Anthony's questions

Warning: I know up front that this is a question asking both for resources and opinions. Ideally, feedback/answers could address the spirit of the question, rather than shout it down. By spirit of the question, I mean feedback could suggest keywords or broader/narrower ways to ask that would help me and other users with similar questions understand the underlying concepts of this question.

Back in the day (circa 2010) when I used to work a help desk at a university, when someone came in reporting issues with slow internet, we would run one of many online network speed tests (like speakeasy or something similar) to establish a baseline of what "slow" looked like before troubleshooting.

After any changes that we thought would improve network speed, we would run the same speed test again, and assuming it had the positive results we were hoping for, we would then do a few "real world" speed tests. At the time, this constituted visiting some known slow-to-load ("heavy") websites like:

• cnn.com
• pitchforkmedia.com

These would give both the user and the support agent some confidence that the increase in throughput wasn't just in a test environment. If the user thought puppiesandkittens.com was slow to load before, but it was a relatively light page to begin with, going to this page again after making changes wouldn't really demonstrate that all sites would load faster.

Is there any sort of directory of pages that are slower-to-load due to network demands that can be checked as a sort of "real world" speed test beyond the dedicated 'download one file, upload one file' online speed tests out there?

Note that I'm not looking to stir up any trouble either, ie to encourage everyone to list their favorite slow site in some disparaging way. There could be a lot of legit reasons some sites require more bandwidth than others. But relying only on tight lab-condition sites that do one or two requests isn't going to give a real impression of the network speed compared to actually seeing a page in the wild deal with tons of graphics, content, streaming, etc.

I've got my .htaccess file set to the following:

 Header set MyHeader "I'm Set!"

If I go to that directory (http://example.com/test/), which has no default index file, and view the network activity (in this case with Chrome), I can see that the header is being sent. If I go to a php file (http://example.com/test/test.php), the header isn't sent.

I've created an index.html (with simply <pre>Hi as the content) and it gets sent. I change the file name to .php, no header. If I change the orignal test.php to test.html, it outputs the garbage-looking code, and the header is sent. If I change test.php to test.png, I get a broken image icon, and the header is sent.

So, without testing beyond the above in terms of mime-type and file extensions, it appears only .php files (legit or otherwise) are either set to not have .htaccess rules apply or specifically the mod_headers directives. But I don't know how to test for this and because it's a shared server, I don't have httpd.conf access to poke around.

Any ideas as to why apache would skip sending headers for php files?

I've also tried:

 <FilesMatch "\.(php)$">
     Header set MyHeader "I'm Set!"
 </FilesMatch>

So if I go to my site without indicating the protocol, I'm taken to:

http://example.org/test.php

But if I go directly to:

https://example.org/test.php

I get a 404 back.

If I go to just:

https://example.org

I get a totally different site (a page about martial arts).

I went to the site via https not very long ago (maybe a week?) and it was fine.

This is a shared server, as I understand it, and I do not have shell access, so I'm limited to the site's CPanel to do any further investigations. But when I go to:

example.org:2083

I'm taken to https://example.org:2083, which, if someone has taken over the SSL port, could mean they have taken over the 2083 part as well (at least in my paranoid mind). I'm made more nervous by the fact that the cpanel login page at the above address looks very new (better, really) compared to the last time I went to it over the weekend.

It's possible that wires got crossed somewhere after a system update, but I don't want to put in my name username and password in case it's a phishing attempt.

Is there any way to know for sure without shell access to know for sure if someone has taken over?

If I look up the IP address for the host name, the IP address matches what I have on a phpinfo page I can get to over http. If I go to the IP address directly on port 2083, I get the same login mentioned above (new and and suspiciously nice). But the SSL cert shows as good when I go this route. So if that's the case (I know the IP is right, the cert checks out, and there isn't any DNS involved), is that enough to feel safe at that point of entry?

Finally, if I can safely log in via the IP, does anyone have any advice on where to check first on CPanel for why the SSL port is forwarding to a site on karate?

