Search Results

Search found 4538 results on 182 pages for 'rules'.

Page 40/182 | < Previous Page | 36 37 38 39 40 41 42 43 44 45 46 47  | Next Page >

• Can't access Linux machine from the network, network from the machine is fine

  - by Matt

  I'm having issues with a machine that stopped replicating with mysql. It's managed by a guy on another continent but recently I've had to get involved. The server is running Ubuntu server 9.10 I can't log in with SSH, there is no response. On the server itself I can ssh to localhost fine. I thought maybe it's the firewall rules. I'm no expert on IP Tables, but I believe that's not the issue as I removed all the rules. But it still won't let me in. Any ideas? it's acting from other machines as though the service isn't listening, but I know that it is. It's like this for all services.

  Read the article

• Iptables config breaks Java + Elastic Search communication

  - by Agustin Lopez

  I am trying to set up a firewall for a server hosting a java app and ES. Both are on the same server and communicate to each other. The problem I am having is that my firewall configuration prevents java from connecting to ES. Not sure why really.... I have tried lot of stuff like opening the port range 9200:9400 to the server ip without any luck but from what I know all communication inside the server should be allowed with this configuration. The idea is that ES should not be accessible from outside but it should be accessible from this java app and ES uses the port range 9200:9400. This is my iptables script: echo -e Deleting rules for INPUT chain iptables -F INPUT echo -e Deleting rules for OUTPUT chain iptables -F OUTPUT echo -e Deleting rules for FORWARD chain iptables -F FORWARD echo -e Setting by default the drop policy on each chain iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP echo -e Open all ports from/to localhost iptables -A INPUT -i lo -j ACCEPT echo -e Open SSH port 22 with brute force security iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 30 --hitcount 4 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j LOG --log-prefix "SSH brute force " iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT echo -e Open NGINX port 80 iptables -A INPUT -p tcp --dport 80 -j ACCEPT echo -e Open NGINX SSL port 443 iptables -A INPUT -p tcp --dport 443 -j ACCEPT echo -e Enable DNS iptables -A INPUT -p tcp -m tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT And I get this in the java app when this config is in place: org.elasticsearch.cluster.block.ClusterBlockException: blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];[SERVICE_UNAVAILABLE/2/no master]; at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:292) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1185) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475) at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304) at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228) at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300) at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195) at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:700) at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760) at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482) at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403) Do any of you see any problem with this configuration and ES? Thanks in advance

  Read the article

• iptables prerouting to redirect source ip address on ethernet

  - by Kevin Campion

  I have 2 ip adresses on the Internet who redirect on the same machine. On this machine, one Debian runs on OpenVZ. I can set iptables rules to redirect all http request to the Debian. iptables prerouting -d ip_address_2 DNAT --to ip_address_local_1 +--------------+ | | | V | ip_address_local_1 I| +------+ +----------+ N|ip_address_1 | |-----|Debian1 VE|-- Apache's log T|-----------------|OpenVZ| +----------+ [client ip_address_1] E| | | | R|ip_address_2 | | | N|--------------+ | | E| +------+ T| Iptables' rules : iptables -t nat -A PREROUTING -p tcp -i eth0 -d ip_address_2 --dport 80 -j DNAT --to ip_address_local_1:80 iptables -A FORWARD -p tcp -i eth0 -o venet0 -d ip_address_local_1 --dport 80 -j ACCEPT iptables -A FORWARD -p tcp -i venet0 -o eth0 -s ip_address_local_1 --sport 80 -j ACCEPT When I go to webpage with "http://ip_address_2", I can see the good content but the ip address on access log file is ip_address_1, I would like to see my ISP's ip address. Any ideas?

