We want our users in company to login their computers by using their USB Flash Disks or something else. Is there a way to achieve this without buying a USB token from a company ?
I'm looking at using this PCB layout program and looking for a tutorial for it.
After skimming through the manual, and a few attempts at guessing how to use it, I have to say that in combination they are a near ideal example of how Not to make a UI easy to use. The GUI seems to borrow it's key combinations from vi (despite not being a text editor) and the manual seems to say more about what things do than how to do things.
The closest I can find is this section that starts with the todo note:
[...] do a real-world tutorial example.
In my WinXP I write a bat file to start the putty which is connected to my linux for development.
D:\PuTTY-v0.60\putty.exe [email protected] -pw 123456
But I have to set the charset to utf-8 manually everytime when I do the login.I think it's quite a waste of time.So how can I do the setting more quickly?Thanks.
I've setup the .ssh/authorized_keys and am able to login with the new "user" using the pub/private key ... I have also added "user" to the sudoers list ... the problem I have now is when I try to execute a sudo command, something simple like:
$ sudo cd /root
it will prompt me for my password, which I enter, but it doesn't work (I am using the private key password I set)
Also, ive disabled the users password using
$ passwd -l user
What am I missing?
Somewhere my initial remarks are being misunderstood ...
I am trying to harden my system ... the ultimate goal is to use pub/private keys to do logins versus simple password authentication. I've figured out how to set all that up via the authorized_keys file.
Additionally I will ultimately prevent server logins through the root account. But before I do that I need sudo to work for a second user (the user which I will be login into the system with all the time).
For this second user I want to prevent regular password logins and force only pub/private key logins, if I don't lock the user via" passwd -l user ... then if i dont use a key, i can still get into the server with a regular password.
But more importantly I need to get sudo to work with a pub/private key setup with a user whos had his/her password disabled.
Edit: Ok I think I've got it (the solution):
1) I've adjusted /etc/ssh/sshd_config and set PasswordAuthentication no
This will prevent ssh password logins (be sure to have a working public/private key setup prior to doing this
2) I've adjusted the sudoers list visudo and added
root ALL=(ALL) ALL
dimas ALL=(ALL) NOPASSWD: ALL
3) root is the only user account that will have a password, I am testing with two user accounts "dimas" and "sherry" which do not have a password set (passwords are blank, passwd -d user)
The above essentially prevents everyone from logging into the system with passwords (a public/private key must be setup).
Additionally users in the sudoers list have admin abilities. They can also su to different accounts. So basically "dimas" can sudo su sherry, however "dimas can NOT do su sherry. Similarly any user NOT in the sudoers list can NOT do su user or sudo su user.
NOTE The above works but is considered poor security. Any script that is able to access code as the "dimas" or "sherry" users will be able to execute sudo to gain root access. A bug in ssh that allows remote users to log in despite the settings, a remote code execution in something like firefox, or any other flaw that allows unwanted code to run as the user will now be able to run as root. Sudo should always require a password or you may as well log in as root instead of some other user.
Issue with apache mod proxy, it stops proxying requests after a graceful restart but not all the time.
It seems to happen only on a Sunday when a graceful restart is triggered by logrotate.
[Sun Sep 9 05:25:06 2012] [notice] SIGUSR1 received. Doing graceful restart
[Sun Sep 9 05:25:06 2012] [notice] Apache/2.2.22 (Ubuntu) Phusion_Passenger/3.0.11 configured -- resuming normal operations
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(492) failed in child 26153 for worker proxy:reverse
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(486) failed in child 26153 for worker http://api.myservice.org/api
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(487) failed in child 26153 for worker http://api.myservice.org/editor/$1
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(489) failed in child 26153 for worker http://api.myservice.org/build
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(490) failed in child 26153 for worker http://api.myservice.org/help
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(491) failed in child 26153 for worker http://api.myservice.org/motd.html
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(480) failed in child 26153 for worker http://api.myservice.org/api
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(481) failed in child 26153 for worker http://api.myservice.org/editor/$1
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(483) failed in child 26153 for worker http://api.myservice.org/build
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(484) failed in child 26153 for worker http://api.myservice.org/help
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(485) failed in child 26153 for worker http://api.myservice.org/motd.html
[Sun Sep 9 05:25:06 2012] [error] proxy: ap_get_scoreboard_lb(479) failed in child 26153 for worker http://api.myservice.org/motd.html
After these lines, the logs are flooded with 404's because the requests are not being proxied.
