Luke's questions

I received an email from AWS that instructs me to renew my SSL certificate for my domain.

My certificate is managed by ACM and my DNS is hosted in Route 53.

I follow the instructions provided on this page (I'm using DNS verification):

https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.html

However, after I follow the instructions I can see that the new certificate has appeared in ACM:

Status: Issued
In Use: No
Renewal eligibility: Ineligible

I can also see that in Route 53 a new CNAME record has been added.

Now, the document that outlines the steps to renew the certificate doesn't provide any next steps OR, if no extra steps are required, what the process is after the new certificate has been renewed.

My assumption is that once the old certificate expires that the new one automatically takes over, but, I have no way of telling if this is actually what is going to happen or not.

Are there any other steps I need to take after renewing a certificate in ACM with Route 53 CNAME validation?

I'm relatively new to AWS and I'm trying to design an infrastructure for my application and I'm wondering if I should use one or multiple VPC's within a single region.

My application consists of a few different stacks. E.g. I have a logging/monitoring stack that is utilising a number of EC2 instances. I also have MongoDB cluster and a RabbitMQ cluster each using a wide number of instances. Next to this I have my actual application stack also consisting of a number of EC2 instances.

My question is, if I should run each of these stacks in a single VPC or each in their own VPC? If I should/can run these stacks in their own VPC, then most of these VPC's should only be accessible to my application. If so, is it then possible/recommended to front each VPC with an ELB or are there other best practises?

I have a situation where I pipe the output of ffmpeg into a PHP script for some processing. I might have a few of these processes running at any given time and I figured to start and stop them I might use Supervisor.

However, I'm running into the problem where I can start a new process but where I can't successfully stop it. I'm trying to execute the following command:

ffmpeg -i http://mystream.com -v 0 -f s16le -acodec pcm_s16le - | php process.php

To make the "piping" work I use the following for the command in Supervisor:

[program:process]
command = /bin/bash -c 'exec /usr/bin/ffmpeg -i http://mystream.com -v 0 -f s16le -acodec pcm_s16le - | php /home/me/process.php'

This seems to be working and starts the whole process just fine, however, when I stop the process using supervisorctl:

stop process

I see with an ps aux that the ffmpeg process is still running. The php process.php seems to have been killed though.

What is the correct way to start and stop a piped command with Supervisor?

I'm trying to restart Supervisor through my Ansible Playbook but I seem to be stumbling into an issue with the supervisor module for Ansible.

In my Supervisor config I have defined a program:

[program:process]
process_name=%(program_name)s_%(process_num)02d
command=/home/box1/workers/bin/process
numprocs=64
directory=/home/box1/workers/bin
autostart=true
autorestart=true
startretries=5
stderr_logfile=/tmp/%(program_name)s-err.log
stdout_logfile=/tmp/%(program_name)s-out.log
user=root

And this works fine. However, when I try to restart Supervisor through Ansible I get the following error:

failed: [box1] => {"failed": true}
msg: program:process: ERROR (no such process)
program:process: ERROR (no such process)

My Ansible task configuration looks like this:

- name: Restart Supervisor
  sudo: yes
  supervisorctl: name=program:process state=restarted config=/etc/supervisor/supervisord.conf

For the name parameter I have tried program:process, program, program: and process but none seem to work. I'm currently on Ansible 1.5.4.

I'm trying to create a high-availability environment for my OpenVPN servers. I do this by having two identical VPN servers and in my client config specify multiple remote's:

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote vpn1 1194
remote vpn2 1194

remote-random

This seem to work. I have a Vagrant environment with two VPN servers and two clients. Once the network runs and I stop OpenVPN on one of the VPN server the other server takes over.

However, before the other server takes over there is a long time before it actually does this. If my clients ping each other it takes about 3 minutes before the pinging continues. My guess is that the clients are trying to reconnect and that the time out is the issue here.

In my OpenVPN client.conf I have played with the following settings but it doesn't seem to make any difference (yes, I restart OpenVPN on the clients after changing the config):

connect-retry 2
connect-retry-max 2

How can I adjust the connect time out on the clients to make them switch faster to a different OpenVPN server?

I have a small OpenVPN based network tying together a bunch of VPS's and I noticed that when I add a new client and restart the OpenVPN server to expose the IP address of the new client, the already connected clients will stall for 1 to 2 mins after which they will be able to see the OpenVPN server again.

The way I tested this is by having my already connected VPN clients to ping the VPN server (ping 10.8.0.1). When I add a new client I create a file containing the IP address of the new client in the ccd/newclient file. E.g:

ifconfig-push 10.8.0.5 10.8.0.6

After doing this I restart my OpenVPN server with service openvpn restart. At this point the new client is pretty much able to see the server immediately, but the already connected clients will stall for 1 to 2 minutes after which they will start pinging again.

I tried using service openvpn reload on the VPN server instead but the behaviour seems to be the same.

What is the best way to add a new client to an existing OpenVPN network without impacting the already existing clients in the network?

I'm currently in the process of setting up OpenVPN across multiple data centres on Linode. The OpenVPN set up is working great and I'm now focusing on getting my firewall set up so that my public and private IP's provided by Linode are protected.

However, I seem to be running into an issue with this. On my VPN server, when I set up my firewall and reboot the VPN server, the firewall is loaded at start up automatically, however, none of my VPN clients seems to be able to ping the VPN server (located at 10.8.0.1). When I bring down my firewall on the VPN server (iptables -F), the clients are capable of pinging the VPN server. When I then reinstate my firewall on the server (iptables-restore < /etc/iptables.up.rules) the clients are still capable of pinging the VPN server.

I would assume that the firewall would either block or not and I can't seem to figure out why this behaviour occurs.