Thanks.

This might be more of a PHP and SO question, but since it deals with HTTP codes, I thought I'd ask here first.

So I'm building a very simple user authentication backend that basically checks the (fairly secured) session tokens to confirm if the user's session exists and is valid. If all checks out, the page loads, if authentication fails, they are redirected to the login page.

I wanted to use the 401 HTTP status code instead of the 302, so that it would reflect at the browser level and in the server logs that the browser was attempting to access a non-yet authorized page, but this has not been successful.

Following several examples, I've tried setting the ErrorDocument directive in the .htaccess file, but no luck (a 404 redirect works fine). I've sent various combinations of headers via the script, the three that seemed most promising were:

 header('Location: http://mysite.org/login.php', 1, 401);

The browser shows a 401 response, but no redirect.

 header($_SERVER["SERVER_PROTOCOL"]." 401 Unauthorized"); 
 header('Location: http://mysite.org/login.php');

The browser redirects, but shows the original page redirect as a 302.

header('WWW-Authenticate: Basic realm="My Realm"');
header($_SERVER["SERVER_PROTOCOL"]." 401 Unauthorized");
header('Status: 401 Unauthorized');
header('Location: http://mysite.org/login.php');

With the last one, I've tried it with and without the Location header, with and without the Status, but in all combinations it only triggers the browser's Basic authentication dialog.

So is there a right or recommended way to handle a web-based (non-browser default) unauthorized redirect?

I know that I can just go with a normal 302, but I want to know if that's the only option (or only standards-compliant option) before I give up.

I am really confused as to what Samba actually does and how it works. Here's what I'm hoping it does:

I set up a Samba server on my LAN, and everyone will be able to see each other's shared files and swap them.

But some of the documentation makes it sound like it will just allow Mac/Linux computers to see Windows computers.

Other bits of the documentation make it sound more like a local server, where a Linux machine would install Samba and they would see everyone and be visible to everyone, but that won't change if anybody else can see each other.

While still other things I've read make it seem more like a file-server, where everyone sees each other but file transfers are not peer-to-peer but instead need a host disk for files to act as go between.

So, assuming I'm even in the right ballpark of what Samba does in terms of my goal of total cross-visibility on the network, I am left with needing to know what I'd need to set up the server and whether it can be done and is worth it...

DD-WRT's article on Samba is a bit ambiguous. One second it sounds as if I can run the server on micro as long as it's set up on a usb drive, but then it also sounds like micro can't run it at all, etc.

If I can run it from a usb-connected drive, I still need to know if the files are actually stored on that drive. The dd-wrt article mentions:

You can run a Samba server on your main computer and run a client on your router (thus gaining writable storage for the router) or you can use Samba to share a drive connected (typically by USB) to the router among all the computers connected to your network.

That one part "to share a drive...among all the computers" makes it sound like the only benefit I get from Samba is a share drive that any OS on the network can see, but they still won't see each other. But I'm very hopeful I'm misreading this.

If the computers can see each other but still need the disk, how much space is generally a good idea? I'm basing this on the idea that the drive is a temporary store point. Obviously I'd have to get a drive big enough to store everything people wanted to share if the drive is a full-on file server.

If I do have this all wrong, is there any software that achieves what I have in mind? Something that connects to the main router to bridge all clients?

I am trying to provide a way for users on my LAN to "register" with the Network admin (me) without having to either a) host a page on my computer b) host a script on the central server (since it is only a router, not really a solid HTTP server) or c) sign up for a Dynamic Domain in order to either either of the first two and avoid the confusion of sending out a URL to a link to a local IP.

Is there a simple way to display the local IP address on screen via a client-side script? I'm thinking maybe I could have an iframe that points to some generic url with some javascript in the path, so that I can have the users go to a non-local site, and the iframe would pop up with their IP address that they can then enter into a form in the main remote page.

