DNS almost working
Hello All,
Thanks to this forum I got DNS working, well almost. We have Mac OS X Sever 10.5.2 and our configuration:
Primary Zone: example.com.
Nameservers: server.example.com.
Machine Name: server
IP Addr: 172.16.1.200
Added ISP's to Forwarder IP Address. Everything looks good; changeip, host and nslookup checkout. But I can't access our web server within the local network (www.example.com). So I tried adding the web server as follows:
Machine Name: www.example.com.
IP Addr: 172.16.2.200
In Safari, I can access it with www.example.com but not with example.com. Please help. How do I make both www.example.com and example.com work? What am I doing wrong?
Thank you so much.
dianne
Hello Leif and Jin,
I think it works now thanks to both of you! Instead of using an alias, I just added another record. So here is what I ended up with:
example.com. Primary Zone
server Machine 172.16.1.200
www Machine 172.16.2.200
example.com. Machine 172.16.2.200
Safari on the leopard server still can't find example.com but I tried nslookup/host/dig on the command line and they found it. Safari and Firefox on the client machines with tiger can find www.example.com as well as example.com.
To answer Leif's question, the leopard server and webserver are behind a firewall.
Please let me know if my setup above doesn't look good, I don't want to use it just because it works.
Thank you very much again.
Dianne
Similar Messages
-
I hit this problem at a customer site and can re-produce it in a simple lab. Lab environment: servers:
1x Server 2012 R2 DC and DNS server - DC1 - 10.0.0.1
1x Server 2012 R2 DirectAccess (DA) server - DA1 - 10.0.0.100
Servers are running "Update" (KB2919355) and following DA hotfixes:
KB2929930
KB2966087
I configured DA (via advanced wizard) as follows:
DA and remote access
AD group
directaccess-webprobehost DNA (A) record pointing to 10.0.0.100
behind an edge device (with a single network adapter)
SSL certificate from enterprise root CA issued to directaccess.contoso.com
NLS on remote server using https://nls.corp.contoso.com
DNS: corp.contoso.com = 10.0.0.1; nls.corp.contoso.com = ""
DNS suffix search list = corp.contoso.com
The DNS server validates successfully in the configuration UI.
With this configuration, I get a static IPv6 address of fd79:7a37:cbd9:3333::1/128 assigned to the NIC
The operations status is all green apart from DNS which displays the following error:
"DNS: Not Working Properly"
Error:
None of the enterprise DNS servers fd79:7a37:cbd9:7777::a00:1 used by DirectAccess clients for name resolution are responding. This might affect DirectAccess client connectivity to corporate resources.
Causes:
Enterprise DNS servers fd79:7a37:cbd9:7777::a00:1 are not responding.
I can, however ping fd79:7a37:cbd9:7777::a00:1 (which is the DNS64 translation of 10.0.0.1)
I would like to know what checks are failing as there are no failures in Event Viewer.
I have come across forums where people have the same issue and fix it by specifying the local IP (in this case 10.0.0.100) as the DNS server, however Richard Hicks has confirmed with me that the DNS server should be set to the DNS server, not the DA server's
IP.Thanks for the post Matt,
ISATAP has been disabled on my DA server, so the results of a "ROUTE PRINT -6" command yields:
===========================================================================
Interface List
12...00 15 5d 01 03 64 ......Microsoft Hyper-V Network Adapter
1...........................Software Loopback Interface 1
14...00 00 00 00 00 00 00 e0 IPHTTPSInterface
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
12 261 fd79:7a37:cbd9::/48 On-link
14 306 fd79:7a37:cbd9:1000::/64 On-link
14 306 fd79:7a37:cbd9:1000::/128 On-link
14 306 fd79:7a37:cbd9:1000::1/128 On-link
14 306 fd79:7a37:cbd9:1000::2/128 On-link
14 306 fd79:7a37:cbd9:1000:814c:28be:46b5:52c1/128 On-link
12 261 fd79:7a37:cbd9:3333::1/128 On-link
12 261 fd79:7a37:cbd9:7777::/96 On-link
12 261 fe80::/64 On-link
14 306 fe80::/64 On-link
12 261 fe80::20c0:e848:d304:9f01/128 On-link
14 306 fe80::814c:28be:46b5:52c1/128 On-link
1 306 ff00::/8 On-link
12 261 ff00::/8 On-link
14 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
If Metric Network Destination Gateway
0 4294967295 fd79:7a37:cbd9:1000::/64 On-link
0 4294967295 fd79:7a37:cbd9::/48 On-link
0 4294967295 fd79:7a37:cbd9:7777::/96 On-link
=========================================================================== -
Hello,
Since a couple of days I got DNS problems. (DNS not working properly). This started happening after a Windows update. I tried to deinstall all of them and see if that helped but it did not.
