JellicleCat's questions

Feel free to give me a course correction. I'm out of my depth here.

I'm using openconnect to connect to a vpn. This creates a device tun0, which I can see when I run ip address. I've successfully added entries to my routing table with ip route add $IP_ADDR dev tun0 and been able to access servers on my vpn.

I want to try using this vpn connection as my default route, and I've seen other posts, such as the following two, which instruct me to perform a command like this: ip route add default via 192.168.30.1 dev mydevice

• Route all traffic through TUN interface
• How to route all traffic through vpn adapter?

Well, I've tried something similar, but I omit the via $IP_ADDR because I can't find an ip address for this device:

dhclient tun0 # => outputs nothing
ip route del default
ip route add default dev tun0

...and when I do so, it appears that I can't connect to any servers at all. If I add a route that uses tun0 to my routing table without making it the default route, though, I can reach servers on the vpn for as many routing rules as I've created.

Edit: here's the output of ip route show (before trying to change the default): https://pastebin.com/0X9rqgne

I've had a virtual private server for close to 6 months, and I'm going to start sending emails to users from [email protected]. My handful of email tests so far have all resulted in a bounce because of "an unsual rate of unsolicited mail originating from your IP address." That's a strange reason because it suggests that my IP address has been sending a lot of emails, not just one or two, and I didn't even install postfix until I the start of these test emails.

I've probably sent 10 emails to my gmail address as a test, and here's the bounce message that gmail gives:

Our system has detected an unusual rate of 550-5.7.28 unsolicited mail originating from your IP address. To protect our 550-5.7.28 users from spam, mail sent from your IP address has been blocked. 550-5.7.28 Please visit 550-5.7.28 https://support.google.com/mail/?p=UnsolicitedIPError to review our 550 5.7.28 Bulk Email Senders Guidelines. g9si1490378qvq.7 - gsmtp (in reply to end of DATA command))

I've visited the link they provide above, which goes to a page entitled Prevent mail to Gmail users from being blocked or sent to spam, but it mostly talks about how to avoid messages being treated as spam, not how to get an IP address unblocked. What can I do to have gmail unblock my IP address?

TMI 1 Only my virtual private server is using this IP address, and my VPS has not been sending out emails in all the time I've had it (aoubt 6 months). I didn't even have postfix installed until a month ago, which is when I started testing emails to Gmail and getting bounces. (I didn't try again until today; it isn't as if I've been repeatedly sending bounce-worthy emails.) So I should think my IP address would have been unblocked by now if waiting patiently were the key.

TMI 2 I realize that I could pay to have an email service send my emails, but I'm just a solitary guy who's trying to serve users and not take on additional expenses.

Update

Thanks for the advice, which indeed proved to be the solution. For anyone reading this in the future, Google's message was misleading: even one email can count as 'an unusual rate of unsolicited mail'. Getting Gmail to accept my messages did not involve changing the rate or even include any wait time after making the suggested changes.

The suggested changes (some of which I had already implemented) included:

• adding an SPF DNS record
• message signing with DKIM
• adding a DMARC DNS record
• adding a reverse DNS record (and updating my postfix config's myhostname to reflect the same domain name)
• adding a List-Unsubscribe header

I've configured a forward proxy in Apache 2.4, but my requests through it result in a 400:

curl: (56) Received HTTP code 400 from proxy after CONNECT

# Using the proxy results in a 400
https_proxy=https://my.example.net:3443/ curl 'https://testapi1.millimanintelliscript.com/Irix/IASRequestWS.asmx?WSDL'
# Skipping the proxy but running the command from my.example.net results in a 200
curl 'https://testapi1.millimanintelliscript.com/Irix/IASRequestWS.asmx?WSDL'

I wonder if the proxy is not using SSL because when I use curl -v, the output includes the following line, which mentions HTTP instead of HTTPS:

* Establish HTTP proxy tunnel to testapi1.millimanintelliscript.com:443

What could the problem be? This is my proxy config at my.example.net:

Listen 3443

<VirtualHost *:3443>
    ServerName my.example.net

    SSLEngine on
    SSLProxyEngine on
    ProxyRequests on
    ProxyVia off

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCertificateFile /etc/letsencrypt/live/my.example.net/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/my.example.net/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/my.example.net/chain.pem
</VirtualHost>

I've set up an apache config to try to redirect /login and to ProxyPass all other requests:

RewriteEngine on
RewriteCond "%{REQUEST_URI}" "^/login$"
RewriteRule "^/login$" "https://sub.example.org/$1" [L,R]