It's worth noting that the destination is just another vhost on the same apache instance, but the vhost (http://api.myservice.org) is serving passenger (mod_rails)
I was thinking that maybe there's some startup issues with the passenger workers not being ready during a graceful restart?
After a full restart resolves it and everything returns to normal.
//Edit
Here's the vhost config, thanks :)
<VirtualHost *:80>
UseCanonicalName Off
LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
<Directory /var/www/vhosts>
RewriteEngine on
AllowOverride All
</Directory>
RewriteEngine on
RewriteCond /var/www/vhosts/%{SERVER_NAME} !-d
RewriteCond /var/www/vhosts/%{SERVER_NAME} !-l
RewriteRule ^ http://sitenotfound.myservice.org/ [R=302,L]
VirtualDocumentRoot /var/www/vhosts/%0/current
# Rewrite requests to /assets to map to the /var/file-store/<SERVER_NAME>/
RewriteMap lowercase int:tolower
RewriteCond %{REQUEST_URI} ^/assets/
RewriteRule ^/assets/(.*)$ /var/file-store/${lowercase:%{SERVER_NAME}}/$1
# Map /login to /editor.html as it's far friendlier.
RewriteCond %{REQUEST_URI} ^/login
RewriteRule .* /editor.html [PT]
# Forward some requests to the API
ProxyPass /api http://api.myservice.org/api
ProxyPass /site.json http://api.myservice.org/api/editor/site
ProxyPassMatch ^/editor/(.*)$ http://api.myservice.org/editor/$1
ProxyPassMatch ^/api/(.*) http://api.myservice.org/api/$1
ProxyPass /build http://api.myservice.org/build
ProxyPass /help http://api.myservice.org/help
ProxyPass /motd.html http://api.myservice.org/motd.html
<Proxy *>
Order allow,deny
Allow from all
</Proxy>
# TODO generate slightly more specific Error Documents for 401/403/500's,
# but for now the 404 page is good enough
ErrorDocument 401 /404.html
ErrorDocument 403 /404.html
ErrorDocument 404 /404.html
ErrorDocument 500 /404.html
</VirtualHost>
I have an intranet site using Windows Authentication. When users are prompted for credentials, they enter:
User: domain\username
Pass: SomePassword
It'd be nice if they could leave off the domain\ part which would be filled in with a default domain. I'm willing to give up the ability to login with a server/machine account (non-domain) because we don't use that anyway.
This seems to be possible with BasicAuth but I can't seem to find a reference for how to do it with WindowsAuth.
So, I have a Tyan Opteron board with a very old BIOS version. I realize Opteron's aren't exactly common like Athlons, Phenoms, Intel CPUs, etc. but my question revolves around updating the BIOS, however I don't have a floppy drive and there's no option to boot off of a USB key.
Tyan has incomplete instructions on their website (link) on how to flash the BIOS via USB. So my second tactic has been to create a Windows 98 boot-able CDROM with the flash utilities on it. It's been years since I've made one but after going to sites like bootdisk.com and such I haven't had any success.
Can anyone tell me step-by-step how to make a boot-able Windows 98 CDROM? I can't believe I'm having such a hard time doing this but I've failed on four different attempts and I must be doing something wrong or I'm not accounting for something.
I'm no novice on networking technology, but one thing I don't really know much about in detail is email and headers. How does email work SPECIFICALLY?