I'm quite inexperienced with this.
Hope someone can help out.
Regards,Hello,
is that in a domain or workgroup? Single machine only?
Please post an unedited ipconfig /all from the problem machine and also, if domain, from the DC/DNS server.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter: -
Custom renderer (almost works)
I'm creating a custom JComboBox renderer. What I want it to do is display text next to a colored box. Everything works except for the default value were its not showing the text. Anyone see the problem? Or is there a better way of doing this? Ive included the code below:
(Renderer Code: ComboBoxRenderer.java)
import java.awt.*;
import java.util.ArrayList;
import javax.swing.*;
class ComboBoxRenderer extends JLabel implements ListCellRenderer
String[] _textLabels = {"Red", "Green", "Blue", "Orange", "Yellow", "Cyan"};
private ArrayList _colors = null;
private JPanel _coloredBox = null;
private JPanel _container = null;
private JLabel _label = null;
public ComboBoxRenderer()
setOpaque(true);
setHorizontalAlignment(CENTER);
setVerticalAlignment(CENTER);
// Text container (can't get text to show without it being contained inside another jpanel. Why is this?)
_container = new JPanel();
Dimension holderSize = new Dimension(80, 20);
_container.setLocation(22, 0);
_container.setSize(holderSize);
_container.setOpaque(false);
_container.setLayout(new BorderLayout());
this.add(_container, BorderLayout.WEST);
// Text
_label = new JLabel("Disabled");
Dimension textSize = new Dimension(80, 20);
_label.setForeground(Color.black);
_label.setPreferredSize(textSize);
_label.setHorizontalAlignment(JTextField.LEFT);
_container.add(_label, BorderLayout.WEST);
// Colored box
_coloredBox = new JPanel();
Dimension preferredSize = new Dimension(16, 16);
_coloredBox.setLocation(2, 2);
_coloredBox.setSize(preferredSize);
_coloredBox.setOpaque(true);
this.add(_coloredBox, BorderLayout.WEST);
// Initialize color list
_colors = new ArrayList();
_colors.add(new Color(255, 0, 0));
_colors.add(new Color(0, 255, 0));
_colors.add(new Color(0, 0, 255));
_colors.add(new Color(255, 215, 0));
_colors.add(new Color(255, 255, 0));
_colors.add(new Color(0, 255, 255));
public Component getListCellRendererComponent(JList list, Object value, int index, boolean isSelected, boolean cellHasFocus)
// Get the selected index.
int selectedIndex = ((Integer)value).intValue();
// Set the background color for each element
if (isSelected) {
setBackground(list.getSelectionBackground());
setForeground(list.getSelectionForeground());
} else {
setBackground(list.getBackground());
setForeground(list.getForeground());
// Set text
String text = _textLabels[selectedIndex];
_label.setText(text);
_label.setFont(list.getFont());
// Set box
Color current = (Color) _colors.get(selectedIndex);
_coloredBox.setBackground(current);
return this;
}(Main: CustomComboBoxDemo.java)
import java.awt.*;
import javax.swing.*;
public class CustomComboBoxDemo extends JPanel
public CustomComboBoxDemo()
super(new BorderLayout());
// Combo list
Integer[] intArray = new Integer[6];
for (int i = 0; i < 6; i++) intArray[i] = new Integer(i);
// Create the combo box.
JComboBox colorList = new JComboBox(intArray);
ComboBoxRenderer renderer= new ComboBoxRenderer();
renderer.setPreferredSize(new Dimension(120, 20));
colorList.setRenderer(renderer);
colorList.setMaximumRowCount(5);
colorList.setSelectedIndex(2);
// Lay out the demo.
add(colorList, BorderLayout.PAGE_START);
setBorder(BorderFactory.createEmptyBorder(20,20,20,20));
private static void CreateAndShowGUI()
// Create and set up the window.
