Search Results

Search found 14544 results on 582 pages for 'ssh config'.

Page 198/582 | < Previous Page | 194 195 196 197 198 199 200 201 202 203 204 205  | Next Page >

• Cisco ASA: Allowing and Denying VPN Access based on membership to an AD group

  - by milkandtang

  I have a Cisco ASA 5505 connecting to an Active Directory server for VPN authentication. Usually we'd restrict this to a particular OU, but in this case users which need access are spread across multiple OUs. So, I'd like to use a group to specify which users have remote access. I've created the group and added the users, but I'm having trouble figuring out how to deny users which aren't in that group. Right now, if someone connects they get assigned the correct group policy "companynamera" if they are in that group, so the LDAP mapping is working. However, users who are not in that group still authenticate fine, and their group policy becomes the LDAP path of their first group, i.e. CN=Domain Users,CN=Users,DC=example,DC=com, and then are still allowed access. How do I add a filter so that I can map everything that isn't "companynamera" to no access? Config I'm using (with some stuff such as ACLs and mappings removed, since they are just noise here): gateway# show run : Saved : ASA Version 8.2(1) ! hostname gateway domain-name corp.company-name.com enable password gDZcqZ.aUC9ML0jK encrypted passwd gDZcqZ.aUC9ML0jK encrypted names name 192.168.0.2 dc5 description FTP Server name 192.168.0.5 dc2 description Everything server name 192.168.0.6 dc4 description File Server name 192.168.0.7 ts1 description Light Use Terminal Server name 192.168.0.8 ts2 description Heavy Use Terminal Server name 4.4.4.82 primary-frontier name 5.5.5.26 primary-eschelon name 172.21.18.5 dmz1 description Kerio Mail Server and FTP Server name 4.4.4.84 ts-frontier name 4.4.4.85 vpn-frontier name 5.5.5.28 ts-eschelon name 5.5.5.29 vpn-eschelon name 5.5.5.27 email-eschelon name 4.4.4.83 guest-frontier name 4.4.4.86 email-frontier dns-guard ! interface Vlan1 nameif inside security-level 100 ip address 192.168.0.254 255.255.255.0 ! interface Vlan2 description Frontier FiOS nameif outside security-level 0 ip address primary-frontier 255.255.255.0 ! interface Vlan3 description Eschelon T1 nameif backup security-level 0 ip address primary-eschelon 255.255.255.248 ! interface Vlan4 nameif dmz security-level 50 ip address 172.21.18.254 255.255.255.0 ! interface Vlan5 nameif guest security-level 25 ip address 172.21.19.254 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport access vlan 3 ! interface Ethernet0/2 switchport access vlan 4 ! interface Ethernet0/3 switchport access vlan 5 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive clock timezone PST -8 clock summer-time PDT recurring dns domain-lookup inside dns server-group DefaultDNS name-server dc2 domain-name corp.company-name.com same-security-traffic permit intra-interface access-list companyname_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0 access-list companyname_splitTunnelAcl standard permit 172.21.18.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip any 172.21.20.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip any 172.21.18.0 255.255.255.0 access-list bypassingnat_dmz extended permit ip 172.21.18.0 255.255.255.0 192.168.0.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 12288 logging buffered warnings logging asdm notifications mtu inside 1500 mtu outside 1500 mtu backup 1500 mtu dmz 1500 mtu guest 1500 ip local pool VPNpool 172.21.20.50-172.21.20.59 mask 255.255.255.0 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface global (outside) 2 email-frontier global (outside) 3 guest-frontier global (backup) 1 interface global (dmz) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 2 dc5 255.255.255.255 nat (inside) 1 192.168.0.0 255.255.255.0 nat (dmz) 0 access-list bypassingnat_dmz nat (dmz) 2 dmz1 255.255.255.255 nat (dmz) 1 172.21.18.0 255.255.255.0 access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz route outside 0.0.0.0 0.0.0.0 4.4.4.1 1 track 1 route backup 0.0.0.0 0.0.0.0 5.5.5.25 254 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 ldap attribute-map RemoteAccessMap map-name memberOf IETF-Radius-Class map-value memberOf CN=RemoteAccess,CN=Users,DC=corp,DC=company-name,DC=com companynamera dynamic-access-policy-record DfltAccessPolicy aaa-server ActiveDirectory protocol ldap aaa-server ActiveDirectory (inside) host dc2 ldap-base-dn dc=corp,dc=company-name,dc=com ldap-scope subtree ldap-login-password * ldap-login-dn cn=administrator,ou=Admins,dc=corp,dc=company-name,dc=com server-type microsoft aaa-server ADRemoteAccess protocol ldap aaa-server ADRemoteAccess (inside) host dc2 ldap-base-dn dc=corp,dc=company-name,dc=com ldap-scope subtree ldap-login-password * ldap-login-dn cn=administrator,ou=Admins,dc=corp,dc=company-name,dc=com server-type microsoft ldap-attribute-map RemoteAccessMap aaa authentication enable console LOCAL aaa authentication ssh console LOCAL http server enable http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart sla monitor 123 type echo protocol ipIcmpEcho 4.4.4.1 interface outside num-packets 3 frequency 10 sla monitor schedule 123 life forever start-time now crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map outside_dyn_map 20 set pfs crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 ! track 1 rtr 123 reachability telnet timeout 5 ssh 192.168.0.0 255.255.255.0 inside ssh timeout 5 ssh version 2 console timeout 0 management-access inside dhcpd auto_config outside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn group-policy companynamera internal group-policy companynamera attributes wins-server value 192.168.0.5 dns-server value 192.168.0.5 vpn-tunnel-protocol IPSec password-storage enable split-tunnel-policy tunnelspecified split-tunnel-network-list value companyname_splitTunnelAcl default-domain value corp.company-name.com split-dns value corp.company-name.com group-policy companyname internal group-policy companyname attributes wins-server value 192.168.0.5 dns-server value 192.168.0.5 vpn-tunnel-protocol IPSec password-storage enable split-tunnel-policy tunnelspecified split-tunnel-network-list value companyname_splitTunnelAcl default-domain value corp.company-name.com split-dns value corp.company-name.com username admin password IhpSqtN210ZsNaH. encrypted privilege 15 tunnel-group companyname type remote-access tunnel-group companyname general-attributes address-pool VPNpool authentication-server-group ActiveDirectory LOCAL default-group-policy companyname tunnel-group companyname ipsec-attributes pre-shared-key * tunnel-group companynamera type remote-access tunnel-group companynamera general-attributes address-pool VPNpool authentication-server-group ADRemoteAccess LOCAL default-group-policy companynamera tunnel-group companynamera ipsec-attributes pre-shared-key * ! class-map type inspect ftp match-all ftp-inspection-map class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect ftp ftp-inspection-map parameters class ftp-inspection-map policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect http inspect ils inspect netbios inspect rsh inspect rtsp inspect skinny inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp inspect icmp error inspect esmtp inspect pptp ! service-policy global_policy global prompt hostname context Cryptochecksum:487525494a81c8176046fec475d17efe : end gateway# Thanks so much!

