carpii's questions

I have a remote CentOS server, lets pretend it's called hostname.com

hostname.com has several user accounts, and I want to ssh into this server as any one of these users (using ssh keys rather than password).

It seems everyone recommends just changing my local ssh config, add an alias the server for each remote user, and then providing a different IdentityFile for each alias.

So then I have to ssh bob@aliased_hostname1 and ssh alice@aliased_hostname2

Are there any other solutions? Id rather not be ssh'ing into aliased hostnames

Ideally I want to just ssh [email protected] or ssh [email protected] and automatically choose the correct ssh keyfile, based on the remote username i'm trying to log in as.

It's from a registered user on my website.

Activity begins with normal looking URLs, which correlates to manual browsing, but then that stops.

After that I get the same GUID-based requests every 3 seconds for hours.

I suspect it's some sort of 'auto-refresh' tool, or maybe some tool to see if a page has changed, but since it's requesting an invalid URL that doesn't make much sense.

Note that the URL being requested actually includes the from HTTP/1.1 bit, which clearly isn't valid and so my server rightly returns a 404.

Any malfunctioning browser extension or software you know of with this pattern?

GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6300 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6394 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6258 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6377 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6436 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6449 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"
GET /A4266F87-1E33-D746-A1DF-306C1E797113/183D2B68-3890-E646-81A7-F0D75019F7FF/from HTTP/1.1" 404 6175 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36" "-"

I have a Centos 5.11 server, and a script I cron every 10 minutes

The script is simply this

#!/bin/sh FNAME=/var/www/html/cached/conntrack_count COUNT=`cat /proc/net/ip_conntrack | /usr/bin/wc -l` echo $COUNT > $FNAME

I've ran this script for several years without issue (the output file is read periodically via http, by a cacti server and then plotted on a graph).

Last week I ran a full yum update, to mitigate the GHOST vulnerability.

But now it seems when this script runs, it causes concurrency issues for local sockets (particularly connections to memcached (locahost->localhost) often time out while the cat is running).

I wonder if anyone can explain why this is now an issue, when previously it was not?

Could it be that Linux is now placing some sort of lock on the file which its being accessed, which could prevent new connections being established?

This would seem unlikely but I've no other explanation

Im looking at migrating my website to https throughout. I have a server responsible for the HTML/PHP, and 4 other servers which serve image content

Now clearly all the image servers need to be https to prevent browser warnings, but I wonder..

Is there any requirement for the image servers to be the same encryption strength as the main SSL website? Or is it enough that they are served via https, regardless of key length and chosen cipher.

I cant really find anything conclusive about this on Google, but admittedly its a difficult topic to search for

I occasionally need to extract a single record from a mysqlbackup

To do this, I first extract the single table I want from the backup...

sed -n -e '/CREATE TABLE.*usertext/,/CREATE TABLE/p' 20120930_backup.sql > table.sql

In table.sql, the records are batched using extended inserts (with maybe 100 records per insert before it creates a new line starting with INSERT INTO), so they look like...

INSERT INTO usertext VALUES (1, field2 etc), (2, field2 etc),

INSERT INTO usertext VALUES (101, field2 etc), (102, field2 etc), ...

Im trying to extract record 239560 from this, using...

sed -n -e '/(239560.*/,/)/p' table.sql > record.sql

Ie.. start streaming when it finds 239560, and stop when it hits the closing bracket

But this isnt working as I hoped, it just results in the full insert batch being output.

Please can someone give me some pointers as to where Im going wrong?

Would I be better off using awk for extracting segments of lines, and use sed for extracting lines within a file?

I have around 7 or 8 servers, which I rsync down to my local LAN each night.

All of these rsync jobs use a common excludes.txt, to filter out files or directories I dont want mirroring.

Now, the excludes.txt contains some dirs which are common to all servers, but also a lot of directories (and patterns) which are specific to an individual server. Of course, they are all intermingled together and uncommented.

Im trying to get a handle on all of this, and move all the server specific patterns into separate files, specific for each individual server.

Im not yet sure how best to go about this, as from what I can see from the man page, rsync doesn't provide any options to display which files/dirs it has ignored.

Any suggestions please?

After creating a self-signed SSL certificate, I have configured my remote MySQL server to use them (and SSL is enabled)

I ssh into my remote server, and try connecting to its own mysqld using SSL (MySQL server is 5.5.25)..

mysql -u <user> -p --ssl=1 --ssl-cert=client.cert --ssl-key=client.key --ssl-ca=ca.cert
Enter password: 
ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

Ok, I remember reading theres some problem with connecting to the same server via SSL. So I download the client keys down to my local box, and test from there...

mysql -h <server> -u <user> -p --ssl=1 --ssl-cert=client.cert --ssl-key=client.key --ssl-ca=ca.cert 
Enter password: 
ERROR 2026 (HY000): SSL connection error

Its unclear what this "SSL connection error" error refers to, but if I omit the -ssl-ca, then I am able to connect using SSL..

mysql -h <server> -u <user> -p --ssl=1 --ssl-cert=client.cert --ssl-key=client.key 
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 37
Server version: 5.5.25 MySQL Community Server (GPL)

However, I believe that this is only encrypting the connection, and not actually verifying the validity of the cert (meaning I would be potentially vulnerable to man-in-middle attack)

The SSL certs are valid (albeit self signed), and do not have a passphrase on them. So my question is, what am I doing wrong? How can I connect via SSL, using a self signed certificate?

MySQL Server version is 5.5.25 and the server and clients are CentOS 5.

Thanks for any advice

Edit: Note that in all cases, the command is being issued from the same directory where the ssl keys reside (hence no absolute path)

Edit (in response to mgorven): ca.cert is the Certificate Authority certificate, which is supposed to tell mysql that my certificate authority is trusted.

The config from my.cnf is

[mysqld]
ssl-ca=/etc/ssl/mysql/ca.cert
ssl-cert=/etc/ssl/mysql/server.cert
ssl-key=/etc/ssl/mysql/server.key

I also tried adding ssl-cipher=DHE-RSA-AES256-SHA but have since removed it as it didn't help.