SSLProxyEngine on
ProxyRequests off
ProxyPassMatch   ^/login ! # Prevent proxy on /login
ProxyPassReverse ^/login ! # Prevent proxy on /login
ProxyPassMatch   ^/      https://sub.example.org/
ProxyPassReverse ^/      https://sub.example.org/
ProxyPreserveHost off
RequestHeader set Host sub.example.org
Header set Host alt.example.org

Most results that I've checked are as I expect:

• alt.example.org/login redirects to sub.example.org/login
• alt.example.org/users shows the content for sub.example.org/users (without redirect)

...but https://alt.example.org/ (empty path) results in a Location header with the value https://alt.example.org^/login. Wow! What's causing that redirect with the ^ in the domain, and why does it reference alt instead of sub?

The log from the Rails application which is running above apache says that the Rails app itself is actually redirecting to https://sub.example.org/login, which makes better sense because the ProxyPass means that Rails should only see sub.example.org and not alt.example.org. So why is apache giving out https://alt.example.org^/login?

I'm finding monit unable to monitor a filesystem effectively. I've added a file /etc/monit.d/disk.cnf with the following:

check device disk1 with path /dev/root
  if space usage > 85% then exec "/bin/custom-alert"

...And when I monit reload, the monit log tells me:

[PST Jan  4 14:48:39] error    : 'disk1' filesystem doesn't exist
[PST Jan  4 14:48:39] info     : 'disk1' trying to restart

Okay, so I cat /proc/cmdline and learn that root=/dev/sda, and then I replace /dev/root with /dev/sda in my disk.cnf file. Then the monit log tells me:

[PST Jan  4 14:46:35] error    : Device /dev/sda not found in /etc/mtab
[PST Jan  4 14:46:35] error    : 'disk1' unable to read filesystem /dev/sda state

Indeed, /etc/mtab references /dev/root instead of /dev/sda.

Why can't monit access the filesystem when I specify /dev/root or /dev/sda on this machine?

More info: df -h outputs the following:

Filesystem      Size  Used Avail Use% Mounted on
/dev/root       173G  146G   26G  85% /
devtmpfs         32G     0   32G   0% /dev
tmpfs            32G     0   32G   0% /dev/shm
tmpfs            32G  3.2G   29G  11% /run
tmpfs            32G     0   32G   0% /sys/fs/cgroup
tmpfs           6.3G     0  6.3G   0% /run/user/1000

I have an application running on Passenger+Apache. (It's running fine.)

When I run passenger-status, though, it gives ERROR: Phusion Passenger doesn't seem to be running.

I've checked the Apache config to confirm that I'm running the proper passenger-status executable:

PassengerRoot /usr/local/rvm/gems/ruby-1.9.3-p547@mygemset/gems/passenger-4.0.53

What could be wrong this this installation or config?

Strangely, passenger-memory-stats looks to me to output accurate process information:

Version: 4.0.53
Date   : 2020-07-28 16:32:36 -0700

---------- Apache processes ----------
PID    PPID   VMSize    Private  Name
--------------------------------------
10093  1      254.8 MB  0.3 MB   /usr/sbin/httpd -DFOREGROUND
10132  10093  254.9 MB  0.4 MB   /usr/sbin/httpd -DFOREGROUND
10134  10093  254.9 MB  0.3 MB   /usr/sbin/httpd -DFOREGROUND
10135  10093  254.9 MB  0.4 MB   /usr/sbin/httpd -DFOREGROUND
10136  10093  254.8 MB  0.2 MB   /usr/sbin/httpd -DFOREGROUND
10137  10093  254.9 MB  0.3 MB   /usr/sbin/httpd -DFOREGROUND
### Processes: 6
### Total private dirty RSS: 1.97 MB


-------- Nginx processes --------

### Processes: 0
### Total private dirty RSS: 0.00 MB


----- Passenger processes -----
PID    VMSize    Private  Name
-------------------------------
10114  212.2 MB  0.3 MB   PassengerWatchdog
10117  491.8 MB  0.4 MB   PassengerHelperAgent
10123  215.7 MB  0.9 MB   PassengerLoggingAgent
### Processes: 3
### Total private dirty RSS: 1.54 MB

I'm running Apache 2.2. I have 10 apache processes running, and it's taxing my limited resources.

I have searched for the config option that controls how many processes are spawned, but I could use some help. Is it MaxRequestWorkers? Is it ThreadsPerChild? Something else? (Neither appears to be set in my config files.)

