All Questions(server)

I've got some questions about table partition after dd cloning a full disk. I have been cloning a full disk with a dual boot: Win + Ubuntu to an image. The disk contained the following partition:

WIN: MBR Partition + Primary + Recovery and Ubuntu: Root partition '/' + Swap partition (I know this is not neccesary) + EFI Partition

and indirectly the Table partition which as far as I read, it is located in the very first 512 bytes (correct me if wrong) and a backup at the end of the disk.

I have shrank the main partitions of both OS to the minimum size and the compressed size result from ~60GiB to ~23GiB.

Well, I could make the reverse operation (de-compress from the image to the disk) and everything seems to be working fine after fixing table partition with gdisk.

However, I've got some questions about using DD:

1. Does the table partition storage information about the unallocated space? I mean, If I only use 50GiB from a 250GiB disk (200 GiB unallocated), when I decompress the disk image on disk which are bigger than 50GiB and have a different size of the original one, will I be able to clone on those kind of disk?
2. Soon I will try this installing both os, but on different disk. Can I just copy an specific partition?
3. Build on 2nd point, can i restore an image which only contain a unique partition to a partition with different size and fix the information on table partition?

I hope you can clear me some doubts, best regards.

I have an Apache/2.4.6 (CentOS) server with multiple subdomains as ServerAlias in Apache VirtualHost.

something like:

<VirtualHost *:443>
  ServerName mydomain.com
  ServerAlias a.mydomain.com
  ServerAlias b.mydomain.com

Each client company should access through its subdomain and there are different databases for each client company for security, there is a separation of data.

I was alerted by a cyber security expert that there is a vulnerability where a user of one subdomain 'a.mydomain.com' can access another subdomain 'b.mydomain.com' by adding a Host header to the calls from the client to the web server.

At first I tried to get the information in PHP but failed, the PHP doesn't get the headers information. Then I switched to looking for a solution to this situation at the web server level - Apache.

I want to detect and reject when a malicious user tries to fool the server and send the request to another subdomain using a Host Header, in this example, the user should be served by a.mydomain.com and not b.mydomain.com:

curl 'https://a.mydomain.com/users/login' \
  -H 'Host: b.mydomain.com' \
  --data-raw $'{"email":"[email protected]","password":"*****"}'

A normal call from the client side application looks like this:

curl 'https://a.mydomain.com/users/login' \
  --data-raw $'{"email":"[email protected]","password":"*****"}'

I tried RequestHeader unset host but it doesn't work as I expected.

My expectation was that if the malicious user sent a "Host" header, the server should ignore it. This would cause both culr calls above to be effectively the same.

I think that what happens is that Apache is using the URL in the call, but if there is a "Host" header, it takes precedent and that is what is used and the original domain from the URL is discarded.

If that is the case, then RequestHeader unset host doesn't send any host to my PHP code, which causes my code to break, as it needs to know which client company is calling it.

I have a RHEL 7.9 server. I am trying to create a local account called sysadmin. I ran

• useradd sysadmin
• usermod -aG wheel sysadmin
• passwd sysadmin

When I look in /home I see the sysadmin folder, but it has a different owner. The owner is a service account that is unrelated. If I run chown sysadmin:sysadmin, it does not change the owner, it stays the same service account. I don't see any related logs in secure or messages. There is no /var/log/auth.log or syslog files. Has anyone seen this behavior?

I have a GitLab instance in a Docker container running on a Synology NAS. Now, I want to move the GitLab to a Windows PC that I have, but keep the data on the NAS, by sharing folders and making them Docker volumes. To test it, I created some folders config, data, and logs on the NAS and shared them on the network with "Shared Folder". From what I understand, we have it configured to use SMB for this. Then, on the Windows machine, I run (based on this suggestion)

docker volume create --driver local
  --opt type=cifs
  --opt device=//192.168.1.150/gitlab_docker_volume/config
  --opt o=user=gitlab_docker_volume,password=<password> gitlab-config

and two more to create gitlab-data and gitlab-logs.

Then, I start the container with

docker run -d -p 8070:80 -p 8433:443 -p 8012:22
  -v gitlab-logs:/var/log/gitlab:rw
  -v gitlab-data:/var/opt/gitlab:rw
  -v gitlab-config:/etc/gitlab:rw gitlab/gitlab-ce

and it crashes with the error

...
Mixlib::ShellOut::ShellCommandFailed:
Failed asserting that ownership of "/var/opt/gitlab/git-data" was git:git
...

2024-12-13 13:54:47 + [ root:root = git:git ]

When I look into the folders on the NAS, I can see that the container successfully created all of the files and folders GitLab needs, but they all have owner gitlab_docker_volume:users and 777 permissions. In the data volume from the original GitLab container that is running on the NAS, the git-data folder belongs to some mysterious user 998 and it has 2770 permissions.

If I understand correctly, what's happening is that the GitLab container tries to chown the git-data folder and this command would have to be mapped across the SMB/CIFS share, but that isn't happening.

There are two posts about the same error, but they ran into it using different setups for their volumes - one of them seems to get the problem due to running the Windows server in a VM, the other one is using Windows-native folders.

https://stackoverflow.com/questions/45134978/setting-up-gitlab-using-docker-on-windows-host-issue-with-shared-folders

https://stackoverflow.com/questions/44684621/volume-trouble-with-gitlab-docker-image-on-windows

I've also tried to find out how to edit the Linux permissions through the network share in general, but the search results are flooded with "how to set the permissions when creating the folders so that the Docker container can edit them in the first place" - which was already working in my setup.

I, on the other hand, have shared folders that are originally on a Linux machine. Is there some way I can change the folder share setup, the volume setup, or anything else, so that the container can change the user and permissions of the files? Docker is running with the WSL backend, by the way.

I have the following code run on my server to allow me to SSH into my server even when the server is connected to a VPN. The code below runs as a service after startup.

ip addr add 192.168.1.113 dev enp1s0 label enp1s0:0
ip rule add from 192.168.1.113 table 402
ip route add default via 192.168.1.1 dev enp1s0:0 table 402

This works with openvpn but it doesn't with wireguard because my wireguard client adds a couple of rules in front of my rule above.

0:  from all lookup local
32761:  from all lookup main suppress_prefixlength 0
32762:  not from all fwmark 0xca6c lookup 51820
32763:  from 192.168.1.113 lookup 402
32766:  from all lookup main
32767:  from all lookup default

If I add the rule from 192.168.1.113 lookup 402 after the wireguard connection then I can SSH into the server. So I'm assuming it is an issue of priority.

How can I ensure my rule (32763) keeps priority even after wireguard connects and adds those couple (32761, 32762) of rules?

FAILED SOLUTION:

I learned the numbers on the left are priorities. I then tried to set the priority of my rule lower..

ip rule add from 192.168.1.113 table 402 prio 300

.. but after I connected to wireguard vpn, the wireguard client simply put their rules below mine at priority 299, and 298.

298:    from all lookup main suppress_prefixlength 0
299:    not from all fwmark 0xca6c lookup 51820
300:    from 192.168.1.113 lookup 402

Is there anyway to prevent this? I suppose I could put a PostUp command in the wireguard conf file that changes the priority but I feel like there has to be a cleaner solution.