  Read the article

• Error when installing SQL Server 2008 R2 Express

  - by dretzlaff17

  When installing SQL Server 2008 R2 from the command line prompt, I am getting the following error that is recorded in the Summary file. Scenario specific rules: Rules report file: C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20101217_131444\SystemConfigurationCheck_Report.htm Exception summary: The following is an exception stack listing the exceptions in outermost to innermost order Inner exceptions are being indented Exception type: System.ArgumentNullException Message: Value cannot be null. Parameter name: path2 Data: DisableWatson = true Stack: at System.IO.Path.Combine(String path1, String path2) at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineSetupPublic.RecomputeDirectoryPaths() at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineSetupPublic.Calculate() at Microsoft.SqlServer.Configuration.SetupExtension.FinalCalculateSettingsAction.ExecuteAction(String actionId) at Microsoft.SqlServer.Chainer.Infrastructure.Action.Execute(String actionId, TextWriter errorStream) at Microsoft.SqlServer.Setup.Chainer.Workflow.ActionInvocation.ExecuteActionHelper(TextWriter statusStream, ISequencedAction actionToRun) Has anyone seen this. Here is what I am sending for the command line parameters. /q /ACTION=Install /FEATURES=SQLEngine /SECURITYMODE=SQL /SAPWD="myPassword" /BROWSERSVCSTARTUPTYPE=Automatic /SQLSVCSTARTUPTYPE=Automatic /SQLSVCACCOUNT="NT AUTHORITY\Network Service" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /AGTSVCACCOUNT="NT AUTHORITY\Network Service" /IACCEPTSQLSERVERLICENSETERMS

  Read the article

• mdadm email notification - change the default subject

  - by Shirker

  I have entry in my crontab 00 */1 * * * /sbin/mdadm --monitor --scan -1 [email protected] It works more than perfect, but I need to change the default email template. So instead of subject "mdadm monitoring" it wished to be "mdadm monitoring from «IP ADDRESS»" or like that. [root@mail ~]# rpm -ql mdadm-3.2.5-4.el6_4.2.x86_64 | grep -v -E '(man|doc)' /etc/cron.d/raid-check /etc/rc.d/init.d/mdmonitor /etc/sysconfig/raid-check /lib/udev/rules.d/65-md-incremental.rules /sbin/mdadm /sbin/mdmon /usr/sbin/raid-check /var/run/mdadm Is it hardcoded or its possible to change?

  Read the article

• IIS7 URL Rewrite - Rewrite CSS files

  - by user1231958

  I'm trying to rewrite certain CSS files with some rules, so it replaces every single instance of links in the CSS (as in background: url("/myuri.jpg")) with a prefix (as in background: url("/zeus/myuri.jpg")) These are the rules. <rule name="ReverseProxyOutboundRule2" preCondition="IsCSS" enabled="true" stopProcessing="false"> <match filterByTags="None" pattern="url\(&quot;(.*)&quot;\)" /> <action type="Rewrite" value="url(&quot;/zeus{R:1}&quot;)" /> <conditions> <add input="{URL}" pattern="/zeus" /> </conditions> </rule> <preCondition name="IsCSS"> <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/css" /> </preCondition> However, only one url is being replaced this way and somehow the rest is being ignored. Thank you beforehand.

  Read the article

• Apache2 - mod_expire and mod_rewrite not working in httpd.conf - serving content from tomcat

  - by Ankit Agrawal

  I am using apache2 server running on debian which forwards all the http request to tomcat installed on same machine. I have two files under my /etc/apache2/ folder apache2.conf and httpd.conf I modified httpd.conf file to look like following. # forward all http request on port 80 to tomcat ProxyPass / ajp://127.0.0.1:8009/ ProxyPassReverse / ajp://127.0.0.1:8009/ # gzip text content AddOutputFilterByType DEFLATE text/plain AddOutputFilterByType DEFLATE text/html AddOutputFilterByType DEFLATE text/xml AddOutputFilterByType DEFLATE text/css AddOutputFilterByType DEFLATE text/javascript AddOutputFilterByType DEFLATE application/xml AddOutputFilterByType DEFLATE application/xhtml+xml AddOutputFilterByType DEFLATE application/rss+xml AddOutputFilterByType DEFLATE application/javascript AddOutputFilterByType DEFLATE application/x-javascript DeflateCompressionLevel 9 BrowserMatch ^Mozilla/4 gzip-only-text/html BrowserMatch ^Mozilla/4\.0[678] no-gzip BrowserMatch \bMSIE !no-gzip !gzip-only-text/html # Turn on Expires and mark all static content to expire in a week # unset last modified and ETag ExpiresActive On ExpiresDefault A0 <FilesMatch "\.(jpg|jpeg|png|gif|js|css|ico)$" ExpiresDefault A604800 Header unset Last-Modified Header unset ETag FileETag None Header append Cache-Control "max-age=604800, public" </FilesMatch RewriteEngine On # rewrite all www.example.com/content/XXX-01.js and YYY-01.css files to XXX.js and YYY.css RewriteRule ^content/(js|css)/([a-z]+)-([0-9]+)\.(js|css)$ /content/$1/$2.$4 # remove all query parameters from URL after we are done with it RewriteCond %{THE_REQUEST} ^GET\ /.*\;.*\ HTTP/ RewriteCond %{QUERY_STRING} !^$ RewriteRule .* http://example.com%{REQUEST_URI}? [R=301,L] # rewrite all www.example.com to example.com RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC] RewriteRule ^(.*)$ http://example.com/$1 [R=301,L] I want to achieve following. forward all traffic to tomcat GZIP all the text content. Put 1 week expiry header to all static files and unset ETag/last modified header. rewrite all js and css file to certain format. remove all the query parameters from URL forward all www.example.com to example.com The problem is only 1 and 2 are working. I tried a lot with many combinations but the expire and rewrite rule (3-6) do not work at all. I also tried moving these rules to apache2.conf and .htaccess files but it didn't work either. It does not give any error but these rules are simple ignored. expires and rewrite modules are ENABLED. Please let me know what should I do to fix this. 1. Do I need to add something else in httpd.conf file (like Options +FollowSymLink) or something else? 2. Do I need to add something in apache2.conf file? 3. Do I need to move these rules to .htaccess file? If yes, what should I write in that file and where should I keep that file? in /etc/apache2/ folder or /var/www/ folder? 4. Any other info to make this work? Thanks, Ankit

