The Comms Room

Dennis Kaarsemaker

08:14

@pauska D) Complacent Directory

pauska

bah, I got another 6-vote review question and I'm afraid to close it...

Dan

Morning

Decided to bring my bike into work - with hindsight, an unfaired bike isn't the ideal motorway commuter bike

pauska

turns out I was right, another audit.

Dan

The audit questions need to be very obvious after reading

pauska

08:48

or atleast be exempt for users above a certain rating..

0

Q: Proxy server on Debian

I'd like to create a simple HTTP(S) proxy allowing only certain IPs XXX.XXX.XXX.* and requiring authentication. Also it won't be forwarding IP of the guest. What solution should I choose? If you have created such a thing using some tutorial, link would be welcome.

In other words - please do my work for me

Dan

Indeed

Journeyman Geek

@pauska: eh, problem is, really, the audit system is really designed to solve a SO problem

tombull89

Is there a limit where you stop getting honeypot questions? I'm 3 flags shy of 700 flags on ServerFault and I'm still getting honeypot questions. I'm fairly sure I know what I'm doing at this point. — tombull89 May 15 at 20:05

@tombull89 unlikely: I have about twice as much flags at Programmers (~1300) and I am getting honeypots. BTW I am also still failing some of them, as well as making mistakes in flagging - which is probably the reason why audits won't stop (no matter how good one is now, there's no guarantee this will be always so in the future) — gnat May 15 at 21:53

Journeyman Geek

@tombull89: I have slightly over a thousand on SU. Still get em. Most of them make me groan at how bad they are ;p

Iain

@JourneymanGeek The only problem I have is where the trigger is. I click close just to see how many votes are on it and bam!

Cold T

08:58

damn didn't realise how difficult it was to vote for someone

morning all

Journeyman Geek

@Iain: eheh. I open them up in new tabs

@ColdT: tell me about it. Lots of good candidates ;p

Dan

I don't spend enough time in the review queue, sorry :(

Iain

@JourneymanGeek It's what i generally do but on the one occasion I didn't

Cold T

@JourneymanGeek first vote was easy :)

tombull89

@ColdT Was it Evan?

Cold T

09:02

@tombull89 ;)

tombull89

@ColdT YOU'VE DOOMED US ALL! Nooooo!

Cold T

@tombull89 could be worse, right?! lol

Journeyman Geek

hm, pat's apparently trolling on RA

tombull89

Yay! Popcorn time!

Ahem. I mean.

pauska

09:53

Any powershell freaks here? Get-Acl is confuse me

When you format the result as a list, ("Get-Acl | Format-List"), in addition to the path, owner, and access list, Windows PowerShell displays the following properties and property values:
-- Group: The security group of the owner.

Iain

@JourneymanGeek RA ?

pauska

Security group of the owner?? It makes no sense..

tombull89

@Iain Root Access, SuperUser Chat.

Iain

ah

Journeyman Geek

yeah, tom complains when he misses these things ;p

Iain

10:00

heed a mod hammer ?

Journeyman Geek

naw

we have mods around

and someone flagged and had him temp banned

Iain

10:23

@syneticon-dj I see what you did there but like most questions associated with LAMP/WAMP/XAMP etc developer stacks its still crappy. All you've done is change it from OT to NARQ as it really doesn't provide any useful information - I don't understand why you wasted your time :(

jscott

@Adrian Thank you, that was a great way to start a morning.

tombull89

o.O

Cold T

@tombull89 that looks worrying...

lol

Dan

@tombull89 I love that he has a cup INSIDE his case

tombull89

10:39

huh so I thought our USDT machines were "Ultra-Small Desktops" but they're "Ultra-Slim Desktops". Make a different with The Googles.

Dan

Do they look like the new Xbox?

tombull89

Not really.

Dan

Ah, those. Shifted some of those in my time

tombull89

Quite nice little machines. Although I've got one the other site of the office that is point blank refusing to work.

Think it's memory errors.

Dan

10:59

The new XBox is oogly though

And they're massively focussed on being a set top box / HTPC rather than a games machine

Nathan C

He did a flip!

tombull89

@Dan I like how he attempted to steer when he started going backwards.

