rfmoz's questions

In a VRRP configuration I've been using /32 subnet mask but I've never know the reason behind.

Sometimes I've using the same subnet mask as the primary interface, like /24, and in some cases it works and int others, until I set up /32, it doesn't.

For example, on Mikrotik documentation points to that, but without explanation:

Note: address on VRRP interface must have /32 netmask if address configured on VRRP is from the same subnet as on router's any other interface.

It's really a requirement? On FreeBSD CARP I didn't find a similar requirement.

In a Nginx working as a proxy, I need to set the "Cache-Control" header on a response based on the size defined on their "content-length".

For example, if the response have "150" or less, "Cache-Control" must be "max-age=60", if not, "max-age=3600"

# curl -I 127.0.0.1/test_small.png
HTTP/1.1 200 
content-type: image/png
cache-control: max-age=60
content-length: 106

# curl -I 127.0.0.1/test_big.png
HTTP/1.1 200 
content-type: image/png
cache-control: max-age=3600
content-length: 250

Maybe it can be done easily if the content-lenght is a fixed value?

For a VPN configuration, I need to route a particular public subnet via the tunnel except one of them, because that IP is assigned to the VPN server.

But, because the configuation will fall into multiple particular client setups, I need to avoid define the gateway ip or interface, so I'm looking for the way to add a route to one IP via default gw

ip route add 1.1.1.1/32 gw vi default gw
Error: either "to" is duplicate, or "gw" is a garbage.

When a user log in a server with systemd, the PAM logic execute pam_systemd.

With that module, the users are registered under the systemd control group. This is an example of two users (root and a normal user) login in a server:

# systemd-cgls
Control group /:
-.slice
├─user.slice
│ ├─user-0.slice
│ │ ├─session-5233.scope
│ │ │ ├─13309 sshd: root@pts/0
│ │ │ ├─13367 -bash
│ │ │ ├─13447 systemd-cgls
│ │ │ └─13448 pager
│ │ └─[email protected]
│ │   └─init.scope
│ │     ├─13312 /lib/systemd/systemd --user
│ │     └─13313 (sd-pam)
│ └─user-1000.slice
│   ├─session-5236.scope
│   │ ├─13385 sshd: user1 [priv]
│   │ ├─13443 sshd: user1@pts/1
│   │ └─13444 -bash
│   └─[email protected]
│     └─init.scope
│       ├─13388 /lib/systemd/systemd --user
│       └─13389 (sd-pam)

But that behaviour was optional in Debian 8 (already with systemd), and in Debian 9 you have the option to disable with pam-auth-update and if you do all seems to work equal.

Why is needed that agrupation over the users under cgroups? What happens when it is disabled?

With the following rules inside the nftables input chaing:

tcp dport 21 ct state established,new counter accept
tcp dport 20 ct state established,related counter accept
tcp dport 1024-65535 ct state established,related counter accept

The pasive FTP connections can login but the data connection can't be established.

The VMware document titled "Timekeeping in VMware Virtual Machines" have the following referente to the issues with the time drift:

If the virtual machine is running too slowly, perhaps as a result of competition for CPU time from other virtual machines or processes running on the host machine, it might be impossible to feed the virtual machine enough interrupts to keep up with real time. In current VMware products, if the backlog of interrupts grows beyond 60 seconds, the virtual machine gives up on catching up, simply setting its record of the backlog to zero.

Where is this backlog counter and how can I read it to monitor this behaviour?

How is it possible to reset the filter in csysdig and get the default that is present when the program starts?

Postfix allow in therir configuration the option "syslog_facility" wich permit change the facility from the default "mail".

But, is it possible to change the default socket "/var/spool/postfix/dev/log" or "/dev/log" to other destination?