  Read the article

• convert.php does not run in a screen session

  - by Tobias

  I am trying to convert a big forum. At the moment I have to do this via ssh and start convert.php with "php5 -f convert.php -- $OPTIONS". But my internet connection is a bit buggy and so it is often killed. If i start the above working command in a screen session it does not work. Instead php gives me the HTML code of the "convert.php" back. head of the page: X-Powered-By: PHP/5.2.12 Set-Cookie: PHPSESSID=6bc4370b2d8d40ff8c3ab23672ff4135; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-type: text/html Does it has something to do with the Sessions? But why does it work on the same ssh-connection without screen?

  Read the article

• Access Git Repository using Eclipse and Netbeans Plugins with LDAP Users

  - by ukrania

  Hello everyone! I've configure a git server. I need to use ssh because I've defined permissions using users of my domain, using LDAP. Only users with permissions could read a project. So, the links to access my repositories are like that: ssh://[email protected]@hostname/var/git/repo.git When I clone, commit or push a project using linux git commands or using tortoisegit on windows, there is no problem, everything works as expected. However, I've tried to clone a project using plugins from Eclipse (EGit) and Netbeans (NBGit), with no success. Seems that they can't recognize the host. I've accessed using a user from the server (not from the domain) and it cloned the project perfectly. Seems that the plugins assume that the host is everything after the first @. Do you know how I can solve this problem? There are any other Git plugins for those IDEs? Thanks for your answers. Best Regards, ukrania

  Read the article

• How to send EOF to stdin in paramiko?

