Yum through http proxy

Hello,

I have several Fedora 13 servers that have to connect through an http proxy for yum updates. All port 80 traffic has to be routed through this proxy. I have setup the proxy server in the network settings GUI. I can browse the internet just fine. I have also setup my proxy information in /etc/yum.conf as follows: proxy=http:proxy.largecorp.corp/accelerated_pac_base.pac proxy_user=user proxy_password=password

I then added the export HTTP_PROXY="http:proxy.largecorp.corp/accelerated_pac_base.pac" to /etc/bashrc and sourced the file.

When i run yum update: Loaded plugins:presto, refresh-packagekit Error: Cannot retrieve repository metadata (repomd.xml) fro repository: fedora. Please verify its path and try again.

All of the repo urls are the defaults, as this is a fresh install.

From serverfault eodchop

• http:proxy.largecorp.corp/accelerated_pac_base.pac is not a valid URL, shouldn't it be http://proxy.largecorp.corp/accelerated_pac_base.pac?

  Apart from this, you should try to explicitely state which proxy yum needs to use, instead of pointing it to an auto-configuration URL like the one you're using; something like

  http://proxy.largecorp.corp:8080
  

  Just look up your actual proxy settings and use them.

  eodchop : That was a typo on my part.
  From Massimo

Adding users to Sharepoint when they are not in the same domain

Bear with me as I explain this, I'm working my way through Sharepoint access as I go, but I'll clarify my question as I go along.

The Problem We have about 10,000 users who need access to our Sharepoint 2005 based reporting. Because our organization is migrating from one domain to another, we need to add each user twice, once for each domain. For the current domain, this is no problem, we've got a powershell script that I tweaked to add all the users in a given CSV file, this takes about 5 minutes to run.

The big problem we're having is with users who are NOT in our currently active domain. Because the sharepoint server cannot authenticate the new users, we can't add them directly. What we're doing is creating a temp user, then using STSADM.EXE to migrate that test user to the proper domain/user_name for each of our 10,000 users. The creation and migration takes about 5 seconds per user, or well over 12 hours to run.

The Question

Has anyone encountered this before? Is there a way to add users without requiring AD authentication? Why is STSADM.EXE running so slow?

Thanks a lot for any advice or direction anyone can give me.

From serverfault $pageUsers[$entry.posts[0].author].name

• Wouldn't it be a lot easier to create a trust between the two domains?

  Chris Thorpe : This seems like the right way to go. You create a domain trust between the domains, and make sure sharepoint can see both. Then you add the users in fully qualified e.g. olddomain\username or username@olddomain
  From Massimo

Thunderbird is unable to find server in DHCP controlled network.

I have a network which consists of linux server and a combination of WinXP, Win7 and linux clients. All the systems are given dynamic IP addresses by the router which connects them all together. The server hosts an IMAP mail server. On Win7 and WinXP Thunderbird can access the IMAP server without any problems. On the linux client, using the same IMAP parameters, Thunderbird is unable to connect to the server.

How do I get Thunderbird to find the server? I'm not sure if this is a linux system configuration problem or a Thunderbird issue.

Additional note: The linux client is running Gnome, the server has a series of Samba shares defined. In the client, doing Places->Connect to Server and selecting Windows Share and specifying the server name, the Samba share is mounted OK.

From serverfault Skizz

• You probably want your imap server to have a fixed address if you can do that.

  If you cannot, then you probably want it to update your DNS with its name and current IP address.

  If you cannot do that, then you cannot do what you want.

  The reason Samba shares work is that the SMB protocol, while it uses IP, doesn't really use DNS. It's older than that, and each server just announces its presence periodically.

  Skizz : A static IP would certainly work, but what bothers me is that Thunderbird running in Windows can connect to the server without any problems, which seems like Windows is getting information the Linux client isn't and I was wondering what that something is.

  Robert Moir : Netbios name resolution possibly. In any case, this is a good case study for "why servers have fixed IP addresses" - because client software is unpredictable.
  From Michael Graff

• I would suggest running wireshark or tcpdump, filtered first to the IP address, and for later captures the MAC address of client system.

