Ben Holness's questions

I am using a LocationMatch directive to determine whether or not to set CORS headers, but I'm having trouble getting it working properly.

For example, if the URI is /folder1/f/folder2/document1, then <LocationMatch "^/folder1/f"> works, but <LocationMatch "^/folder1/f/"> does not, however <LocationMatch "^/folder1/f."> does. Ideally I would end up with <LocationMatch "^/folder1/f/folder2">, but that doesn't work either.

I can't figure out why ^/folder1/f/ doesn't work. Ideally I want to see in a log somewhere what it's matching against, in case there's something happening that I'm not aware of.

Is there any way to have that output to a log somewhere?

I am running Ubuntu 22 and I have openvpn (client) setup to run as a service. I used to have one .conf file in /etc/openvpn and I recently added another.

When openvpn starts, or I restart it, it only connects to the vpn from the first .conf file and not the second.

If I run sudo openvpn --config secondvpn.conf it works fine and connects.

The script for the service, in /etc/init.d, says

# Description: This script will start OpenVPN tunnels as specified
#              in /etc/default/openvpn and /etc/openvpn/*.conf

I don't have any tunnels specified in /etc/default/openvpn, and both config files are in /etc/openvpn/ and have the .conf extension.

I have tried systemctl daemon-reload but that didn't seem to help.

I also tried commenting out the LimitNPROC line in /lib/systemd/system/openvpn@.service. (from OpenVPN won't start as a service with config file) but that didn't make a difference.

How do I get openvpn to recognize my second config file?

I'm setting up an NFS mount on some Ubuntu 18 servers, following these instructions.

I have followed all of the instructions and it works when (on a remote) I run

mount 10.0.0.7:/mnt/nfs_share /mnt/nfs_share

In the /etc/fstab file for the remote servers that are to be mounting the share, I have tried various options and ended up with the following line:

10.0.0.7:/mnt/nfs_share /mnt/nfs_share nfs defaults,tcp,_netdev 0 0

When I boot, it does not mount.

Here's the weird part. After booting, I check to see if it mounted and find out it didn't. If I type mount /mnt/nfs_share, it hangs. If I type mount 10.0.0.7:/mnt/nfs_share /mnt/nfs_share followed by umount /mnt/nfs_share followed by mount /mnt/nfs_share, it works fine.

Even weirder, if I type mount /mnt/nfs_share, it hangs. If I then remove it from /etc/fstab, and try again it says not found. Then if I re-add it and type mount /mnt/nfs_share, it works.

What am I missing?

I am using Postal and all is going well but suddenly Google is soft failing me for sending too many messages, but I haven't sent very many!

I want to check if someone unauthorized is using the server as a relay, but I couldn't find any mail.log in /var/log and the postal log is empty.

How can I find all emails being sent from this server? The OS is Ubuntu 18.04 LTS

Thanks!

I have a site that sends emails to users. One user in particular is not receiving emails. I have looked at the logs and I found:

Nov  9 21:27:22 ******** sendmail[28960]: 0A9LRK37028960: to=**********@bellsouth.net, ctladdr=********** (1000/4), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=31941, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (0A9LRKwX028961 Message accepted for delivery)

Nov  9 21:27:22 ******** sm-mta[28963]: 0A9LRKwX028961: to=**********@bellsouth.net, ctladdr=******************** (1000/4), delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=122066, relay=*************. [***********], dsn=5.6.0, stat=Data format error

There are hundreds of other emails to other email addresses that are working fine.

How do I get more information about "Data Format Error", or what things could I change to see if it resolves the error? Is it possible that the issue is with bellsouth.net?

The email is being sent via a PHP script using phpmailer. It is a multipart text/html with an attachment.

I am having some troubles getting Location or LocationMatch to work properly for some locations.

Is there a way to log what it's matching against somewhere?

I have a website that is protected with basic authentication, except for one file, one folder, and one rewritten URL location.

