Is there an option for chkrootkit to display only warnings - not the whole list what was checked and found to be "not infected", "not found", "nothing found", etc...
The manpage does not disclose such an option (at least I did not find one there, and it is rather short).
For SFTP access to my server, I have created a sftp user that is limited to a working directory by chroot.
Match User sftp-user
AuthorizedKeysFile /home/sftp-user/.ssh/authorized_keys
ChrootDirectory /var/www/domain
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
And this entry in /etc/passwd
sftp-user:x:1003:1003::/html:/usr/sbin/nologin
There were some issues with the key file, but setting an absolute path for that solved the issue. The SFTP login worked fine until - I do not exactly know - the nagios server monitoring was installed on the server (a VPS) and/or updates have been run, and the system has been rebooted.
Now, connection fails and the syslog shows this error:
systemd[7590]: gpgconf: running /usr/bin/gpg-agent failed (exitcode=2): General error
systemd[7590]: gpgconf: fatal error (exit status 1)
This error occurs no matter if the login is done via key file or password. So I have tried following the question gpg-agent says agent exists, but gpg says agent doesn't exist? to narrow down the problem.
$ gpg-agent --version
gpg-agent (GnuPG) 2.2.4
libgcrypt 1.8.1
When I started gpg-agent as user (not the sftp user), it creates a file in the home directory on the first run:
$ gpg -d demo-file.asc
gpg: keybox '/home/username/.gnupg/pubring.kbx' created
When I disable the chroot in /etc/ssh/sshd_config, the login works properly. So I assume, that some access fails in the chroot session. As the sftp user is not allowed to use a shell, I did not bind any directories into the sftp-user's home directory.
I'm setting up a single-sign-on (as service provider) via SimpleSAML. After importing the Metadata from the identity provider's XML, the first redirect worked.
However, the login fails with a sspmod_saml_Error: Requester/InvalidNameIDPolicy: An error occurred. and the identity provider (idp) tells me that the request should include
format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
Instead of
format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
The only thing i found in the SimpleSAML manual refers to the idp configuration (manual). However, when I add this to the metadata/shib13-sp-remote.php an metadata/saml20-sp-remote.php ...
$metadata['<same URL as in metadata/saml20-idp-remote.php>'] = array (
'NameIdFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
);
... then nothing changes. The request still contains:
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" AllowCreate="true"/>
This is not unexpected, as I am trying to configute the request to the idp, not to an sp. So, in sheer despair, I have also tried setting the NameIdPolicy to the same value, and I have also have tried the ...-idp-remote.php files, but (as expected) that did not do the trick, either. And I also tried the ID of my service provider as key for $metadata, but ... well.
Also tried a modification to metadata/saml20-ipd-hosted.php as described here, but that also did have no effect.
It's really fishing in the dark, the SimpleSAML documentation is missing some basic information (where, for example, to put these parameters)... So, I assume that I have the wrong file, the wrong key, or the wrong setting. Any hint is welcome. Thanks!
I am running a webserver with Ubuntu 16 and php-fpm to process PHP requests. php-fpm has been installed via apt-get from the default Ubuntu repositories.
According to this reference I should be able to run php-fpm -t to test the configuration. However, this only tells me, the there is no php-fpm. I quite sure, it is (the webserver incl. PHP processing works well, and the service php7.0-fpm is up and running) ... but no executable with the name php-fpm.
How can I test a php-fpm configuration change with PHP 7 before reloading the configuration?
On a webserver, that usually works quite well with nginx and php-fpm (currently version 7.0.22, but this is mostly independet from the version), there are times when a 502 Bad Gateway occurs. This sually means: One of the php-fpm processes has crashed, and nginx does not receive an answer from the chosen process.
My current workaround is to monitor not only the php-fpm process, but also the output of a PHP page. And if this does not work for 4 minutes (two failed retries with a surveillance interval of 2 minutes), then monit will kill all php-fpm processes and restart the php-fpm service. Works, but still causes a 5 minute downtime (at least for some users that connect to the broken process) or more, because monit may as well see the answer from a sane process a few times, before it observes the 502 Bad Gateway.