I'm getting spam in my hotmail inbox when I've made painful attempts to not give out my actual email. I use my own domain name to forward email to my inbox using several aliases. Yet now I'm getting spam with no address in the to: line, or also "undisclosed recipients". Looking at the headers is of no help whatsoever.
So from a technical standpoint, I have to wonder... if I send an email to a certain address in my personal domain and it gets forwarded to my hotmail account, how does hotmail know what inbox to dump the message in if that address is not listed in the headers?
Does anyone know of a wordpress plugin which simplifies the registration process by allowing users to sign up on the spot without having to be sent an email?
It would be good if you could also pass a redirect_to parameter in the url like you can for the login.
I have the following problem - Windows Vista does not connect to adhoc wireless network created on my Macbook. I have tried to create secured (with 40 bit key) and unsecured network but Windows Vista still has problems to connect. Windows VISTA informs me -- after 5 minutes of attempts - that setting up the connection -- with my adhoc network -- took too much time.
My question: do I need to configure some settings on Vista to connect it to my Macbook? Maybe it is a problem with DHCP?
Edited: I have tried the other way: http://superuser.com/questions/202890/set-up-an-adhoc-network-in-windows-vista-to-connect-to-and-share-the-internet-con
I am new to putty. I am pushing files to a customer with sftp command that includes @ sign in the command. e.g. sftp (login@IP Address) the session will not allow @ on the command line. It bounces me to the next line. Can anyone tell me how to correct this.
I created a CentOS 5.6 Guest OS Virtual Machine.
I made the first disk 10GB, I am rapidly outgrowing it.
It was suggested that I make disks for my /var, /opt and /home directories and move them so I can better manage the disks for backing up and what not.
This sounds like a good idea.
I know how to create the disks in Virtual Box. I have dug around Google and the internet in general and all my attempts at doing this have failed. Snapshots are awesome!
I can get the drives fdisked, and I have had limited success mounting them to /mnt/var, /mnt/home and /mnt/opt, but even in single user mode ( init 1 ) I can't get the entire contents of the directories to move over, and then the machine won't reboot correctly.
cd /var
cp * -ax /mnt/var
The /var directory in particular is not wanting to move everything to the new location.
How do I format, mount and move the /var, /opt and /home to my new disks?
We had an issue early this morning when iSCSI issues broke connectivity with a few of our databases (resulting in a SQL Server Error 21). Attempts to DBCC CheckDB did not work, and the only solution was to restart the SQL Service.
Is there a known reason why an iSCSI initiator session would reset itself out of the blue?
Example below from the NetApp syslog. This set of errors was replicated 4 times (once for each SQL server in production). Only one SQL server was noticeably impacted, however.
[san1: iscsi.notice:notice]: ISCSI: iswta, ISID Rule: new connection from same initiator, shutting down old session 7
[san1: iscsi.notice:notice]: ISCSI: iswta, New session from initiator iqn.1991-05.com.microsoft:sql1.example.corp at IP addr 10.xxx.xxx.123
We are faced with a dilemma with using snow leopard. We want to have thr snow leopard server on site and not off site because it makes sense to have the server in the network physically for other services (file sharing, VPN, wiki etc) but our office does not have a very reliable Internet connection so it'd hard to host the email with it. We don't want to factor out the email as a separate server because we want to enjoy a single user login across everything. How do we get around this dilemma?
Hi,
I've recently switched to roaming profiles in an XP and Windows 7 environment and also changed the login script. Can anyone tell me where I would find the info regarding messages that appear when people are launching various in-house apps :
This program is from an untrusted location, Click Run or Cancel.
The programs run but users need to click 'Run' first.
Thanks
Scott
When I start Win XP SP2 I get to the welcome screen with no user names
displayed. I then press Alt+Ctrl+Del twice and type in the username and then
am able to login to Windows. When I go to user accounts in Control Panel I
get the error message cells.item(...) is null or not an object. When I go to
computer administration and then local users and groups there are no users
listed under users but the groups is listed. I did a windows repair with no
luck. I tried doing restore points but it said they didn’t work. Please help?