Taking for example this hierarchy from systemd-cgls:

└─user.slice
  ├─user-1000.slice
  │ ├─[email protected]
  │ │ └─init.scope
  │ │   ├─3262 /lib/systemd/systemd --user
  │ │   └─3263 (sd-pam)  
  │ └─session-3.scope
  │   ├─3260 sshd: user1 [priv]
  │   ├─3362 sshd: user1@pts/1 
  │   ├─3363 -bash
  │   └─3378 ssh-agent -s
  └─user-0.slice
    ├─session-1.scope
    │ ├─3151 sshd: root@pts/0    
    │ ├─3252 -bash
    │ ├─3625 systemd-cgls

If I set a limit for user.slice, for example 5M of memory, the Memory line clearly report it:

systemctl status user.slice
● user.slice
   Loaded: loaded (/etc/systemd/system/user.slice; static; vendor preset: enabled)
   Active: active since Mon 2016-08-22 11:32:13 CEST; 52min ago
    Tasks: 12
   Memory: 3.1M (limit: 5.0M)
      CPU: 1.275s
   CGroup: /user.slice
...

The user-1000 slice have the limit applied, if I stress the system with this user I can see it. But the status don't report the limit in this child slice:

systemctl status user-1000.slice
● user-1000.slice - User Slice of user1
   Loaded: loaded (/run/systemd/transient/user-1000.slice; transient; vendor preset: enabled)
Transient: yes
   Active: active since Mon 2016-08-22 11:32:42 CEST; 1h 8min ago
    Tasks: 6 (limit: 12288)
   Memory: 856.0K
      CPU: 521ms

Following the proc way I can see that the user-1000 process belong to the user slice:

# cat /proc/3260/cgroup 
10:memory:/user.slice/user-1000.slice
...

And checking directly inside the /sys/:

root@server1:/sys/fs/cgroup/memory/user.slice# cat memory.limit_in_bytes 
5242880
root@server1:/sys/fs/cgroup/memory/user.slice# cd user-1000.slice/
root@server1:/sys/fs/cgroup/memory/user.slice/user-1000.slice# cat memory.limit_in_bytes 
9223372036854771712

How is possible to know if a child process/slice have a limit defined in a parent cgroup?

Using iptables is it possible to block fragmented packets with this rule:

iptables -A INPUT -f -j DROP

But there isn't a equivalent in nftables. There is any way to do it?

CPU frequency governor can scale the CPU frequency up or down in order to save resources.

In a physical server usually have sense, but I don't know if this is applicable for a virtual guest running under VMware.

Does make sense in a custom kernel avoid the option CPU Frequency scaling?

In various linux servers I see how the permissions of the /etc/resolv.conf file change automatically.

In state normal:

-r--r--r-- 1 root root 103 Jul  4 11:50 resolv.conf

In changed state:

-r--r----- 1 root root 103 Jul  4 11:50 resolv.conf

I installed auditd for monitoring it, and these are the two entries between the change:

type=PATH msg=audit(07/04/2012 12:20:02.719:303) : item=0 name=/etc/resolv.conf inode=137102 dev=fe:00 mode=file,644 ouid=root ogid=root rdev=00:00 
type=CWD msg=audit(07/04/2012 12:20:02.719:303) :  cwd=/ 
type=SYSCALL msg=audit(07/04/2012 12:20:02.719:303) : arch=x86_64 syscall=open success=yes exit=3 a0=7feeb1405dec a1=0 a2=1b6 a3=0 items=1 ppid=1585 pid=3445 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=hostid exe=/usr/bin/hostid key=(null) 

type=PATH msg=audit(07/04/2012 12:50:03.727:304) : item=0 name=/etc/resolv.conf inode=137102 dev=fe:00 mode=file,440 ouid=root ogid=root rdev=00:00 
type=CWD msg=audit(07/04/2012 12:50:03.727:304) :  cwd=/ 
type=SYSCALL msg=audit(07/04/2012 12:50:03.727:304) : arch=x86_64 syscall=open success=yes exit=3 a0=7f2bcf7abdec a1=0 a2=1b6 a3=0 items=1 ppid=1585 pid=3610 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=hostid exe=/usr/bin/hostid key=(null) 

any ideas about the change of permissions?

FIXED: puppet was configured and running on the server, it changed the file.