JFrame frame = new JFrame("CustomComboBoxDemo");
frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
// Create and set up the content pane
JComponent newContentPane = new CustomComboBoxDemo();
newContentPane.setOpaque(true);
frame.setContentPane(newContentPane);
// Display the window.
frame.pack();
frame.setVisible(true);
public static void main(String[] args)
//Schedule a job for the event-dispatching thread:
//creating and showing this application's GUI.
javax.swing.SwingUtilities.invokeLater(new Runnable() {
public void run() {
CreateAndShowGUI();
}Edited by: geforce2000 on Dec 13, 2009 3:37 AM
Edited by: geforce2000 on Dec 13, 2009 3:38 AMBeForthrightWhenCrossPostingToOtherSites
Here's one: [custom-renderer-almost-works|http://www.java-forums.org/awt-swing/23831-custom-renderer-almost-works.html]
Any others?
Next issue: TellTheDetails
You may understand fully just what is not working here, but we don't since you tell us that it doesn't work, but never really tell us how. -
Suspend almost working, input/output error after resume
Hi,
I have gotten suspend to ram almost working on my sony vaio sz 28 laptop. It resumes properly and I can use the terminal to list files for a while, but I cannot launch any programs, I get "input output error" It's like the machine cannot do anything new that wasn't started before the suspend. After a while some programs quits (nm-manager), because of I/O error, and then shutdown won't even finish. At first I tought the hard drive didn't work, but since I can list files in the terminal, that shouldn't be the problem.
Any ideas ?
My /etc/powersave/sleep contains
UNLOAD_MODULES_BEFORE_SUSPEND2RAM="prism54 ipw3945 i810 sky2 ath_pci "
and
SUSPEND2RAM_RESTART_SERVICES="ipw3945d networkcpufreq"
thanks,
SteinarI am running powersaved on a vaio c2z laptop with this config. Maybe it helps.
UNLOAD_MODULES_BEFORE_SUSPEND2RAM=""
SUSPEND2RAM_RESTART_SERVICES=""
SUSPEND2RAM_SWITCH_VT="yes"
Also you dont need to run the cpufreq service powersaved and the acpid can do this too. I disabled all of them and let the kernel
handel my cpufreq. The only thing iam doing is to tell the system on startup which govenour it should use by default, for me thats "conservative".
#!/bin/bash
# /etc/rc.local: Local multi-user startup script.
cpufreq-set -c 0 -g conservative
cpufreq-set -c 1 -g conservative
If i need another one i can adjust that via the terminal (cpufreq-set or via direct echo in /sys) or gnomes cpufreq applet.
For using the kernel handler correctly you have modify these entries
1. in /etc/powersave/cpufreq to prevent powersaved from setting cpufreq.
CPUFREQ_ENABLED="no"
2. in /etc/acpi/handlers.sh to prevent acpid from setting corespeed back to kernels default govenour (mostly performance) after returning from suspend.
ac_adapter)
case "$2" in
AC)
case "$4" in
00000000)
echo -n $minspeed >$setspeed <--- add a # before this command
#/etc/laptop-mode/laptop-mode start
00000001)
echo -n $maxspeed >$setspeed <--- add a # before this command
#/etc/laptop-mode/laptop-mode stop
esac
*) logger "ACPI action undefined: $2" ;;
esac
Have fun -
WiFi problem - No internet / DNS Not working
Hi,
I installed 64bit Windows 7 on my T500, and I'm having problems when connecting to wireless networks.
Everything works fine with wired networks, but when I connect to a wireless network (any wireless network) DNS isnt working.
I can ping and connect to websites using IP, but it refuses to resolve domain names. I have verified that the correct DNS servers are beeing used.
I have installed all the drivers supplied by Lenovos system update + some beta drivers from http://www-307.ibm.com/pc/support/site.wss/WIN7-BETA.html, but at this time I'm no longer sure what drivers are beta and whats release.
Software & drivers installed:
Access Connections version 5.42 build 6JC725WW
Realtek 11b/g/m Wireless LAN Mini-PCI Express Adapter II (driver version 2007.2.1103.2009)
Microsoft Virtual WiFi Miniport Adapter (driver version 6.1.7600.16385
Anyone know what this could be?
Thanks,
Trygve
Solved!
Go to Solution.I have had this happen now on three seperate Lenovo laptops. They are the 4446-25U model. This is the THIRD time that this exact same problem has manifested in this model of laptop. I am in a corporate environment and all systems are joined to the domain.