My wife and I have been using fast user switching on out computer for years with no problem. Beginning a few months ago, I started Win XP Prof one day I get to the welcome screen with no user names displayed. I then press Alt+Ctrl+Del twice and type in the username and then am able to login to Windows with an account of owner. When I go to user accounts in Control Panel I get the error message cells.item(...) is null or not an object. When I go to computer administration and then local users and groups there are no users listed under users but the groups are listed. I have done system point restores and imports of exports of the registry I take with import. I have tried everything under safe mode and it makes no difference. This followed a Microsoft update the night before as I left the computer on. I tried to do a restore point but all my restore points failed and could not backout the MS updates. I was working with a fellow from Microsoft and he had me do all kinds of things but to no avail. He seems to think a DLL file is corrupt but which one? Finally in desperation he sent me a new OS XP Prof SP3 disk and I installed it and it wiped my hard drive. Luckily I took an Acronis Image backup first so I easily restored my system. I do not want to do a fresh windows update as it is heavily customized and worked fine up to that point. This has been going on for months, Thanks John
I have a Windows 2003 print server that I need to retire.
Through variaous methods (login scripts, etc) I think that I had everyone migrated off of this server and connected to the new print server.
Having said that, I'd like to make sure before taking the server down :-)
Is there a script that I can run to query a remote workstations in my domain to see what printer shares it is connected to?
My set up is as follows:
OS: CentOS 6.2 running on an OpenVZ virtual machine.
Web server: Nginx listening on port 8080
Reverse proxy: Varnish listening on port 80
The problem is that Varnish redirects my requests to port 8080 and this appears in the address bar like so http://mysite.com:8080/directory/, causing relative links on the site to include the port number (8080) in the request and thus bypassing Varnish.
The site is powered by WordPress.
How do I allow Varnish to use Nginx as the backend on port 8080 without appending the port number to the address?
Edit: Varnish is set up like so:
I have told the Varnish daemon to listen to port 80 by default.
