. Could someone help me to realize what other options may be available to me? They have quite a large infrastructure so moving to a new forest would be a massive job I would like to try to avoid if possible.

Thank you in advance for your help.

Answer

Domain rename with Exchange 2007/2010 is not supported by Microsoft. If you want to go this route, you will not be able to get any support from Microsoft, and there is a good change that your infrastructure will be damaged in some way. Most sites I have read on this say NOT to do this.

So this leaves you with three options:

1)Do Nothing - This is the easiest of the three options. If the external domain is not something people are going to go to, then there is probably nothing to worry about. There may be some issues in getting UC/SAN certificates for Exchange, but the only issue I am aware of will be a security warning in Outlook when you're using the program inside your firewall.

2)Remove Exchange, then do a domain rename - I don't know what other AD-aware/AD-connected applications you have, so this may not be an option. How this works is that you take a long outage, back up your Exchange databases, remove Exchange from your environment, rename your domain, and then re-install Exchange and configure your environment. This would be a lot of work, and you would have no email during this outage. You would also need to extensively document your Exchange environment so that it is reconfigured with the same settings.

3)AD Migration - Create a new Active Directory forest and migrate all of your AD-objects to this domain. This will require the most work and the most testing to make sure that a migration doesn't break any of your applications.

3a)New AD Domain in the same forest - Some of the Microsoft material that I have read for my MCITP states that you can have discontiguous DNS naming structures in the same forest. This means that you can have one Active Directory forest with domains xyz.com and abc.local. This is a supported configuration for Microsoft Exchange 2010 (see http://blogs.technet.com/b/exchange/archive/2009/10/27/3408616.aspx), and it should allow you to solve your issue without a large-scale migration to a new forest.

If you decide to make any major changes to your AD environment, I would recommend contacting a Microsoft partner to go over your scenario in greater detail than what you can provide here. There may be other caveats that you can't go into detail on that could hinder your project.

Does Samba work well with Windows when case-sensitive names are enabled?

I want to have a *nix Samba share accessible by Windows clients.

Samba has an option to enable or disable filename case-sensitivity. Normally for windows access, this is disabled, so that fred==FRED=fReD.

However, this leads to one major gotcha, AFAICT:

• On unix, you create two folders
  called "RODDY" and "roddy"


• On Windows, you'll see both of the
  folders, but...



• When you delete/rename/open one from Windows,
  you could end up
  deleting/renaming/etc either of them.
  You have no way of knowing which!.

So, my question is, how does Samba behave on windows if the case-sensitive flag is set "ON"? Can a user still see both folders, and have file operations work in a consistent manner?

Answer

It should be fine. Windows Explorer does a fine job of displaying filename case correctly. I use this in my smb.conf to make sure what I type in Explorer is what Samba uses (I set all of these per-share):

case sensitive = True
default case = lower
preserve case = yes
short preserve case = yes

I ran through a quick test (Samba 3.0.24 on the backend, WinXP on the front). Files were created on the samba server via an SSH session.

$ cd /some/samba/share/path
$ mkdir test

$ cd test

$ mkdir test1 TEST1
$ touch test1/foo TEST1/bar

After this, I browsed through my mapped drive to the test directory. I can see both "test1" and "TEST1" directories. I opened "test1" and saw the "foo" file. I opened "TEST1" and saw the "bar" file. So far so good.

Then I went back to the test directory, and in the Explorer window, renamed TEST1 to TEST2. Windows freaked slightly -- it renamed the folder, then showed BOTH folders as TEST2 -- appearing to have renamed both folders. But, in the SSH terminal, I checked:

$ ls
test1 TEST2

So Windows renamed the file, and Samba got the filename correctly. When I pressed F5 in the Explorer window to refresh the folder contents, the display changed to show the correct folder names.

Caveat: Linux filesystems allow some characters that Windows doesn't (like ":"). Samba has a "name mangling" option to turn those filenames into something Windows will like. If I make a file called "FA:23" in my SSH window, for example, Samba mangles the name to "F7T4H0~F" and that's what appears in the Explorer window.

.htaccess - Require all denied has no effect. Require all allowed, works

I have a website structure setup as follows, which I am trying to organize access levels for each but without specifying as that requires the structure to be fixed (aka, if i copy this to a different site, into a subfolder, it would require editing of all .htaccess to the new location).

• /app/ - allow all, deny config/etc


• /app/templates/ - deny all


• /app/templates/mytheme/ - allow all for images, javascript, css, fonts only


• /app/lib/ - deny all

I have tried implementing Apache2.4's new(ish) directive scheme:

/etc/apache2/conf-enabled/security.conf

... more stuff above ...


   AllowOverride All
   Require all denied


... more stuff below ...

And adding Require all allowed to .htaccess in the root of the application, while adding Require all denied to .htaccess in the folders I wish to deny access to.

The problem is Require all denied seems to do absolutely nothing. I have seen reference to using the mod_auth_compat or whichever library, but it appears to only be required for older versions of apache (v2.3).

I am using Apache 2.4 on Debian 8.

Previously, I would supply :

Order Allow, Deny

Deny from all

And then drop the following in folders which require access :

Allow from all

.. and where I need to allow only specific file type access,

    Allow from all

According to apache's documentation, unexpected results may arise from mixing old and new declarations, and as such, I am only using new declarations. There are no stray .htaccess files or *.conf files loaded using the old declaration format for permissions - so this should work ?

Given the folder structure I laid out, and what is loaded in '/etc/apache2/conf-enabled/security.conf' (as that is where the "root" declaration is for AllowOverride [it doesn't seem to function when specifying AllowOverride All inside the same format of declaration in the websites conf ( 000-default.conf )], could someone give some guidance or preferably a working solution to this problem.

