Server 2003 answers ping, but wont serve http, ftp,smtp or pop3

After reboot, my server wont respond to any incoming request until it is rebooted again. Then, about 5-6 hrs later, any website on it will return a ping, but it will not serve the page, nor will it serve ftp, pop3 or smtp requests.

The System log shows W3SVC errors 1014 and 1074, which relate to an Application pool not replying; I have one phpAdmin app pool which I have stopped - it is showing a solitary website as the default App, but the server no longer serves php extensions, and I can't transfer the default website to another pool to kill the whole app pool.

I would appreciate your help.

From serverfault Manfred

• Welcome to pool hell. If the application pool responsible for your sites isn't running... your site won't run. As far as the default site goes, you probably need to configure it to run the php extensions. If you don't really need the default site, you might simply need to stop it & start the correct sites. I've seen similar situations where 2 sites are configured to both accept all server names on the same port/ip.

  Manfred : I managed to get rid of the app pool problems ( I think) - no more log messages. The only app pool running now is the default app pool. php is gone. Still, at 6:40 am the server shutdown and re-started, and when it came up, it would not serve but it pings... I am puzzled
  From TheCompWiz

• Just because the server is pinging doesn't mean that the requisite services are. (That just indicates that the server is running and the network stack is working.)

  Have you verified that IIS (which covers WWW and FTP) is running, as well as your SMTP service? You mention the IIS errors but don't mention whether those errors have stopped the service or not.

  Manfred : I am not located close tot he server, but it is sounding like I should take a trip to see it onsite the next time it hangs.

  gWaldo : If you can RDP into it, do that. Also, if you open an MMC under an account that has rights to that server, do so and open services and event viewer (or computer management to do it all at once) to check out the services and logs.

  gWaldo : run nmap against it to see what ports it _is_ listening on. That may help give you a clue what is working...
  From gWaldo

How to configure Postfix client relay to Exchange 2010 server

I'm getting

(delivery temporarily suspended: SASL authentication failed; server myserver.com[xxx.xxx.xxx.x] said: 535 5.7.3 Authentication unsuccessful)

when I try to relay mail from Postfix 2.5.5-1.1 on Debian Lenny box to Exchange 2010.

I think I tried all possible combinations but I'm definitely missing something. Here is relevant part of main.cf:

broken_sasl_auth_clients = yes
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_pix_workarounds =
smtp_sasl_type = cyrus
smtp_always_send_ehlo = yes
relayhost = myserver.com

And I got libsasl2-modules installed. Anybody managed to successfully relay mail between Postfix and Exchange? Oh, and I already double-checked if password is right.

From serverfault helcim

• The Exchange Server will offer GSSAPI (Kerberos) but it seems that Cyrus SASL providing authentication service to Postfix was not configured to handle GSSAPI.

  man 5 postconf | less +/^smtp_sasl_mechanism_filter

  this will tell you what you need to set smtp_sasl_mechanism_filter to in order to get this to authenticate properly.

  helcim : So if I'm right i should have smtp_sasl_mechanism_filter = gssapi but then i'm getting postfix/smtp[3196]: warning: myserver.com[xxx.xxx.xxx.x]:25 offered no supported AUTH mechanisms: 'NTLM'

  Khushil : that would sugggest that the MS Exchange Server is setup with other auth mech - can you please check which auth is turned on with MS Exchange server or follow the guide at http://support.microsoft.com/kb/239869 to setup NTLM(GSSAPI) with MS Exchange server.

  Khushil : you could also try smtp_sasl_mechanism_filter = !gssapi, !ntlm, static:rest
  From Khushil

Group Policy or reg hack to hide startup dialogs in XP

I have a system that I'd like to try and hide some dialogs on at startup. I've gotten rid of login, and welcome screen and all kinds of stuff, but there are still a couple of pesky dialogs I can't seem to hide. There is the "Loading your personal settings" dialog "Applying your personal settings" dialog.

Does anyone know how to hide them?

From serverfault Oliver Nelson

• You could edit the (probably) gina.dll and change the graphics inside to be clear but you are probably asking for trouble at that point.

  You generally want those dialogs. Are you working with some xp embedded platform and are trying to do something stealthy?

  Oliver Nelson : It is for an embedded system, but running full XP...not trying to do anything stealthy, just wanted the startup to look as clean as possible. Client wouldn't accept my solution (which was to use a different OS entirely).

  Matt : Then you could probably lock down the theme, keeping the background colors the same. Then change the graphic (it should be in the gina) to match the background color. When you hack the gina you run the risk that a security patch in the future may overwrite your gina - but since a lot of vendors hack the gina these days (fingerprint logon, etc.) the rest of the vendors don't seem too concerned about it. Not exactly sure on the order, but writing your own shell may deal with that as well.

  Matt : they discuss that here, but you can run your program directly, or write your own windows program to only have the menus you require and lock them out of the rest of the OS. http://www.knowledgesutra.com/forums/topic/20367-how-to-change-the-windows-xp-shell/ Pretty sure the local policies dialog you are seeing would still come up - almost 100% percent sure that's in the gina dll.

