主页 / user-485497

maar's questions

Martin Hope
maar
Asked: 2021-07-24 00:37:20 +0800 CST
  • 0

我在新安装的 PfSense 系统中没有互联网连接。
脚步：

  1. 我用 Ubuntu 创建了 OVH 实例并安装了mfsbsd图像。
  2. 开机后mfsbsd也有网络问题。根本无法下载任何东西或ping。
  3. 我使用本地网络通过 SSH 复制了 PfSense 图像。
  4. 我用UFS BIOS option.
  5. 使用 OVH 控制台，我可以看到 PfSense 在重新启动后正确启动。我还使用同一本地网络中的其他服务器（http://192.168.10.22/ --> https://pfsense.domain.com/）在 nginx 上配置了反向代理。之后我可以通过pfsense.domain.comURL 访问 GUI，但登录后出现错误，我无法在 UI 中执行任何操作：

检测到 HTTP_REFERER 未在系统 > 高级 ( https://pfsense.domain.com/ ) 中定义。如果不需要，可以在系统 > 高级 > 管理员访问中禁用此检查。

  1. 使用控制台登录到 PfSense 服务器后，我注意到还有网络连接问题。
  2. 一些输出：
[2.5.2-RELEASE][[email protected]]/root: ifconfig
    vtnet0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
            options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
            ether xx:xx:xx:xx:xx:xx
            inet6 xxxx::xxxx:xxxx:xxxx:xxxx%vtnet0 prefixlen 64 scopeid 0x1
            inet 123.123.123.123 netmask 0xffffffff broadcast 123.123.123.123
            media: Ethernet 10Gbase-T <full-duplex>
            status: active
            nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
    vtnet1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
            options=800b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,LINKSTATE>
            ether xx:xx:xx:xx:xx:xx
            inet6 xxxx::xxxx:xxxx:xxxx:xxxx%vtnet1 prefixlen 64 scopeid 0x2
            inet 192.168.10.22 netmask 0xffffff00 broadcast 192.168.10.255
            media: Ethernet 10Gbase-T <full-duplex>
            status: active
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    enc0: flags=0<> metric 0 mtu 1536
            groups: enc
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
            options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
            inet6 ::1 prefixlen 128
            inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
            inet 127.0.0.1 netmask 0xff000000
            groups: lo
            nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
    pflog0: flags=100<PROMISC> metric 0 mtu 33160
            groups: pflog
    pfsync0: flags=0<> metric 0 mtu 1500
            groups: pfsync

[2.5.2-RELEASE][[email protected]]/root: netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
123.123.123.123    link#1             UHS         lo0
123.123.123.123/32 link#1             U        vtnet0
127.0.0.1          link#4             UH          lo0
192.168.10.0/24    link#2             U        vtnet1
192.168.10.22      link#2             UHS         lo0
213.186.33.99      xx:xx:xx:xx:xx:xx  UHS      vtnet0

Internet6:
Destination                       Gateway                       Flags     Netif Expire
::1                               link#4                        UH          lo0
fe80::%vtnet0/64                  link#1                        U        vtnet0
fe80::xxxx:xxxx:xxxx:xxxx%vtnet0  link#1                        UHS         lo0
fe80::%vtnet1/64                  link#2                        U        vtnet1
fe80::xxxx:xxxx:xxxx:xxxx%vtnet1  link#2                        UHS         lo0
fe80::%lo0/64                     link#4                        U           lo0
fe80::1%lo0                       link#4                        UHS         lo0

[2.5.2-RELEASE][[email protected]]/root: ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
ping: sendto: No route to host

[2.5.2-RELEASE][[email protected]]/root: ping serverfault.com
ping: cannot resolve serverfault.com: Host name lookup failure
  1. 我检查了/etc/defaults/rc.conf和选项defaultrouter并gateway_enable设置为NO. 我将它们更改为YES，但重新启动后没有帮助。
networking freebsd pfsense
Martin Hope
maar
Asked: 2021-06-29 00:30:27 +0800 CST
  • 0

我正在测试 repmgr 工具，我有点困惑。一切都很好，直到standby register步骤。

我应该在standby服务器上配置什么？从文档中我认为不standby应该有集群，但它没有配置新的集群。当postgres集群存在时repmgr，现有数据存在问题。当我将停止集群服务并手动删除数据并从repmgr启动集群后运行迁移时出现错误：

postgres@ip-10-0-34-147:~$ /usr/lib/postgresql/13/bin/pg_ctl -D /var/lib/postgresql/13/main start
waiting for server to start....postgres: could not access the server configuration file "/var/lib/postgresql/13/main/postgresql.conf": No such file or directory
 stopped waiting
pg_ctl: could not start server
Examine the log output.

