gmane.linux.gentoo.server

Fwd: Re: [gentoo-user] udevd boot messages

Pandu Poluan — 2012-05-24T00:59:46

Mes amis,

Please be informed that the latest baselayout update might very likely
needs a reboot.

Here's some info I repost from Gentoo-user list. For the full thread, check
out its archive.

Rgds,
 ---------- Forwarded message ----------
From: "Tanstaafl" <tanstaafl< at >libertytrek.org>
Date: May 23, 2012 11:27 PM
Subject: Re: [gentoo-user] udevd boot messages
To: <gentoo-user< at >lists.gentoo.org>

On 2012-05-21 5:00 PM, Markos Chandras <hwoarang< at >gentoo.org> wrote:

 The package clearly informed you that you need to reboot for things to

<pet-peeve>
I asked about this a while back but never got a decent answer...

*Especially* for servers, there really, REALLY needs to be a way to see
this kind of warning BEFORE updating... ie, the warning should be printed
to the screen during an 'emerge -pvuDN world' or something, so I know that
a reboot will be required for this update.
</pet-peeve>

Re: Postfix Double Bounce Handling

Tanstaafl — 2012-05-15T19:02:50

*From* your domain? Or destined *for* your domain?


Well, since you haven't proven any of your assertions, we have no way of 
knowing.

You should be asking this on the postfix list, but we can probably help 
you here too, if you are willing to listen...

First, we'll need full output of postconf -n...


If you accept messages to *any* address (including invalid recipients), 
then that is what is causing the bounce messages.

If you only accept messages for valid recipients, the bounces stop. 
Simple, no?

Re: Postfix Double Bounce Handling

Michael Orlitzky — 2012-05-14T19:25:58

In that case, how are spam bots a problem?

Can you post an example of a bounce, and the logs where it entered your
mail system?

Re: Postfix Double Bounce Handling

Vinícius Ferrão — 2012-05-14T18:48:54

Thanks for your quick response Michael,

But I don't understand what can make my server a backscatter source.

I'm not relaying from outside, and I only accept messages from my domain, and only from my aging sendmail+dovecot server, so no relaying from outside.

What I don't have is what you said: check for local recipients. But this is a problem?

Thanks in advance,

On May 14, 2012, at 2:22 PM, Michael Orlitzky wrote:

Re: Postfix Double Bounce Handling

Michael Orlitzky — 2012-05-14T17:22:11

If you are accepting mail for addresses that don't belong to you, stop!
That makes you a backscatter source, and will eventually (rightly) get
you blacklisted.

You said it's a mail filtering gateway... Usually the reason people
backscatter on a gateway is because "it's hard" to get a list of all
valid recipients; usually those recipients are on some other mail
server. There are ways to do it, though, and you must, e.g.

  a) Run a cron job that pulls valid accounts every hour.

  b) Store the email accounts in a database, and allow the gateway to
     query the database to determine which users are valid.

  c) Use recipient verification[1]. When receiving mail, your gateway
     can open a connection to the real mail server in the background,
     and see if the recipient is valid.


We use a combination of all three. We use (a) for an old Windows box,
(b) for users stored in Dovecot, and (c) for customers with their own
Exchange servers.

If you ask over on postfix-users and provide the output of `postconf
-n`, there are plenty of people who are able to give you tips relevant
to your specific configuration.


[1] http://www.postfix.org/ADDRESS_VERIFICATION_README.html#recipient

Postfix Double Bounce Handling

Vinícius Ferrão — 2012-05-14T16:38:52

Hello,

I'm running a postfix mail filtering gateway in a hardened gentoo box and I
really don't know what to do with double-bounced messages.

Since we have a lot of spam bots attacking our infrastructure, the double
bounce messages cannot be ignored and mail mail queue is growing with
undeliverable double bounce messages.

Any thoughts on what should be done to handle this?


Thanks in advance,
Vinícius Ferrão

Re: Active Directory Based Authentication?

Pandu Poluan — 2012-05-12T13:22:28

by the Fedora Project if I remember correctly.
relying on LDAP for information and Kerberos for authentication. So you
don't need things like nss-ldap, nslcd, nscd and other old services. You
can handle almost everything with SSSD. And even better: SSSD supports
offline server authentication in the case of your AD is down or not
reachable at the moment.
at home.
Active Directory authentication on Gentoo?
daemons/services.
can live without that.

Ahaha, this is what I've been looking for: a recommendation backed by
experience ;-)

Thanks for the heads up, guys! Honestly, this is the first time I ever
heard of SSSD. Sounds very interesting... I'll certainly look into it.

Rgds,

Re: Active Directory Based Authentication?

Pandu Poluan — 2012-05-12T13:18:53

allows authenticated binds to retrieve data and it requires an ssl
connection to do that, other than that it's really just ldap).
personally find the later to be extra complication that's usually
unnecessary.
do this in any number of schemes (eg: libnss-ldap, libpam-ldap, sssd, etc.).
authenticating users and doing attribute lookups on them.
can
probably something like redhat/suse specific.
controller to serve GPs to windows clients.

PowerBroker (née Likewise) claims that it can manage Linux boxen via GPO...

... but in my case I think I'll just force my subordinates to learn puppet
*heh*heh*

Rgds,

Re: Active Directory Based Authentication?

Pandu Poluan — 2012-05-12T13:15:45

daemons/services.
can

I *already* Googled for answers. I got lots of _alternatives_ but not
enough _experience-based_recommendations_.

Rgds,

Re: Active Directory Based Authentication?

Matthew Thode — 2012-05-11T21:25:48

I can attest to how awesome sssd is.  I use it for linux server to linux
client, but the concept is still the same.

Re: Active Directory Based Authentication?