It looks like this:

<Directory /var/www/mydomain.com>
  AuthType Basic
  AuthName "Authentication Required"
  AuthUserFile "/etc/htpasswd.mydomain"
  Require valid-user
  Options Indexes  FollowSymLinks
  AllowOverride All
</Directory>

<Location /manifest.webmanifest>
  Satisfy Any
  Allow from all
</Location>

<Location /icons/>
  Satisfy Any
  Allow from all
</Location>

<Location /receive>
  Satisfy Any
  Allow from all
</Location>

manifest.webmanifest and files in the /icons/ folder bypass the auth, but /receive doesn't. The obvious difference is that receive isn't an actual file - it gets rewritten to /index.php for rendering.

How can I make it bypass the auth for /receive?

EDIT: The rewrite happens in a .htaccess file:

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}.php !-f
RewriteRule ^(.*)$ index.php?AppRouting=$1 [QSA]

I setup a new server a couple of months ago, running Ubuntu 18.04 LTS. I successfully installed certbot and created my certificates using the cloudflare DNS plugin.

It's now getting to be time for renewal, but when I run certbot renew (or various other certbot commands) I get the following error

# certbot renew
/usr/local/lib/python2.7/dist-packages/cryptography/__init__.py:39: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release.
  CryptographyDeprecationWarning,
Traceback (most recent call last):
  File "/usr/local/bin/certbot", line 7, in <module>
    from certbot.main import main
  File "/usr/local/lib/python2.7/dist-packages/certbot/main.py", line 2, in <module>
    from certbot._internal import main as internal_main
  File "/usr/local/lib/python2.7/dist-packages/certbot/_internal/main.py", line 21, in <module>
    from certbot._internal import cert_manager
  File "/usr/local/lib/python2.7/dist-packages/certbot/_internal/cert_manager.py", line 16, in <module>
    from certbot._internal import storage
  File "/usr/local/lib/python2.7/dist-packages/certbot/_internal/storage.py", line 79, in <module>
    def add_time_interval(base_time, interval, textparser=parsedatetime.Calendar()):
  File "/usr/local/lib/python2.7/dist-packages/parsedatetime/__init__.py", line 270, in __init__
    self.ptc = Constants()
  File "/usr/local/lib/python2.7/dist-packages/parsedatetime/__init__.py", line 2381, in __init__
    self.locale = get_icu(self.localeID)
  File "/usr/local/lib/python2.7/dist-packages/parsedatetime/pdt_locales/icu.py", line 56, in get_icu
    result['icu'] = icu = pyicu.Locale(locale)
AttributeError: 'module' object has no attribute 'Locale'

The output of locale -a is

# locale -a
C
C.UTF-8
en_US.utf8
POSIX

I have also run pip install cryptography --upgrade but that didn't change anything.

I am not sure what changed that broke it, and I can't figure out how to get it working!

I wish to add a file to the /etc/sudoers.d folder that includes a directive to allow www-data to run one specific script with no root password.

The directive is

www-data ALL=(ALL) NOPASSWD: /path/to/script.sh

If I visudo and add it to /etc/sudoers, there is no problem.

If I put that line in a file and copy it to /etc/sudoers.d, then visudo, it tells me that the file has a 'syntax error near line 1'.

Is there something else I need to put in the file, or something else I need to do to make it work?

I am running Ubuntu 18.

Thanks!

If, for example, one server wanted to create a separate VPN for every user on the system, that included all of their servers. There would be no internet routing, just separate VPNs between (user A and the server), and (user B and the server) etc.

I am moving some servers from Ubuntu 16 to Ubuntu 18 and I am having trouble getting php sessions and memcache working.

On the current (Ubuntu 16) setup, there are three servers sharing sessions using memcache (note: not memcached!).