  - by Alexandru

  I would like to execute some program through ssh and redirect its input from a file. The behaviour of the following code: channel.exec_command('cat') with open('mumu', 'r') as f: text = f.read() nbytes = 0 while nbytes < len(text): sent = channel.send(text[nbytes:]) if sent == 0: break nbytes += sent should be equivalent to (assuming public-key authentication): ssh user@host cat < mumu However the application hangs waiting for more input. I think this happens because the stdin stream is never closed. How do I do that?

  Read the article

• ec2_bundle_vol fails with error LoadError

  - by Koran

  Hi, I am a newbie in amazon ec2 setup. I have now setup a machine to my taste - and I now want to bundle it. I am running the following command from the launched instance - root@domU-21-34-67-26-ED-Z4:~# ec2-bundle-vol -r i386 -d /mnt \ -p ACT-VOL -u 8940-1355-4155 -k /tmp/pk-key.pem \ -c /tmp/cert.pem -s 10240 \ -e /mnt,/root/.ssh,/home/ubuntu/.ssh ruby: No such file or directory -- /home/ubuntu/ec2tools/ec2-api-tools-1.3-46266/lib/ec2/amitools/bundlevol.rb (LoadError) The ruby version is 1.8.7. I searched internet and installed libruby1.8-extras etc too, but to no avail. I also tried running it from site_ruby (/usr/local/lib/site_ruby) - but no use. I tried installing 1.8.6 version of ruby, but was unable to find a way to do so too. Any help would be much appreciated. Thanks, K

  Read the article

• Git access on Heroku deployment and others: connection refused

  - by Toby Hede

  I have suddenly run into an issue using git. I created a new app, went to push to Heroku and now see: ssh: connect to host heroku.com port 22: Connection refused My other previously working Heroku apps no longer work, receiving the same error. Other Heroku commands work (create, info, db:push). I also see the error when accessing Git on my unfuddle accounts. I can SSH to other services, so it doesn't look like it's my machine. Any ideas?

  Read the article

• Restrict folder sharing over cygwin sshd

  - by mtanish

  I recently installed a SSH server on my Windows 7 PC and created a separate user account for this. When i logged in using SSH, i could access all the windows directories. /cygdrive/c /cygdrive/d /cygdrive/e How do i prevent this user from accessing all the win directories other than its home directory under cygwin /home/chuck/ ? Preferably i do not want the user to even view /cygdrive when the user types "mount". Is there a easy way to do this? I want to later allow remote users to log on to this machine and avoid messing up other things.I know i can setup a separate machine but this is a plan for later.

  Read the article

• How do you share your git repository with other developers?

  - by semi

  I have a central git repository that everyone pushes to for testing and integration, but it only is pushed to when features are 'ready'. While in the middle of a big task, developers frequently have many commits that stay on their harddrives. Sometimes in the middle of these projects I'd like to either see what another developer is doing, or show him how I've done something. I'd like to be able to tell another developer to just "pull my working copy" The only way I can think of is having everyone run ssh on their development machines and adding accounts or ssh keys for everyone, but this is a huge privacy and permissions nightmare, and seems like a lot of work to maintain. Should we just be pushing to that central repository in these cases? Should we be pushing after every local commit?

  Read the article

• Update website with a single command (git push) instead of FTP drag and dropping

  - by Wolfr

  Situation: I have a local copy of a website I have a server that I have SSH access to What do I want to do? Commit locally until I'm happy with my code Make branches locally Have one master branch that is the one that should be pushed to the server Update the website using a single command (git push origin master) If I set up a git repo locally using git init, and then push to a folder on the server, it doesn't work. When I FTP to the server to check the files, they're actually there. When I SSH into the server and do git status, it's not clean, even though it should be since I just pushed to the server. Steps I'm doing: Make a new folder on my computer (mkdir folder_x) Go into that folder (cd folder_x) Set up a new git repository there (git init) (git repository sets up successfully) Push the repository to the server using git push origin master (where origin is set up as user:[email protected])

