分类目录归档:Software

解决域里的Windows和域控制器时间不同步问题

今天刚开了个新的AD,兴高采烈地把设备都加了域,结果WinRM不工作。报错如下:

PS C:\Windows\system32> enter-pssession server02
enter-pssession : Connecting to remote server server02 failed with the following error message : WinRM cannot process
the request. The following error with errorcode 0x80090324 occurred while using Kerberos authentication: There is a
time and/or date difference between the client and server.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ enter-pssession server02
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (server02:String) [Enter-PSSession], PSRemotingTransportException
    + FullyQualifiedErrorId : CreateRemoteRunspaceFailed

对于一个新的域,这种情况大概率是两台设备的时钟不同步了。

继续阅读

Proxmox Mail Gateway使用ZeroTier One网络同步

有的时候你需要在多地部署PMG应用,但是它们不一定都有公网IP,这样就会不满足PMG Cluster节点间必须双向可访问的要求。另外,虽然PMG号称自己“使用了高级的VPN技术”,其实用的是SSH+Rsync同步,在特殊的网络环境下面容易出现问题。在这种情况下,我们可以用ZeroTier One(或者其它类似的SD-WAN解决方案)来绕过这一限制。但是Proxmox系列软件的网络配置都比较难用,操作的时候必须小心。

用root账号登录Proxmox Mail Gateway服务器。首先安装ZeroTier One并加入网络:

curl -s https://install.zerotier.com | bash
zerotier-cli join aaabbbcccddd

在控制器上确认设备加入并分配IP。

修改hosts,让本机主机名解析到ZeroTier网卡的IP上。然后正常加入cluster:

pmgcm join your-master-ip

如果有节点的hosts文件不对,导致master那边拿到了错误的节点IP,那么节点会卡在syncing状态或者处于error状态(提示“error 401: Permission denied – invalid PMG ticket”)。这时候我们需要手动修改一下节点IP:在每个节点上打开/etc/pmg/cluster.conf,修改节点IP,然后重启。