Agvorth's questions

I'm setting up a CentOS 6 server on a VPS. I've worked with Apache before, but I've never dealt with CentOS 6.

I guess it would just be this right?

sudo yum install httpd -y
sudo yum install mod_ssl -y

(And then use chkconfig to set it to run on startup and start configuring the details under /etc/httpd/conf.)

Is there more to it? Anything special I should be know about going in? Any gotchas I should be wary of?

I ran across this page in the Heroku docs...

Naked domains, also called bare or apex domains, are configured in DNS via A-records and have serious availability implications when used in highly available environments such as massive on-premise datacenters, cloud infrastructure services, and platforms like Heroku.

For maximum scalability and resiliency applications should avoid naked domains and instead rely solely on subdomain-based hostnames.

Does anyone here speak Enterprise? What are the "availability implications" they're warning about?

(I notice that http://stackoverflow.com works no problem, so evidently there are viable alternate philosophies on this issue.)

I thought I had ssl set up correctly, but I discovered a problem.

This part is OK: ssldomain.com goes to https://ssldomain.com.

But this isn't working: www.ssldomain.com is going to http://anotherdomain.com, which happens to be the first vhost on the machine. In other words, I have a non-SSL vhost running on that server, and www.ssldomain.com is bouncing to that one.

I used this utiltiy and verified that my Commodo "PositiveSSL" certificate covers the domain both with and without the "www".

I'm using Apache 2.2.3-65.

Here's my config in /etc/httpd/conf.d/ssl.conf...

<VirtualHost *:443>
    ServerName www.ssldomain.com
    ServerAlias ssldomain.com
    DocumentRoot "/opt/deployed_rails_apps/ssl_site/current/public"

    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/www.ssldomain.com.crt
    SSLCertificateKeyFile /etc/pki/tls/certs/www.ssldomain.com.pem
    SSLCACertificateFile /etc/pki/tls/certs/www.ssldomain.com.ca-bundle
    SSLHonorCipherOrder On
    SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
    SSLProtocol all -SSLv2
    Header add Strict-Transport-Security "max-age=15768000"

    ErrorLog "logs/ssldomain.com-ssl-error_log"
    CustomLog "logs/ssldomain.com-ssl-access_log" common
    CustomLog "logs/ssldomain.com-ssl-deflate_log" deflate
    <Directory "/opt/deployed_rails_apps/rock_pebble/current/public">
        Options -MultiViews FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>
</Virtualhost>

# apachectl -S
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:443                  ssldomain.com (/etc/httpd/conf.d/ssl.conf:230)
*:80                   is a NameVirtualHost
         default server anotherdomain.com (/etc/httpd/conf/httpd.conf:232)
         port 80 namevhost anotherdomain.com (/etc/httpd/conf/httpd.conf:232)
Syntax OK

I'm new to SSL. I set it up on my CentOS 5 system running Apache 2.2.3-65. It appears to be working -- a can browse my site and the https protocol is displayed in the address bar.

Here's my SSL vhost config. Does it look OK? Did I make any major errors?

The intention is for all traffic for this particular site to be encrypted, so there's no vhost for port 80, just this one.

<VirtualHost *:443>
    ServerName www.mydomain.com
    ServerAlias mydomain.com
    DocumentRoot "/opt/deployed_rails_apps/my_app/current/public"

    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/www.mydomain.com.crt
    SSLCertificateKeyFile /etc/pki/tls/certs/www.mydomain.com.pem
    SSLCACertificateFile /etc/pki/tls/certs/www.mydomain.com.ca-bundle

    ErrorLog "logs/mydomain.com-ssl-error_log"
    CustomLog "logs/mydomain.com-ssl-access_log" common
    CustomLog "logs/mydomain.com-ssl-deflate_log" deflate
    <Directory "/opt/deployed_rails_apps/rock_pebble/current/public">
        Options -MultiViews FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>
</Virtualhost>

Possible Duplicate:
Difference between SSL products

I want to ensure that the traffic between the browser and my app is encrypted, and that visitors don't have to click through a scary "unverified certificate" dialog.