Using SATA III SSDs for ZFS pools

I'm thinking of building a ZFS server optimized for random access (PostgreSQL database). I figured that I have 2 options:

1. Use pools consisting of the Crucial M500 960 GB SATA III SSDs. Enterprise SAS SSDs are not price-effective, considering that they could cost 10x as much as their SATA III counterparts.




2. Use pools consisting of 15K SAS HDDs. (In contrast, the price differential between an enterprise SAS HDD and a regular SATA III HDD is much smaller, so buying a SAS HDD is still justifiable.)

My questions are:

1. SATA III SSD vs 15k SAS HDD: Most of the arguments against SATA III have to do with the duty cycle (not suitable for 24/7?), but given that the MTBFs of consumer SATA III SSDs (e.g. Samsung 840 Pro, Crucial M500) are comparable to those of SAS SSDs and 15k HDDs, is there anything wrong with using the M500s? Or am I better off with the 15k SAS HDDs despite the clear performance advantages of the SSDs for random access?




2. L2ARC and SSD ZFS pools: If I'm using SSDs-only for my ZFS pools, would I benefit from an L2ARC device?

Answer

My recommendations vary a bit based on the distribution and approach to ZFS...

• SSD-only pools work well - However, you need to think very carefully about the controller, backplane and drive layout. Main considerations are: no expanders, use pure SAS HBAs, ZFS mirrors are king.




• 15k SAS disks in 2014 are Meh - If you need the random I/O performance of SSDs. You can used SAS disks as another tier or even nearline drives if you need the capacity.




• L2ARC won't be necessary for your all-SSD pool - Optimize and maximize RAM. There are some considerations for Linux-based ZFS solutions, but in general, more RAM is better than gobs of L2ARC, especially if you don't know your I/O pattern and working set.




• Miscellaneous - Use compression, monitor and scrub your pool, use good RAM, test, buy quality SSDs... Crucial isn't on my radar. There are other high quality SATA SSDs available that will have better performance characteristics.

storage area network - Installing hard disks on a server connected to a SAN

I have a server that is connected to a SAN (Dell Compellent) and due to space concerns I am looking into installing some physical disks into this server to 'offload' some data being used by the server on the SAN. The server has several volumes using the SAN, one of which is the OS/system drive. I want to leave this on the SAN, but replace all other volumes with the physical disks.

I plan to clear the disks beforehand using another server, and also to install them offline (i.e. not hotplug them) for safety.

My question is - Will simply plugging the disks in be ok (And will I then be able to format and configure them in disk manager in windows) or do I need to configure them using the RAID configuration software that loads before the OS (I have very little experience with server RAID setup)

The server in question is a dell poweredge 1850 (not sure which generation at the moment) running windows server 2008 Standard.

Answer

I believe it will depend entirely on the RAID controller. I know that there's no way to configure my HP P212 controller in 'pass-through' mode, so a new disk that's plugged into the controller has to be configured as a single-disk volume, before the OS sees it as a disk.

That said, there are controllers that do enable unconfigured disks to be exposed directly to the OS without any RAID configuration needed.

It's interesting that you want to move data off the SAN, but leave the system disk on the SAN - I'd guess that most people would want to do this the other way round. SANs tend (!) to be well managed, resiliant, backed up etc. A system drive is easily-rebuildable, whereas people's data isn't.

I'd also argue that in a production hosting environment, you'd want all locally attached disks to be in RAID 1 (mirrored) for the sake of resilience, unless you've got a very good reason for doing so.

performance - xenserver 5.6 on on raid 10 array

We've always had performance issues with our Xenserver 5.6 and ive asked a question here about it and still didnt manage to get it resolved (xenserver VMs continous temporary lag).

Since this appears to be a storage thing not being able to put up with 10 XP-SP3 and 2 W2k3 VMs, we got one storage blade for each of our BL460 servers to provide with DAS hence each server will have 4 instead of 2 SAS 10k drives.

My questions:

• Between RAID 10 and RAID 5 on a p400i raid controller, which do you recommend for improved performance? there are some confusing opinions on the net between those 2.




• Currently (storage blade not installed yet) the p200i raid controller's smartarray on the BL460 allows for creation of a logical drive with RAID 10, and indeed thats the configuration we're using. but how is that possible with only 2 physical drives?

Answer

Raid 10 with 2 drives ends up being a raid 1 (check the "fault tolerance" section here). Raid 10, generally, is a system where every pair of drives you add becomes a mirrored pair, and all the volume data is striped across all the pairs. Since there's no parity to calculate, it's faster than raid 5. for writes. Reads will be the same. If you have an ASIC on your raid card that can calculate parity in-line, you can get almost the same performance on writes with raid 5. Also, as someone else answered, ensure that you have caching enabled, at least for writes.

For performance alone, I'd always recommend raid 10. If you see the data growing and want to delay more disk purchases in the future, raid 5 is a fair trade-off. Raid 5 lets you use the space on all your disks except one. Raid 10 reduces the amount of space you can use by half.

For reliability, raid 10 still has the lead, but not as much as you'd think. If you lose the wrong two drives, a double disk failure can still hose your data and force you to recover from tape. Raid 5 will always fail on a double disk failure, but raid 10 only sometimes fails on a double disk failure.

spam marked - Why am I getting 500 error while trying to send emails to some domains?

Recently I've been seeing the following error while trying to send emails to some domains:

Final-Recipient: name@example.com
Original-Recipient: name@example.com
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.example.com

Diagnostic-Code: smtp; 550 "The mail server detected your message as spam and
    has prevented delivery."

Neither my IP address nor my domain is blacklisted. The email is a simple test email without attachments or links.

What can I do or where can I get more information about this issue?

Thank you