boatcoder's questions

Based on the docs you can spin up a "new" gunicorn with kill -USR2

Then you can send a kill -WINCH to the old master process to kill off it's workers.

But if Systemd launches gunicorn (like this)

ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/app/next/bin/gunicorn --pid /var/run/next/gunicorn.pid --chdir /app/next/dubclub --workers 5 --bind unix:/var/run/next/next.socket myapp.wsgi:application
ExecStop=/bin/kill -TERM $MAINPID

all that happens on WINCH is [INFO] Handling signal: winch

Docs also say you have to use --daemon on the command line to daemonize it. BUT if you do that with systemd, gunicorn exits right after starting.

Is there a way to use --daemon with systemd and still leave the process running?

I've run out of ideas as to why I can't connect to this nginx inside or outside of the docker. I can understand that networking might cause a problem outside the machine, but even inside the docker nginx is not responding even though you can see it running and listening (inside the docker). Outside the docker, maybe the port isn't mapping thru but it seems to be configured such that it should.

"Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "80/tcp": {}
            },

On the HOST machine

root@host:~# docker ps
CONTAINER ID        IMAGE                           COMMAND                  CREATED             STATUS              PORTS               NAMES
0be6e751cd6d        humanyze/nginx:config-pentest   "nginx -g 'daemon of…"   8 seconds ago       Up 8 seconds        80/tcp              inspiring_boyd

root@host:~# wget http://localhost
--2021-09-14 22:56:32--  http://localhost/
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:80... failed: Connection refused.

root@host:~# netstat -an | grep LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN

And even though nginx is not installed on the host, this still shows up

root@host:~# ps ax | grep nginx
 4102 ?        Ss     0:00 nginx: master process nginx -g daemon off;
 4134 ?        S      0:00 nginx: worker process

And inside the docker

root@host:~# docker exec -it 0be6e751cd6d sh

/ # netstat -an | grep LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 :::80                   :::*                    LISTEN

/ # ps ax | grep nginx
    1 root      0:00 nginx: master process nginx -g daemon off;
    5 nginx     0:00 nginx: worker process
   12 root      0:00 grep nginx

/ # wget http://localhost
Connecting to localhost (127.0.0.1:80)
Connecting to localhost (127.0.0.1:443)
wget: can't connect to remote host (127.0.0.1): Connection refused

This "services" appears to run /bin/true, but why? There is another [email protected] file as well, but why does this one exist at all? Yes, this is the entire file.

# systemd service for managing all PostgreSQL clusters on the system. This
# service is actually a systemd target, but we are using a service since
# targets cannot be reloaded.

[Unit]
Description=PostgreSQL RDBMS

[Service]
Type=oneshot
ExecStart=/bin/true
ExecReload=/bin/true
RemainAfterExit=on

[Install]
WantedBy=multi-user.target

How do I relate this information with which physical drive is failing? It's a debian kernel.

Nov 21 18:06:00 IHPAC kernel: [594026.608042] ata5.00: status: { DRDY }
Nov 21 18:06:00 IHPAC kernel: [594026.787427] ata5.00: failed command: WRITE FPDMA QUEUED
Nov 21 18:06:00 IHPAC kernel: [594026.966505] ata5.00: cmd 61/00:e8:fb:b6:59/04:00:a2:00:00/40 tag 29 ncq 524288 out
Nov 21 18:06:00 IHPAC kernel: [594026.966508]          res 40/00:48:03:ef:59/00:00:a2:00:00/40 Emask 0x50 (ATA bus error)