Dan

@tombull89 Yeah, he gave it his best shot :D

tombull89

I was laughing at this too much last night.

Dan

11:14

@tombull89 Haha, that got a genuine out loud laugh

syneticon-dj

@pauska this seems to be the "primary" POSIX group of the principal. I am not sure where it comes from, though - System.Security.Accesscontrol which is the object type returned by Get-ACL does not have this property.

ewwhite

Thanks man , Since my question considered not real question :( i post those specifications here , dovecot , sendmail , over 1,200,000 users and 25,000 active users , migrating from an exchange server which was windows 2008 R2, i am the developer of web client and mobile client, they asked me to give my opinions on how they should configure the server specially partitioning , my developing environment was CentOS 6.3 ~ 6.4 — Synxmax 3 hours ago

pauska

@syneticon-dj Where is this set? I know that some users had a different primary group than Domain Users in the past, but this has all been revoked to Domain Users long time ago..

maybe it's just set when the folder is created?

syneticon-dj

@Iain The question seems answerable as @Adrian has proposed an answer. And it likely is on-topic too, although it certainly is not suffering from being too descriptive. I think having it re-opened and the answer accepted is of more value to the site than leaving it as is.

Iain

@syneticon-dj this one serverfault.com/q/509654/9517 ?

syneticon-dj

11:27

@pauska It is part of the ACL - the SDDL string even has the G: property to denote the "group" permissions. msdn.microsoft.com/en-us/magazine/cc982153.aspx

Dan

@pauska Just scan reading, but you can still change the primary group if you need to

syneticon-dj

@Iain no

This one was just an edit proposal making things marginally better where I clicked on "improve" to remove all the unnecessary spaces.

Iain

that's the one I was talking about hence the reason to mention *AMP etc

ewwhite

Sorry people, I need you to help me partition my CentOS mail server which will have 1.2 million users.

syneticon-dj

@Iain I just misunderstood then

Iain

11:30

np

syneticon-dj

@ewwhite you give me root credentials, I help you real good

Iain

@ewwhite where ?

ewwhite

1

A: Best Practice for Partitioning CentOS as a Mail Server?

This is a big server... It's probably overkill for the application of just running mail. We're missing so many details here that it's difficult to give a real answer. Consider: What mail solution are you using? How many users do you have to support? How much data needs to be stored? Are you mi...

Iain

@ewwhite if you have to ask theat many questions then surely that should be a comment requesting clarification ?

ewwhite

Comments don't lend themselves to bullet lists. But the main takeaway is to use RAID 1+0 and a FBWC controller.

syneticon-dj

11:34

I feel that SE is lacking a decent process to cycle questions through the request/improve phases. Using comments for asking questions, making edits and again writing comments to notify the people asking is ... ugly at best.

ewwhite

I was waiting for more info... but 1.2 million users is nuts.

pauska

@ewwhite he's migrating from a single exchange server with 1.2 million mailboxes

this guy is clearly on drugs

Dan

1.2 million can't be right

syneticon-dj

I would run 1.2 million users on my laptop. Over 3G.

Dan

@syneticon-dj I'm running 5 million right now

ewwhite

11:36

@syneticon-dj this is true

We are using Ubuntu, and MacOS, chef, copperegg, rundeck, redis, splunk. There are some other tools in the mix, but that’s the core of what we care about

The majority of our infrastructure is on AWS but there are some other elements: a few mac minis and a pool of Android virtual machines on dedicated hardware.

pauska

@syneticon-dj Yes, I understand that part, but it's not reflecting the current primary group of that user. Which is why I said that it seems like it's not something that changes when the user modifies the object (it stays at the same SID forever, apparently)

syneticon-dj

@ewwhite I can't think of any better alternative, but I am sure someone has. I would love to see this changing one day.

pauska

@ewwhite ...

ewwhite

I love reading the tools list touted by DevOps job ads... All sorts of things I've never heard of...