  Read the article

• git: having 2 push/pull repos in sync (or 1 push/pull and 1 pull in sync)

  - by xavjuan

  Hello, We work on multiple geographically seperate sites. Today I have our git clones all live on one site A. Then users from site B have to ssh over to do a git clone or to push in changes. These are bare repos where the update is through pushes. Ideally, for git clone/push performance, I'd like to limit having to go over ssh. I'd like to have a copy of git repo X live on site A and site B... and have some syncing mechanism between them. OR to have X live on both sites, but only allow pushing to A (and have that setup correctly at clone time on B) I'm worried about the case where someone on site A pushes changes to the repo at site A at the same time that someone on site B pushes a truely conflicting change to the repo at site B. Is there some 'sync'ing solution built into git for distributed open repos like this? Or a way to have a clone from X set the origin/parent to the X from the other site? thanks, -John

  Read the article

• Iptables block host

  - by Peter

  Hi, how I can block a whole host (internet provider), or allow only one country for ssh login?

  Read the article

• Python: Converting a tuple to a string with 'err'

  - by skylarking

  Given this : import os import subprocess def check_server(): cl = subprocess.Popen(["nmap","10.7.1.71"], stdout=subprocess.PIPE) result = cl.communicate() print result check_server() check_server() returns this tuple: ('\nStarting Nmap 4.53 ( http://insecure.org ) at 2010-04-07 07:26 EDT\nInteresting ports on 10.7.1.71:\nNot shown: 1711 closed ports\nPORT STATE SERVICE\n21/tcp open ftp\n22/tcp open ssh\n80/tcp open http\n\nNmap done: 1 IP address (1 host up) scanned in 0.293 seconds\n', None) Changing the second line in the method to result, err = cl.communicate() results in check_server() returning : Starting Nmap 4.53 ( http://insecure.org ) at 2010-04-07 07:27 EDT Interesting ports on 10.7.1.71: Not shown: 1711 closed ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.319 seconds Looks to be the case that the tuple is converted to a string, and the \n's are being stripped.... but how? What is 'err' and what exactly is it doing?

  Read the article

• Safe executing shell scripts; escaping vars before execution.

  - by Kirzilla

  Hello, Let's imagine that we have a simple php script that should get ssh_host, ssh_username, ssh_port from $_GET array and try to connect using this parameters to SSH. $port = escapeshellcmd($_GET['ssh_port']); $host = escapeshellcmd($_GET['ssh_host']); $username = escapeshellcmd($_GET['ssh_username']); $answer = shell_exec("ssh -p " . $port . " " . $user . "@" . $host); Is escapeshellcmd() enough or I need something more tricky? Or maybe I should use escapeshellarg() in this example? Thank you.

  Read the article

• PVM terminates after Adding Host

  - by Tyug

  On Ubuntu 9.10 using PVM 3.4.5-12 (the PVM package when you use apt-get) The program terminates after adding a host. laptop> pvm pvm> add bowtie-slave add bowtie-slave terminated laptop> Current Configuration only $PVM_RSH = bin/usr/ssh I can ssh perfectly fine into the slave without a password, and run commands on it. Any ideas? Thanks in advance! Here are the sample logs: Laptop log [t80040000] 02/11 10:23:32 laptop (127.0.1.1:xxxxx) LINUX 3.4.5 [t80040000] 02/11 10:23:32 ready Thu Feb 11 10:23:32 2010 [t80040000] 02/11 10:23:32 netoutput() sendto: errno=22 [t80040000] 02/11 10:23:32 em=0x2c24f0 [t80040000] 02/11 10:23:32 [49/à][6e/à][76/à][61/à][6c/à][69/à][64/à][20/à][61/à][72/à] [t80040000] 02/11 10:23:32 netoutput() sendto: Invalid argument [t80040000] 02/11 10:23:32 pvmbailout(0) bowtie-log [t80080000] 02/11 10:23:25 bowtie-slave (xxx.x.x.xxx:xxxxx) LINUX64 3.4.5 [t80080000] 02/11 10:23:25 ready Thu Feb 11 10:23:25 2010 [t80080000] 02/11 10:28:26 work() run = STARTUP, timed out waiting for master [t80080000] 02/11 10:28:26 pvmbailout(0)

  Read the article

• How can I make an expect script prompt for a password?