  Read the article

• Huawei b260a gsm modem not forwarding gre for pptp tunnel

  - by Priit

  I have a huawei gsm modem that does not want to let gre through. The goal is to connect into a pptp server thats behind the huawei. In the modems port forwarding settings theres a ready made profile for pptp (1723). After activating that the MS pptp test tools show that connection is being initiated but no gre packets make it to the server. After taking a closer look into the modems iptables rules theres nothing in there about gre. So I tried making gre rules manualy into forward and preroute chains without any success what so ever. As far as I can tell theres no ip_gre module present on the device is that needed for gre forwarding? Thats what I'm afraid of that it doesn't support gre in NAT but how would I turn it into a bridge? The wan interface is ppp0 so bridging it with eth0 would not work right? Is there some iptables rule I could use to make the modem let all the traffic just straight through?

  Read the article

• Centos iptables blocks after reboot

  - by bilal

  I have a Centos5 installation with kvm on my server. I am using nat portforwarding to ssh my virtual machines. I have several iptables rules and saved then in /etc/sysconfig/iptables. After reboot, I see all these rules when I type service iptables status but I am getting a connection refused error. After typing service iptables restart everything works. I don't understand, why do I need to restart iptables again? Doesn't it restart on reboot?

  Read the article

• Upgraded from fc10 to fc12 now I have eth0_rename, how do I get back to plain old eth0?

  - by shank

  I upgraded from Fedora 10 to Fedora 12. Unfortunately, my ethernet interface eth0 is now named eth0_rename. I'd like to get back to having it named plain old eth0. I googled a bit but the solution of removing the eth0 entry from /etc/udev/rules.d/70-persistent-net.rules seems to have no effect (I restarted the network service but didn't reboot). The interface works just fine although I could see a script or two having a problem with the format. So, it's more of an inconvenience thing than anything else. Any ideas? Thanks.

  Read the article

• How to drop all subnets outside of the US using iptables

  - by Jim

  I want to block all subnets outside the US. I've made a script that has all of the US subnets in it. I want to disallow or DROP all but my list. Can someone give me an example of how I can start by denying everything? This is the output from -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:ftp state NEW DROP icmp -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination And these are the rules iptables --F iptables --policy INPUT DROP iptables --policy FORWARD DROP iptables --policy OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -i eth0 --dport 21 -m state --state NEW -j ACCEPT iptables -A INPUT -p icmp -j DROP Just for clarity, with these rules, I can still connect to port 21 without my subnet list. I want to block ALL subnets and just open those inside the US.

  Read the article

• linux audit - exclude a process that updates the time

  - by user185704

  I have set my auditd rules to log when the system time is changed However, our servers are VMs and thus have problems with the time drifting out. We needed to solve this issue so we used a VMware tool to regularly synchronize the time. My problem now is that my audit logs are overwhelmed with time change entries like this: Jun 1 15:08:39 ***** audispd: node=****** type=SYSCALL msg=audit(1338559719.053:344291): arch=c000003e syscall=159 success=yes exit=5 a0=7ffff2084050 a1=0 a2=144b a3=485449575f4c4c55 items=0 ppid=1 pid=1348 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="vmtoolsd" exe="/usr/lib/vmware-tools/bin64/appLoader" key="time_change" How can I exclude this vmware tool from the audit, but still capture a user changing the time? Here are my current audit rules to capture time changes: -a always,exit -F arch=b32 -S adjtimex -S settimeofday -k time_change -a always,exit -F arch=b32 -S clock_settime -k time_change

  Read the article

• Rate-Limit affects All clients or single IP?