If all else fails, is there a way for them to look up their IP that is cross-platform and doesn't involve using the command line (I think the first, even if impossible, is probably more realistic than the second).

I am trying to build pdftk, which apparently requires gcj. Since it is not already in my path, I can either add the directory holding gcj to my path or define the path in the pre-made Makefile.

The problem is that I have no idea:

a) where gcj is, and b) whether it exists on the server at all (at least in such a way I can add to path).

This problem has come up more than once in my previous attempts to build binaries from source, so I'm hoping I can ask two questions at once to fix my current issue and avoid this issue in the future...

1. Is there a way to add EVERYTHING I have read/execute permission into my path? Sub-question, is this a bad idea?

2. Does whereis only search my path? Is there some equivalent for finding files/directories I need without having to search the ENTIRE host and getting access-denied for every other directory?

3. Is there a way I can know for sure if a library/binary is definitely not available vs. just not in my path?

4. Is there a way to tell, specifically for gcc if gcj is available?

5. Can I compile gcj to my user directory without having to compile all of gcc with it?

6. Is there a (universal) way, when building a binary, to flag the compile or make file to deal with any dependencies as it finds them rather than simply failing?

7. Does a typical user on a shared-host situation have the ability to use the OS package library to get packages at the user-level?

I created a test directory called "rewrite" and put a .htaccess file inside with a rewrite rule.

When I go to that URL through my browser I get a 500 Internal Server Error.

So I thought it was my rewrite syntax and tried a few changes, same thing. Then I commented out everything with # on each line. Same thing.

Then I noticed that the directory doesn't show up in its parent directory (which has no index file).

So then I tried changing the filename to .htaccess_bad, and the directory shows up.

Then I changed it back to .htaccess and emptied the file, so it a blank file. The directory still shows up.

Finally I added a single # to the .htaccess file, and viola, the directory disappears again.

I though the issue might be that the parent directory has a .htaccess file with a [R] flag on its rewrite rule, but removing that didn't fix the issue.

Any help on what to try next or why this is happening?

Quick update:

Even having a line break is causing issues. (so it has to be truly empty it seems).

Here is the basic situation/topology of the network I manage:

• Residential, but we are a co-op, so we have a business-class contract with ISP.

The residents are college students, so there is quite a bit of everything, including P2P (torrenting), gaming, file sharing (internal), as well as crucial needs for the basics like getting to websites for school/homework, email, FTP, etc. Basically, I get bad reviews when members can't have their fun, but then legitimate complaints when someone can't turn in an assignment.

• There are at most 31 residents, but we are not always at full capacity. Of course, plenty of residents connect multiple devices (Laptop, Desktop, Mobile) all at once.

• The property is spread out over 3 buildings, 2 of which are connected physically, the third is stand-alone but only a few steps from the main two buildings.

Here is the basic layout of the property:

==========================                   =====================
|                        |                   =            |Router=
|                        |                   =             ----- =
|   Main House           |                   =    Annex          =
|   (3 stories)          |                   =  (2 stories)      =
|(first floor is commons |====================  (No commons)     =
| area, ie TV Room,etc)  | Breeze Way        =                   =
==================================================================

                                        ======================
                                        =                    =
                                        =    Cottage         =
                                        =   (2 Stories)      =
                                        =  (No Commons)      =
                                        ======================

The cable comes into a closet in the Annex where it goes from the modem (ISP provided) to the D-Link DIR-625 Wireless router. So from the very start the set up is not ideal, as one of the WAPs is in a closet on the ground floor. C'est la vie.