All are running the XP Pro downgrade. All will ping both internal and external IP addresses, but will not resolve the domain name (neither internal or external). All were working fine, then suddenly began with this issue that I have so far been unable to resolve. I cannot see that any software has been installed to create a Layered Service Provider issue which seems to be the only thing that matches symptoms with what I am seeing according to MS. Previously when the the first laptop did this about 3 mos ago, I restored it using the Vista restore discs, and had to forego the XP Pro downgrade. I didn't have time to tinker with it, so I just restored it with Vista and went on. I have now seen two more inside of a week with exactly the same issue. DNS does not work. DNS services have been stopped and re-started, DNS has been both statically assigned, as well as handled by DHCP, new user account created, all unneccesary software removed, and several other seemingly un-related things changed around to see if anything would work, and I cannot get DNS to resolve names.
If anyone has seen this issue please post here. I think it's odd that this has happened now three times on three seperate laptops of the same model. I've seen screwy DNS problems before, but I think I can remember one or maybe two times in my career that DNS just refused to work for no rhyme or reason, and now I've seen two in a week!! -
Noticed today that reverse DNS is no longer working for our (10) VMs. It was yesterday and had been for several weeks.
I removed and re-added one of them. Waited for over an hour and still not resolving.
PS C:\Windows\system32> Get-AzureService "emvpodeast2"
ServiceName : EMVPodEast2
Url : https://management.core.windows.net/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/services/hostedservices/EMVPodEast2
Label : EMVPodEast2
Description : emvpodeast2 with Reverse DNS
Location : East US
AffinityGroup :
Status : Created
ExtendedProperties : {[ResourceGroup, EMVPodEast2], [ResourceLocation, East US]}
DateModified : 12/23/2014 10:32:34 AM
DateCreated : 9/2/2014 7:44:55 PM
ReverseDnsFqdn : fathersonholyghosttown.com.
WebWorkerRoleSizes : {}
VirtualMachineRoleSizes : {}
OperationDescription : Get-AzureService
OperationId : xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
OperationStatus : Succeeded
PTR Check:
http://mxtoolbox.com/SuperTool.aspx?action=ptr%3a191.238.18.70&run=toolpageI'm having the exact same issue here.
There were no IP changes. Reverse DNS was working until it wasn't anymore. We noticed it on the 22nd December when about 400 e-mails were refused from our newsletter because there was no reverse DNS.
Tried reconfiguring like SIRob45 but to no avail.
PS C:\> Get-AzureService "assistimo"
ServiceName : assistimo
Url :
https://management.core.windows.net/cac66cff-7d19-41a7-a012-e2197e145d36/services/hostedservi
ces/assistimo
Label : assistimo
Description : S4 reverse DNS
Location : North Europe
AffinityGroup :
Status : Created
ExtendedProperties : {[ResourceGroup, assistimo], [ResourceLocation, North Europe]}
DateModified : 24/12/2014 17:33:26
DateCreated : 14/11/2014 13:50:26
ReverseDnsFqdn : s4.assistimo.pt.
WebWorkerRoleSizes : {}
VirtualMachineRoleSizes : {}
OperationDescription : Get-AzureService
OperationId : 670e5f9b-206d-5b41-a3c7-f5acf5f89fcd
OperationStatus : Succeeded
Results from
http://mxtoolbox.com/SuperTool.aspx?action=ptr%3a191.235.218.152&run=toolpage:
ptr:191.235.218.152
No ptr Records exist
History results:
Type
IP Address
Domain Name
TTL
PTR
191.235.218.152
assistimo.cloudapp.net
1 min
smtp diag
blacklist
port scan
subnet tool
Reported by PRD2.AZUREDNS-CLOUD.NET on 12/1/2014 at 11:15:54 AM (UTC -6),
just for you. (History) Transcript
Session Transcript:
MXTB-PWS3v2 468ms
0 f.in-addr-servers.arpa 193.0.9.1 NON-AUTH 109 ms Received 8 Referrals , rcode=NO_ERROR NS tinnie.arin.net,NS ns-lacnic.nic.mx,NS ns3.afrinic.net,NS ns.lacnic.net,NS
sec1.authdns.ripe.net,NS sec3.apnic.net,NS a.arpa.dns.br,NS ns2.lacnic.net,
1 tinnie.arin.net 199.212.0.53 NON-AUTH 31 ms Received 5 Referrals , rcode=NO_ERROR NS PRD1.AZUREDNS-CLOUD.NET,NS PRD5.AZUREDNS-CLOUD.NET,NS PRD3.AZUREDNS-CLOUD.NET,NS
PRD4.AZUREDNS-CLOUD.NET,NS PRD2.AZUREDNS-CLOUD.NET,
2 PRD2.AZUREDNS-CLOUD.NET 65.55.117.43 AUTH 46 ms Received 1 Answers , rcode=NO_ERROR PTR assistimo.cloudapp.net,
We have no support contract and cannot submit a support request as suggested.