Dan

@ewwhite Android Virtual Machines?

pauska

11:38

I bet that those devops shops use 90% of their total workforce time on setting up tools, rather than actually developing stuff

Dan

No, I suppose that kind of makes sense. Not sure what good they'd be on intel x86 though

syneticon-dj

@pauska no, it would (and should) not - it is set once and is the equivalent of what is set in UNIX by issuing chown :group. No idea what is capable of changing it - probably Cygwin's chown would

ewwhite

so here's the thing... devops jobs are the holy grail it seems... MY company wants to hires someone who would be a fit for THAT job.

pauska

@syneticon-dj or perhaps setacl. Blah, I'll just let it fly by.. we don't use any Unix components here either way

ewwhite

and I think the people who are running the environments for that sort of environment aren't the right fit for what we need.

Dan

11:40

@ewwhite To be fair, I kind of wish I did fit that job. Sounds more interesting than where I've ended up, to be honest

pauska

@Dan !!!!!

ewwhite

But every day... on the right side of my SF page, the same sorts of devops job descriptions.

pauska

stop it! group policy is pwn!

ewwhite

@Dan I think you'll experience what I did when I was posing as a devops-capable syasadmin through most of last year...

A shop with no real internal infra, Netgear switches, entirely dependent upon Rackspace Cloud or AWS, and maybe a couple of dozen servers.

Dan

Oh, I don't want to do DevOps as such - I just like the automation route that Linux has took. I know Microsoft are trying the same with Orchestra and the like, but, hmm, I'm not so convinced

ewwhite

11:43

or such glaring engineering mistakes... At work I have a major devops client. And while they've automated this crazy infrastructure, they're missing so many sysadmin basics that it's sad.

Dan

@pauska I do like Group Policy, besides I'm so entrenched in Microsoft that it would take me a long time to be able to realistically put Linux on my CV for the kind of job titles I want

Nathan C

It's funny, I look at all these jobs and they want people who have dealt previously with "massive" databases or "scaling" and things of that sort. Hard to get exposure to this sort of stuff when everyone requires experience already. :P

It's like asking for 5 years experience on Windows Server 2012!

Dan

@NathanC Big databases have been around for a long time - it's just that before you hired a DBA. Now they want a programmer :D

dawud

after working for DAYS on an specific SELinux policy for this bloody oracle database, I've been forced by management to set the server to permissive. This DB admin dude says: "see, it works now" . Sometimes I feel like 3.bp.blogspot.com/-Cd3t-tecEOA/TnDVQiHX16I/AAAAAAAAAGo/…

2

ewwhite

But even my firm is looking to get someone from one of those environments... discounting the fact that collectively, we have the experience to do it

Nathan C

11:46

@dawud If it don't work, disable it!

And...that's how the server got hacked.

dawud

pretty much

Nathan C

Actually, what I see more often is that people request "3+ years" experience in the most obscure software that probably only that company uses

-1

Q: what are the Advantages Of Computerized Asset Management Software?

what are the Advantages Of Computerized Asset Management Software? http://www.nexgenam.com/

software-raid software-deployment

Blatant advertising best advertising.

ewwhite

@NathanC Like copperegg, rundesk and redis?

Nathan C

Exactly.

Travis

@NathanC Straight from their website :) "Efficiently manage and sustain a comprehensive asset management program through a single software solution"

Journeyman Geek

11:51

flagged

Nathan C

Yeah, I flagged it too.

syneticon-dj

@NathanC "3+ years experience" is just code for "we have no idea what we are talking about, you better will!"

Nathan C

Yep, basically. A college degree apparently doesn't count either :P although, it's not like I managed a network as part of school...

Travis

When I applied for this job their requirement was "must know EDI." Well, I don't know EDI and also they don't have the software capability to do EDI

So apparently Lexmark customer support can not open PDF files...

Nathan C

Can't or won't? :P

Travis

11:57

They say they are unable to

Nathan C

Send a .txt, that'll show them.

Travis

It's an HTML file

Nathan C

In my previous job the recruiter couldn't open a .docx because they didn't have an updated version of Office...

It was a sad day.

syneticon-dj

Awesome - questions are auto-deleted after a certain number of spam flags thrown?