  - by Asad Moeen

  Well up-til now I've considered iptables rate-limit commands with the "recent" module to work for each IP Address. For example rate-limit rule of 20k/s will trigger only if a single IP exceeds 20k/s rate and not if 4 different IPs exceed 5k/s rate. Please correct me if I considered this wrong as I've only used these rules for TCP/ UDP. But today I tried similar rules for ICMP and applied 4/s Input/Output. But then on trying to ping-test from just-ping.com I could see packet loss on almost all IP Addresses. How could that happen because if it worked for each IP Address then it wouldn't be triggering the rule because I believe each IP from just-ping has a rate of probably 1/s. I still think the first one is true because if it wasn't then my GameServer would block everyone if the combined rate ( in case of more connected players ) increased the threshold. This hasn't happened up til now so the ICMP thing really confused me. Thank you.

  Read the article

• How Do I make an Acer T230H Touchcreen work on Ubuntu 9.10?

  - by N Rahl

  I've done this so far: sudo nano /etc/udev/rules.d/99-touchscreen.rules And added: SUBSYSTEM=="usb", ATTRS{idVendor}=="0408", ATTRS{idProduct}=="3000", SYMLINK+="usb/quanta_touch" SUBSYSTEM=="input", KERNEL=="event*", ATTRS{idVendor}=="0408", ATTRS{idProduct}=="3000", SYMLINK+="input/quanta_touch" sudo service udev restart then the instructions here: http://ubuntuforums.org/showpost.php?p=8932808&postcount=36 And then added to my xorg conf: Section "InputDevice" Identifier "Acer T230H" Driver "hidtouch" Option "SendCoreEvents" "true" Option "ReportingMode" "Raw" Option "Device" "/dev/usb/quanta_touch" Option "PacketCount" "13" Option "OpcodePressure" "852034" Option "OpcodeX" "65584" Option "OpcodeY" "65585" Option "CalibrationModel" "1" Option "CornerTopLeftX" "0" Option "CornerTopLeftY" "0" Option "CornerTopRightX" "1920" # 1920 for 23" Option "CornerTopRightY" "0" Option "CornerBottomLeftX" "0" Option "CornerBottomLeftY" "1080" # 1080 for 23" Option "CornerBottomRightX" "1920" # 1920 for 23" Option "CornerBottomRightY" "1080" # 1080 for 23" Option "CornerScreenWidth" "1920" # 1920 for 23" Option "CornerScreenHeight" "1080" # 1080 for 23" EndSection Section "ServerLayout" Identifier "Touchscreen" InputDevice "Acer T230H" "SendCoreEvents" EndSection And restarted. And the touchscreen does nothing. Any ideas?

  Read the article

• What other protocols must not be fire-walled for FTP to work?

  - by Chris

  my Netgear router randomly reset itself the other day loosing all of my config settings: DSL details, Firewall rules, the lot! So I set about restoring all of the details manually, but when it came to configuring the firewall I wanted improve the security by explicitly setting 'deny' rules for everything that I figured is 'non-essential', and (although not necessary) whilst I was at it I set explicit 'allow' for the 'essential' protocols. I'll admit now I didn't really know what I was doing and everything was just 'my best guess', but I enabled only DNS, HTTP, HTTPS, FTP, SFTP, TFTP with everything else blocked. This did not work for me as I could not access 99% of web sites (although strangely Google worked!), so I played around a bit more and found that (oddly) if I disabled just the explicit 'allow' rules then everything worked fine, for browsing anyway. Today I came to work on some web-sites via FTP and just could not get a consistent connection, it kept dropping out after a few files or being blocked by the server or simply not connecting. It would authenticate okay but then stop when retrieving the initial directory listing! e.g.: Status: Delaying connection for 1 second due to previously failed connection attempt... Status: Resolving address of ftp.domain.co.uk Status: Resolving address of ftp.domain.co.uk Status: Connecting to 123.123.123.123:21... Status: Connecting to 123.123.123.123:21... Status: Connection established, waiting for welcome message... Status: Connection established, waiting for welcome message... Response: 421 Too many connections (8) from this IP Error: Could not connect to server Status: Delaying connection for 5 seconds due to previously failed connection attempt... Response: 421 Too many connections (8) from this IP Error: Could not connect to server Status: Delaying connection for 5 seconds due to previously failed connection attempt... I've checked and re-checked the FTP settings (they worked before anyway), I have Googled the I.T. out of the various protocols that I have blocked in the fire-wall but none seem essential to FTP (other than FTP/SFTP etc. which I have passively enabled). I'm (clearly) no server engineer, or protocols / fire-wall expert so I was hoping that some one could maybe shed some light on why my FTP is failing. I've been wondering if I ought to be allowing BGP, BOOTP and/or IDENT (or any others)? What other protocols are required for FTP? Thanks in advance!