IHPAC:~$ dmesg | grep ata5
[    6.291403] ata5: SATA max UDMA/133 abar m1024@0xfaffe400 port 0xfaffe600 irq 22
[    6.840145] ata5: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[    6.840829] ata5.00: ATA-8: ST3000DM001-9YN166, CC9C, max UDMA/133
[    6.840832] ata5.00: 5860533168 sectors, multi 16: LBA48 NCQ (depth 31/32), AA
[    6.841483] ata5.00: configured for UDMA/133
[59669.062886] ata5: exception Emask 0x10 SAct 0x0 SErr 0x90202 action 0xe frozen
[59669.066958] ata5: irq_stat 0x00400000, PHY RDY changed
[59669.069852] ata5: SError: { RecovComm Persist PHYRdyChg 10B8B }
[59669.073247] ata5: hard resetting link
[59675.560102] ata5: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[59675.561576] ata5.00: configured for UDMA/133
[59675.561589] ata5: EH complete
...
[421238.151794] ata5: exception Emask 0x10 SAct 0x0 SErr 0x90202 action 0xe frozen   \
[421238.155912] ata5: irq_stat 0x00400000, PHY RDY changed                            \
[421238.158854] ata5: SError: { RecovComm Persist PHYRdyChg 10B8B }                    |
[421238.162302] ata5: hard resetting link                                              | Repeats 5 times
[421244.650101] ata5: SATA link up 3.0 Gbps (SStatus 123 SControl 300)                 |
[421244.651513] ata5.00: configured for UDMA/133                                      /
[421244.651525] ata5: EH complete                                                    /
...
[593676.000793] ata5.00: exception Emask 0x50 SAct 0x7fffffff SErr 0x90a02 action 0xe frozen
[593676.130479] ata5.00: irq_stat 0x00400000, PHY RDY changed
[593676.259877] ata5: SError: { RecovComm Persist HostInt PHYRdyChg 10B8B }
[593676.388864] ata5.00: failed command: WRITE FPDMA QUEUED                             \
[593676.513825] ata5.00: cmd 61/e0:00:ab:ac:30/01:00:9d:00:00/40 tag 0 ncq 245760 out    | Repeats MANY times
[593676.750610] ata5.00: status: { DRDY }                                               /
...
[593697.436610] ata5: hard resetting link
[593698.380128] ata5: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[593698.382682] ata5.00: configured for UDMA/133
[593698.382883] ata5: EH complete
[594005.248408] ata5.00: exception Emask 0x50 SAct 0x7fffffff SErr 0x90a02 action 0xe frozen
[594005.429802] ata5.00: irq_stat 0x00400000, PHY RDY changed
[594005.610614] ata5: SError: { RecovComm Persist HostInt PHYRdyChg 10B8B }
[594005.791306] ata5.00: failed command: WRITE FPDMA QUEUED                            \
[594005.972202] ata5.00: cmd 61/00:00:fb:8a:59/04:00:a2:00:00/40 tag 0 ncq 524288 out   | Repeats MANY times
[594006.337349] ata5.00: status: { DRDY }                                              /
...
[594028.228309] ata5: hard resetting link
[594029.170095] ata5: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[594029.173073] ata5.00: configured for UDMA/133
[594029.173367] ata5: EH complete

This comes from an implementation of OpenStack, and we have a fix, but I don't understand why we need this fix.

• My machine has an ip of 192.168.20.45
• My default gateway (pfsense) has an ip of 192.168.20.254
• My openstack compute node has an ip of 192.168.20.58
• When a VM is running, it is on 10.60.60.12

I can ssh to this VM (from 20.45) and then ping google.com from there, it will stay connected about 20 or so pings, then the ssh session will timeout and disconnect.

Adding some hard coded routes has solved this issue, but makes me wonder WHY did it ever work at all?

We added static routes to 10.60.60.x via 192.168.20.58 to pfsense, via dhcp to all clients, and via openvpn and MS VPN configurations.

I know how the static routes solve the problem, but what eludes me is how it worked at all before they were in place, and why did the connection go from functioning to not functioning? Why would TCP deal with the first 60+ packets, and then quit working?

Is it possible with PFSense and Traffic shaping to make watching movies really not worth it. We had a problem a while back (our inbound pipe was full) and it got people off youtube and back on to doing what they should be doing while at work.

I'd like to just degrade youtube, dailyshow, break, etc... so that it isn't worth watching at work without having to threaten anyone.

We have a dual homed PFSense v2 firewall.