Travis

Yep! This job I have now was like that. I didn't hear back so 3 days later I resent them a follow up in .doc and .pdf

Nathan C

11:59

-5

Q: failing the boot and detect the hard disque raid smart array of hp proliant dl 180 G5 server

I have broblem when the server start boot , boot Server does not boot a previously detect OS and leds off hard disque is all off.

hp

syneticon-dj

@NathanC "updated" would mean Office 2003 or newer?

Journeyman Geek

@syneticon-dj: yup

Nathan C

@syneticon-dj Honestly I have no idea what they were trying to open it with (it was my resume). I ended up re-sending it as a .doc so they could open it.

syneticon-dj

"I have a bro blem"

Journeyman Geek

@NathanC: .... thats painful

Travis

12:00

@syneticon-dj 2000 with compatibility pack opens docx. 2003 is the same

We have Office 2000...

syneticon-dj

2000 did not have a compatibility pack, did it?

Travis

@syneticon-dj Yep

@syneticon-dj We use it now. I finally got them to let me buy 10 licenses of 2013

@syneticon-dj But since only 3 machines are Windows 7....all our XP machines can't run 2013

Journeyman Geek

oops

syneticon-dj

@Travis Not that it would matter much as Office 2000 is 13 years old now, but do you have a link?

Travis

@syneticon-dj microsoft.com/en-us/download/details.aspx?id=3

@syneticon-dj Just standard pack for 2000 and 2003. One and the same

Nathan C

12:04

Okay, guess I should do work...even thought that means modifying our pricing catalog which is done in excel of all things

Travis

@NathanC Now when I do a "save as" it doesn't save my answers on that check list to send to them lol

@NathanC Whats a price catalog :)

Nathan C

Some sort of paper catalog that should be all web-based by now that's what. :P

Travis

@NathanC We have a catalog we send out. Could be called a product guide, product catalog, item catalog...something. Nope. They call it a "Guide to packaging profits..." I am still looking for where it instructs our distributors to make more profit from their packaging

Scott Pack

Gentlemen.

Travis

@ScottPack Sir

Jenny D

12:09

@Travis isn't it about what wrapping to choose for your profits?

@ScottPack ahem

Travis

@JennyD Nope. We sell aluminum foil

Jenny D

@Travis Easy choice, then.

Travis

@JennyD Just doesn't make much sense to me

syneticon-dj

@Travis Oh, I see. To be honest, I never noticed the compatibility pack has been updated to include older Office versions. As it has been distributed initially, Office 2000 was not supported IIRC.

Jenny D

@Travis It's marketing. Sense costs extra.

Scott Pack

12:11

@JennyD Lady.

Travis

@syneticon-dj Maybe. I've never used it before until I got here. Didn't need it at previous jobs. They upgraded on a lifecycle..

Jenny D

@ScottPack Sir.

Travis

@JennyD Glad I'm not in marketing

Scott Pack

My sincerest apologies. Had I seen your name in the recent speakers I would have been more inclusive.

Jenny D

@ScottPack No worries

I'm not really that thin-skinned...

Travis

12:14

Guess I actually need to do work and install this certificate authority

syneticon-dj

@Travis Don't. You certainly will regret it.

Travis

@syneticon-dj Which part. Working or the CA lol :)

Nathan C

0

Q: How do I check whether I'm Internet2 routable?

How do I check whether I have access to/am accessible from Internet2? Google says I should be using Internet2 Detective, but that tool seems to have disappeared.

networking internet

Well...

Travis

serverfault.com/questions/509858/….

I guess an electric dragster motorcycle would be the fastest server..

Nathan C

bit.ly/10TpPQm

:D

Jenny D

12:20

@Travis I'd go with the computers in fighter planes. I think there are some in there that can be considered servers, depending on your definition.

Travis

@NathanC lol, I almost posted that

@JennyD Space shuttle maybe faster

Nathan C

I did post that in the question actually. I post that to those "Google it" questions

Jenny D

@Travis But is it still considered "in the world?"

ewwhite

I'm looking at the Network Solutions DNS zone for one of my clients... and I see:
capital.aca .productiveBLAH.com
baa.aca .productiveBLAH.com
dev .productiveBLAH.com

tombull89

Titan (supercomputer)

Titan is a supercomputer built by Cray at Oak Ridge National Laboratory for use in a variety of science projects. Titan is an upgrade of Jaguar, a previous supercomputer at Oak Ridge, to use graphics processing units (GPUs) in addition to conventional central processing units (CPUs), and is the first such hybrid to perform over 10 petaFLOPS. The upgrade began in October 2011, commenced stability testing in October 2012 and it became partially available to researchers in early 2013. The initial cost of the upgrade was US$60 million, funded primarily by the United States Depart...

