Tuesday, January 25, 2011

IP Address Restriction

Hi,

I need some technical help regarding IP address restriction in IIS7. My problem how i can block all IP's except following IP address ex:- 69.59.196.212 in my IIS7. I want give access max 4-5 IP's remaining all Block.

Thank You.

How can ssh allowed to setup remote port forwarding but not execute commands?

How can an SSH command be setup to allow port forwarding but not execute commands.

I know that the ssh login can use -N to stop commands executing, but can the ssh config file be setup to disallow it?

Restricting the type of shell and the path in Linux is on option, but can it be done in the SSH configuration itself?

  • this article should set you in the right path

    http://www.semicomplete.com/articles/ssh-security/

    From eric
  • Look at man sshd and search for AUTHORIZED_KEYS FILE FORMAT

    What you want to do is create a public/private key pair, and put the public key in the ~/.ssh/authorized_keys file as normal. Then edit the authorized_keys file to add the string:

    command="/bin/false",no-agent-forwarding,no-pty,no-usr-rc,no-X11-forwarding,permitopen="127.0.0.1:80"

    It will end up looking kind of like:

    command="/bin/false",no-agent-forwarding,no-pty,no-usr-rc,no-X11-forwarding,permitopen="127.0.0.1:80" ssh-dss AAAAC3...51R==
    

    You would want to change the argument to 'permitopen' and possibly change some of the other settings, but I think that's basically it.

    vfclists : I guess the permitopen sets the local ports that can be forwarded from the users end. Does it affect remote port forwarding? Does it apply only to that key?
    Slartibartfast : The authorized_keys file is on the remote (ssh server) end. It indicates host+port combinations that clients with the authorized key are allowed to connect to via the server. The port that you use on the local (ssh client) side is irrelevant (and probably not communicated to the server), so it is omitted. Yes, it applies only to that key (which is why it is listed on the same line as the public key corresponding to the key that is permitted)

Creating swap files faster

I'm using Amazon EC2 and wish to be able to quickly generate large swapfiles (~10+GB) on instance startup. Unfortunately, I/O speed on my instances (c1.xlarge) is slow enough (20 MB/s) that this operation takes 10+ minutes, which is unacceptable for my usage.

I am aware that the swapfiles must be pre-alocated to use, so that I can't use sparse files.

However, is there some command to allocate blocks w/out spending the large amount of time zero-ing out the blocks? Also, if this command exists, am I correct in assuming that a page in the swapfile is zero'd out before a user process has access to it (mitigating security concerns)?

  • You didn't indicate what method you were trying to avoid.

    Traditionally, you would issue a dd command that would in turn pump out a zero'd file of the appropriate size, then run mkswap, add the entry to /etc/fstab, and then swapon to activate it. I've attached a rather hastily-written example shell script that I'm sure has errors (it's late where I'm at and the fstab entry is far from perfect)

    #!/bin/bash
    # --- allocate 10Gbyte of swap space as 10 separate 1Gbyte files
    # --- that are brought online sequentially during processing
    for swpidx in 01 02 03 04 05 06 07 08 09 10
    do
      dd if=/dev/zero of=/swapfile.$swpidx bs=16738 count=65536
      mkswap /swapfile.$swpidx
      echo "/swapfile.$swpidx    swap    swap    default    0 0" >> /etc/fstab
      swapon -a
    done
    swapon -s
    

    However, it sounds like you are trying to avoid this method. The fastest solution that I could provide would be to use a swap partition, which does not require the zero-out process, and can be brought online in minutes. If your instance is running LVM and you have an existing volume group that you could carve a partition out of, that would work just as well, and the allocation could be completed in just a few minutes.

    I think I should mention that carving out a swap space of this size is a bit unusual, even for a server; and I only say that because most servers have several gigs of RAM attached when dealing with programs/data of that size. Not to pry or anything, but are you really needing that much swap space?