  Read the article

• Non-Registry Fix for Secondary Mailboxes Sent Items

  - by Jai Kang

  There is a known issue with Outlook and Exchange where "secondary" mailboxes which are mounted in the same profile, e.g. "John Doe" + CorpMailbox1, CorpMailbox2, CorpMailbox3 will place "sent items" from the secondary mailboxes (e.g. CorpMailbox1) in the user's (e.g. "John Doe") Sent Items folder. There is a registry value (something like DelegateSentItems) to semi-fix this, but I'm looking for an Exchange-side solution. It seems like, at some point, an admin made CC rules to fix this, and for the mailboxes where I see a BCC rule: any item sent to [address] BCC to [address]. The behavior "fixes" the issue, but when I duplicate this work-around for new shared mailboxes, the email ends up in the Inbox and not the Sent Items for the shared mailbox. I don't believe there is any outlook/client-side shenanigans going on, as the intended behavior for the older mailboxes works for new PCs/Users (new imagse) without any Outlook Mailbox Rules.

  Read the article

• NIC bonding with two uplinks

  - by Karolis T.

  Is bonding the preferred way of implementing ISP redundancy? In the texts I've seen, bond device has a netmask, gateway of it's own. How can this be obtained if there are two different gateways from two uplinks, which one to choose? Do I need any special routing rules to go with it or does simply configuring separate interfaces (using Debian, /etc/network/interfaces), i.e eth1, eth2 for their corresponding uplinks and bonding them to bond0 handle routing automatically? If I want to NAT client machines, do they use bond device's IP as a gateway? Does the bond0 device is the device that goes into iptables nat rules? Thanks

  Read the article

• mod_rewite Rule: root/? root/app/views/home/home.php

  - by Jonathon David Oates

  I am shocking at mod_rewite, here's the scenario: I need a rule that rewrites mydomain.com to mydomain.com/app/views/home/home.php. The rule, or set of rules rather, must also rewite mydomain.com/signin to mydomain.com/app/views/signin/signin.php, and work in a similar fashion for any subdirectory, for example: mydomain.com/subdir must redirect to mydomain.com/app/views/subdir/subdir.php. The rules must also work with or without the trailing slash, for example: ….com or ….com/. Thank you all, your help is much appreciated! If you could outline how and why your solution works or direct me to a good resource that explains it, I'd be exceptionally grateful! Edit: I have got a simple .htaccess file with this: Options +FollowSymLinks RewriteEngine On RewriteRule ^$ http://mydomain.local/~Jay/some_awesome_app/app/views/home/home.php This does the redirect but changes the URL in the address bar too! I've not got a trailing [R] flag so why would this be?

  Read the article

• How do I identify which rewrite rule is being trigger on IIS 7.5?

  - by Jordan Reiter

  I have a set of rewrite rules (offhand, I would say around 40-50) for a given server. It's basically to handle and reroute mangled URLs so that bad links still go to where they're supposed to go. I've come across an URL that is redirecting and I can't figure out which rewrite rule it is applying. My background is Apache and in that case I'd simply enable a rewrite log and look at the logged output to figure out what was happening. Is there an equivalent way to do this in IIS? bonus round Any way for me to view & edit the rewrite rules in a text file rather than the GUI interface?