Thank you in advance.
Carlos R. Calado -
Applescript to open URL in Safari without titlebar...almost working :-)
Hi guys,
I'm trying to open an URL in Safari with applescript, and i don't want any toolbar in the opened window, actually this code almost works but it open 2 windows as the javascript is executed from document 1
I use Javascript because i dont want to have any modifications of Safari preferences, so when i close it and reopen it should not have the toolbar hidden.
<pre class="jive-pre">tell application "Safari"
activate
tell document 1
do JavaScript ("window.open('http://www.google.com','_blank','titlebar=0');")
end tell
end tell</pre>
Does anybody knows a way to make this work or to open a window without the toolbars ?? I've tried different things but i'm stuck, so any help appreciated.
Thanks by advance,
MaxThis is about the best you're going to do using JavaScript...
<pre style="width:630px;height:auto;overflow-x:auto;overflow-y:hidden;"
title="Copy this code and paste it into your Script Editor application.">tell application "Safari"
activate
set theURL to URL of document 1
set windowID to id of window 1
do JavaScript ("window.open('" & theURL & "','_blank','titlebar=0');") in document 1
close window id windowID
end tell</pre>
The above script opens a new window with the current document's url and then closes the original window. As far as I've read you cannot get JavaScript to act upon the current window.
Hope this helps at least a little... -
I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root: myname
admin: myname
sysadmin: myname
certadmin: myname
webmaster: myname
my_alternate: myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080 # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost # Default is localhost
REMOTEPORT_DEFAULT=3128 # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
-p) shift; # -p option
SSHPORT=$1;
shift;;
*) TUNNEL_DETAILS=$1; # 1st argument option
shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])} # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*} # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%@} # delete @
if [ "$CAR" != "" ] # leading or trailing port specified
then
USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ] # no hostname given
then
HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
&& echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
|| echo "SSH tunnel FAIL." -
DNS not working for some computers
We have a SRP521W router and is set up with one SSID for wireless. In our office all the computers (5) can connect but only some may get on the internet. I have a laptop I am testing with and it will not connect, wired or wireless.
I found an article relating to flushing DNS, tried that, no luck.
I found another that said I should try setting my DNS to 208.67.222.222 and this worked, internet works fine.
I tried rebooting the DSL modem and router, tried many different things but am not a networking guru so I am just not sure why the DNS is not working for one computer but works for another, connected to same LAN or SSID.
Thanks,
BradThough what Don posted is one way to accomplish it, I never add anything to my DNS and it works fine. Windows DNS, in a default installation, will automatically forward to the root (.com, .edu, .gov, etc.). So I always just point my workstations
to my Domain Controller as their DNS and everything works just fine without any additional configuration.
Guess I'm one of those who won't even trust Google for sharing a DNS, particularly when I have never needed to set up any forwarders.
.:|:.:|:. tim -
Quantum Gateway Router - Local DNS not working
I just installed the Quantum Gateway Router, and I can't seem to get local DNS (i.e. user defined DNS entries) to work correctly. I'm able to make user-defined entries under Advanced->DNS Server, but the when I attempt to ping the entries, from any machine on my LAN/WLAN, the entries are not resolved. Has anyone else run into this problem?
Thanks in advance!
Solved!
Go to Solution.That is correct. that would be the address for the dns resolver that is handed out for dhcp connections.
You may want to check that your router is actually getting dns server addresses for use with it's dhcp connection from the wan.
Log into the router
select My Network
Select Network Connections
select Network (home/office)
Halfway down the page see the dns server line
if it says no dns server then it should default to the dns servers provided the wan connection.
you can override the values here by
selecting the drop down value use the following dns servers
then you can 2 values in the fields that appear - typically opendns or google servers.