Here's an example of one of my apache processes:

F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY        TIME CMD
5 S    33 26099 25513  0  80   0 - 56951 poll_s ?          1:42 /usr/sbin/apache2 -k start

Edit:

I'm sorry. I am running apache 2.2, not 2.4.

list of mods-enabled:

lrwxrwxrwx 1 root root 28 Sep  5  2014 alias.conf -> ../mods-available/alias.conf
lrwxrwxrwx 1 root root 28 Sep  5  2014 alias.load -> ../mods-available/alias.load
lrwxrwxrwx 1 root root 33 Sep  5  2014 auth_basic.load -> ../mods-available/auth_basic.load
lrwxrwxrwx 1 root root 33 Sep  5  2014 authn_file.load -> ../mods-available/authn_file.load
lrwxrwxrwx 1 root root 36 Sep  5  2014 authz_default.load -> ../mods-available/authz_default.load
lrwxrwxrwx 1 root root 38 Sep  5  2014 authz_groupfile.load -> ../mods-available/authz_groupfile.load
lrwxrwxrwx 1 root root 33 Sep  5  2014 authz_host.load -> ../mods-available/authz_host.load
lrwxrwxrwx 1 root root 33 Sep  5  2014 authz_user.load -> ../mods-available/authz_user.load
lrwxrwxrwx 1 root root 32 Sep  5  2014 autoindex.conf -> ../mods-available/autoindex.conf
lrwxrwxrwx 1 root root 32 Sep  5  2014 autoindex.load -> ../mods-available/autoindex.load
lrwxrwxrwx 1 root root 26 Sep  5  2014 cgi.load -> ../mods-available/cgi.load
lrwxrwxrwx 1 root root 30 Sep  5  2014 deflate.conf -> ../mods-available/deflate.conf
lrwxrwxrwx 1 root root 30 Sep  5  2014 deflate.load -> ../mods-available/deflate.load
lrwxrwxrwx 1 root root 26 Sep  5  2014 dir.conf -> ../mods-available/dir.conf
lrwxrwxrwx 1 root root 26 Sep  5  2014 dir.load -> ../mods-available/dir.load
lrwxrwxrwx 1 root root 26 Sep  5  2014 env.load -> ../mods-available/env.load
lrwxrwxrwx 1 root root 27 Sep  5  2014 mime.conf -> ../mods-available/mime.conf
lrwxrwxrwx 1 root root 27 Sep  5  2014 mime.load -> ../mods-available/mime.load
lrwxrwxrwx 1 root root 34 Sep  5  2014 negotiation.conf -> ../mods-available/negotiation.conf
lrwxrwxrwx 1 root root 34 Sep  5  2014 negotiation.load -> ../mods-available/negotiation.load
lrwxrwxrwx 1 root root 32 Sep 12  2014 passenger.conf -> ../mods-available/passenger.conf
lrwxrwxrwx 1 root root 32 Sep 12  2014 passenger.load -> ../mods-available/passenger.load
lrwxrwxrwx 1 root root 27 Sep  5  2014 php5.conf -> ../mods-available/php5.conf
lrwxrwxrwx 1 root root 27 Sep  5  2014 php5.load -> ../mods-available/php5.load
lrwxrwxrwx 1 root root 33 Sep  5  2014 reqtimeout.conf -> ../mods-available/reqtimeout.conf
lrwxrwxrwx 1 root root 33 Sep  5  2014 reqtimeout.load -> ../mods-available/reqtimeout.load
lrwxrwxrwx 1 root root 40 Sep 14  2014 rewrite.load -> /etc/apache2/mods-available/rewrite.load
lrwxrwxrwx 1 root root 31 Sep  5  2014 setenvif.conf -> ../mods-available/setenvif.conf
lrwxrwxrwx 1 root root 31 Sep  5  2014 setenvif.load -> ../mods-available/setenvif.load
lrwxrwxrwx 1 root root 36 Jun  7  2015 ssl.conf -> /etc/apache2/mods-available/ssl.conf
lrwxrwxrwx 1 root root 36 Jun  7  2015 ssl.load -> /etc/apache2/mods-available/ssl.load
lrwxrwxrwx 1 root root 29 Sep  5  2014 status.conf -> ../mods-available/status.conf
lrwxrwxrwx 1 root root 29 Sep  5  2014 status.load -> ../mods-available/status.load

I see that an Apache config can specify a particular IP address on which to listen (at least when defining VirtualHosts):

NameVirtualHost *:80

<VirtualHost *:80>

Under what circumstances would it be advantageous to specify an address instead of using a wildcard?