I'm not trying to single out people, those that aren't using youtube won't notice this a bit.

Got an apache log entry that looks like this, actually I have a bunch of them spread out over time.

XXX.XXX.XXX.XXX - - [27/Apr/2012:14:39:52 -0500] "-" 408 - "-" "-"

It wasn't a GET or POST, the method was "-".

Anyone else seen requests like this? It wasn't from the penetration tester, but I have it from LOTS of other IPs from Apr of 2012 up until and including today.

We failed it with a 408, just wondering what someone might be trying and googling for minus sign does NOT work.

We are setting up a new piece of hardware to virtualize several of our servers on. Choices are RAID 5, RAID 6, and RAID 0+1.

We are wanting to benchmark all three before we go live with the machine, but I'm not sure how to test the speed.

• Since we will be using it to host VMs, what will the actual disk traffic look like?
• What can I use to see if RAID 6 is too slow?
• Short of setting up the system with all the VM's on it and running that way, then redoing on all the work, I'm not sure how to test it. It them becomes more of a subjective test than an objective one.
• I'm worried that RAID6 will have too much overhead, that RAID5 will be to fragile with 3TB drives and I've never worked with 0+1 at all.

So in short I'd like to setup the base machine (which will be running Linux) and then test the underlying SW RAID for speed. What kind of tool exists to simulate this kind of load? Barring the lack of a specific tool, how about a generic FS testing tool that will simulate different loads?

I hear lots about SATA being slower than SAS but I've only found 1 decent benchmark. http://blog.whitesites.com/SAS-RAID-0-VS-SCSI-RAID-0-VS-SATA-Benchmarks__633689244191943184_blog.htm

In this, SAS comes out on top until you read that the SAS drives are 10K and the SATA drives are 7200 RPM.

Has anyone seen any good benchmarks/comparisons with equivalent speed disks? Has anyone seen any real-world loads (DB loads/searches, media streaming, etc?

We have a pfSense setup with 2 WAN connections (3Mb/s and 17Mb/s) and are using tcpdump to log connection setup and dns requests. We'd like to analyze the places being connected to with an eye toward watching for trojans and other dial home programs. Are there any tools out there for this kind of analysis?

I've seen Tool do analyze web traffic per file and time period? and the answers there seem to be for looking at inbound traffic to a web server, where this is more a review of outbound traffic.

We aren't using squid because we haven't figured out how to get it to work in a fail over mode. With the asymmetric bandwidth connections we have some things that always go in/out over the 3Mb/s (like email) but we want the web stuff to go out over the 17Mb/s connection, unless it is down, then we want it to fail over to the 3Mb/s connection, and that is something we haven't figured out how to configure.

The other thing about this setup is that we'd like to watch for non-web traffic as well. We'd like to see what outbound connections are being made (chat clients, ssh.....). The primary usage is to watch for rogue activity. Something to help that activity raise a red flag......

I have just set up a FreeBSD 8.1 in a VM and am trying to get it to do DHCP automatically. Right now, if I leave /etc/rc.conf like so:

#ifconfig_de0="DHCP"

then I can do dhclient de0 and it gets an IP instantly.

If I remove the comment so that DHCP is supposedly automatic, then dhclient de0 never gets an address (and it doesn't happen automatically either)

I get DHCPREQUEST on de0 to 255.255.255.255 port 67

Nothing else changes, what am I doing wrong?

I've also tried using sysinstall, but I have found no way to get it to write the changes to the files once I make them.....

==== Edit

Hoping to save someone else the time I spent on this, here is my rc.conf:

# -- sysinstall generated deltas -- # Mon Dec  6 11:51:13 2010
# -- sysinstall generated deltas -- # Wed Dec  8 08:28:27 2010
# Created: Mon Dec  6 11:51:13 2010
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
#REMOVED: inetd_enable="YES"
hostname="pfsensedev.intomec.com"
#ifconfig_de0="DHCP"
inetd_enable="NO"
sshd_enable="YES"

I found that I had to comment out the ifconfig_de0 line if I wanted to get an IP address assigned. If I left it in rc.conf, it was impossible to get an IP address via dhclient.