它正在运行Ubuntu，但可能更适用Debian。但我仍然不知道如何使它正确。

sql postgresql postgresql-replication
Martin Hope
maar
Asked: 2019-05-28 05:24:19 +0800 CST
  • 3

问题：

当站点无法访问时触发立即发送电子邮件。

系统：

Linux Debian Stretch，Zabbix 4.2.1。

Web场景的当前配置：

Scenario: 
Name: website.com 
Update interval: 30s 
Attempts: 3 
Agent: Zabbix

Steps: 
(just one) 
Name: website.com 
URL: http://website.com/page.php
Follow redirects: checked 
Timeout: 30s

（其余不变）

触发器的当前配置：

Name: The website.com can't be reached!
Expression: {VIRTUALMACHINE:web.test.fail[website.com].last(3m)}>0

（其余不变）

解释

如果站点在 3 分钟内无法访问（或最后 3 次检查，每次检查超时 30 秒），触发器必须发送电子邮件。我试图以多种方式进行（如下*），但是当 zabbix 第一次检测到问题时（而不是第 n 次尝试），我尝试的每个触发表达式都会立即发送电子邮件通知。

*
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3m)}<>0
{VIRTUALMACHINE:web.test.rspcode[website.com,website.com].last(0)}#200
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}#0
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].min(1)}>0

如果您给出答案，请解释一下。随意问。

monitoring
Martin Hope
maar
Asked: 2018-09-12 04:43:14 +0800 CST
  • 1

下面更新

________________

我决定使用 HAProxy 作为 SharePoint 网站的反向代理，没有 SSL 一切正常，但使用 SSL 我无法启动 haproxy.service。我尝试了许多配置，但我无法弄清楚......

尝试启动服务：

$ sudo systemctl start haproxy.service
Job for haproxy.service failed because the control process exited with error code.
See "systemctl status haproxy.service" and "journalctl -xe" for details.

haproxy.service 的状态：

$ sudo systemctl status haproxy.service
     haproxy.service - HAProxy Load Balancer
       Loaded: loaded (/lib/systemd/system/haproxy.service; enabled; vendor preset: enabled)
       Active: failed (Result: exit-code) since date CEST;
         Docs: man:haproxy(1)
               file:/usr/share/doc/haproxy/configuration.txt.gz
      Process: ExecStart=/usr/sbin/haproxy-systemd-wrapper -f $CONFIG -p $PIDFILE $EXTRAOPTS (code=exited, status=0/SUCCESS)
      Process: ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=1/FAILURE)
     Main PID: (code=exited, status=0/SUCCESS)
 systemd[1]: haproxy.service: Failed with result 'exit-code'.
 systemd[1]: haproxy.service: Service hold-off time over, scheduling restart.
 systemd[1]: Stopped HAProxy Load Balancer.
 systemd[1]: haproxy.service: Start request repeated too quickly.
 systemd[1]: Failed to start HAProxy Load Balancer.
 systemd[1]: haproxy.service: Unit entered failed state.
 systemd[1]: haproxy.service: Failed with result 'exit-code'.
 systemd[1]: haproxy.service: Start request repeated too quickly.
 systemd[1]: Failed to start HAProxy Load Balancer.
 systemd[1]: haproxy.service: Failed with result 'exit-code'.

检查配置文件问题：

$ sudo haproxy -c -f haproxy.cfg
    Enter PEM pass phrase:
    [ALERT]: parsing [haproxy.cfg:31] : 'bind *:443' : unable to load SSL private key from PEM file './cert.pem'.
    [ALERT]: Error(s) found in configuration file : haproxy.cfg
    [ALERT]: Proxy 'http_id': no SSL certificate specified for bind '*:443' at [haproxy.cfg:31] (use 'crt').    
    [ALERT]: Fatal errors found in configuration.