To see the dns servers that came with the wan dhcp connection
select My Network
Select Network Connections
Select broadband connection
halfway down the page are the dns values
These can be over ridden too by
Selecting settings and then selecting the -
Network ... almost working but not for all adresses[RESOLVED]
Hi,
I have a very weird matter since a few weeks. (can't figure out if it's due tu an update or what).
I'm currently writing from my arch laptop : so you may say my network works fine.
Exept, it only works with some sites.
I mean : I cannot access http://www.archlinux.fr/ for exampe, or many other, whereas other work juste fine.
(by "access" I mean : use a browser to see the page.)
This happens :
- on Wifi
- on linked network
- with chromium or firefox
On the other hand : ping and traceroute works fine for these otherwise unreachable adresses.
Weirder still : if I reboot on another OS, everything works flawlessly.
Another PC linked to the same broadband router will show no problem either.
Accessing the "cache" version of sites from g**gle page shows results.
I tried reboot, network restart ... now I dont' know what to try.
Here's my hardware : Laptop is Lenovo Y510
03:00.0 Network controller: Intel Corporation PRO/Wireless 3945ABG [Golan] Network Connection (rev 02)
04:00.0 Ethernet controller: Broadcom Corporation NetLink BCM5906M Fast Ethernet PCI Express (rev 02)
kernel 2.6.32-ARCH
in one word : Help ! ;-)
Last edited by skai (2010-01-09 12:09:16)Hmm, seems I solved it by tweeking with the broadband router.
(I fed it with a backup DNS, and reactivated DoS firewall)
Does neither explain why another PC worked well alongside this one,
nor why another OS gave other results.
Maybe just a broadband router inconsistency, anyway, l'll consider this fixed for now. -
Hi!
I'm running arch64 on my Thinkpad x220 and have a strange problem here.
Sometimes DNS just stops working, to rule out a bad Server I tried it with the one of Google:
dig @8.8.8.8 archlinux.puzzle.ch
On Archlinux dig tells me that no servers could be reached, although I can successfully ping 8.8.8.8.
Running MacOSX on another machine in the same network, dig gives me back the matching a-record.
This usually lasts from a few minutes up to about two hours, only on archlinux. Does somebody have any idea on this?
Last edited by simt (2011-12-22 18:39:27)You are right, the manpage says 'dig @server query' but it seems to work either way. Maybe you can try 'tcptraceroute 8.8.8.8 53', it will probe tcp port 53 directly, although not the same as a "normal" dns query that will use udp [1] it will be quite close.
[1] http://en.wikipedia.org/wiki/Domain_Nam … ol_details -
I'm trying to set up a leopard home server and have rebuilt it several times now trying toiget the mail service to work correctly.
I will no doubt omit lots of necessary information but please bear with me
I have a registered domain and a static ip. My ISP supplies a broadband modem which just acts as a bridge to my own wireless router. I have done what I understand to be the required port forwarding - 21, 25, 80 & 110.
I have DNS at the ISP but have also set up DNS internally since I couldn't get anything to work without it!
Whilst I can send mail from the server my users can only send to the outside & receive no mail from inside or out.