(1) The ideal solution was to bugfix whatever break the php-fpm process. Yet, the error occurs rarely, so I was unable to track it down to some specific reason. Possibly a memory leak in a PHP script ... I don't know.
(2) The second best option, I have in mind, would involve some cooperation from nginx. If the webserver process could react to a PHP failure, it could (a) kill the specifically broken process and (b) try another process instead of throwing the 502 Bad Gatway.
So far, I did not find an option to make nginx react to the failure. Who has an ideas how this could be achieved? Or is there an easier solution, I missed?
connect() to unix:/run/php/php7.0-fpm.sock failed (11: Resource temporarily unavailable)
After an update from Ubuntu 14 to Ubuntu 16, duply stopped working - or rather continued working, but stored the backup files into the wrong directory.
This is the duply configuration (excerpt):
TARGET='file:///mnt/backup/server'
TARGET_USER=''
TARGET_PASS=''
And here's what ps -aux tells me when the backup is started:
python2 /usr/bin/duplicity --name duply_server --encrypt-key XXXXXXXX --sign-key XXXXXXXX --verbosity 4 --full-if-older-than 14D --force --exclude-filelist /root/.duply/server/exclude / file://@/mnt/backup/server
Note that AT sign (@) in the filename (last parameter). When run from /root/, It causes duplicity to create a folder /root/@/mnt/backup/server to store the backup there. I am unsure if this is a change in the behavior of duply, duplicity or python. Any idea how to solve this and tell duply the full folder, as it used to work?
Edit
For now, I assume, it's a bug in duply which tries to add a user name to the folder, as required for ftp.
My workaround is to create a symbolic link /root/@/mnt -> /mnt, but that's nothing more than a workaround. So thank you very much for better ideas!
to solve a webdesign issue with an old version of Internet Explorer, I downloaded a Hyper-V image from Microsoft (https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) and started this with the Hyper-V Manager.
In the Hyper-V Manager I created an "internal" network switch, and selected that switch for the VM's network connection. I set an IPv4 address (192.168.1.1) on my Host for this network, and another address (192.168.1.2) on the VM for the network.
Now, I'm stuck: I cannot ping from the Host to the VM or the other way around (each computer can ping it's own network address). What am I missing? I read some tutorials about Hyper-V networks, but can't find the point...
I had also tried the "external" switch, which allowed the VM to connect to the Internet - but again not to the Host, although the IP addresses (then automatically retrieved) are in the same subnet.
Thanks for advice and hints!
When working with PHP scripts, I usually do not have to bother with the underlying system. Today, I have to.
A PHP script (cronjob) that has worked fine is crashing since 2 days ago. The cronjob mail as well as running the script via shell both say:
Bus-Zugriffsfehler (Speicherabzug geschrieben)
If running the same script via PHP-FPM (via nginx) I receive a Bad Gateway which probably means "I have crashed, leave me alone", as well.
Unfortunately, I have no idea how to find more information, let alone, solve the problem. I have already checked the syslog (nothing related to the issue), dmesg (nothing) and the PHP error log (nothing). I also have reinstalled php5-cli, php5-pfm, and even libc6 and restarted the server -- no effect.
By the way: The whole thing is running on a virtual server (VPS), which also limits the chances of a hardware error. PHP has been updated to php5-cli (5.5.9+dfsg-1ubuntu4.7) recently, but the script worked fine after that for 9 days and two reboots...
Any ideas? Thanks a lot!
BurninLeo
EDIT: Solution
Of course, regularly sending echo from the PHP script is not elegant - but it helps to track problems to function calls. And, of course, the one seeking help did touch something, when he told he did not...