  - by MiniQuark

  I have an expect script that connects to a few routers through ssh. All these routers have the same password (I know, it's wrong), and the script needs to know that password in order to be able to connect to the routers. Currently, the password is passed to my script as an argument on the command line, but this means that there's a trace of that password in my .bash_history file as well as in the running processes. So instead I would like the user to be prompted for a password, if possible silently. Do you know whether or not it's possible to prompt the user for a password with expect? Thank you. Edit: if I was connecting to servers instead of routers, I would probably use ssh keys instead of passwords. But the routers I'm using just support passwords.

  Read the article

• Get Process ID of Program Started with C# Process.Start

  - by ThaKidd

  Thanks in advance of all of your help! I am currently developing a program in C# 2010 that launches PLink (Putty) to create a SSH Tunnel. I am trying to make the program able to keep track of each tunnel that is open so a user may terminate those instances that are no longer needed. I am currently using System.Diagnostics.Process.Start to run PLink (currently Putty being used). I need to determine the PID of each plink program when it is launched so a user can terminate it at will. Question is how to do that and am I using the right .Net name space or is there something better? Code snippet: private void btnSSHTest_Click(object sender, EventArgs e) { String puttyConString; puttyConString = "-ssh -P " + cboSSHVersion.SelectedText + " -" + txtSSHPort.Text + " -pw " + txtSSHPassword.Text + " " + txtSSHUsername.Text + "@" + txtSSHHostname.Text; Process.Start("C:\\Program Files (x86)\\Putty\\putty.exe", puttyConString); }

  Read the article

• how to mysqldump remote db from local machine

  - by Mauritz Hansen

  Hi folks, I need to do a mysqldump of a database on a remote server, but the server does not have mysqldump installed. I would like to use the mysqldump on my machine to connect to the remote database and do the dump on my machine. I have tried to create an ssh tunnel and then do the dump, but this does not seem to work. I tried: ssh -f -L3310:remote.server:3306 [email protected] -N The tunnel is created with success. If I do telnet localhost 3310 I get some blurb which shows the correct server mysql version. However, doing the following seems to try to connect locally mysqldump -P 3310 -h localhost -u mysql_user -p database_name table_name Can someone assist me? Thanks, Mauritz

  Read the article

• OCIError (ruby on rails)

  - by swingfuture

  I am using rails freeze 1.2.3 to run a rails app. Because the app is on a remote machine, I used ssh tunnel (ssh -l -L) to show the app on my screen. When I ran it, it correctly prompted the login page, after I put in the info, I got this error: OCIError in ServiceController Error while trying to retrieve text for error ORA-12154 I have tried the same app on a different machine w/o using freeze (because that machine has rails version 1.2.3 while current one has 2.0.2). Is that where the error comes from? Thanks.

  Read the article

• PHP CLI Application on Debian: why can't I output a line break?

  - by Steffen Müller

  Hello! I have a really puzzling problem: I am writing a PHP CLI application running on a debian server. I am connected to the server via SSH, just the normal way. Everything runs as usual. Except the following: echo "My CLI fun\n\n"; echo "Is this."; Outputs on the SSH terminal, when executing the PHP script: My CLI funIs this. I am really puzzled as I have never had such a problem. The bash behaves normal in all other aspects. I already tried to output chr(10) and such, same problem. Does anybody have a clue?

  Read the article

• Custom script in .screenrc

  - by benoror

  Hi. I made a script that spawns a remote shell or runs a local shell whether it's on the current machine or not: #!/bin/bash # By: benoror <[email protected]> # # spawns a remote shell or runs a local shell whether it's on the current machine or not # $1 = hostname if [ "$(hostname)" == "$1" ]; then bash else ssh "$1.local" fi For example, if I'm on server1: ./spawnshell.sh server1 -> runs bash ./spawnshell.sh server2 -> ssh to server2.local I want that script to run automatically in separate tabs in GNU Screen, but I can't make it run, my .screenrc: ... screen -t "@server1" 1 exec /home/benoror/scripts/spawnshell.sh server1 screen -t "@server2" 2 exec /home/benoror/scripts/spawnshell.sh server2 ... But it doesn't works, I've tried without 'exec', with -X option and a lot more. Any ideas ?