  Matt : Wow. If you wanna be hardcore you can write (or outsource) one. http://msdn.microsoft.com/en-us/magazine/cc163803.aspx
  From Matt

• Have you checked your verbose messages configuration?

  John Gardeniers : That article describes how to turn ON verbose messages, which are turned off by default. That's the reverse of what was asked.

  edusysadmin : Correct, an article on how to activate something can be helpful to check the current status of such a setting if one was not aware of it. I can think of plenty of senerios where an admin might not know all of the active policy configurations.
  From edusysadmin

What Trouble Ticket system would you recommend?

Possible Duplicate:
What are some good web based trouble ticket systems?

Hi I am looking for a simple trouble ticketing system for my small software development company. It should be web based, preferrably an open source for self hosting, but cheap hosted service is okay too.

The main feature should be e-mail submitting of new tickets.

Thanks for helping.

EDIT: This is for customer support. For internal activities (projects, plans, bugs etc) we use Redmine.

From serverfault twk

• Is this for tech support or for some sort of Bug Tracking?

  We use SysAid which suits us very well, and is free for our purposes.

  EDIT: SysAid is a web-based helpdesk application.

  For your purposes, I think SysAid would be very good for you to try anyways. And the new version comes out tomorrow I believe.

  twk : Does the customers sending requests by email require to have an previously created account?
  From $pageUsers[$post.author].name

• For your consideration: http://www.zendesk.com/

  From schultkl

• <3 Tender http://www.tenderapp.com . Any emails sent to it creates an "issue" (case). Depending on which email addy is used, you can create different buckets to drop the emails into. Users do not need accounts. You can allow users to set up accounts or, alternatively, set the whole thing to "Private" and they can only see the discussions they have created. Very slick.

  From Matt Rogish

• We use Mantis Bug Tracker. It's a free online bug tracking system and it works very well for us. It emails you whenever you've got a new bug, etc. Give it a peek and see if it'll do what you need it to do (it's pretty flexible and easy to set up).

  From Django Reinhardt

• I had good success with Best Practical's RT: http://www.bestpractical.com/rt/

  From $pageUsers[$post.author].name

• What we did is we used our internal bug tracking system to handle external client requests via email as well. Perhaps Redmine supports this? For smaller companies it can be really nice to have it all in one place, because than you can easily convert client requests into tasks and assign them to team members. Just a thought...

  From jjriv

• CodeSmith Insight is a help desk software with advanced application integration. It can handle your emails and user feedback, as well as your applications error and crash reports. Everything is in one place and you can reply to an error report just as easily as you can reply to an email.

  From $pageUsers[$post.author].name

Permission denied on /proc/ some process

I am using chkroot to scan my system and it gave me permission denied error

/proc/23746/fd/0: Permission denied
/proc/23746/fd/1: Permission denied
/proc/23746/fd/2: Permission denied
/proc/23746/fd/3: Permission denied
/proc/23746/fd/5: Permission denied
/proc/23746/fd/8: Permission denied
/proc/23746/fd/11: Permission denied






[/proc/23746/fd]# ls -liah
/bin/ls: cannot read symbolic link 0: Permission denied
/bin/ls: cannot read symbolic link 1: Permission denied
/bin/ls: cannot read symbolic link 2: Permission denied
/bin/ls: cannot read symbolic link 3: Permission denied
/bin/ls: cannot read symbolic link 5: Permission denied
/bin/ls: cannot read symbolic link 8: Permission denied
/bin/ls: cannot read symbolic link 11: Permission denied
total 0
1489109001 dr-x------ 2 root root  0 Oct  8 10:46 ./
1489108994 dr-xr-xr-x 4 root root  0 Oct  8 10:46 ../
1489141760 lrwx------ 1 root root 64 Oct  8 10:48 0
1489141761 lrwx------ 1 root root 64 Oct  8 10:48 1
1489141771 lr-x------ 1 root root 64 Oct  8 10:48 11
1489141762 lrwx------ 1 root root 64 Oct  8 10:48 2
1489141763 lrwx------ 1 root root 64 Oct  8 10:48 3
1489141765 lr-x------ 1 root root 64 Oct  8 10:48 5
1489141768 l-wx------ 1 root root 64 Oct  8 10:48 8

What should i do fix them

From serverfault Master

• That's okay: you can't access resources of processes that are not yours (unless you're root)

  Master : i am logged as root
  From o_O Tync

How to sync email with iPhone

A client of mine has an iPhone. We have verified that he has the correct settings input in his iPhone for his Exchange account. Other users have iPhones as well and are able to get email on their device. His username, password, server, email address, server are all correct. SSL is on which it should be. When setting up the account the iPhone accepts it but when he goes to check his mail a warning pops up stating that he is not able to connect to the Exchange server. Any ideas on where to look to solve this?

From serverfault Jason T.

• Make sure that you're on Wifi and not the Cell networks.

  Ensure that his Exchange server is reachable by the iPhone. Since you don't have a command-line to ping from, try accessing OWA (Outlook Web Access) by going to http://[mailserver]/exchange/

  From gWaldo

• Have you tried setting his phone up with another user's account and setting his account up on another user's phone? This should tell you if it's a phone or account issue.