The solution was quite simple: A static class method called itself in the first line:
class ServerManager {
public static function dropCache() {
ServerManager::dropCache(); // VERY STUPID
foreach (array('active', 'packed', 'old') as $class) {
$cacheID = 'cache-'.$class.'-0';
Cache::drop($cacheID);
}
}
}
Well, maybe PHP could have been a bit more specific in the cause of the problem. Yet, removing this one solved the problem.
My webserver runs NGINX with PHP-FPM. After (I guess) an update, the service php5-fpm stopped working and refuses to restart/start - even after a reboot. As another webserver does the same updates and still works, updates may not be the cause.
> sudo service php5-fpm start
start: Job failed to start
> sudo service php5-fpm status
php5-fpm stop/waiting
> cat /proc/version
Linux version 3.13.0-48-generic (buildd@orlo) (gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) ) #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015
The /var/log/syslog says
kernel: [ 131.844584] init: Failed to spawn php5-fpm pre-start process: unable to execute: No such file or directory
And there is no relevant entry in /var/log/php5-fpm.logor any other file in /var/log/.
I'm afraid, I lack the background knowledge on pre-start processes. Therefore, I do not know where to start... Any ideas? Thanks!
My webserver runs nginx with php5-fpm. If some trouble occurs, usually php5-fpm hung up, resulting in a "bad gateway" server error. Of course, I never know, if nginx may crash as well, some day.
When something happens, the both processes (ad their threads) usually exist and need a restart. I am not so much interested in the cause of a current problem, but want to restart both processes. To do so, I create two bash scripts /etc/monit/webserver.start.sh and /etc/monit/webserver.stop.sh.
Here's my monit configuration file (in conf.d):
check process webserver with pidfile /var/run/nginx.pid
start program = "/etc/monit/webserver.start.sh"
stop program = "/etc/monit/webserver.stop.sh"
if failed (url https://www.myserver.com/example/ and content == 'test string' and timeout 20 seconds)
then alert
if failed (url https://www.myserver.com/example/ and content == 'test string' and timeout 20 seconds)
for 2 cycles
then restart
if failed (url https://www.myserver.com/example/ and content == 'test string' and timeout 20 seconds)
for 4 cycles
then exec "/sbin/reboot"
That's not entirely wrong, but some questions remain:
nginx process here, but the ports/URLs. Can I use any other check instead of check process?if failed conditions, resulting in three server requests. Is there any way to run one request per cycle and perform different activities after a different number of fails?I tried to find the answers from the official monit reference, but obviously, I do not understand the possibilities as decribed in that source. Therefore, I would apprechiate some advice very much.
Update
After spending some mot time with the monit man page (it's much better structured than the online manual, in my opinion), I found this optimization:
CHECK HOST webserver WITH ADDRESS 127.0.0.1
START PROGRAM = "/etc/monit/webserver.start.sh"
STOP PROGRAM = "/etc/monit/webserver.stop.sh"
IF NOT EXIST THEN ALERT
IF FAILED (url https://www.mydomain.tld/example/ and content == 'test content' and timeout 20 seconds)
FOR 2 CYCLES
THEN RESTART
IF 2 RESTARTS WITHIN 5 CYCLES
THEN EXEC "/sbin/reboot"
This modification does not include the alert on first URL fail (a workaround would be to use dummy start/stop commands, here) but can do a restart after 2 fails and a reboot aber 4 fails - with only one server request.
It's still not perfect. If someone knows how to do it better, advice is stil appreciated :) Thanks!