  Read the article

• Windows 2003 GPO Software Restrictions

  - by joeqwerty

  We're running a Terminal Server farm in a Windows 2003 Domain, and I found a problem with the Software Restrictions GPO settings that are being applied to our TS servers. Here are the details of our configuration and the problem: All of our servers (Domain Controllers and Terminal Servers) are running Windows Server 2003 SP2 and both the domain and forest are at Windows 2003 level. Our TS servers are in an OU where we have specific GPO's linked and have inheritance blocked, so only the TS specific GPO's are applied to these TS servers. Our users are all remote and do not have workstations joined to our domain, so we don't use loopback policy processing. We take a "whitelist" approach to allowing users to run applications, so only applications that we approve and add as path or hash rules are able to run. We have the Security Level in Software Restrictions set to Disallowed and Enforcement is set to "All software files except libraries". What I've found is that if I give a user a shortcut to an application, they're able to launch the application even if it's not in the Additional Rules list of "whitelisted" applications. If I give a user a copy of the main executable for the application and they attempt to launch it, they get the expected "this program has been restricted..." message. It appears that the Software Restrictions are indeed working, except for when the user launches an application using a shortcut as opposed to launching the application from the main executable itself, which seems to contradict the purpose of using Software Restrictions. My questions are: Has anyone else seen this behavior? Can anyone else reproduce this behavior? Am I missing something in my understanding of Software Restrictions? Is it likely that I have something misconfigured in Software Restrictions? EDIT To clarify the problem a little bit: No higher level GPO's are being enforced. Running gpresults shows that in fact, only the TS level GPO's are being applied and I can indeed see my Software Restictions being applied. No path wildcards are in use. I'm testing with an application that is at "C:\Program Files\Application\executable.exe" and the application executable is not in any path or hash rule. If the user launches the main application executable directly from the application's folder, the Software Restrictions are enforced. If I give the user a shortcut that points to the application executable at "C:\Program Files\Application\executable.exe" then they are able to launch the program. EDIT Also, LNK files are listed in the Designated File Types, so they should be treated as executable, which should mean that they are bound by the same Software Restrictions settings and rules.

  Read the article

• debian gateway using iptables

  - by meijuh

  I am having problems setting up a debian gateway server. My goal: Having eth1 the WAN interface. Having eth0 the LAN interface. Allow both ports 22 (SSH) and 80 (HTTP) accessed from the outside world on the gateway (SSH and HTTP run on this server). What I did was the following: Create a file /etc/iptables.rules with contents: /etc/iptables.rules: *nat -A POSTROUTING -o eth1 -j MASQUERADE COMMIT *filter -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -i eth1 -j DROP COMMIT edit /etc/network/interfaces as follows: /etc/network/interfaces: # The loopback network interface auto lo iface lo inet loopback pre-up iptables-restore < /etc/iptables.rules auto eth0 allow-hotplug eth0 iface eth0 inet dhcp #auto eth1 #allow-hotplug eth1 #iface eth1 inet dhcp allow-hotplug eth1 iface eth1 inet static address 217.119.224.51 netmask 255.255.255.248 gateway 217.119.224.49 dns-nameservers 217.119.226.67 217.119.226.68 Uncomment the rule net.ipv4.ip_forward=1 in /etc/sysctl.conf to allow packet forwarding. The static settings for eth1 such as the ip address I got from my router (which I want to replace); I simply copied these. I have a (windows) DNS + DHCP server on ip address 10.180.1.10, which assigns ip address 10.180.1.44 to eth0. What this server does is not really interesting it only maps domain names on our local network and assigns one static ip to the gateway. What works: on the gateway itself I can ping 8.8.8.8 and google.nl. So that is okey. What does not work: (1) Every machine connected to eth0 (indirectly via a switch) can not ping an ip or a domain. So I guess the gateway can not be found. (2) Also when I configure my linux machine (a laptop) to use a static ip 10.180.1.41, a mask and a gateway (10.180.1.44) I can not ping an ip or domain either. This means that maybe my iptables is incorrect of not loaded correctly. Or I maybe have to configure my DNS/DHCP on my windows machine. I have not reset the windows machine net, restart the DNS/DHCP services, should I do this? I did not install dnsmasq as desribed here: http://blog.noviantech.com/2010/12/22/debian-router-gateway-in-15-minutes/. I don't think this is necessary?

  Read the article

• What kind of router do I need to handle multiple external I.P addresses?

