Deploy the Zscaler ZPA App Connector with Docker
A working docker run command for the Zscaler Private Access App Connector, what each flag does, and what to check before you put it into production.
-
-
Relay SMTP through Microsoft Graph with SMTP2Graph
Exchange Online is retiring Basic Authentication for SMTP AUTH. SMTP2Graph accepts mail locally and sends it through the Microsoft Graph API, with no user license needed.
-
Restrict SSH access to trusted networks with firewalld IPSets
Allow SSH only from a list of trusted networks with a firewalld IPSet and a rich rule, then remove the default rule that leaves SSH open to the whole internet.
-
Load balancing Exchange with HAProxy
During a migration to Exchange Online, our load balancer could not take the extra traffic without a costly upgrade. HAProxy on a small Debian VM did the job: the full configuration.
-
Build VPP Debian packages from source
The steps I use to build FD.io VPP from source into .deb packages on Debian 12, from cloning the repository to make pkg-deb.
-
Erase a Windows-formatted USB stick on macOS
Disk Utility often cannot erase a USB stick that held a Windows installer or uses an MBR layout. diskutil eraseDisk in Terminal wipes and reformats it in one step.
-
Fix freezes in Proxmox VE 8.2
Some Proxmox VE 8.2 hosts freeze and may not even reboot. Two kernel parameters, pcie_port_pm=off and libata.force=noncq, stop it until a fixed kernel is out.
-
Change the master role in a Juniper Virtual Chassis
How to move the master role of a Juniper Virtual Chassis back to member 0 with a single command, and what to expect while it switches.
-
Configure a Virtual Chassis on Juniper QFX5100-48S-6Q
Step-by-step configuration of a preprovisioned two-member Virtual Chassis on Juniper QFX5100 switches, from serial numbers and VC ports to per-member management addresses.
-
Show BGP advertised routes on MikroTik RouterOS 7
RouterOS 7 now has a direct command to show the routes advertised to a BGP peer: /routing/bgp/advertisements print. An update to my earlier workaround.
-
Configure SNMP on Proxmox VE
Install snmpd on a Proxmox host, give it a minimal read-only configuration limited to one monitoring server, and start it at boot.
-
Red Hat restricts access to the RHEL source code
In June 2023 Red Hat stopped publishing RHEL sources on git.centos.org. My take on what it means for Rocky Linux, AlmaLinux, Oracle Linux and open source.
-
Fix the "setlocale: LC_CTYPE: cannot change locale (UTF-8)" warning
Logging in over SSH from a Mac to a CentOS server prints a setlocale LC_CTYPE warning. Setting LC_CTYPE in /etc/environment and generating the locale fixes it.
-
Exchange HTTP error 400 and event ID 15021 after a reboot
After a reboot, Exchange returned HTTP 400 and logged event 15021 for 0.0.0.0:444. The Exchange Back End site in IIS had lost its certificate binding.
-
Hyper-V networking: MAC addresses, adapter names and VLANs
PowerShell commands to find the MAC address of a Hyper-V virtual machine's adapters, rename an adapter, and configure it as a VLAN trunk.
-
How the internet really works: IP transit, peering and provider tiers
How ISPs connect to each other through peering and paid IP transit, what Tier-1, Tier-2 and Tier-3 providers are, and why two providers on two routers is the topology to aim for.
-
BGP and RPKI: why you should implement route origin validation
BGP trusts whatever routes its neighbours announce. RPKI lets you sign which AS may originate your prefixes and drop announcements that contradict it. What it protects against, what it does not, and how to deploy it.
-
Measuring bandwidth usage: 95th percentile, CIR and actual usage
How 95th percentile billing works, why the top 36 hours of the month are free, and how it compares with a committed information rate and volume-based billing.
-
What umask is and how it works
How Linux permissions are written, how umask removes permissions from new files and directories, and how to read a value such as 022 or 027.
-
Why I think Proxmox is the best hypervisor for small deployments
Proxmox VE is free, built on Debian, and covers clustering, high availability, Ceph storage and backups through one web interface. Why I recommend it over VMware and Hyper-V for small deployments, and where it falls short.
-
Count active mailboxes and distribution groups in Exchange
Exchange Management Shell one-liners that count the active user mailboxes, shared mailboxes and distribution groups in an Exchange 2016 organisation.
-
Generate an SSL certificate for the Proxmox web interface
Create a key and a SAN certificate request with OpenSSL, have it signed by your CA, and install the certificate in the Proxmox VE web interface.
-
Increase the ActiveSync attachment size limit in Exchange
Exchange limits ActiveSync to about 10 MB by default, so large attachments fail to open on mobile devices. Two values in the Sync web.config raise the limit.
-
Show BGP advertised routes on MikroTik RouterOS 7 (the old way)
Before RouterOS had a proper command, seeing what you advertise to a BGP peer meant saving the sent attributes and reading them from a pcap. Kept for reference.
-
Find the license server of a Remote Desktop Session Host
One PowerShell line shows which Remote Desktop license server an RD Session Host is configured to use.
-
Customise the Microsoft Teams Rooms background
Set your own background image and colour on a Microsoft Teams Rooms device with a SkypeSettings.xml file, and the image size it expects for one or two screens.
-
Sign in to Windows 10 with a YubiKey and Azure AD
Use a FIDO2 security key such as a YubiKey 5 to sign in to an Azure AD joined Windows 10 device: the requirements, the Azure AD setting and the Intune profile.
-
Find the VTP primary server on a Cisco switch
"VTP VLAN configuration not allowed when device is in CLIENT mode" means VLANs are managed elsewhere. One show command tells you which switch is the VTP primary.
-
Outlook "Need password" and a blank popup in hybrid Exchange
Outlook 2016 shows a blank sign-in window and keeps asking for a password in a hybrid Exchange setup with Modern Authentication. The cause can be a missing autodiscover service principal name.
-
Stop Outlook 2016 from using Office 365 autodiscover
A single registry value, ExcludeExplicitO365Endpoint, stops Outlook 2016 from going straight to Office 365 during autodiscover, so it uses your own autodiscover records instead.
-
Generate a SAN certificate with OpenSSL
Create a certificate request that covers several DNS names and IP addresses with an OpenSSL configuration file, then convert the signed certificate to PFX for Windows.
-
Run BGP on Windows Server 2019
Windows Server 2019 can speak BGP without third-party software. How to install the routing role, configure the router and a peer, announce prefixes and apply policies.
-
Change the keyboard layout of the Linux console
Set the console keyboard layout of a CentOS or other systemd-based Linux server with localectl, and list the keymaps you can choose from.
-
Missing dependency 'jq' when installing Microsoft Tunnel Gateway on CentOS 7
The Microsoft Tunnel readiness script stops with "jq: command not found" on CentOS 7. jq is in EPEL, so enable that repository and install it.
-
Certificate error 0x80094001 (CERTSRV_E_BAD_REQUESTSUBJECT)
An internal CA rejects a request with 0x80094001. The usual cause is a country name written out in full instead of its two-letter ISO 3166 code.
-
Find the certificate authority in an Active Directory domain
certutil -config - -ping lists the enterprise CAs published in Active Directory and checks that the one you pick is responding.