    Another thing you may wish to consider is re-tuning your workload, rather than trying to dynamically allocate swap space. While it's great to have that much "on-demand", as you yourself pointed out, it will quickly become a bottleneck due to the slow I/O throughput on your server instance. By the time you exhaust your memory and you're essentially "living in swap", you'll find that the 20Mbyte/sec transfer rate turns your instance into a 386SX.

"'' is not a valid login or you do not have permission" on sql server installation

I have tried installing SQL Server 2008 multiple times on my machine, and I always receive this error about 3/4 of the way through: '' is not a valid login or you do not have permission.

I use SYSTEM user for install, when i try to use my admin login/password installation manager shows other errors.

  • Did you run as an administrator the installator ?

  • I solved my problem, it occurs when you computer name equals your username.

  • Thanks Alex!

    It saved my day!

    Strange bug / behavior though...

  • I face the same problem.and thank you for helping me to slove the problem.

    From Richard
  • WOW, It really worked! Thank you Alex :)

    From Vahid

Writing to network share failed

I have outlook files stored on a network share and accessed by clients directly.
Outlook is version 2003, clients windows XP and server is 2003. The files are quite big at around 3GB.

One of the common problem that happens is that I get 'delayed write failed' and this happens only on these PST files.

When this happens I have to run scanpst.exe to fix the PST file. I did not find any entries in even logs that I could relate to the issue.

What would you suggest to change to fix the issue or where to look to further diagnose it?

EDIT: No loss on ping and ping times within normal for LAN.

  • Not that this is a great answer but Microsoft definitely doesn't support PST over LAN.

    http://support.microsoft.com/kb/297019

    mfinni : No, that is the right answer.
    From Tsynapse
  • Although it is true that pst files are not supported over a Lan, I understand your pain. I have had delayed write failed errors on my network shares as well, most of the time when transferring big files (about 20 gigs). I suggest you check your disk configuration on the server. There are many leads . Check this http://www.gibni.com/windows-delayed-write-failed-solutions. In my case it was a network card settings (had to update the driver). But I had another instance when the disk I was writing to was faulty and had to be replaced, after which the delayed write failed errors stopped.

    Unreason : Thank you for the pointers - I will follow up on the storage issues, too.
    From redknight

Wordpress: 404 page after logging in

I get a 404 page when loging in to wordpress for all my users. It adds an extra "/" so its like website.com//

I am using:<?php wp_loginout(urlencode($_SERVER['REQUEST_URI'])); ?>

So that after a user logs in, it brings them back to where they were.

Is there something wrong with that code? Any ideas? This might help: http://pastebin.com/28tURS8m Thanks

  • OK. I actually had a few minutes to test this on my Wordpress 2.9.2 blog.

    The issue you are having, as mentioned in my comment, is that you're escaping $_SERVER['REQUEST_URI'] in your paramters of wp_loginout(). That function, wp_loginout(), already has a url cleanser called esc_url().

    So, if you just write...

    <?php wp_loginout($_SERVER['REQUEST_URI']); ?>
    

    ... your code will work as you want it to.

    thegreyspot : James works great. I really appreciate it. I had taken the code from some forum, no idea what it meant. Wish i could give you plus1 :) not enough reputation...
    James : No worries. I'm glad it worked. Escaping strings can always be a tricky endeavor in PHP development. Every function does it different or behaves in a way that puzzles one for hours.
    From James

Checkinstall failed with /root/rpmbuild has no source directory

Hi, I am trying to use checkinstall to build a package from source code. However, when i run checkinstall , it ask :

/root/rpmbuild has no source directory, please write the path to the rpm source directory tree.

i am running on fedora 12 and system was installed through kickstart via repository of dvd of fc12. I was not aware of the rpm source directory during the installation.

so how can i check whether rpm source has been installed or not. if not, how to make the rpm source directory so that i can please the checkinstall and build the package successfully. or can i bypass it?

thanks a lot

  • Hi,

    the solution you seek is:

    (as root) mkdir -p /root/rpmbuild/SOURCES

    From lope