I'm looking over the SSL certificate options here at namecheap.com, and I'm having a hard time figuring out which one will do that for me.

In particular, can anyone tell me what the difference is between "Positive SSL" and "Essential SSL"?

Also, if I choose one of the options that doesn't support wildcards, will it cover my domain both with and without the "www" part?

Sorry for the totally newbie question. I haven't implemented SSL on a site before. Any help would be greatly appreciated.

I have a site hosted on a Slicehost VPS (diablocomics.com). The domain is registered with GoDaddy. I'd like to use Slicehost's DNS servers...

ns1.slicehost.net
ns2.slicehost.net
ns3.slicehost.net

I'm pretty sure I have the config on the Slicehost side OK, but I'm less confident of the GoDaddy side.

This was my attempt...

Although I entered "diablocomics.com" the resulting record is "@". Maybe that's correct.

There's no way to remove those records that say "informational". Does it matter?

And do I need to add records to cover both "diablocomics.com" and "www.diablocomics.com"?

I have a CentOS 5.5 VPS server.

I want to use RVM.

According to the console output when I run the RVM installer, RVM requires bash >= 4.1.

I just ran yum update. My bash version is now 3.2.25.

If I understand how yum works, that means that 3.2.25 is sort of the version of bash that "belongs with" my CentOS version, and it's the latest version I can get using yum. (Right? Or am I wrong about this?)

How can I get that on my CentOS 5.5 system?

To clarify, I understand that I can just download the source and install, but I'm hesitant to break out of yum's version management system. Is there a way to upgrade bash without disrupting yum?

I'm interested in installing Git on a CentOS Linux 5.4 host.

The installation instructions in the Pro Git book online offer two avenues: installing from source or using the host's package management system (in this case, yum).

However, neither is working for me.

Install from yum

When I try yum I get this result...

$ sudo yum install git-core
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.team-cymru.org
 * extras: centos.mirrors.tds.net
 * updates: ftp.osuosl.org
Setting up Install Process
No package git-core available.
Nothing to do

(Why would yum not find such a commonplace package? Does it have to do with Kernel.org being down?)

Install from source

The other option is to download the source.

The location of the latest stable version of Git, v1.7.6.1, given on the main Git website is http://kernel.org/pub/software/scm/git/git-1.7.6.1.tar.bz2.

However that link leads to a page saying "down for maintenance". It appears that kernel.org has been down for a couple weeks due to an attack.

Any suggestions?

Thanks!

I have an old application with URLs of the form...

http://apps.myserver.com/appname/viewItem.akt?p=123

I am replacing this old app with one that has URLs like...

http://appname.myserver.com/item/123

I've tried adding several different rewrite rules to httpd/httpd.conf and restarting the server, but I keep getting 404 errors.

A couple things I've tried...

RewriteEngine on

RewriteRule ^.*viewItem.akt\?p=([0-9]*)$ http://appname.myserver.com/item/$1 [R]

Or...

RewriteRule ^/appname/viewItem.akt\?p=([0-9]*)$ http://appname.myserver.com/item/$1 [R]

The result is always "The requested URL /appname/viewItem.akt was not found on this server", as if the rewrite rule weren't even there.

What I'm getting in the access log is...

[IP address] - - [09/Sep/2011:21:27:37 -0700] "GET /appname/viewItem.akt?p=1018 HTTP/1.0" 404 248

I tested all my regexes in Rubular to make sure they match the incoming request.

What am I missing?

In case it's relevant, the old application was a Java app running under Tomcat, and I had a ProxyPass set up like this...

(I'm showing these lines commented out, as they are when I'm trying to get the rewrite rule to work.)

# ProxyPass /appname http://apps.myserver.com:8080/appname
# ProxyPassReverse /appname http://apps.myserver.com:8080/appname

But that shouldn't matter right? As long as my rewrite rule matches the request it should send it along properly, shouldn't it?

MySQL version

mysql  Ver 14.12 Distrib 5.0.77, for redhat-linux-gnu (i386) using readline 5.1

Restarted the machine. Then tried...