Update
After some testing, I DO NOT recommend to use monit's timeout feature (IF 2 REsTARTS WITHIN...) for second-order actions. It seems that the timeout action is re-run after a reboot under certaing circumstances. In my case, this caused multiple reboots:
[CET Dec 28 05:59:50] error : skipping queued event /var/monit/id - unknown data format
[CET Dec 28 05:59:50] error : skipping queued event /var/monit/state - unknown data format
[CET Dec 30 03:10:52] error : 'webserver' failed protocol test [HTTP] at INET[www.myserver.com/example/] via TCPSSL -- HTTP: Error receiving data -- Resource temporarily unavailable
[CET Jan 1 03:08:10] error : 'webserver' failed protocol test [HTTP] at INET[www.myserver.com/example/] via TCPSSL -- HTTP: Error receiving data -- Resource temporarily unavailable
[CET Jan 1 03:09:30] error : 'webserver' failed protocol test [HTTP] at INET[www.myserver.com/example/] via TCPSSL -- HTTP: Error receiving data -- Resource temporarily unavailable
[CET Jan 1 03:09:31] info : 'webserver' trying to restart
[CET Jan 1 03:09:31] info : 'webserver' stop: /etc/monit/webserver.stop.sh
[CET Jan 1 03:09:31] info : 'webserver' start: /etc/monit/webserver.start.sh
[CET Jan 1 03:10:31] error : 'webserver' failed, cannot open a connection to INET[www.myserver.com/example/] via TCPSSL
[CET Jan 1 03:10:31] info : 'webserver' trying to restart
[CET Jan 1 03:10:31] info : 'webserver' stop: /etc/monit/webserver.stop.sh
[CET Jan 1 03:10:31] info : 'webserver' start: /etc/monit/webserver.start.sh
[CET Jan 1 03:10:31] error : 'php-fpm' process is not running
[CET Jan 1 03:10:31] info : 'php-fpm' trying to restart
[CET Jan 1 03:10:31] info : 'php-fpm' start: /usr/sbin/service
[CET Jan 1 03:10:31] error : 'nginx' process is not running
[CET Jan 1 03:10:31] info : 'nginx' trying to restart
[CET Jan 1 03:10:31] info : 'nginx' start: /usr/sbin/service
[CET Jan 1 03:11:32] error : 'webserver' service restarted 2 times within 2 cycles(s) - exec
[CET Jan 1 03:11:32] info : 'webserver' exec: /sbin/reboot
[CET Jan 1 03:12:24] info : Starting monit daemon with http interface at [0.0.0.0:2812]
[CET Jan 1 03:12:24] info : Monit start delay set -- pause for 240s
[CET Jan 1 03:16:24] info : Starting monit HTTP server at [0.0.0.0:2812]
[CET Jan 1 03:16:24] info : monit HTTP server started
[CET Jan 1 03:16:24] info : 'Memory' Monit started
[CET Jan 1 03:16:24] error : skipping queued event /var/monit/id - unknown data format
[CET Jan 1 03:16:24] error : skipping queued event /var/monit/state - unknown data format
[CET Jan 1 03:16:24] error : 'webserver' service restarted 2 times within 2 cycles(s) - exec
[CET Jan 1 03:16:24] info : 'webserver' exec: /sbin/reboot
[CET Jan 1 03:17:04] info : Starting monit daemon with http interface at [0.0.0.0:2812]
[CET Jan 1 03:17:04] info : Monit start delay set -- pause for 240s
[CET Jan 1 03:21:04] info : Starting monit HTTP server at [0.0.0.0:2812]
[CET Jan 1 03:21:04] info : monit HTTP server started
[CET Jan 1 03:21:04] info : 'Memory' Monit started
[CET Jan 1 03:21:04] error : skipping queued event /var/monit/id - unknown data format
[CET Jan 1 03:21:04] error : skipping queued event /var/monit/state - unknown data format
[CET Jan 1 03:21:04] error : 'webserver' service restarted 2 times within 2 cycles(s) - exec
[CET Jan 1 03:21:04] info : 'webserver' exec: /sbin/reboot
[CET Jan 1 03:21:44] info : Starting monit daemon with http interface at [0.0.0.0:2812]
[CET Jan 1 03:21:44] info : Monit start delay set -- pause for 240s
[CET Jan 1 03:25:44] info : Starting monit HTTP server at [0.0.0.0:2812]
[CET Jan 1 03:25:44] info : monit HTTP server started
[CET Jan 1 03:25:44] info : 'Memory' Monit started
[CET Jan 1 03:25:44] error : skipping queued event /var/monit/id - unknown data format
[CET Jan 1 03:25:44] error : skipping queued event /var/monit/state - unknown data format
[CET Jan 1 03:25:44] error : 'webserver' service restarted 2 times within 2 cycles(s) - exec
[CET Jan 1 03:25:44] info : 'webserver' exec: /sbin/reboot
Unless anyone has a good idea, I shall switch back to multiple requests. Finally, they are not so time-consuming...
