I am getting the following error email every week. It appears to be a problem with either cron, logrotate, or denyhosts. I'm not sure which.
Subject: Cron <root@vps> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
/etc/cron.daily/logrotate:
test: 91: /etc/hosts.deny: unexpected operator
Any suggestions?
My PHP-CGI started serving blank pages for no apparent reason until I restarted the process.
I want to know why.
Unfortunately the "production" configuration file of PHP has no error_log by default. My Nginx error log also displayed no errors relating to PHP. This is probably a hopeless case, but I am asking just in case.
Here is my setup
Any ideas what might have caused the error?
Update
I think I've isolated the problem. I've been using Monit to automatically restart PHP whenever it started blanking. My PHP error logs are blank.
But I figured out that if I disabled a Wordpress plugin called WP-SuperCache, my PHP stopped being reset every ~10 hours. So far my PHP has been running for 3 days straight. Does anyone have any suggestions about this?
When you have corrupted data: through packets, or hard drives, what kind of errors do you usually find?
Is it a bit tranposition (switched bits)?
Is it random noise? (flipped bits)?
And when you do get an error, how much corruption do you usually see? (just 1 or 2 bits or a whole block).
Or do you see any other patterns.
Do you use web statistics software like Awstats, Weblizer etc... (any other popular ones?)
Or do you prefer to use Google Analytics and embed the JavaScript in each page?
How do I setup an iptable setting to drop all IP packets that don't have my IP address on it? (do I even need to do this?)
This is the closest I can think of, but I think it doesn't quite work because I somehow need to be able to specify NOT destination AND source.
* filter
-A INPUT -i eth0 -d ! 1.2.3.4 -j DROP
COMMIT
I was reading an article about a recent website (astalavista.com) that was hacked.
The perpetrator wrote down how he did it:
[+] Connecting to astalavista.com:80
[+] Grabbing banner...
LiteSpeed
[+] Injecting shellcode...
[-] Wait for it
[~] We g0tshell
uname -a: Linux asta1.astalavistaserver.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:35:59 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
ID: uid=100(apache) gid=500(apache) groups=500(apache)
I tried searching to see if there was any remote injection vulnerability in Litespeed, but I could not find any. Some people claimed that the kernel was susceptible to the vmsplice() exploit, but doesn't this still require arbitrary code execution?
mysql> select username,password,email from contrexx_access_users where is_admin = 1;
+------------+----------------------------------+-----------------------------+
| username | password | email |
+------------+----------------------------------+-----------------------------+
| system | 0defe9e458e745625fffbc215d7801c5 | [email protected] |
| prozac | 1f65f06d9758599e9ad27cf9707f92b5 | [email protected] |
| Be1er0ph0r | 78d164dc7f57cc142f07b1b4629b958a | [email protected] |
| schmid | 0defe9e458e745625fffbc215d7801c5 | [email protected] |
+------------+----------------------------------+-----------------------------+
system:f82BN3+_*
Be1er0ph0r:belerophor4astacom
prozac:asta4cms!
commander:mpbdaagf6m
sykadul:ak29eral
How did they get rainbow table coverage up to 18 characters long? How complete are the md5 rainbow tables out there?
You can make an SSL certificate by using *.domain.com as the name.
But unfortunately, this doesn't cover https://domain.com
Is there any fix for this?
I was reading a website about the difference between stealthed and closed ports.
http://www.grc.com/faq-shieldsup.htm
A closed port will echo a packet if closed. However, a stealthed port will not respond at all.
Is it recommended to stealth all the ports you don't use? If so, how do you go about doing so?
When I edit my bind dns records, I need to add a trailing period for it to work. What is the point of this?
How come when I use everydns.net, they do not require me to add a trailing period?
Is this an implementation quirk?
What are the pros and cons between these two ways to synchronize your server?
It seems to me that your server would probably not drift more than 1 second every day, so ntpdate on a crontab would be ok. But I heard you could use redundant NTP servers here
http://www.pool.ntp.org/en/use.html
in order to maintain synchronized time in case of failure.
Do you have any suggestions?
I would like to use Google AppEngine, but it appears to require a cellphone to receive SMS for verification.
Is there any way around this, or any other option I can take?