$ ps aux | grep mysql
mysql     3298  0.0  0.8 136772 17216 ?        Rl   12:13   0:00 
  /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql 
  --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking 
  --socket=/var/lib/mysql/mysql.sock
xxxxx    3311  0.0  0.0   4000   680 pts/1    R+   12:13   0:00 
  grep mysql
root      3461  2.3  0.0   4624  1232 ?        S    11:55   0:26 
  /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql 
    --socket=/var/lib/mysql/mysql.sock --log-error=/var/log/mysqld.log 
    --pid-file=/var/run/mysqld/mysqld.pid --user=mysql

So mysqld is running.

However I can't make a client connection to it...

$ mysql -u root
ERROR 2002 (HY000): Can't connect to local MySQL server through 
  socket '/var/lib/mysql/mysql.sock' (2)

When I try to connect from a different machine using Sequel Pro I get the error...

"MySQL said: Lost connection to MySQL server at 'reading initial communication packet', system error: 61"

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also the usual user registration and login functionality that maybe should be protected.

I know that there is going to be some performance reduction with SSL because server and client have encrypt and decrypt. Also, from what I understand, encrypted data doesn't compress as much, so Apache's mod_deflate probably won't work as well.

How significant is the performance hit likely to be? I plan to do some testing, but nonetheless I'd be interested in any comments based on experience.

I'd like to run Apache and Tomcat on an RHEL 5 server with Apache handling Ruby on Rails apps (through mod_rails/Passenger) and Tomcat handling Java apps.

Under Apache, each Rails app will have a URL and vhost. The URLs are already configured in our DNS server to point to the machine.

Under Tomcat, each Java app has a URL like this: ourserver.ourcompany.com/app1, ourserver.ourcompany.com/app2, etc.

The server is already up and running with Tomcat 6 running on port 80 and serving several Java apps. I want to add Apache and reconfigure. I'm familiar with how to configure a sole Apache server to host RoR apps using Passenger. I just don't know how to get Apache and Tomcat to work together like that.

I've found various resources and discussions through Googling (for example, this one) but they tend to be a bit sketchy and incomplete or they don't seem to really match what I'm trying to do. The one I linked to seems to be for if you want to send all requests to Tomcat, not just certain ones and have Apache handle others.

Could someone suggest an example config for server.xml and httpd.conf, or perhaps point me to some resources that are more detailed?

SOLUTION

Apache needs at least execute permissions on all the parent directories of the vhost dir.

I'm trying to set up a Rails app running under Apache on CentOS 4.3. I'm using Phusion Passenger (mod_rails) I made sure the app deployment dir is owned by group Apache and the permissions are set to allow the group to read it.

In my Apache config I have...

<VirtualHost *:80>

  ServerAdmin [email protected]
  DocumentRoot "/home/sneedmoure/deployed_rails_apps/myapp/current/public" 
  ServerName myapp.com
  ServerAlias www.myapp.com
  ErrorLog "logs/myapp.com-error_log"
  CustomLog "logs/myapp.com-access_log" common
  CustomLog "logs/myapp.com-deflate_log" deflate

  <Directory "/home/sneedmoure/deployed_rails_apps/myapp/current/public">
    Order allow,deny
    Allow from all
#AllowOverride all       # Not sure whether I need this
    Options -MultiViews  # Passenger docs say to include this
  </Directory>

</VirtualHost>

When I try to access my app in the browser I get a 403 error.

In the error log I'm getting entries like...

[Wed Nov 25 03:01:19 2009] [error] [client 123.456.789.12] (13)Permission denied: access to / denied

I've tried different paths within the app and get the same result. It does work fine on my development machine.

Any notion what I'm doing wrong?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script...

# Establish a clean slate
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F # Flush all rules
iptables -X # Delete all chains

# Disable routing. Drop packets if they reach the end of the chain.
iptables -P FORWARD DROP

# Drop all packets with a bad state
iptables -A INPUT -m state --state INVALID -j DROP
# Accept any packets that have something to do with ones we've sent on outbound
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Accept any packets coming or going on localhost (this can be very important)
iptables -A INPUT -i lo -j ACCEPT
# Accept ICMP
iptables -A INPUT -p icmp -j ACCEPT

# Allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow httpd
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Allow SSL
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Block all other traffic 
iptables -A INPUT -j DROP

For context, this machine is a Virtual Private Server Web app host.