BurninLeo
Recently, I have changed from Apache mpm-prefork (PHP module) to mpm-worker (PHP-FPM) due to memory issues. I am running a quite-large PHP application that requires ~20-30M per prefork process.
Overall, the server runs stable and fast. However, from time to time, the page is unavailable to some users for a few minutes.
Working hypothesis 1 (=rough idea) is that one of the processes (usually 2, sometime up to 5 or 6) hangs and each client assigned to this process (e.g. 50% of the clients) receives an error message.
Working hypothesis 2 is that MaxRequestsPerProcess is responsible. After 500 calls, the process tries to shut down, mod_fcgid does not gracefully kill and while the process is waiting for the kill, further clients are assigned to (and rejected by) the process. But I cannot really imaging that Apache would be so stupid.
My problem is: There is nothing in the error logs except some
[warn] mod_fcgid: process ???? graceful kill fail, sending SIGKILL
I am running out of ideas where to trace the problem. It appears sporadically and I have not yet managed to provoke it. Server performance (CPU/RAM) shall not be an issue, as the overall load has been in the lower range the recent weeks.
Thanks for any hints. Any comments on my hypotheses (that did not help my to find a solution, yet - I tried to disable the MaxRequestsPerProcess but do not yet know if it helped)? I would greatly appreciate some ideas how to trace this problem.
Apache configuration
<Directory /var/www/html>
...
# PHP FCGI
<FilesMatch \.php$>
SetHandler fcgid-script
</FilesMatch>
Options +ExecCGI
</Directory>
<IfModule mod_fcgid.c>
FcgidWrapper /var/www/php-fcgi-starter .php
# Allow request up to 33 MB
FcgidMaxRequestLen 34603008
FcgidIOTimeout 300
FcgidBusyTimeout 3600
# Set 1200 (>1000) for PHP_FCGI_MAX_REQUESTS to avoid problems
FcgidMaxRequestsPerProcess 1000
</IfModule>
Apache module configuration
<IfModule mod_fcgid.c>
AddHandler fcgid-script .fcgi
FcgidConnectTimeout 20
FcgidBusyTimeout 7200
DefaultMinClassProcessCount 0
IdleTimeout 600
IdleScanInterval 60
MaxProcessCount 20
MaxRequestsPerProcess 500
PHP_Fix_Pathinfo_Enable 1
</IfModule>
Note: The timeout was set to 2 hours because rarely, the application may require some time to run (e.g. the nightly cronjob that does a database optimization).
Starter script
#!/bin/sh
PHP_FCGI_MAX_REQUESTS=1200
export PHP_FCGI_MAX_REQUESTS
export PHPRC="/etc/php5/cgi"
exec /usr/bin/php5-cgi
#PHP_FCGI_CHILDREN=10
#export PHP_FCGI_CHILDREN
Package versions
While asking this question, I feel that it may be dumb - but I have no idea at the moment...
How to find out the current setting for FcgidMaxProcesses on Apache?
Background
I experienced the following error: mod_fcgid: can't apply process slot for ...
My Apache2 allows MaxClients=500 and the default configuration for FcgidMaxProcesses is 1000, according to mod_fcgid docs. Therefore, the MaxProcesses should not be the limiting factor - but before starting to play around with the settings, I would prefer to check the current value. So ... how do I?