Then it spreads out like so:

DIR-625 (DHCP Router and 
- Netgear 8-port switch (2nd floor Annex)
- Linksys 5-port switch (1st floor Annex)
- Netgear 8-port switch (Cottage)
    - D-Link WBR-1310 Wireless Router acting as WAP
- Netgear 16-port switch (Main House)
    - D-Link WBR-1310 Wireless Router acting as WAP for Common's Area
    - D-Link WBR-1310 Wireless Router acting as WAP for 2nd and 3rd floor

Okay, that's about all the backstory anyone should ever need. Sorry if that was a bit much, but when I try to get advice from friends, they tend to think either "Only 31 people, what's the problem?" or "3 buildings, and you don't have a T1?" etc, etc. It's a fairly simply network in terms of what we need and our small population, but made very complicated by our physical layout.

Oh, and we are paying for 10 down/ 1.5 up, as far as service.

Now, here's the actual question (one of many, I'm sure):

I need a QoS system that is as low maintainance as possible. Not only to make my job easier, but to make it so the next IT officer that gets this fantastic job after me doesn't have to do what I did, which was basically start from scratch.

Ideally, this what I want in terms of QoS:

• Bob really wants to play WoW. It's 2pm and no one is home but him. He gets dynamite throughput.

• Half an hour later, Joe gets home and his torrenting program immediately starts up. He is a good co-oper, so he has his client capped for uploads, so he and Bob are both getting pretty good bandwidth.

• Bob signs out of WoW and goes off to class. Joe's torrents are now going super-fast.

• Jill gets home an hour later. She goes to check her email and watches some Hulu. She is in no way aware that Joe is torrenting. Joe notices his torrents are doing pretty good.

• Everyone else comes home and each of them are doing a mix of all of the above. Everyone doing basic HTTP stuff or email think "I love our network admin." All of the gamers, file-sharers, and Skype-ers think, "This will be even more awesome when everyone goes to bed!" No one comes by my room with murderous intent. No one is crying to me how the girl down the hall snuck in with scissors to literally cut off their torrents so they could read their homework.

Right now, I have the main router (the DIR-625) set up with its built-in QoS and with the DNS ports set to highest, the HTTP, email, and whatnot set to 2nd highest priority, and with anything higher than 3000 set to lowest priority.

But even so, this doesn't stop the fact that if Joe is torrenting 50GB worth of junk, and Bob is gaming all day, that they are just using MORE of the bandwidth. They get a lower priority, but they basically get all of the router's attention and all of the bandwidth.

I've taken to blocking people if they seem to be using more than 25% of the current network activity, but I'm not even sure the reporting tools I'm using are accurate. And I shouldn't have to do that, or if I should, I really don't understand what QoS does at all.

So, again, here's the real question:

Will a Linux-based router/firewall provide smarter/more customizable QoS than my current setup? I have to get all purchases voted on, so I can't just experiment as much as I want. I have looked at Tomato, Gargoyle, and SmoothWall. But each one makes me nervous.

Smoothwall can do anything, I'm told, but it requires me getting/building a machine and it apparently reveals more information than I'd like to have access to, or anyone who takes over after me, (like who's emailing who). Not to mention I just can't tell if it will meet my specific needs.

Tomato and OpenWRT require getting yet another router, taking the risk of bricking said router (and having to explain the loss to a committee), and still may not give me what I want.

2) If there is no magical QoS that can do Mac/IP based throttling (instead of Port-based), is there any software/router solution that will give me IP based bandwidth usage? All of the screenshots I see are port-based or give traffic usage in terms of packets instead of bits/second. Or only show one IP at a time (which is great when I want to COMPARE usage).

Right now, I have Excel pulling two XML files from the D-Link Router, one for MAC/IP/hostname, one for "current connections" that gives each connection per IP. I then combine all of the data into another sheet that shows number of connections per IP and then does the percentage per IP based on the total. If it's over 25%, I either shut them down for awhile or go and have words. But I'm not even sure if the total number of connections is a good measure of bandwidth usage!

I have tons of other issues, like computers not seeing each other, not being able to share, dropped wifi connections, low internal transfer rates, possibly misconfigured WAPs, just to name a few. But right now the question I get the most stress over is "Why is my internet so slow? Can't you keep people from torrenting?"

Thanks for reading all of this.