In a previous question, Lee B said that I should "lock down ICMP a bit more." Why not just block it altogether? What would happen if I did that (what bad thing would happen)?

If I need to not block ICMP, how could I go about locking it down more?

This is a follow up to a previous question where I asked whether my iptables config is correct.

CentOS 5.3 system.

Intended result: block everything except ping, ssh, Apache, and SSL.

Based on xenoterracide's advice and the other responses to the question (thanks guys), I created this script:

# Establish a clean slate
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F # Flush all rules
iptables -X # Delete all chains

# Disable routing. Drop packets if they reach the end of the chain.
iptables -P FORWARD DROP

# Drop all packets with a bad state
iptables -A INPUT -m state --state INVALID -j DROP
# Accept any packets that have something to do with ones we've sent on outbound
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Accept any packets coming or going on localhost (this can be very important)
iptables -A INPUT -i lo -j ACCEPT
# Accept ICMP
iptables -A INPUT -p icmp -j ACCEPT

# Allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow httpd
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Allow SSL
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Block all other traffic 
iptables -A INPUT -j DROP

Now when I list the rules I get...

# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  any    any     anywhere             anywhere            state INVALID 
    9   612 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 5 packets, 644 bytes)
 pkts bytes target     prot opt in     out     source               destination

I ran it and I can still log in, so that's good. Anyone notice anything major out of wack?

I recently installed MySQL on a new Mac OS 10.6.1 Snow Leopard system. MySQL seems to be running according to the control panel and the output of ps aux | grep mysql. However, on the command line the mysql command is not available because (I think) the dir /usr/local/mysql/bin is not in the PATH.

I could add this to /etc/bashrc...

export PATH=$PATH:/usr/local/mysql/bin

Yes, OK that worked.

But is that the right way to do it? Should I add it to /etc/profile instead? Or something else?

What would be a reasonable and logical directory into which to deploy my production Rails apps on a Linux system?

Some candidates...

/var/rails  <= There's a /var/www so this would be consistent with that 
               pattern. But I.T. guys have complained about stuff in /var 
               before.

/home/my_home_dir/rails  <= OK, not /var, but I'm not the only developer. 
                            Seems like it really ought to be a systemwide
                            location.

/home/rails  <= I don't know. That just seems weird.

/rails  <= Seems even weirder.

What is the least astonishing, most normal thing to do here?

(Background info -- a Rails app is a bunch of server side code written in Ruby along with a public dir containing JavaScript, CSS, and maybe a little HTML. The public dir is mapped to an Apache vhost. Apache handles the Ruby code through a module called Passenger or mod_rails.)

Thanks for the help, all. I think I'm going to go with /opt/deployed_rails_apps. (I like long, expository directory names, and tab completion.) /var/... is also a good place, but I've gotten stern grumbling from I.T. when I tried to deploy stuff there. If it were my own machine I might go with /var or /srv.

I installed Rubygems 1.3.4 on an RHEL 5 system. The way you install that is to download source and run setup.rb. I did not find a package for it through yum list available.

Now I'd like to uninstall it because I've decided to use a different version of Rubygems. There is no install log file or any list of where the installer put stuff. It isn't immediately clear from looking at setup.rb where things went.

Any thoughts?

I'm setting up up a new MySQL server and I'd like to give it the same set of usernames, allowed hosts, and passwords as an existing server (which is going away).

Would it work to just do a dump of the users table and then load it on the new server?

Is there a better way than that?

Our I.T. dept would like me to configure a MySQL server to use a non-default data dir (/data).

We're using MySQL 5.0.45-7.el5 on RHEL 5.

What is the general procedure for doing that?

Are there any caveats or gotchas I should know about before I get started?

What about RHEL's packaging system. Will it be harder to update the MySQL package if the data dir is not in its default location?