  Jason T. : Well I tried setting his account up on my iPhone and the same thing happened. That's why I'm starting to think it's an issue with his account but I can't pinpoint it.

  Chopper3 : just get your exchange admin to compare accounts - tell him that you've tried what you just did ok, it'll help.

  joeqwerty : In that case I'd look at the Exchange Features tab of the user account properties and make sure that Mobile Services are enabled.

  Jason T. : Thanks for the tip. Although after looking for that I cannot seem to find it. In fact, there is no Exchange Features tab for that user in AD. Nor does any other user have that tab.

  Chopper3 : just for sanity's sake try this problem user and a working user on another phone - just to be sure of your belief that it's a user issue ok. Also why not add a comment here showing the various config details (minus passwords of course) of the bad and good users - plus any other config details of the phones too - have you compared the data service APN settings etc.?
  From Chopper3

• Found the solution, at least for my case. In Active Directory went into the users properties, security tab, clicked on SELF, then advanced and checked the box to allow for inheritable permissions from the parent. After that he was able to sync up.

  Kara Marfia : Thanks for coming back with the fix. I love the solutions which don't seem like they should've changed anything...

  Jason T. : Yeah, I'm not sure how that setting was changed. Checked other users' accounts and that was checked. :-\
  From Jason T.

What options i have if my linux box is compromised

I have put all security meaures and log monitoring tools. Now but i don't know what to do if find out the there is some rootkit on my system.

If i have live sites running on my system and i can't turn off the server as well. How can i remove the infection

Regarding backups should i do backups of whole linux system or just the public_html directory and database. because i am currently backing up only those folders.

I have VPS and my hosting company is taking the daily snapshots but what is the other way to be safe so that if i some rootkit infection then i can recover it.

From serverfault Master

• If your web server has a virus, the only safe thing to do is nuke in from outer space. That's right, put it onto the next space shuttle mission and make sure it's jettisoned far enough away from earth that we don't all get showered in EMP or fallout, and press the red button that makes it explode.

  If that's unfeasable, too expensive, or you your local shopping centre has run out of nuclear bombs, then the only other way to make sure any virus is gone is to format the server. Your hosting provider may be able to assist you with this by setting up a 2nd VPS and giving you a month or so to move everything over before shutting down and deleting the current instance. Of course, if you just migrate everything over indescriminately from the old VPS to the new VPS then you'll likely bring the virus with you.

  If you have customer data on there and there's a risk you're leaking that data or taking part in a botnet or a backdoor has been left in the system, then you have an obligation to your clients to do everything in your power, and simply scanning/removing any known virus isn't really enough because you just never know what they've left behind.

  Regarding the backups, I would say you're doing the right thing, because you shouldn't have execute permissions on anything the public_html folder and the database is unlikely to be harbouring anything malicious.

  Master : IF i get the new VPS and i need to make the all the websites running very soon which directory backups you think i need to do that so that all sites get running in least possible time. I mean all user accounts , apache setting , home directories , MX records , Canel whm setting

  symcbean : Good answer - except the bit about 'virus' - yes there's malware on Unix systems - but no virus in the wild since the Morris worm.

  symcbean : @Master: the most common cause of system intrusions is insecure CGI code. Once an attacker finds a whole, they usually install further backdoros to get access - so by restoring your website you could well be restoring the route in to compromise the system.

  Master : @symcbean , then what is the best way to restore bckups. how to find that websitecode is compromised , i mean what things to look foror how to scan that

  Cypher : @master: what symcbean is saying is that you most likely have a hole in your web code: be it cgi, php, perl or some bundled package, such as phpmyadmin, mysql, or other popular control panels/software tools. while restoring your data onto a clean system is a good thing, you should be looking for holes in your code that the attacker may have used to gain access to your system in the first place, or this will just happen all over again. there are other ways for attackers to gain access: bad passwords, plain ftp, unpached software (apache,mysql,phpmyadmin,control panels,drupal,wordpress,etc).
  From Farseeker

• I would suggest you keep backups of just your data: your site files and your database data. Keep those backups off the system. If you get infected or the server gets compromised, you can have your host "initialize" the server (reset to original state), you copy up your data and you are back online with a clean server.

  I also suggest that you sweep your system and find out how you got infected/compromised in the first place and implement measures to prevent that from happening again.

  From Cypher

• Backups, backups, backups. Sadly, there is no way to be sure that the rootkit is gone without formatting and restoring from backup. I would keep backups of the data directories of each of your services (webserver, so /home/*/public_html and /var/www; MySQL, probably /var/lib/mysql, read up on each service you use to find where the files are stored) and a backup of your configuration (/etc), and any local changes you've made to the system and home directories (/home/*, /usr/local/*) at bare minimum.

  To further elaborate on potential rootkits, once they obtain root priviledges, it is possible for them to mask every sign that they exist on the infected system.

  symcbean : -1: as commented elsewhere, most systems are compromised by bad website code. Having the bad website code on a tape ready to install on top of a clean machine is a very temporary fix. Usually rootkits are installed **after** the system has been compromised.
  From Darth Android