dirtside's questions

In the output of route -n on Linux, you get something like this:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    0      0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.169.254 0.0.0.0         255.255.255.255 UH    0      0        0 eth0

I know that Genmask refers to the netmask portion of the route, but why is it called "Genmask" instead of "netmask" like it is everywhere else? This is literally the only place I've ever seen "Genmask".

I've got Apache 2.2.15 running under CentOS 6.5. The module mod_authnz_ldap is being used to authenticate against a Microsoft AD server. Here's the LDAP config in Apache:

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL ldap://[ad server ip address]/[basedn]?mail
AuthLDAPBindDN [binddn]
AuthLDAPBindPassword [bindpass]
AuthName "LDAP: myhost.example.com"
Require ldap-group cn=[foo],ou=Permissions,ou=Groups,ou=[bar],dc=[baz],dc=com

Most of the time, browser requests to this Apache host work just fine; it authenticates correctly against the AD server and the page loads normally.

Once every few minutes on average, however, the request will appear to hang from the browser side. tcpdump reveals that Apache is sending a TCP RST packet, apparently in response to a PSH ACK packet from the AD host. The exchange looks like this:

53  600.408744  Apache  AD  TCP  74  42804 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2665219285 TSecr=0 WS=128
55  600.469478  AD  Apache  TCP  66  ldap > 42804 [PSH, ACK] Seq=1 Ack=3457841362 Win=65093 Len=0 TSval=4832637 TSecr=2664621718
56  600.469524  Apache  AD  TCP  54  42804 > ldap [RST] Seq=3457841362 Win=0 Len=0
65  601.409434  Apache  AD  TCP  74  [TCP Retransmission] 42804 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2665220285 TSecr=0 WS=128
67  601.470951  AD  Apache  TCP  78  [TCP Previous segment not captured] ldap > 42804 [SYN, ACK] Seq=252322338 Ack=1 Win=16384 Len=0 MSS=1380 WS=1 TSval=0 TSecr=0 SACK_PERM=1

No other packets are sent after this point, on this connection, and so the thread appears to be hanging. strace provides no illumination, it just shows a write() call being made with the LDAP bind request.

I also had a longer-running tcpdump session catch one of the Apache processes trying to send an LDAP request from a TCP port that was not part of any open connection. It looked like it was from an earlier connection (similar to the kind shown in the dump above), and somehow the Apache process thought that that connection was still open.

I thought maybe one of the LDAP caches was being problematic, so I disabled them as follows:

LDAPSharedCacheSize 0
LDAPCacheEntries 0
LDAPOpCacheEntries 0

but this made no difference; the problem still occurs.

The only way to fix it currently is to restart Apache every few minutes. With the load the server receives, the problem starts occurring within a couple of minutes of restart.

I'm running Apache 2.2 on CentOS 6.5 and what I'd like to do is have Apache's current access log file be:

/var/log/httpd/access_log

And each day at midnight, that file is renamed like so (assume 2014-09-22 is the date that just passed):

/var/log/httpd/access_log.2014-09-22

...and a new log file (access_log) is created at that instant, and Apache continues logging to it. How can I do this? I've got this CustomLog directive set up already:

CustomLog "|/usr/sbin/rotatelogs /var/log/httpd/access_log.%Y-%m-%d 86400" combined

But this causes the current (active) logfile to be named access_log.2014-09-22 if today is 2014-09-22.

I can think of a hacky solution, where I have a script that runs just after midnight and sets /var/log/httpd/access_log to be a symlink to whatever the current day's logfile is. (It would be based on date, so even if it's a low-traffic server and the new logfile didn't exist yet, the symlink would be correct and would function as soon as any requests hit the server). But it seems like there must be a more elegant way to do this. Is there some way to tell rotate logs to use one filename for the current log, and a different filename for the rotated logs? Failing that, is there some other clean way to do what I want?

EDIT: Restarting Apache each day is not an option.

I've recently learned how great expect is, now that I'm suddenly responsible for managing 150 VMs. I've been using it to distribute config files to remote servers, but there's got to be a better way than what I'm doing.

Mainly what I do is things like this:

set server [lindex $argv 0]
set timeout -1
spawn scp -i $::env(HOME)/.ssh/key.pem file $server:/tmp/
expect ">>"
spawn ssh -i $::env(HOME)/.ssh/key.pem $server
expect ">>"
send "sudo mv /tmp/file /etc/file && sudo service foo restart\r"
expect ">>"
puts "\r\r"

So basically, the script scp's the file over to the remote server, and then ssh's into the server and moves the file (using sudo, because it's a file owned by root in /etc, e.g. nscd.conf) to its destination. It seems like there must be a better way than this to manage distributing a new root-owned config file to a bunch of machines.