Travis

12:22

@JennyD For a period of time :)

tombull89

But will it run Crysis (3)?

Travis

@NathanC nogeekleftbehind.com/2010/11/11/…

ewwhite

You can't have dots in your A record name, right?

Dan

You wouldn't believe what I'm having to go through to build a VM right now

Aaron Copley

@tombull89 I bet that thing can mine the fcuk out of some bitcoins.

tombull89

12:23

@AaronCopley You'd have to mine a shit-ton of Bitcoins to get your $97 million back.

Aaron Copley

haha right?

Dan

I'm running a VMware Workstation VM, to run a VPN so I can RDP to a server. From there I'm RDPing to a server which runs their VSphere Client. I'm then using the console to build a VM. It's painful

2

Travis

How the hell does a bitcoin translate to real money?

ewwhite

@Dan rough

Journeyman Geek

@Travis: what people think its worth

Jenny D

12:24

@Travis Randomly

Dan

@Travis Same as any currency - because people are stupid enough to believe it :D

Journeyman Geek

same as any money

Travis

@JourneymanGeek Just like a stock I guess...

Aaron Copley

@Travis No idea. I am too old to understand it. But, I do know they use GPUs in parallel like this Titan.

Nathan C

@Dan so I heard you like RDP

Journeyman Geek

12:24

@Travis: or real money ;p

Travis

@JourneymanGeek Shush. Gonna take my vote for mod away from you now lol

Dan

@NathanC One hop, I do. This is a bit much :D

Jenny D

@Travis planetmoney.npr.org had some podcasts about bitcoin a while back, they were reasonably accurate as far as I could tell

Travis

@JennyD Thanks. Seen some info on slashdot but didn't read much into it. Looked more like a scam to me

gWaldo

@JennyD Actually, the computer components are very outdated. The procurement and processing and years of acceptance and safety testing pushes them well behind what is "current"

Journeyman Geek

12:25

@Travis: difference being of course, that real money is backed up by a government

Nathan C

Bitcoins are at a point now where it's worth the cost of electricity and such to mine...I still find them kinda meh though.

Journeyman Geek

but there's places where there's non 'government' legal tender

ewwhite

6

Q: Can I have dots in a hostname?

I'm using names like a.alpha for the hostname of my linux box, but it seams that these name are not completely usable. The response of a hostname shell command is correct (a.alpha). But the name printed after my user account is "user@a" instead of "[email protected]". When I use avahi, I can reach (b...

hostname linux-networking avahi

Journeyman Geek

scotland has its own pounds, not printed by the british government for example

Nathan C

You need a lottt of power to really make money off them, plus you'd just wear on your own components really.

Journeyman Geek

12:26

and in singapore we can use brunei dollars due to a interexchange treaty

Jenny D

@gWaldo Sure, but they move fast!

Travis

@NathanC Guess I need to understand bitcoins to understand your statement :)

Jenny D

@NathanC That's if you mine them. You can also buy and sell them.

gWaldo

@JennyD LOL; that they do...

Aaron Copley

@ewwhite Could he set ndots:2 to do what he wants?

Nathan C

12:28

@Travis mining bitcoins is basically munching hashes as fast as possible. In a sense, you can use it to benchmark if you really want to...

@JennyD True, but in that case you need money to make money :P

ewwhite

@AaronCopley see:

Jenny D

@NathanC I see bitcoins like buying shares in minor companies: it's a gamble, don't use money you're not prepared to lose; you may get lucky but don't count on it

ewwhite

6 mins ago, by ewwhite

I'm looking at the Network Solutions DNS zone for one of my clients... and I see:
capital.aca .productiveBLAH.com
baa.aca .productiveBLAH.com
dev .productiveBLAH.com

Nathan C

Plus I wouldn't want to invest in bitcoins as they stand right now.