  1. Start the capture running, filtering on a windows box. Launch thunderbird. See what comes up.
  2. Start a new capture running, filtering on the linux box. Launch thunderbird. See what comes up.
  3. Iterate, filtering out stuff that seems obviously not related to the differences between the IMAP connection between the two machines.

  Eventually, you will see some kind of traffic sent by the Windows box which is not sent by the Linux box. I wonder if WINS is somehow involved.

  From EricJLN

Accessing multiple local HD's or RAID with ESXi 4.0

How to I get additional HD's to be recognized and used by ESXi 4.0.

When I purchased my system I had two 2TB HD's, but when I installed ESXi it only recognized one of them. I'm happy to get whatever number of drives that I need (I have a four bay SATA in my Dell T310).

What are some options? RAID? If so, is it supported. I guess I would need hardware instead of software since ESXi is so small.

The VMWare forums (where I've lived for the last two days) are a charlie foxtrot of outdated and conflicting info.

I want to utilize my T310, with 32 GB RAM, 2.8GHz quad core to run many lab Windows VM's. I don't need production level availability but I do want decent performance, even though it's in a lab environment.

A huge thanks to Jim B., Zypher, Helvick, and Jeff Hengesbach who posted answers to my earlier predecessor question on why ESXi was so sluggish.

From serverfault Shawn Anderson

• ESX and ESXi can't see individual volumes larger than 2TB which you have to bear in mind. There is some useful discussion on this with regard to ESXi and Dell servers in this VMware Communities thread. The 2TB limit stems from the fact that even with V4 both ESX and ESXi are still constrained by SCSI2 limits. If you build a RAID pack that is bigger than 2TB you will have to split it into volumes that are smaller than 2TB for ESXi to be able to use them. Note that this 2TB limit also applies to the maximum virtual disk (VMDK) size that ESX\ESXi can currently present to a VM but that's probably not an issue for you at this stage.

  The simplest way to add storage in your case is simply to add the drive and then rescan the storage adapters (Under the Configuration->Storage Adapters Tab select Rescan). This should then allow you to create a new Datastore on the new drive (under the Configuration->Storage Tab select the Add Storage link and then select New VMFS Datastore). The downside of this approach is that you are creating silos of single drive Datastores which isn't good for resilience or performance.

  If you have a RAID controller in the T310 then you should be able to configure RAID using the RAID BIOS at boot (CTRL+C to get into the SAS6/iR BIOS if you have that , CTRL+R if you have a PERC, see below if you have neither). That will allow you to build the RAID pack from the drives you have attached but your options will depend on the type of controller you have. You can then carve that (again in the Controller BIOS) into a number of smaller volumes so ESX can detect and use the storage. The problem with this approach is that you will probably need to reinstall ESXi completely to take full advantage of it but it's a much better way to present storage to ESX\ESXi.

  Dell's RAID controllers have some limitations and in order to implement a hardware RAID5 your choices are limited to the PERC-6i, H200 or H700 controllers. The SAS 6iR only supports RAID 0 or RAID 1. If you want other options you'll have to buy a 3rd party controller that is compatible with both ESXi and the T310. The VMWare Hardware Compatibility Guide is useful for finding this sort of thing. The Community Support site lists things that are not actively supported but have been reported to work.

  Shawn Anderson : Here is what I see on the HCL intro page. "NOTE: IDE RAID and SATA RAID are not supported for the VMFS file system." My T310 is a 4 bay SATA. Am I hosed here? My goal is to get higher IO so that I can run multiple Windows VM's without sluggishness. Am I reading this wrong? Do I have other options besides RAID, like having multiple discs (SATA) that ESXi can use simultaneously?

  Helvick : That statement doesn't mean it doesn't work (it does) just that VMWare don't support VMFS on SATA RAID. If you are using ESXi with its free licence then their active support isn't as important as knowing something will work. The Community support site is useful for scenarios like yours and the ESX Whitebox HCL [ http://www.vm-help.com//esx40i/esx40_whitebox_HCL.php ] is another unofficial site with useful pointers to configs that work.
  From Helvick

Performance problems - Jira running on Ubuntu over VMware ESX 4.0 maxing out all 4 vCPUs.