The SMTP since the last restart:-
Feb 24 17:56:19 merlin postfix/master[37]: daemon started -- version 2.4.3, configuration /etc/postfix
Feb 24 18:08:53 merlin postfix/smtpd[282]: connect from demokritos5.cytanet.com.cy[195.14.130.179]
Feb 24 18:08:54 merlin postfix/smtpd[282]: NOQUEUE: reject: RCPT from demokritos5.cytanet.com.cy[195.14.130.179]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<demokritos5.cytanet.com.cy>
Feb 24 18:08:54 merlin postfix/smtpd[282]: disconnect from demokritos5.cytanet.com.cy[195.14.130.179]
Feb 24 18:12:14 merlin postfix/anvil[284]: statistics: max connection rate 1/60s for (smtp:195.14.130.179) at Feb 24 18:08:53
Feb 24 18:12:14 merlin postfix/anvil[284]: statistics: max connection count 1 for (smtp:195.14.130.179) at Feb 24 18:08:53
Feb 24 18:12:14 merlin postfix/anvil[284]: statistics: max cache size 1 at Feb 24 18:08:53
Feb 24 18:12:16 merlin postfix/smtpd[317]: connect from demokritos3.cytanet.com.cy[195.14.130.227]
Feb 24 18:12:16 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from demokritos3.cytanet.com.cy[195.14.130.227]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<demokritos3.cytanet.com.cy>
Feb 24 18:12:16 merlin postfix/smtpd[317]: disconnect from demokritos3.cytanet.com.cy[195.14.130.227]
Feb 24 18:12:46 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:12:46 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from unknown[213.149.189.165]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.4]>
Feb 24 18:12:47 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:12:58 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:12:59 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from unknown[213.149.189.165]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.4]>
Feb 24 18:12:59 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:13:28 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:13:29 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from unknown[213.149.189.165]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.4]>
Feb 24 18:13:29 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:14:09 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:14:09 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from unknown[213.149.189.165]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.4]>
Feb 24 18:14:09 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:14:20 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:14:20 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:15:50 merlin postfix/smtpd[317]: connect from unknown[213.149.189.165]
Feb 24 18:15:50 merlin postfix/smtpd[317]: NOQUEUE: reject: RCPT from unknown[213.149.189.165]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.4]>
Feb 24 18:15:50 merlin postfix/smtpd[317]: disconnect from unknown[213.149.189.165]
Feb 24 18:19:10 merlin postfix/anvil[318]: statistics: max connection rate 3/60s for (smtp:213.149.189.165) at Feb 24 18:13:28
Feb 24 18:19:10 merlin postfix/anvil[318]: statistics: max connection count 1 for (smtp:195.14.130.227) at Feb 24 18:12:16
Feb 24 18:19:10 merlin postfix/anvil[318]: statistics: max cache size 2 at Feb 24 18:12:46
Feb 24 18:20:09 merlin postfix/smtpd[376]: connect from merlin.2ndwivesclub.eu[192.168.1.2]
Feb 24 18:20:09 merlin postfix/smtpd[376]: 4D4ED8123E: client=merlin.2ndwivesclub.eu[192.168.1.2]
Feb 24 18:20:09 merlin postfix/cleanup[378]: 4D4ED8123E: message-id=<[email protected]>
Feb 24 18:20:09 merlin postfix/qmgr[100]: 4D4ED8123E: from=<[email protected]>, size=583, nrcpt=1 (queue active)
Feb 24 18:20:15 merlin postfix/smtpd[385]: connect from localhost[127.0.0.1]
Feb 24 18:20:15 merlin postfix/smtpd[385]: B202081265: client=localhost[127.0.0.1]
Feb 24 18:20:15 merlin postfix/cleanup[378]: B202081265: message-id=<[email protected]>
Feb 24 18:20:15 merlin postfix/qmgr[100]: B202081265: from=<[email protected]>, size=1037, nrcpt=1 (queue active)
Feb 24 18:20:15 merlin postfix/smtpd[385]: disconnect from localhost[127.0.0.1]
Feb 24 18:20:15 merlin postfix/smtp[386]: B202081265: to=<[email protected]>, relay=none, delay=0.05, delays=0.02/0.03/0/0, dsn=5.4.6, status=bounced (mail for 2ndwivesclub.eu loops back to myself)
Feb 24 18:20:15 merlin postfix/cleanup[378]: CBEAD81267: message-id=<[email protected]>
Feb 24 18:20:15 merlin postfix/qmgr[100]: CBEAD81267: from=, size=2928, nrcpt=1 (queue active)
Feb 24 18:20:15 merlin postfix/bounce[387]: B202081265: sender non-delivery notification: CBEAD81267
Feb 24 18:20:15 merlin postfix/qmgr[100]: B202081265: removed
Feb 24 18:20:15 merlin postfix/smtp[386]: CBEAD81267: to=<[email protected]>, relay=none, delay=0.02, delays=0.01/0/0/0, dsn=5.4.6, status=bounced (mail for 2ndwivesclub.eu loops back to myself)
Feb 24 18:20:15 merlin postfix/qmgr[100]: CBEAD81267: removed
Feb 24 18:20:15 merlin postfix/smtp[379]: 4D4ED8123E: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.7, delays=0.2/0.13/0.4/6, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as B202081265)
Feb 24 18:20:15 merlin postfix/qmgr[100]: 4D4ED8123E: removed
Feb 24 18:21:09 merlin postfix/smtpd[376]: disconnect from merlin.2ndwivesclub.eu[192.168.1.2]
And conf:-
merlin:~ alf$ postconf -n
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
debugpeerlevel = 2
enableserveroptions = yes
html_directory = no
inet_interfaces = all
localrecipientmaps =
luser_relay = postmaster
mail_owner = _postfix
mailboxsizelimit = 0
mailbox_transport = cyrus
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
messagesizelimit = 10485760
mydestination = $myhostname,localhost.$mydomain,localhost
mydomain = 2ndwivesclub.eu
mydomain_fallback = localhost
myhostname = mail.2ndwivesclub.eu
newaliases_path = /usr/bin/newaliases
queue_directory = /private/var/spool/postfix
readme_directory = /usr/share/doc/postfix
relayhost =
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtpdpw_server_securityoptions = none
smtpdrecipientrestrictions = permitmynetworks,reject_unauthdestination,permit
smtpduse_pwserver = no
unknownlocal_recipient_rejectcode = 550
merlin:~ alf$
And a rejection notice.