Thank you
Settings
# apache2.conf
<IfModule mpm_worker_module>
StartServers 2
ServerLimit 32
MinSpareThreads 25
MaxSpareThreads 100
ThreadLimit 64
ThreadsPerChild 50
MaxClients 1000
MaxRequestsPerChild 10000
</IfModule>
# VirtualHost configuration
<IfModule mod_fcgid.c>
FcgidWrapper /var/www/php-fcgi-starter .php
# Allow request up to 33 MB
FcgidMaxRequestLen 34603008
FcgidIOTimeout 300
FcgidBusyTimeout 3600
</IfModule>
#/var/www/php-fcgi-starter
#!/bin/sh
export PHPRC="/etc/php5/cgi"
exec /usr/bin/php5-cgi
If you tell Apache to use CustomLog files, Apache2 will create these files on startup. And it always gives them to user root:root. How can I change this behavior?
Background
Apache runs with
SuexecUserGroup www-data www-data
and at the same time, I use a CustomLog that pipes it output to a script. The script removes two bytes from the IP and then wirtes to the logfile. As you cannot tell Apache to omit the IP from the error.log, this piped-output is important (regarding German privacy law).
The script cannot access my custom log if this does not belong to www-data.
If I change the owner, everthing works fine.
I also know how to change the file owner when logrotate renames and re-creates the logfile.
However, if I stop the Apache process, delete the logfiles, and then restart the Apache process, new files beloging to root:root are created.
How can I tell Apache to create the new, void files as/for www-data on startup?
on a Linux system there are lot's of users by default: daemon, bin, sys, games, etc.
According to my /etc/passwd most of these users have a shell assigned (/bin/sh) which seems some kind of insecure to me. My naive thinking would say: Only give those users a shell that may login to the server.
Is my thinking wrong?
If not completely wrong: Can I disable the shell for "daemon" and "www-data" without having side effects (e.g. the system wont start or the Apache PHP cannot excute system calls)?
Added: My distribution is a Debian Squeeze.
Thanks for your hints!
I am stuck on this topic for a while now: How can I get more details on where response time burns.
My Problem is the extreme variance in response times. Sometimes it takes the server 5 or 10 seconds or more to respond (esp. for the first call). Firebug marks this time mostly as "waiting". When I check localhost/server-status (where this delay occurs as well), most slots are occupied - but half a second later, they're free, again. I can hardly imagine that there are so many load spikes to explain this behavior.
Another strange thing: There are requests for 100K JPG images that sometimes - according to server-status - take 1, 2, or even 10 seconds to perform (column Req). At the same time, PHP scripts that include some CPU load, are handled in 100 ms or less (well, others also need 1 or 2 seconds). Requests to other (smaller) GIF or PNG images are even listed with a time of 0 ms.
This is where I am stuck: Is there any way to see what takes 10 seconds to send a simple JPG image?
Thanks for your good ideas!
-
System: I am talking about an Apache 2 webserver on Debian Linux (Sequeeze) that mostly delivers PHP scripted pages and images. The server is running on a VPS at a professional Germany server hoster. There is no memory swapping on the server (as far as I can see from the stats) and CPU load is not especially high (uptime reports a value around 3 that can rise to about 32 under extreme load - I think it should be an 8-CPU system). Of course, I can never be sure what the other VPSs on the server do.
Special Settings: Notably the server is sending all data via SSL. I further reduced keep-alive time to 1 seconds, because users typically spend very much time on each page (30-60 sec.) and keeping these connections alive after the image(s) are retrieved would quickly exhaust the server's memory (or the 2 GB I may use on the VPS). Due to larger PHP scripts, a typical thread takes up 20 MB of RAM. Therefore there are only 50 server slots (MaxClient) of which 35 support keep-alive.
Material: I created a test page (https://www.soscisurvey.de/example/?debug&password=demo) that is observed by the server site24x7.com (usually reponds in 1.4 seconds, but regularly there are spikes up to 20 or 30 seconds). To cross-check the results, I sent it to Load Impact es well: http://loadimpact.com/load-test/www.soscisurvey.de-35648bef3b84d3269e1fc7cb11bf1721