Vinícius Ferrão — 2012-05-11T14:51:59

Hello Pandu,

I have done a implementation using a daemon named sssd. It's sponsored by the Fedora Project if I remember correctly.

It supports 2008r2 AD without much hassle. I've setup everything relying on LDAP for information and Kerberos for authentication. So you don't need things like nss-ldap, nslcd, nscd and other old services. You can handle almost everything with SSSD. And even better: SSSD supports offline server authentication in the case of your AD is down or not reachable at the moment.

I can send you some links in the night (Brazilian night) when I will be at home.

Sent from my iPhone

On 11/05/2012, at 00:36, Pandu Poluan <pandu< at >poluan.info> wrote:

Re: Active Directory Based Authentication?

Brian Kroth — 2012-05-11T14:30:00

Pandu Poluan <pandu< at >poluan.info> 2012-05-11 10:36:

Attribute data can be stored/retrieved in ldaps (as in AD usually only 
allows authenticated binds to retrieve data and it requires an ssl 
connection to do that, other than that it's really just ldap).

Authentication can be done either via ldaps or kerberos, though I 
personally find the later to be extra complication that's usually 
unnecessary.

As someone else mentioned, there's a wealth of data out there on how to 
do this in any number of schemes (eg: libnss-ldap, libpam-ldap, sssd, 
etc.).


I don't see the distinction.  Either way it seems you're concerned with 
authenticating users and doing attribute lookups on them.


I'm not personally aware of anything that does that.  If there is, it's 
probably something like redhat/suse specific.

However, I believe it is possible to use a samba4 host as a domain 
controller to serve GPs to windows clients.

Cheers,
Brian

Re: Active Directory Based Authentication?

Matthew Thode — 2012-05-11T14:14:16

Not trying to be rude or anything, but it's easier then providing
multiple links.

http://lmgtfy.com/?q=active+directory+authentication+linux

Active Directory Based Authentication?

Pandu Poluan — 2012-05-11T03:36:08

Hello list,

I just want to know, what is your recommendation(s) to implement Active
Directory authentication on Gentoo?

I want to use AD not only for logins, but also for running daemons/services.

*Ideally*, it would also allow me to manage my boxen using GPO, but I can
live without that.

Rgds,

Re: Nginx dav-ext webdav the gentoo way

Norman Rieß — 2012-04-24T17:32:36

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thank you, i did that now and it works as it should be.

Regards
Norman



Am 23.04.2012 09:04, schrieb Denis Bondar:

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPluO0AAoJEMCA6frkLT6z3JwH/iY5dAOgED/yOeqGFtWjfkUb
qzldR1rznapNmkWYawtAtTUcPQv9mefb8p6CAoA0WLd5JSYXK0D2gfQKSr0T9kAx
GmfxSuYel+PNzIWzpzEv4tuMXQd1UeffEJfOnipFVuswTdDiQYhRDh2ZBWWOGZwx
GCFrnGFqfYj3TuvqMSs+Sb2SrUvJBpP0yUuIDZN5vd6RHazzChHwfMEHDQjUv2qZ
mEdOqg1EtL5eEwXUfBKsU07sxjTocS8a8Mypc5NlAJJnXLM+TtPVydexOmFIOk3K
qzm/SA7MsQiz4VvjMTVgdbvAilWqvUaTGOHrTZhud7ATv2NZvaTgZVlXDDPoAls=
=6qAr
-----END PGP SIGNATURE-----

Re: Nginx dav-ext webdav the gentoo way

Denis Bondar — 2012-04-23T07:04:03

Hi Norman-

The Gentoo way is to create your own ebuild in your PORTDIR_OVERLAY.
For example, I needed the auth_ldap in nginx. The final diff for my ebuild
was look like https://gist.github.com/2469281



On 22 April 2012 15:15, Norman Rieß <norman< at >smash-net.org> wrote:

Re: MySQL Backup

Brian Kroth — 2012-04-16T15:26:02

I use this for some very large data sets as well.  The trouble is that 
to do it right you have to lock the tables while it's running, so I 
actually run it off replication slaves instead.  One of the nice things 
of doing things this way is that you can use perl or your other favorite 
text processing tool to parse out individual databases, tables, views, 
etc.  That's important in a hosting environment and usually more 
difficult/costly with raw file backups.

Brian

Tanner Danzey <arkaniad< at >gmail.com> 2012-04-15 13:10:

Re: MySQL Backup

Robert Bridge — 2012-04-15T21:51:02

We use xtrabackup from percona, with tar to generate backup of the
running mysql servers in a fraction of the time it would take to use
mysqldump. Restoration is than just a case of copy the uncompressed
tarball into place and starting mysql.

It's a pain when it comes to restoring individual tables, but for a
full system backup it's fast and easy.

RobbieAB.

On 15 April 2012 20:40, Jesse Pasichnyk <jesse< at >pasichnyk.net> wrote:

RE: MySQL Backup

Jesse Pasichnyk — 2012-04-15T19:40:16

I run backuppc, calling MySQL dump as a pre-backup task...

Re: MySQL Backup

Tanner Danzey — 2012-04-15T18:10:39

I usr MySQL's "mysqldump" and a daily cron task that zips it up and sends
it to my NFS backup drive in dated folders. It works just fine for my
minute data set.
On Apr 15, 2012 1:04 PM, "Gerry Smith" <smith.gerry< at >gmail.com> wrote:

Re: MySQL Backup

kojiro — 2012-04-15T17:58:16

Tar+ssh

Gerry Smith <smith.gerry< at >gmail.com> wrote:

What's recommended for MySQL backups these days ?
I've been using zmanda, which I found very easy to install and use,
but it doesn't seem to be in portage anymore ?

Thanks,

Gerry Smith