Some help would be really appreciated.
Cheers.
JohnAdd 2ndwivesclub.eu to local host aliases in Server Admin -> Mail -> Settings -> Advanced -> Hosting
-
Https ssl config Oracle AS, webcache, portal...almost works
Hi,
I have searched the forums and I havent found anything that works for me.
I have Oracle infrastructure on one server, and Oracle App server/portal on another server. I can get as far as the http server showing the "welcome to oracle" page in https form. When I try to access a page in the portal (plsql) I get a blank page. It does convert the "https://myserver:xxxx//pls/portal/url/page/IRWEB/HOME
" to "https://myserver:xxxx/portal/page?_pageid=73,86254,73_86264:73_86316:73_8632...." but nothing comes up.
Also, it uses the Infrastructure server for single-sign-on...so I need to make the app server do the single sign-on. I've tried by adding /pls/orasso entry in DADS.conf of http server..
So as far as I can tell...the http server IS operating in https/ssl, but the single-sign-on and the pages in the portal are not.
I have to do everything manually since I am using 10.1.2 (no Oracle Collab Suite installed, so no SSLConfigTool and other assistants)
Here is what I've done to get https://myserver:xxxx/ to come up ok.
server 1: Oracle Infrastructure and Oracle database release 1 10.1.2.0.0
server 2: Oracle Application Server / Portal with webcache release 2 10.1.2
using Oracle Wallet for certificate,
http server -> process management "ssl-enabled",
http server -> advanced -> ssl.config: SSLWallet file:, SSLWalletPassword, virtual host for ssl
webcache -> added settings for ssl (I used the current entries for non-ssl as a guide for the ssl entries)
Interesting issue...with the ports in the ssl.conf file example:
Port 4459
Listen 4459
VirtualHose myserver.blah.edu:4450
Port 4458
When I get the blank page trying to use ssl and 4459, I can manually change the url in my browser to 4458 (or maybe its the other way around) and get this message: "Error: The portlet could not be contacted"
Is this a problem with webcache? Do I have to do any ssl config on the server with the database?
I've even tried disabling the webcache, both with the oracle sql script and through web interface but neither made a difference...same problem.
Any help would be greatly appreciated..I feel as if I'm almost there.
If I did not post enough info for accurate help, please ask what you need to know to provide help! Thanks in advance.Hi,
Yes you can go for SSl configuration without re-installing any of the components.
Regards,
access_tammy
Maybe you are looking for
-
After i download web page, the downloads window in firefox 3.6.9 is blank
why is the downloads window in firefox 3.6.9 blank after i download a file or web page? all of my downloads are directed to the "downloads" folder on my desktop [which i selected from ere i placed it]. i've tried many suggestions from contributors, m
-
After I upgraded to Yosemite my isight webcam is always too dark. If before on photo booth the image was clear even if there was a bit of light now it doesn't...even on skype is the same...is there some way to fix it? My macbook pro is a mid 2014...n
-
A french question about a login
-
I can't get into iTunes music store at all. It's just a blank page that says the music store may be busy, check my internet connection. Also I no longer receive information from iTunes on new releases Tuesdays. It's like they're mad and don't want to
-
I'm asked to register every time I start CS2?
Hello. Every time I open CS2 it asks me to register, I do, and then it happens again each time. What am I doing wrong? Thank you for your time. Kind regards, Cindy