I've written various pieces of code that connect to LDAP servers and run queries, but it's always been voodoo to me. One thing I don't really understand is the concept of a bind DN. Here's an example using the ldapsearch command-line tool available from openldap. (Ignore the lack of authentication.)

ldapsearch -h 1.2.3.4 -D dc=example,dc=com [query]

What is the purpose and function of the -D dc=example,dc=com part of this? Why do we need to bind to a particular location in the directory hierarchy? Is it to establish which part of the directory my queries should apply to? E.g. if the root node of the directory is dc=com, and it has two children (dc=foo and dc=bar), maybe I want my queries to be against the dc=foo,dc=com subtree and not the dc=bar,dc=com subtree?

I've got two VMs: CentOS 6.5 and Ubuntu Server 14.04. Neither of their package management systems has the MySQL 5.1 libraries available (they both have MySQL 5.5). I need to know how to install the MySQL 5.1 libraries on each of them. It can be by downloading and compiling them (although I wasn't able to find 5.1 on the MySQL site) or by finding old packages that will work with either package management system (yum/apt respectively).

The underlying reason is that I need to compile a program against the 5.1 libraries. It will not work with newer versions of MySQL. (For complicated reasons, the program cannot be modified to work with newer versions of MySQL.)

If it makes any difference, the VMs are in Microsoft's Azure system.

Running kubuntu 10.04 on my host, let's call it alpha. I've got postfix as my system MTA. I've got crons running on alpha that need to send email to a remote host, let's call it mailhost. I cannot alter any configs on mailhost.

Normally I use Thunderbird to send/get email through mailhost using IMAP over TLS. The SMTP setup in Thunderbird is configured to use STARTTLS.

I want cron jobs running on alpha to send mail to mailhost, but because alpha is a dynamic-IP host behind residential NAT, it's difficult to get mailhost to accept mail from alpha due to the usual anti-spam/RBL heuristics. However, if I can get postfix to use TLS to connect to mailhost when it's sending mail to an address (dirtside@mailhost for example), then the mails should go through just fine.

What I'm trying to figure out is how to configure postfix to use STARTTLS with a specific username and password ONLY when connecting to mailhost.

Alternative solutions (e.g. using something besides postfix) are acceptable, but the ultimate task is still to allow crons running on alpha to send emails to [email protected].

Trying to get a script to properly make use of variables. (The below examples are on the command line but I see the exact same behavior when inside a #!/bin/bash script.

$ FLAGS='--rsh="ssh -2"'
$ rsync $FLAGS foo bar
rsync: -2": unknown option
rsync error: syntax or usage error (code 1) at main.c(1084)

So then I add quotes.

$ rsync "$FLAGS" foo bar

And now it works properly. Okay. Now let's add some more flags to the $FLAGS variable. (I tried it with just "-r" and just "-p", the same thing happens, so I don't think it's related to the particular single-hyphen flags I'm passing.)

$ FLAGS='-rptvlCR --rsh="ssh -2"'
$ rsync $FLAGS foo bar
rsync: -2": unknown option
rsync error: syntax or usage error (code 1) at main.c(1084)
$ rsync "$FLAGS" foo bar
rsync: -rptvlCR --rsh="ssh -2": unknown option
rsync error: syntax or usage error (code 1) at main.c(1084)
$ 

Notice in the second case it's treating the entire argument as a single option to rsync.

The basic command (typed out by hand without using the $FLAGS variable) works properly.

Any ideas?

Any ideas? I've read through all the bash scripting docs I can find, and I can't figure out why rsync is ignoring the double quotes some of the time and treating -2" as a single token.

Here's what I want to do: I want to get a tree-formatted list of processes from ps (as when you do ps auxwwf), but only of processes that are either owned by me, or are ancestors of processes owned by me. So if I own a bash process way down the tree, and it has ancestors owned by root, I want to see those root ancestors in addition to the ones I own. I do not want to see any process trees that do not contain any processes owned by me.

Is there any way to do this with ps's normal options, or do I need to write a script to parse the output?

• THE SETUP

Two machines at home, behind a residential cable modem and router:

gaia: Kubuntu 10.04, 192.168.0.103

pixel: Ubuntu 10.04, 192.168.0.104

router: DLink DI-52, 1.1.1.1 (not its real IP). The router is configured to forward ports 23 and 10002 to pixel:22, and to forward ports 22 and 10001 to gaia:22.

Two external hosts on different networks in different states:

zeus: CentOS, IP 2.2.2.2 (not its real IP) in Texas

argo: Kubuntu 10.04, IP 3.3.3.3 (not its real IP) in California

• THE PROBLEM

If I SSH from zeus to router:22, :23, :10001, or :10002, it connects fine (to gaia, pixel, gaia, and pixel, respectively).