  Read the article

• Hudson jobs won't call javac?

  - by Dissonant

  Hi, I have just set up Hudson on my server. For some reason, my build will not call javac to compile my builds...? I have set the path to the JDK in the Manage Hudson area, and it seems to recognise it (doesn't give me a warning). Is there something else I'm supposed to do? Here's a sample console output of one of my jobs (note how javac isn't called at all): Started by user admin Checking out svn+ssh://myhost.com/Project1 A /src/Program.java A build.xml U At revision 119 no change for svn+ssh://myhost.com/Project1 since the previous build Finished: SUCCESS

  Read the article

• How do I prevent TCP connection freezes over an OpenVPN network?

  - by Jason R

  New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast packets, which doesn't seem to be possible with tun networks) with a handful of clients across the Internet. I've been experiencing frequent TCP connection freezes over the VPN. That is, I will establish a TCP connection (e.g. an SSH connection, but other protocols have similar issues), and at some point during the session, it seems that traffic will cease being transmitted over that TCP session. This seems to be related to points at which large data transfers occur, such as if I execute an ls command in an SSH session, or if I cat a long log file. Some Google searches turn up a number of answers like this previous one on Server Fault, indicating that the likely culprit is an MTU issue: that during periods of high traffic, the VPN is trying to send packets that get dropped somewhere in the pipes between the VPN endpoints. The above-linked answer suggests using the following OpenVPN configuration settings to mitigate the problem: fragment 1400 mssfix This should limit the MTU used on the VPN to 1400 bytes and fix the TCP maximum segment size to prevent the generation of any packets larger than that. This seems to mitigate the problem a bit, but I still frequently see the freezes. I've tried a number of sizes as arguments to the fragment directive: 1200, 1000, 576, all with similar results. I can't think of any strange network topology between the two ends that could trigger such a problem: the VPN server is running on a pfSense machine connected directly to the Internet, and my client is also connected directly to the Internet at another location. One other strange piece of the puzzle: if I run the tracepath utility, then that seems to band-aid the problem. A sample run looks like: [~]$ tracepath -n 192.168.100.91 1: 192.168.100.90 0.039ms pmtu 1500 1: 192.168.100.91 40.823ms reached 1: 192.168.100.91 19.846ms reached Resume: pmtu 1500 hops 1 back 64 The above run is between two clients on the VPN: I initiated the trace from 192.168.100.90 to the destination of 192.168.100.91. Both clients were configured with fragment 1200; mssfix; in an attempt to limit the MTU used on the link. The above results would seem to suggest that tracepath was able to detect a path MTU of 1500 bytes between the two clients. I would assume that it would be somewhat smaller due to the fragmentation settings specified in the OpenVPN configuration. I found that result somewhat strange. Even stranger, however: if I have a TCP connection in the stalled state (e.g. an SSH session with a directory listing that froze in the middle), then executing the tracepath command shown above causes the connection to start up again! I can't figure out any reasonable explanation for why this would be the case, but I feel like this might be pointing toward a solution to ultimately eradicate the problem. Does anyone have any recommendations for other things to try? Edit: I've come back and looked at this a bit further, and have found only more confounding information: I set the OpenVPN connection to fragment at 1400 bytes, as shown above. Then, I connected to the VPN from across the Internet and used Wireshark to look at the UDP packets that were sent to the VPN server while the stall occurred. None were greater than the specified 1400 byte count, so the fragmentation seems to be functioning properly. To verify that even a 1400-byte MTU would be sufficient, I pinged the VPN server using the following (Linux) command: ping <host> -s 1450 -M do This (I believe) sends a 1450-byte packet with fragmentation disabled (I at least verified that it didn't work if I set it to an obviously-too-large value like 1600 bytes). These seem to work just fine; I get replies back from the host with no issue. So, maybe this isn't an MTU issue at all. I'm just confused as to what else it might be! Edit 2: The rabbit hole just keeps getting deeper: I've now isolated the problem a bit more. It seems to be related to the exact OS that the VPN client uses. I have successfully duplicated the problem on at least three Ubuntu machines (versions 12.04 through 13.04). I can reliably duplicate an SSH connection freeze within a minute or so by just cat-ing a large log file. However, if I do the same test using a CentOS 6 machine as a client, then I don't see the problem! I've tested using the exact same OpenVPN client version as I was using on the Ubuntu machines. I can cat log files for hours without seeing the connection freeze. This seems to provide some insight as to the ultimate cause, but I'm just not sure what that insight is. I have examined the traffic over the VPN using Wireshark. I'm not a TCP expert, so I'm not sure what to make of the gory details, but the gist is that at some point, a UDP packet gets dropped due to the limited bandwidth of the Internet link, causing TCP retransmissions inside the VPN tunnel. On the CentOS client, these retransmissions occur properly and things move on happily. At some point with the Ubuntu clients, though, the remote end starts retransmitting the same TCP segment over and over (with the transmit delay increasing between each retransmission). The client sends what looks like a valid TCP ACK to each retransmission, but the remote end still continues to transmit the same TCP segment periodically. This extends ad infinitum and the connection stalls. My question here would be: Does anyone have any recommendations for how to troubleshoot and/or determine the root cause of the TCP issue? It's as if the remote end isn't accepting the ACK messages sent by the VPN client. One common difference between the CentOS node and the various Ubuntu releases is that Ubuntu has a much more recent Linux kernel version (from 3.2 in Ubuntu 12.04 to 3.8 in 13.04). A pointer to some new kernel bug maybe? I'm assuming that if that were so, then I wouldn't be the only one experiencing the problem; I don't think this seems like a particularly exotic setup.