I believe I have replicated the current setup on the new servers, but it doesn't work and I get the following error in the apache error log:

PHP Warning:  session_start(): Failed to read session data: memcache (path: tcp://10.32.82.6:11211?persistent=1&weight=1&timeout=1&retry_interval=15,tcp://10.32.82.7:11211?persistent=1&weight=1&timeout=1&retry_interval=15,tcp://10.32.82.8:11211?persistent=1&weight=1&timeout=1&retry_interval=15)

In phpinfo() I see that the session.save_path and session.save_handler are set correctly (as reflected in the log message above).

If I go to any one of the three machines, I can telnet to port 11211 on any of the other servers.

If I look at the logs (set to -vv), I can see stuff happening and quite a few "NOT_FOUND" statements, but I don't really know how to interpret these logs.

In /etc/php/7.2/mods-available/memcache.ini:

memcache.allow_failover="1"
memcache.max_failover_attempts="4"
memcache.session_redundancy="4"

On the current (Ubuntu 16) setup, I remember trying both memcached and memcache and figuring out that memcache was the right solution. Trying memcached on the new setup is my last resort, as I feel that memcache should work, and I am just missing something, or something has changed in Ubuntu 18 that I am not aware of.

I have a bash script that runs a bunch of MySQL commands, separated by user input.

Each time a query is run, the password must be re-entered.

I understand it's best to avoid putting the password on the commandline, so I am wary of asking the user for the password and then passing it in on the commandline to each command.

Is there a recommended way to do this without compromising security?

I recently migrated a system from an Ubuntu 12 based four-webserver setup to an Ubuntu 16 three-webserver setup in a new data centre . The system uses memcache for the session handler. The session is used to determine whether a user is logged in or not and which user is logged in. It worked perfectly on the Ubuntu 12 setup.

On the new Ubuntu 16 setup, every now and then when I login, I get immediately logged out (session disappears). The system also allows me as an administrator to switch between users (which basically changes the session data to the new selected user). When I do this, sometimes it will switch back to the old user when I navigate to another page.

This all sounds to me like the memcache session is not working 100% and I sometimes get old session data, either from when I was logged out, or when I was a different user.

How do I debug this to determine what the problem is? My google searches have found how to debug memcached but not memcache

Here is the relevant config from php.ini :

session.save_handler = memcache
session.save_path="tcp://10.32.82.2:11211?persistent=1&weight=1&timeout=1&retry_interval=15,tcp://10.32.82.3:11211?persistent=1&weight=1&timeout=1&retry_interval=15,tcp://10.32.82.4:11211?persistent=1&weight=1&timeout=1&retry_interval=15"

Here is the relevant config from memcache.ini :

extension=memcache.so

[memcache]
memcache.dbpath="/var/lib/memcache"
memcache.maxreclevel=0
memcache.maxfiles=0
memcache.archivememlim=0
memcache.maxfilesize=0
memcache.maxratio=0
memcache.allow_failover=1
memcache.session_redundancy=4

I run a server that sends emails through smtp.mailgun.org. I locked down the server to only allow outgoing SMTP on port 587 to smtp.mailgun.org.

The IP address for this domain recently changed and as a result my system stopped sending emails. As part of trying to figure out what had stopped working, I became aware of the downsides of using domain names in iptables rules as well as the fact that iptables does a lookup when you run the rule and saves the IP address at the time the rule is created, thus IP address changes in domains are not reflected in iptables.

From mailgun's status page, they say

Our infrastructure upgrades will result in more frequent changes to these IP addresses in the future and customers should ensure that they are only using our supported hostnames when connecting to the Mailgun service.

I was not notified of an IP address change, and I do not know if I will be notified of future changes.

What's the best way to manage this situation? Should I write a script that regularly checks the IP address for smtp.mailgun.org and updates iptables when it changes? (I am aware of the security risks in doing this, but perhaps they are worth taking).

I am setting up an apache2 server with a number of virtualhosts.

They are all working except for www.mydomain.com, which goes to the default virtualhost instead of the virtualhost I created for it.