If I SSH from argo to router:23 or :10002, it connects to pixel fine. If I SSH from argo to router:22 or :10001, it does not connect to gaia; the SYN packet is never replied to (I watched this with Wireshark on gaia to verify that gaia does not send anything back to argo). Also tested with other hosts on the same network as argo; none of them get any farther. The SSH dump (-vvv) looks like this:

@@ 08:29:04 Sat Sep 18 [user@argo - ~]$ ssh 1.1.1.1 -vvv
OpenSSH_5.3p1 Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /home/user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 1.1.1.1 [1.1.1.1] port 22.
debug1: connect to address 1.1.1.1 port 22: Connection timed out
ssh: connect to host 1.1.1.1 port 22: Connection timed out
@@ 08:39:00 Sat Sep 18 [user@argo - ~]$ 

Now, to make things even weirder: I have a VPN client on gaia that lets me get past the firewall that is on argo's corporate network. This VPN client gives gaia an additional IP (172.16.1.1, again not real). If I try to ssh to THAT IP from argo, it connects just fine.

So my question is, what the hell is going on? Does gaia for some reason just not like the IP that argo is using? gaia is a two-day-old Kubuntu install, and I haven't done anything weird like configure certain IP ranges to be blocked from connecting to sshd. And it doesn't seem like it could be something about the SYN packet that gaia doesn't like, since it WILL let argo connect if it's to the VPN IP.

EDIT: I just discovered that this problem only occurs when the VPN client is running on gaia. As soon as I shut it off, argo can connect to gaia through its public IP just fine. Any idea why this would be?

EDIT 2: My next guess is that the VPN client tells the IP stack to ignore any packets coming from the corporate firewall's public IP, to make sure that while the VPN is active, all data from gaia to the corporate network goes through the VPN, and not through the public firewall. This doesn't cause me a real problem, because I can still SSH directly to gaia using its VPN IP instead of the router's IP, but it's a little confusing.

On my local host alpha I have a directory foo that is mapped via sshfs to host bravo as follows:

$ sshfs charlie@bravo:/home/charlie ~/foo

However, on host bravo there is another user, delta, that I want to sudo /bin/su as, so that I can do work in bravo:/home/delta. delta may not be logged into via ssh; for reasons which I cannot change, you can only sudo over to delta once you're on the machine.

Normally I'd ssh into bravo, then sudo to delta, but I'm wondering if there's any way that I can do that when I've got charlie's home dir mounted via ssh.

I use

ssh -D 1080 myhost.org

...to open up an SSH tunnel from my work machine to my home machine, so as to bypass the idiotic content filter on the corporate firewall. However this also creates an interactive SSH session that lives the whole time I'm using the tunnel. Is there any way to tell SSH just to create the tunnel and not bother with the interactive session?

Looking at the Ethernet entry on Wikipedia, I can't figure out how it's indicated how long the Ethernet frame is. The EtherType/Length header field apparently can indicate either a frame type or an explicit length, and I'm guessing that in the case of a frame type, it has to do some other logic to figure out how long the packet is. For example, if the EtherType field is 0x0800, that indicates an IPv4 payload, and so the receiving NIC would have to examine the first 32 bits of the payload to find the length of the IP packet, and therefore to figure out the total length of the Ethernet frame, and know when to look for the end-of-frame checksum and interframe gap.

Does this sound correct? I also looked at the IEEE 802.3 spec for Ethernet (part 1, anyway) which seems to corroborate this, but it's pretty opaque.

When I use

Options +indexes

...in an .htaccess file, Apache (1.3) displays a formatted list of files in that directory. Yay! However, the actual layout of that formatting kind of sucks; the filenames are only about 20 characters wide, and get truncated with ".." on the end. Is there any way to change how Apache formats the width of the various text here? (Aside from, you know, editing the source code.)

/home/myname/bin/script:

#!/bin/bash
ifconfig > /home/myname/foo

Crontab:

* * * * * /home/myname/bin/script

...waits 1 minute...

@@ 11:35:51 [myname@comp - ~]$ ls foo
-rw-r--r-- 1 myname myname 0 Jul  7 11:35 foo
@@ 11:35:55 [myname@comp - ~]$ 

I can't figure out why foo would end up empty. Running the ifconfig command on the command line works exactly as you'd expect, dumping its output into a file just like normal. For reference, I'm running Ubuntu 8.04.

Given the following Apache rewrite rule:

RewriteRule .* foo

...how do I find out precisely what string .* is testing against? Assume that any number of arbitrary rewrite rules could have been applied before this point, and that I have no way of knowing what they are (assume httpd.conf is hidden from me).

EDIT: Thanks, though keep in mind that I do not have access to edit (or even read!) httpd.conf. I only have .htaccess files at my disposal.