  Read the article

• Working with git from 2 laptops with no bare repo

  - by matiit

  I've started project in my first laptop. git init, and start working. Tomorrow i'm going to vacations. I want to take with me my smaller laptop. And work with project from time to time. I cloned repository via ssh from bigger laptop (git clone ssh://adress) And when i will back, what is the best way to push changes from smaller laptop to the bigger one? There is no bare repo in bigger laptop. And i want to work with that repo on the bigger laptop later, so i have to do this clear.

  Read the article

• Socket left in TIME_WAIT after file transfer via netcat

  - by com

  Using Copying by NetCat I am trying to copy files throught network by NetCat. From console it work pretty well. First I run listening netcat on the destination machine and after I run sending on source machine. The problem is it's doen't work from script from the source machine: ssh -f user@$desthost 'nc -l 1234 | tar xvf - /dev/null &' #listening on destination host tar cv /tmp/file | nc $desthost 1234 #sending to destination host I saw that after running port 1234 is still was open and status of the socket was TIME_WAIT. If you know what's the problem, please, help me out. And by the way, after copying how can I validate that the content is identical? Thanks! Addendum: I found one very strange thing, the same implementation with screen on destination work works, but not stable, sometimes it doesn't copy a file. ssh user@$desthost screen -dm -S test 'nc -l 1234 | tar xvf - ' #listening on destination host Maybe there is an issue with timeout?

  Read the article

• Capistrano update causes C: to be placed in the current directory (cygwin)

  - by user321775

  When I run cap deploy:update in a directory on my local machine (via cygwin), "C:" magically appears in the directory. Sure enough, I can cd to it and it's my windows C: drive. Now I'm afraid to delete it, but I definitely don't want it in this directory (a rails project under /home/username/blah/blah). Here's my config/deploy.rb file. custom options set :application, "xyz.com" set :repository, "ssh://[email protected]:yyyy/home/git/xxx" set :user, "myname" set :runner, user set :use_sudo, false server "xxx.xxx.xxx.xxx:yyyy", :app, :web, :db, :primary = true deploy to set :deploy_to, "/home/myname/public_html/xyz" repository set :scm, :git set :deploy_via, :copy ssh options default_run_options[:pty] = true ssh_options[:paranoid] = false ssh_options[:port] = yyyy start passenger namespace :deploy do task :start do ; end task :stop do ; end task :restart, :roles = :app, :except = { :no_release = true } do run "#{try_sudo} touch #{File.join(current_path,'tmp','restart.txt')}" end end Anyone see the problem? And does anyone know a safe way of getting rid of the C: drives that have already shown up (this has happened in a few directories)?

  Read the article

< Previous Page | 194 195 196 197 198 199 200 201 202 203 204 205  | Next Page >