Aaron Copley

Right... It would make every thing have 2 dots... Nevermind.

Dan

12:29

@ewwhite BLAH is a terrible name

ewwhite

It's clearly wrong to have that in a DNS zone, right?

Aaron Copley

I don't necessarily think so. Let me see if I can support it with a reference.

Travis

@NathanC Yeah, I did a quick Google to see how to mine them because I have a dormant server I could do it on that has 64GB of RAM and dual, 6 core processors

tombull89

@Travis You need GPUS too.

Travis

@tombull89 Don't have that...

Dan

12:32

@ewwhite On MS DNS it'll create a new subdomain and put your a record in there. I think, can't test it

Nathan C

Well, you don't need then per-say

They're just better at it then CPU grinding.

Travis

@NathanC Right, makes it faster

@NathanC You and I need to get back to work!

Nathan C

True story.

ewwhite

@Dan this is Networksolutions Public DNS

Dan

@ewwhite I don't know if it's stricly compliant, but I can't think of any reason it won't work unless you end up with a conflict

Scott Pack

12:36

The problem with using dots in your record is that it is the separator. It's a bit like asking, "Can I put commas in the fields of my CSV?"

SmallClanger

Afternoon all

Dan

@ScottPack Agreed, it's bad form

And it makes things unclear

Jenny D

@ScottPack except that DNS doesn't have quoting, so it's even worse

ewwhite

@ScottPack there's no subdomain

Scott Pack

@JennyD It's not a perfect example, but yes. :)

@ewwhite There is when you put a period in the name.

Jenny D

12:39

@ScottPack I spent an hour this morning discussing DNS with the guy who writes the dnscheck program. He gets questions like that way too often...

Aaron Copley

@Dan I think the only way you're going to have conflict though is if you actually expect the hostname to have the dot in it. If you understand that capital.aca with $ORIGIN productiveBLAH.com is really hostname capital then it's acceptable. It seems when BIND does AXFR to a slave it will set $ORIGIN "correctly" on the slave. Either way it will resolve. So, if it's done as a shortcut on the master to avoid creating a whole seperate zone file for 1 or 2 records, I see no problem.

Scott Pack

@JennyD On one hand, that must get tiresome. On the other hand, that's pretty cool to talk to guys like that.

Aaron Copley

Here is where they talk about the results after zone transfer. mentby.com/Group/bind-users/dots-in-hostnames-problem.html

Jenny D

@ScottPack It is cool, that's part of the reason I married him

Scott Pack

@JennyD At this point my best claim to fame is that my MS advisor is the author of tcptrace.

@JennyD I'm trying desperately to make a joke regarding children and glue records but it's just not happening.

Jenny D

12:41

@ScottPack I laughed anyway :-)

Scott Pack

I appreciate that. It's still rather early for me.

Jenny D

@ScottPack It's post-lunch coma time for me.

ewwhite

@AaronCopley Interesting. So it's valid?

I'm not sure whether to tell the client that it's wrong and should be corrected.

Dan

Why don't you just go for "Personally, I'd recommend you do [abc]" rather than outright say it's wrong

Jenny D

@ewwhite It's not exactly wrong, it's just that it may or may not work as they expect, depending on how various programmers have interpreted the RFCs

Travis

12:44

Anyone have a good guide that they used on securing certificate authorities?

(not just a google response..but one actually used)

Aaron Copley

@ewwhite It seems so. At least from an RFC and an "it works" stand point. But, it's a matter of scale and maintainability. Also, like that SF question postures. As long as you don't expect to be able to mail [email protected].

Nathan C

This is on superuser, but this guy's running a 680ti graphics card on a 650W power supply..

Scott Pack

My understanding was that periods are not permitted characters. I haven't looked at any of those RFCs since before unicode was allowed, so I may be out of date or misremembering.

Jenny D

@Travis We have one but I'm not sure I am allowed to give it out. I'll see if I can find something that's OK to be public with

Scott Pack

@Travis I'm pretty sure there's been a fair bit of chatter on that over at security.stackexchange.com

Aaron Copley

12:45

@ScottPack This isn't really putting a period in a hostname.