Putting the lines into /etc/rc.local did the trick

dhclient de0

I'm running this on a MS Virtual PC VM under Win7x64 (already had it loaded for XP Mode).

Thanks for the help guys.

I once read about a database for rolling logs. It was for keeping server data over a fixed period and basically it worked like a huge circular buffer on disk. Since all the space was statically allocated, it didn't suffer from problems of purging old records and the like.

I tried to find the name of that setup today and just can't seem to locate it. I'm recording server log messages (IP traffic mostly) and I only want to keep the data for a set # of days, and just let the wrap around and overwrite the old data, but I still want to be able to mine that data.

Does anyone else remember hearing about it or what the name of it was? I do know it was open source and had been out several years, so its probably at least 3-5 years old.

I recently upgraded one of my ubuntu machines to Karmic and I'm having trouble getting the permissions of /dev/raw1394 set to 0666.

They only thing this machine is used for is recording audio from a firepod which uses /dev/raw1394 via jackd and there are no other FireWire devices connected, so security around this device is not really an issue.

If I run as root, everything works as expected, but I have some folks that run the recorder that I don't want to have root access. However, I can't figure out which lines setup the perms

I've tied this:

/etc/udev/permissions.d/raw1394.rules:raw1394:root:root:0666

And I have this setup (default install)

/lib/udev/rules.d/75-persistent-net-generator.rules:SUBSYSTEMS=="ieee1394", ENV{COMMENT}="Firewire device $attr{host_id})"
/lib/udev/rules.d/75-cd-aliases-generator.rules:# the "path" of usb/ieee1394 devices changes frequently, use "id"
/lib/udev/rules.d/75-cd-aliases-generator.rules:ACTION=="add", SUBSYSTEM=="block", SUBSYSTEMS=="usb|ieee1394", ENV{ID_CDROM}=="?*", ENV{GENERATED}!="?*", \
/lib/udev/rules.d/60-persistent-storage-tape.rules:KERNEL=="st*[0-9]|nst*[0-9]", ATTRS{ieee1394_id}=="?*", ENV{ID_SERIAL}="$attr{ieee1394_id}", ENV{ID_BUS}="ieee1394"
/lib/udev/rules.d/50-udev-default.rules:# FireWire (deprecated dv1394 and video1394 drivers)
/lib/udev/rules.d/50-udev-default.rules:KERNEL=="dv1394-[0-9]*",        NAME="dv1394/%n", GROUP="video"
/lib/udev/rules.d/50-udev-default.rules:KERNEL=="video1394-[0-9]*",     NAME="video1394/%n", GROUP="video"
/lib/udev/rules.d/60-persistent-storage.rules:KERNEL=="sd*[!0-9]|sr*", ATTRS{ieee1394_id}=="?*", SYMLINK+="disk/by-id/ieee1394-$attr{ieee1394_id}"
/lib/udev/rules.d/60-persistent-storage.rules:KERNEL=="sd*[0-9]", ATTRS{ieee1394_id}=="?*", SYMLINK+="disk/by-id/ieee1394-$attr{ieee1394_id}-part%n"

And I find these lines in /var/log/syslog

Apr 30 09:11:30 record kernel: [    3.284010] ieee1394: Node added: ID:BUS[0-00:1023]  GUID[000a9200c7062266]
Apr 30 09:11:30 record kernel: [    3.284195] ieee1394: Host added: ID:BUS[0-01:1023]  GUID[00d0035600a97b9f]
Apr 30 09:11:30 record kernel: [   18.372791] ieee1394: raw1394: /dev/raw1394 device initialized

What I can't figure out, is which line actually creates that raw1394 device in the first place.

How do you get /dev/raw1394 to have permissions 0666?

I'm stuck at this point with ViewVC

ImportError: No module named svn

I can't find prebuilt Python 2.6 bindings for Subversion, and I can't seem to locate the source for them either!