VARNISH_VCL_CONF=/etc/varnish/default.vcl
#
# # Default address and port to bind to
# # Blank address means all IPv4 and IPv6 interfaces, otherwise specify
# # a host name, an IPv4 dotted quad, or an IPv6 address in brackets.
# VARNISH_LISTEN_ADDRESS=
VARNISH_LISTEN_PORT=80
#
# # Telnet admin interface listen address and port
VARNISH_ADMIN_LISTEN_ADDRESS=127.0.0.1
VARNISH_ADMIN_LISTEN_PORT=6082
#
# # Shared secret file for admin interface
VARNISH_SECRET_FILE=/etc/varnish/secret
#
# # The minimum number of worker threads to start
VARNISH_MIN_THREADS=1
#
# # The Maximum number of worker threads to start
VARNISH_MAX_THREADS=1000
#
# # Idle timeout for worker threads
VARNISH_THREAD_TIMEOUT=120
#
# # Cache file location
VARNISH_STORAGE_FILE=/var/lib/varnish/varnish_storage.bin
#
# # Cache file size: in bytes, optionally using k / M / G / T suffix,
# # or in percentage of available disk space using the % suffix.
VARNISH_STORAGE_SIZE=1G
#
# # Backend storage specification
VARNISH_STORAGE="file,${VARNISH_STORAGE_FILE},${VARNISH_STORAGE_SIZE}"
#
# # Default TTL used when the backend does not specify one
VARNISH_TTL=120
The VCL file that Varnish calls (through an include in default.vcl) consists of:
backend playwithbits {
.host = "127.0.0.1";
.port = "8080";
}
acl purge {
"127.0.0.1";
}
sub vcl_recv {
if (req.http.Host ~ "^(.*\.)?playwithbits\.com$") {
set req.backend = playwithbits;
set req.http.Host = regsub(req.http.Host, ":[0-9]+", "");
if (req.request == "PURGE") {
if (!client.ip ~ purge) {
error 405 "Not allowed.";
}
return(lookup);
}
if (req.url ~ "^/$") {
unset req.http.cookie;
}
}
}
sub vcl_hit {
if (req.http.Host ~ "^(.*\.)?playwithbits\.com$") {
if (req.request == "PURGE") {
set obj.ttl = 0s;
error 200 "Purged.";
}
}
}
sub vcl_miss {
if (req.http.Host ~ "^(.*\.)?playwithbits\.com$") {
if (req.request == "PURGE") {
error 404 "Not in cache.";
}
if (!(req.url ~ "wp-(login|admin)")) {
unset req.http.cookie;
}
if (req.url ~ "^/[^?]+.(jpeg|jpg|png|gif|ico|js|css|txt|gz|zip|lzma|bz2|tgz|tbz|html|htm)(\?.|)$") {
unset req.http.cookie;
set req.url = regsub(req.url, "\?.$", "");
}
if (req.url ~ "^/$") {
unset req.http.cookie;
}
}
}
sub vcl_fetch {
if (req.http.Host ~ "^(.*\.)?playwithbits\.com$") {
if (req.url ~ "^/$") {
unset beresp.http.set-cookie;
}
if (!(req.url ~ "wp-(login|admin)")) {
unset beresp.http.set-cookie;
}
}
}
In FreeBSD, I tested a CLI browser where I was able to use wget directly from the browser. Either I cannot remember its name or the key to get the dropdown box to launch wget. I try to mirror a page after login.
Has anyone ever heard of a 64-bit OS identifying itself as a 32-bit OS?
We have a Windows Server 2008 R2 x64 development server. We've been trying to activate it with a product key from MSDN, but it keeps telling us the the key is invalid. I've opened a ticket with MSDN for this.
Then something odd happened --
I tried to install a 64-bit version of SQL Server 2005. After it extracted, we got this message:
This version of hotfix.exe is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program...
Now, we're pretty sure this is a 64-bit OS. Computer Properties says:
System Type: 64-bit Operating System
Also, we have both a "Program Files" and a "Program Files (x64)" directory.
I don't know how the product key activator or the SQL install program attempts to divine the type of OS, but could it be...wrong?
Has anyone had any luck configuring Passenger and nginx with SSL? I've spent hours trying to get this configuration working as I'd like, using what few resources there are out there on the net, and I can't get any of the supposedly forwarded headers to show up in the Rails controller.
For example, with a conf file of the following (and multiple variations thereof):
server {
listen 3000;
server_name .example.com;
root /Users/website/public;
passenger_enabled on;
rails_env development;
}
server {
listen 3443;
root /Users/website/public;
rails_env development;
passenger_enabled on;
ssl on;
#ssl_verify_client on;
ssl_certificate /Users/website/ssl/server.crt;
ssl_certificate_key /Users/website/ssl/server.key;
#ssl_client_certificate /Users/website/ssl/CA.crt;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X_FORWARDED_PROTO https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-SSL-Subject $ssl_client_s_dn;
#proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
proxy_redirect off;