We are running Jira on a box under VMware ESX 4.0 and performance is vaiable to say the least. The physical box has 12 Gig RAM and 4x Xeon 2.26 GHz CPUs. vCentre is telling us the CPUs are not maxed out at any time, RAM is fine too. When we issue a request to the host it sometimes maxes out all 4 vCPUs. Sometimes it's quick, sometimes very very slow. There doesn't seem to be a pattern.

Any ideas?

From serverfault Jack T

• To me this sounds like the heap memory issue. I think jira allocated 128M of RAM to run on.

  So in

  ./bin/setenv.sh
  

  Just increase the memory options for

  JAVA_OPTS
  JIRA_MAX_PERM_SIZE
  

  Then restart jira.. see if that helps. That is what helped for me on slow page/ajax loads.

  From Mike

• Turned out they were Tunneling in over SSH (using putty SSH port forwarding ). I got them to VPN into our firewall instead and when they connected in via normal HTTP it worked just fine!

  Java having issues with SSH decrypt? Who knows. Working now.

  pauska : Please mark this as the solution to your question
  From Jack T

IIS not using available memory?

Recently launched an ASP.NET site running on a single 32-bit WS2003 box (SQL on a separate server). The server has 4GB intalled, 3GB available. According to task manager, the w3wp.exe process is only using between 200-600MB. The site has tens of thousands of pages and makes heavy use of page output caching, so I would expect it to use a lot more of the available memory.

The app pool isn't set to throttle memory usage. Is there anything else that might be limiting the amount of memory that IIS takes?

From serverfault Herb Caudill

• There shouldn't be anything else besides the app pool that throttles that. Are you seeing any problems, or are you just baselining the system and want to make sure you understand everything?

  Herb Caudill : No, no problems - just seems strange, and makes me think that something could be preventing it from using the available memory.
  From mfinni

• The site may host a lot of pages, but what about the load? If there are only a couple hundred http requests coming in per hour, I wouldn't expect the server to use up all available memory.
  
  

  Also echoing mfinni's comment, are you having any problems or just trying to understand your server?

  Herb Caudill : The site typically handles between 10K and 15K requests per hour.
  From SDGuero

Is it secure to store the cert/key on a private AMI?

Are there any major security implications to bundling a private AMI which contains the private key/certificate & environment variables?

For resiliency I'm creating an EC2 image which should be able to boot and configure itself without any intervention. After boot it will attempt to:

• Attach & mount specific EBS volume(s)
• Associate a specific Elastic IP
• Start issuing backups of the EBS volume(s) to S3

However, to do this it will need the private key/pem files and will need certain environment variables to be available on start-up. Since this is a private AMI I'm wondering if it will be "safe" to store these variables/files directly in the image so that I don't need to specify any user-data information and can therefore start a new instance remotely (from my iPhone, if needed) should the instance be terminated for any reason.

From serverfault Phillip Oldham

• I can't really think of a more secure way to do it, since a private AMI is protected by the same AWS levels of security as your EC2 account.

  An alternative would be to store the keys in a source code repository and check them out when you start up the EC2 instance; although you're then sending the keys across the wire, you can encrypt the traffic(e.g. with svn:ssh or https for Subversion).

  From gareth_bowles

• A private AMI is safe, I wouldn't worry about anyone hacking your S3 data. However, a running server is as safe as you made it and you should assume that it is hackable. Therefore, your keys, which are really the key to Everything on your account, should not be left lying around.

  Make sure that the startup scripts delete the keys from the disk and do not retain them, unless there is a really good reason.

  If your server uses other AWS services and needs the keys to access them, consider having multiple AWS accounts for various services, and consolidate their billing for your convenience.

  You can also use external management services like RightScale, Scalr or Eucalyptus.

  From Shalom Carmel

• AMIs which are directly stored in S3 will be encrypted by Amazon and signed with your keys (see "The creation process for an AMI that uses an instance store as its root device does the following:" in http://docs.amazonwebservices.com/AWSEC2/latest/DeveloperGuide/index.html?ComponentsAMIs.html).

  However, AMIs stored in EBS volumes are based on snapshots, which are not encrypted: aws.amazon.com/ec2/faqs/#Do_you_offer_encryption_on_Amazon_EBS_volumes_or_snapshots

  In either case, you should take a critical look at the permissions on the S3 bucket containing your AMI. By default the bucket will only be accessible by your account, but you may also want to add further protection using S3 ACLs.

  From