HAProxy -vv：

$ sudo haproxy -vv
HA-Proxy version 1.7.5-2

Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.8
Running on zlib version : 1.2.8
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with OpenSSL version : OpenSSL 1.1.0e
Running on OpenSSL version : OpenSSL 1.1.0f
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports prefer-server-ciphers : yes
Built with PCRE version : 8.39
Running on PCRE version : 8.39
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with Lua version : Lua 5.3.3
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with network namespace support

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available filters :
        [COMP] compression
        [TRACE] trace
        [SPOE] spoe

日志：

 haproxy: [ALERT]: parsing [/etc/haproxy/haproxy.cfg:31] : 'bind *:443' : unable to load SSL certificate file './cert.pem' file does not exist.
 haproxy: [ALERT]: Error(s) found in configuration file : /etc/haproxy/.cfg
 haproxy: [ALERT]: Proxy 'http_id': no SSL certificate specified for bind '*:443' at [/etc/haproxy/haproxy.cfg:31] (use 'crt').
 haproxy: [ALERT]: Fatal errors found in configuration.

我在另一台服务器上为 nginx 使用相同的证书（但分为：证书、密钥、链），它可以工作。我用命令为 HAProxy 创建了这个cat cert.crt priv.key certchain.crt > cert.pem，我尝试了不同的顺序，但错误是一样的。命令haproxy -c -f haproxy.cfg服务器也询问密码，所以我认为证书没问题（也许我错了）并且配置文件有问题。感谢您的时间和帮助。

我的 haproxy.cfg：

    global    
        tune.ssl.default-dh-param 2048
        maxconn 4096
        user haproxy
        group haproxy
        daemon
        #ssl-server-verify none
    
    defaults
        mode http
        option forwardfor
        log 127.0.0.1 local0 notice
        maxconn 2000
        option httplog
        option dontlognull
        timeout connect 5000
        timeout client 50000
        timeout server 50000
            
    backend sharepoint
        mode http
        #balance roundrobin
        option redispatch
        cookie SERVERID insert nocache
        server spsrv xxx.xxx.xxx.xxx:80
            
    frontend http_id
        #bind *:80
        bind *:443 ssl crt ./cert.pem
        mode http
        reqadd X-Forwarded-Proto:\ https
        acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com:443
        use_backend sharepoint if hosts_sharepoint
        default_backend sharepoint

第一次更新

我尝试了直通，现在 SharePoint 在端口 80 上请求凭据（在禁用 IIS 角色之后），然后 SharePoint 重定向到 https 并出现错误“504 网关超时”。这是我当前的 haproxy.cfg：

global
    maxconn 4096
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m
frontend httpid
    mode tcp
    bind *:443
    acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com
    use_backend sharepoint if hosts_sharepoint
    default_backend sharepoint
backend sharepoint
    mode tcp
    balance roundrobin
    option redispatch
    cookie SERVERID insert indirect nocache
    server st1 xxx.xxx.xxx.xxx:443
    option ssl-hello-chk

同样 command: $ curl xxx.xxx.xxx.xxx:**80** --header 'Host: sharepoint.intranet.com' -vv返回 401 ，因此连接正常，但是带有端口 443 的命令$ url xxx.xxx.xxx.xxx:**443** --header 'Host: sharepoint.intranet.com' -vv返回curl: (56) Recv failure: Connection reset by peer. 我的配置文件正确吗？或者也许我需要配置 IIS？

第二次更新

重新启动 SharePoint 服务器后，此配置正在使用pass-through：

global
    maxconn 4096
    user haproxy
    group haproxy
    daemon
defaults
    mode tcp
    log 127.0.0.1 local0 notice
    maxconn 2000
    option tcplog
    option dontlognull
    timeout connect 20s
    timeout client 10m
    timeout server 10m
frontend httpid
    mode tcp
    bind *:443
    acl hosts_sharepoint hdr_end(host) -i intranet.sharepoint.com
    use_backend sharepoint if hosts_sharepoint
    default_backend sharepoint
backend sharepoint
    mode tcp
    balance roundrobin
    option redispatch
    cookie SERVERID insert indirect nocache
    server st1 xxx.xxx.xxx.xxx:443
    option ssl-hello-chk
ssl
Martin Hope
maar
Asked: 2018-08-31 03:33:53 +0800 CST
  • 2

我正在同一 NLB 群集中的两台 SharePoint 服务器之间配置 Windows 网络负载平衡，但我希望第一台服务器用于用户，第二台服务器用于服务（并且仅当第一台服务器上的负载很高时才用于用户，例如例如 80%）。目前，多模式下两台服务器上的负载相同。

可以用 Microsoft NLB 来完成吗？还是有其他适用于 Windows 的工具？这将是一个生产环境。

windows-server-2012-r2