Scott Pack

@Travis SSL and CA stuff comes up quite often.

Jenny D

@ScottPack yeah, that's probably a better place to look

Travis

@JennyD Ok. @ScottPack: I'll search it. Thanks.

ewwhite

@AaronCopley Well, it's a website.

Aaron Copley

@ScottPack This is using a period in DNS to create a subdomain "on the fly."

The hostname itself cannot have a period in it, as far as I can tell.

Scott Pack

12:46

@AaronCopley Oh, so a subdomain but not a fully separate zone?

Jenny D

@Travis ejbca.org/security.html may be a little useful

Aaron Copley

@ScottPack Right! If you only have 3-4 DNS records that are hostname.dev or something, I think it's fine to keep them in the parent zone with a common $ORIGIN rather than setting up another zone file. But, if you expect that "dev" subdomain to grow, it might be better off to do it now rather than later?

Travis

@JennyD Cool

I'm not sure how really "insecure" it would be anyway since the only thing the CA is doing is providing a certificate for the firewall to do LDAPS queries

Jenny D

@Travis Also, it's not enough that the CA server itself be secure (which basically means it's locked in a cage, not reachable by the internet at large or even internal systems other than those absolutely necessary, not allowing even SSH logins, etc). The main issue is making sure that absolutely everything done by sysadmin, CAA, etc, is always logged and always traceable

@Travis Given that, scratch my latest screed. I was thinking of a CA made for really important purposes

Travis

@JennyD Not at the moment. I'm thinking if we go to a new ERP it may become useful for something though with user authentication and security

Scott Pack

12:51

@AaronCopley Ah, ok, I get it. We actually do quite a lot of that here. So, for example, it.example.com is the subdomain used for internal IT resources and is a fully separate zone. Then you'll have security.it.example.com for the security office, net.it.example.com for the Networks stuff, sysops.it.example.com for the SysAdmins stuff, etc. All of those still exist within the it.example.com zone.

Jenny D

@Travis In that case, cost/benefit analysis - what is the risk if it gets compromised, what is the cost of securing it further?

Travis

@JennyD Right. Really no risk if it is compromised. All it would do is prevent the firewall from performing LDAP queries to determine which user is using what service..

Scott Pack

@Travis Any time you want to look into hardening something you need to take a hard look at the actual risk profile of the system. You don't want to end up putting a $5000 padlock on a shed storing a $100 mower, for example.

Jenny D

@Travis It should be as secure as the ldap server that is trusting the certificates, then.

All of this is IMAO of course; but I've been setting up an internal CA actually used to give out credentials to banking customers, so our security requirements were very high...

Travis

@JennyD Yep! I'm all about security coming from the Dept. of Defense

@ScottPack Right

Aaron Copley

12:54

@ScottPack Right, but in your example the zone $ORIGIN would be example.com and the records security.it. net.it, and sysops.it. It's dirty when considering dozens of records. But, only a handful?

Jenny D

@Travis nod Same mindset, I would guess

Travis

This firewall is much more robust than what we had. Almost makes your head spin. Now I know why folks were talking about the complexity of setup

Scott Pack

@AaronCopley Well, in my example example.com would be a zone, it.example.com would be another zone, and the others would just be subdomains within the it zone. How messy that gets from a management environment I can't say. That's what the DNS guys are for. :)

@AaronCopley I do know that the arrangement works completely fine in both BIND and MS-DNS.

Aaron Copley

@ScottPack Oh, you were sayin those were zones, too. Got it.

ewwhite

Hmmm

Scott Pack

12:56

@AaronCopley Yeah, so not one monolithic zone for dozens of subdomains, each of which has handfuls of subdomains.

Aaron Copley

@ScottPack Yea, I see no problem for a handful of records. But, if you are part of a rapidly growing organization, you may want to go ahead and create a separate zone to save the trouble later.

ewwhite

@AaronCopley I just wanted to tell client that they were wrong... and use the internet to back me up!!

Aaron Copley

@ewwhite Sorry! If I agreed with you, I'd have to go make some changes to our own DNS! :X

Transcript for