proxy_max_temp_file_size 0;
}
and Rails code in the controller like this:
request.headers.each { |k, v|
RAILS_DEFAULT_LOGGER.error "Header #{k} Val #{v}"
}
other headers appear, but not those set in nginx, e.g.:
Header rack.multithread Val false
Header REQUEST_URI Val /login/new
Header REMOTE_PORT Val 64021
Header rack.multiprocess Val true
Header PASSENGER_USE_GLOBAL_QUEUE Val false
Header PASSENGER_APP_TYPE Val rails
Header SCGI Val 1
Header SERVER_PORT Val 3443
Header HTTP_ACCEPT_CHARSET Val ISO-8859-1,utf-8;q=0.7,*;q=0.7
Header rack.request.query_hash Val
Header DOCUMENT_ROOT Val /Users/website/public
I've even gone so far as to modify Passenger's abstract_request_handler's main_loop method, i.e.,
headers, input = parse_request(client)
if headers
if headers[REQUEST_METHOD] == PING
process_ping(headers, input, client)
else
headers.each { |h,v|
log.unknown "abstract_request_handler: #{h} = #{v}"
}
process_request(headers, input, client)
end
end
only to find that the supposedly added headers do not exist there either:
abstract_request_handler: HTTP_KEEP_ALIVE = 300
abstract_request_handler: HTTP_USER_AGENT = Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5
abstract_request_handler: PASSENGER_SPAWN_METHOD = smart-lv2
abstract_request_handler: CONTENT_LENGTH = 0
abstract_request_handler: HTTP_IF_NONE_MATCH = "b6e8b9afbc1110ee3bf0c87e119252ad"
abstract_request_handler: HTTP_ACCEPT_LANGUAGE = en-us,en;q=0.5
abstract_request_handler: SERVER_PROTOCOL = HTTP/1.1
abstract_request_handler: HTTPS = on
abstract_request_handler: REMOTE_ADDR = 127.0.0.1
abstract_request_handler: SERVER_SOFTWARE = nginx/0.7.61
abstract_request_handler: SERVER_ADDR = 127.0.0.1
abstract_request_handler: SCRIPT_NAME =
abstract_request_handler: PASSENGER_ENVIRONMENT = development
abstract_request_handler: REMOTE_PORT = 64021
abstract_request_handler: REQUEST_URI = /login/new
abstract_request_handler: HTTP_ACCEPT_CHARSET = ISO-8859-1,utf-8;q=0.7,*;q=0.7
abstract_request_handler: SERVER_PORT = 3443
abstract_request_handler: SCGI = 1
abstract_request_handler: PASSENGER_APP_TYPE = rails
abstract_request_handler: PASSENGER_USE_GLOBAL_QUEUE = false
I'm tired of banging my head against the wall, so I'd truly appreciate any help I can get!
Direct shot to foot moment...
While setting-up individual non-admin accts for MSSQLSERVER services, I temporarily set Server service login to Local System account.
I remembered later that:
SQL Server Configuration Manager performs additional configuration such as setting permissions in the Windows Registry so that the new account can read the SQL Server settings.
I want my Local System back . (Actually just restored to its original security profile)
Any advice? Thanks!
Hi,
My cousin and I bought a wireless Belkin router for testing purposes. Please keep in mind for all of our tests there is no ethernet cable plugged in, just the router's power cord.
We have been trying to "flood" it with PING requests on its default address 192.168.2.1, but it isn't doing a thing; not even logging any attempts of too many requests. I've disabled the firewall, disabled PING request block, etc. Any idea why this thing isn't being affected? We sent 4 million packets and it hasn't done a thing. Quite odd!
Thanks.
I've got a router performing simple NAT translation using iptables
iptables -t nat -o -j MASQUERADE
This works fine almost all of the time except for one particular case where some TCP RST and FIN packets are leaving the router un-NAT'd.
In this scenario I setup 1 or 2 client computers streaming Flash video (eg www.nasa.gov/ntv)
At the router I then tear down and re-establish the public interface (which is a modem)
As expected the Flash streams stall out. After the connection is re-established and I try to refresh the Flash pages, I see some TCP RST and [FIN,ACK] packets leaving the public interface (I assume as Flash attempts to recover its stream).
I don't know how these packets can leave the router non-NAT'd
I have a local domain controller setup, which is MYDOMAIN.com, and on a seperate local server I have a MOSS site running. the DNS is all working fine but when I try to connect to the MOSS site using domain credentials I can't use syntax:
MYDOMAIN/MyAccount
it is expecting
[email protected]
What can I do to fix this issue, so I have normal domain login capabilities like every other sharepoint site out there?