  - by user1308743

  I have 3 dedicated I.P addresses going to a location with a few servers, and 1 RVS4000 router. Right now, only one I.P is being used. I would like a router that can use all 3 I.P addresses and I can make rules like this: IP1:80 goes to ServerA IP2:80 goes to ServerB What kind of router/device with what features do I need to handle this? I will need to set 30-40 rules to forward certain ports to certain servers. Only a couple ports will need to go to IP2 or IP3. Thanks

  Read the article

• FreeBSD jail with IPFW with loopback - unable to connect loopback interface

  - by khinester

  I am trying to configure a one IP jail with loopback interface, but I am unsure how to configure the IPFW rules to allow traffic to pass between the jail and the network card on the server. I have followed http://blog.burghardt.pl/2009/01/multiple-freebsd-jails-sharing-one-ip-address/ and https://forums.freebsd.org/viewtopic.php?&t=30063 but without success, here is what i have in my ipfw.rules # vim /usr/local/etc/ipfw.rules ext_if="igb0" jail_if="lo666" IP_PUB="192.168.0.2" IP_JAIL_WWW="10.6.6.6" NET_JAIL="10.6.6.0/24" IPF="ipfw -q add" ipfw -q -f flush #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any $IPF 40 deny tcp from any to any frag # statefull $IPF 50 check-state $IPF 60 allow tcp from any to any established $IPF 70 allow all from any to any out keep-state $IPF 80 allow icmp from any to any # open port ftp (20,21), ssh (22), mail (25) # ssh (22), , dns (53) etc $IPF 120 allow tcp from any to any 21 out $IPF 130 allow tcp from any to any 22 in $IPF 140 allow tcp from any to any 22 out $IPF 150 allow tcp from any to any 25 in $IPF 160 allow tcp from any to any 25 out $IPF 170 allow udp from any to any 53 in $IPF 175 allow tcp from any to any 53 in $IPF 180 allow udp from any to any 53 out $IPF 185 allow tcp from any to any 53 out # HTTP $IPF 300 skipto 63000 tcp from any to me http,https setup keep-state $IPF 300 skipto 63000 tcp from any to me http,https setup keep-state # deny and log everything $IPF 500 deny log all from any to any # NAT $IPF 63000 divert natd ip from any to any via $jail_if out $IPF 63000 divert natd ip from any to any via $jail_if in but when i create a jail as: # ezjail-admin create -f continental -c zfs node 10.6.6.7 /usr/jails/node/. /usr/jails/node/./etc /usr/jails/node/./etc/resolv.conf /usr/jails/node/./etc/ezjail.flavour.continental /usr/jails/node/./etc/rc.d /usr/jails/node/./etc/rc.conf 4 blocks find: /usr/jails/node/pkg/: No such file or directory Warning: IP 10.6.6.7 not configured on a local interface. Warning: Some services already seem to be listening on all IP, (including 10.6.6.7) This may cause some confusion, here they are: root syslogd 1203 6 udp6 *:514 *:* root syslogd 1203 7 udp4 *:514 *:* i get these warning and then when i go into the jail environment, i am unable to install any ports. any advice much appreciated.

  Read the article

• Outlook 2007 - Fwd all mail from one mailbox to another email

  - by Simon

  I have two separate mailboxes setup in Outlook. My main everyday one (call this A), and another one which is where clients questions go direct to (call this B) I have a few rules setup on my main inbox. I need to setup a new rule to fwd all incoming email to B, to another colleague. If this was for mailbox A, it would not seem to hard and I would basically follow the instructions here. However, I cant see a way of applying rules to separate MailBoxes. - Does anyone know how to do this?

  Read the article

• Apache 410 Gone instructions not working with mod_alias nor mod_rewrite

  - by Peter Boughton

  Apache 2.2 seems to be ignoring instructions to return a 410 status. This happens for both mod_alias's Redirect (using 410 or gone) and mod_rewrite's RewriteRule (using [G]), being used inside a .htaccess file. This works: Redirect 302 /somewhere /gone But this doesn't: Redirect 410 /somewhere That line is ignored (as if it had been commented) and the request falls through to other rules (which direct it to an unrelated generic error handling script). Similarly, trying to use a RewriteRule with a [G] flag doesn't work, but the same rule rewriting to a script that generates a 410 does - so the rules aren't the problem and it seems instead to be something about 410/gone that isn't behaving. I can workaround it by having a script sending the 410, but that's annoying and I don't get why it's not working. Any ideas?

  Read the article

< Previous Page | 36 37 38 39 40 41 42 43 44 45 46 47  | Next Page >