These are my iptables on the VPN server:

*filter

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allows all outbound traffic
# You can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allows SSH connections
#
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
#
-A INPUT -p tcp -m state --state NEW --dport 30000 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

# prevent attacks on port 22.
-I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
-I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 90 --hitcount 4 -j DROP


# OpenVPN
-A INPUT -i eth0:0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
-A INPUT -i eth0:1 -m state --state NEW -p udp --dport 1194 -j ACCEPT

# Allow TUN interface connections to OpenVPN server
-A INPUT -i tun+ -j ACCEPT

# Allow TUN interface connections to be forwarded through other interfaces
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

COMMIT

# NAT the VPN client traffic to the internet
*nat

-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

COMMIT

I have RabbitMQ running behind Apache mod_proxy so I can access the web management interface over port 80:

<VirtualHost *:80>
    ServerName rabbit.example.com

    ProxyRequests Off
    ProxyPreserveHost On

    <Proxy *>
       Order deny,allow
       Allow from all
    </Proxy>

    ProxyPass / http://localhost:15672/
    ProxyPassReverse / http://localhost:15672/

    <Location />
       Order allow,deny
       Allow from all
    </Location>
</VirtualHost>

This seems to work however, when I e.g. go to the Queues page and I click on one of the listed queues I get a Not Found page and a URL that looks something like this:

http://rabbit.example.com/#/queues/%2F/myqueue

The same thing goes for Connections, Channels etc. I only seem to be able to access the top pages but anything deeper seems to result in a Not Found.

What is the correct way to configure RabbitMQ behind Apache mod_proxy?

I have a problem executing a remote command through SSH that has special character in it. I'm trying to export a database from MySQL for back up purposes. This is the command I have in my local script:

#!/bin/bash
ssh user@host "mysqldump -u dbname -p'p$ssw0rd' --lock-tables=false dbname > ~/sites/mysite/backup/dbname.sql"

As you can see I'm using the ' characters around my password. When I execute this script I get the following error:

mysqldump: Got error: 1045: Access denied for user 'dbname'@'localhost' (using password: YES) when trying to connect

However, when I ssh into the machine manually and execute the command it executes just fine. I get the impression that through executing the command through ssh something is lost and the password doesn't come through.

How can I execute my command with special characters through ssh?

On my NFS server (Ubuntu) I have in /etc/exports the following:

/share 192.168.89.1/24(rw,no_root_squash,async)

However, I have a new machine which is not in 192.168.89.* IP range, it's in 192.168.92.* instead. How can I make this machine access my NFS server?

I've set up Cacti on my web server and it gives me graphs for Load Average and Memory Usage and such but I'd also like to monitor how much bandwidth my site is using.

I've been reading some of the Cacti documentation and I tried searching with Google but I can't seem to find anything that explains to me how to do this.

UPDATE:

Could it be that I shouldn't be looking at Apache for bandwidth measurement but at a lower level device? I'm currently running my LAMP stack on a EC2 instance if that makes a difference.

UPDATE 2:

Since asking this question I've actually switched from Cacti to Munin. Not that one is better than the other but simply because Munin suited more with my needs since out of the box it showed me everything I needed to know. I might still use Cacti in the future though.

I'm interested in the possibilities of master/slave replication for Derby in client/server mode (if at all possible). However, I'm unable to find any material that either explains it in a decent fashion or is able to convince me that master/slave replication doesn't exist for Derby.

Any pointers to decent reading material are very much appreciated.

I have some Trac installations running on my Ubuntu/Apache web server and I've noticed that when I monitor the CPU usage while accessing Trac pages that it is not uncommon for the CPU to spike up to a 100%. It concerns me that this happens with just one user accessing the system.

Is there a way I can make accessing Trac on my web server less CPU intensive?

I run a number of virtual servers on my network and I want to be able to easily clone base installations of Ubuntu Server. I use the VBoxManage command to clone the actual hard disk and I then create a new profile for my VM and copy over the settings of the original VM.

However, when I boot into the cloned VM, there seems to be a network problem. When I issue a PING I get the message "Network unreachable". I traced it down to the fact that the virtual network card of the cloned VM has a different MAC address then the original VM. When I copy the MAC address the clone seems to work fine.

How can I have the cloned VM have it's own MAC address?

After installing a fresh Ubuntu server (I personally use 8.04 LTS) what do you do to optimize it in terms of memory consumption, disk usage and speed? What services and pre-installed packages do you remove to make your system as lean and mean as possible before you start building your server?

I run an Ubuntu desktop with a bunch of virtual servers in Virtual Box to test stuff out, etc. In the past I have also been connecting to other kinds of remote VPS Linux boxes. Currently my .ssh/known_hosts file has a whole bunch of keys in it, most of which are not being used any more.

I want to clean up my .ssh/known_hosts file, but how do I know which key belongs to what host? I.e. how do I know which keys I can safely remove and which ones I should leave alone?

I'd like to create an image of my Windows partition (so a can restore it later) and I was wondering if anyone could recommend any utilities that are capable of this? Either command line or GUI (pref. Gnome) would be OK.

I've been using Linux for a couple of years now but I still haven't figured out what the origin or meaning of some the directory names are on Unix and Unix like systems. E.g. what does etc stand for or var? Where does the opt name come from?

And while we're on the topic anyway. Can someone give a clear explanation of what directory is best used for what. I sometimes get confused where certain software is installed or what the most appropriate directory is to install software into.

Is there a limit of the number of databases a single MySQL server can handle?

I need to set up a mail server on an Ubuntu Linux box. Instead of starting from scratch I'm looking for an all in one package, like a bundle that offers a complete but minimal and light weight solution.

I'd like this bundle to have at least the following characteristics; based around Postfix, some form of spam handling and a web interface the manage accounts etc.