The virtualhost file (www.mydomain.com.conf) looks like this:

<VirtualHost *:80>
    ServerName www.mydomain.com
    ServerAdmin info@mydomain.com
    DocumentRoot /var/www/mydomain.com/www
    ErrorDocument 404 "/error.php"
</VirtualHost>

If I change ServerName to www2.mydomain.com it works. If I change it back to www.mydomain.com it goes to the default virtualhost.

The default virtual host file (000-default.conf) looks like this:

<Virtualhost *:80>
    ServerAdmin info@mydomain.com
    DocumentRoot /var/www/mydomain.com/html
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/mydomain.com/html>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>
    ErrorLog /var/log/apache2/error.log
    LogLevel warn
    CustomLog /var/log/apache2/access.log combined
</VirtualHost>

One other thing to note, that may be affecting this, is that the hostname of the server (/etc/hostname) is www.mydomain.com

Is www. a special case? Why is this happening and how do I make it work like I want it to?

I am using Ubuntu 16.04, Apache2 Server version: Apache/2.4.18 (Ubuntu)

EDIT: I have confirmed that the problem was /etc/hostname having www.mydomain.com - I changed it to www-server.mydomain.com and now the www virtualhost goes to the right place. I still don't know why this happens.

I have setup postfix and spamassassin on Ubuntu 14.04.

I would like to set it up such that if the score of a message is above 5.0, it goes to one email account on my mailserver. If it's less that 5.0 it continues to the original destination.

I have tried rewrite_header To spam@mydomain.com but this just adds "spam@mydomain.com" to the To address and it doesn't actually go to the spam account.

I can't figure out what I need to do next. From what I have read I think I need either another program to do this, or I have to configure postfix to do this, but I can't find any information on how to do it.

Thanks!

I have an Ubuntu 12.04 server, freshly installed, however it is set to the wrong timezone. I tried to use dpkg-reconfigure tzdata to correct it, but I can't tell what I am selecting. When I move the cursor keys up and down I get @ characters next to the options (that don't disappear). All of my searching so far has found nothing, other than using dpkg-reconfigure console-setup, which has the same issue.

I am using putty to ssh to the system, there is no GUI installed. I want to know how to fix the keyboard issue so I can use it for other things. Trial and error eventually allowed me to select the correct timezone eventually, so that specific function is no longer an issue.

I am working on a multi-server system for a client. All of the servers are fresh installs (although two were installed a couple of months ago, five a couple of days ago).

They are all supposed to be the same version of everything, but when I uname -a the two that were installed originally have

3.2.0-36-generic #57-Ubuntu SMP GNU/Linux

and the five new ones have

3.2.0-29-generic #46-Ubuntu SMP GNU/Linux

I have done apt-get upgrade on all servers, but this doesn't change. Is it a big deal? The servers will be a replicated mysql setup and the mysql version is the same on all of them.

Is it easy (or worthwhile) to upgrade the #46 to #57 so they are the same through and through? They are the same hardware. Can you point me to some guides as to how to do this upgrade?

I am in the process of adding a new slave to a replicated MySQL setup. I'm proposing the following process:

1. clone one of the nodes to a new VM
2. start it with no networking
3. stop mysql
4. change the server-id in my.cnf to a new id
5. restart mysql and networking

Should this work correctly? Or will MySQL get confused because it used to be a different server id?

OS: Ubuntu 10.10

VM Platform: VMWare 5

MySQL : Server version: 5.1.49-1ubuntu8.1-log (Ubuntu)

I built a web application that runs on a virtual server for one of my customers. It includes the facility for them to upload files, but they now want to store those files on a server in their office.

The easiest way to do this would be to mount their file system over the internet directly onto the virtual server. I have experience of mounting NFS over an internal network, but I am not clear if it would work in this scenario.

Any thoughts? I can always write new software to transfer the files, but this would be an easy fix!

Note: The server in the office is Ubuntu 12 server running on a virtual server in a windows hyper-v environment. The VPS with the web app is Ubuntu 11.04