(I recently worked on a machine whose IP address changed, and the guy who had configured Apache had not used a wildcard, so it failed to serve anything but 404s. It didn't occur to me to look for this configuration, so the problem went unresolved until I asked him to troubleshoot with me. Could I have gotten more debug info from the service or logs that would have helped me identify this problem?)

I'm using Passenger + RVM + Nginx, and my Rails applications which are configured for Ruby 1.9.3 work fine, but those for 1.8.7 always return a 502 error. Can anyone spot the trouble?

My config is as follows:

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    passenger_root /usr/local/rvm/gems/ruby-1.9.3-p448@mygems/gems/passenger-4.0
    passenger_log_level 2;
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    include /etc/nginx/conf/sites-enabled/*;

    # from sites-enabled/qa.pinneyinsurance.com
    server {
        listen       80;
        server_name  qa.pinneyinsurance.com;
        index  index.html index.htm;
        root   /var/www/pinneyinsurance.com/current/public;
        passenger_enabled on;
        passenger_ruby /usr/local/rvm/wrappers/ruby-1.8.7-p374@mygems/ruby;
    }
}

My nginx error log outputs the following:

[ 2013-09-12 08:23:56.2677 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:1311 ]: [Client 20] New client accepted; new client count = 1
[ 2013-09-12 08:23:56.2678 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:1881 ]: [Client 20] Checking out session: appRoot=/var/www/pinneyinsurance.com/current
[ 2013-09-12 08:23:56.2678 8932/7f4cd3fff700 Pool2/Pool.h:944 ]: asyncGet(appRoot=/var/www/pinneyinsurance.com/current)  
[ 2013-09-12 08:23:56.2678 8932/7f4cd3fff700 Pool2/Pool.h:949 ]: Found existing SuperGroup
[ 2013-09-12 08:23:56.2679 8932/7f4cd3fff700 Pool2/Group.h:775 ]: Session checked out from process (pid=9183, group=/var/www/pinneyinsurance.com/current#default)
[ 2013-09-12 08:23:56.2679 8932/7f4cd3fff700 Pool2/Pool.h:954 ]: asyncGet() finished
[ 2013-09-12 08:23:56.2679 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:1931 ]: [Client 20] Session checked out: pid=9183, gupid=15eb29b-P6mIqEOuG90
[ 2013-09-12 08:23:56.2680 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:2026 ]: [Client 20] Session initiated: fd=24
[ 2013-09-12 08:23:56.2680 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:2047 ]: [Client 20] Sending headers to application
[ 2013-09-12 08:23:56.2680 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:2177 ]: [Client 20] Begin sending body to application
[ 2013-09-12 08:23:56.2684 8932/7f4cd9fae700 Pool2/Implementation.cpp:1274 ]: [App 8964 stderr] [ 2013-09-12 08:23:56.2683 9183/0x7f8a68ca5770(Worker 1) request_handler/thread_handler.rb:197 ]: *** Passenger RequestHandler warning: someone tried to connect with an invalid connect password.
[ 2013-09-12 08:23:56.2684 8932/7f4cd9fae700 Pool2/Implementation.cpp:1274 ]: [App 8964 stderr] [ 2013-09-12 08:23:56.2684 9183/0x7f8a68ca5770(Worker 1) request_handler/thread_handler.rb:155 ]: No headers parsed; disconnecting client.
[ 2013-09-12 08:23:56.2685 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:1121 ]: [Client 20] Application sent EOF
[ 2013-09-12 08:23:56.2685 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:1203 ]: [Client 20] Client output pipe ended; disconnecting client
[ 2013-09-12 08:23:56.2685 8932/7f4cd3fff700 agents/HelperAgent/RequestHandler.h:577 ]: [Client 20] Disconnected; new client count = 0
[ 2013-09-12 08:23:56.2686 8932/7f4cd3fff700 Pool2/Implementation.cpp:391 ]: Session closed for process (pid=9183, group=/var/www/pinneyinsurance.com/current#default)
2013/09/12 08:23:56 [error] 8948#0: *2 upstream prematurely closed connection while reading response header from upstream, client: 10.71.16.193, server: qa.pinneyinsurance.com, request: "GET / HTTP/1.1", upstream: "passenger:/tmp/passenger.1.0.8928/generation-0/request:", host: "qa.pinneyinsurance.com"

TMI
os: Debian 7
passenger: 4.0.16
rvm: 1.22.7

I'm trying to set up a Rails application on a redhat server, and in accordance with instructions I have found on multiple tutorials, I wish to set the owner of certain directories to 'www-data' so that Passenger shall have owner-access.

However, I find that this user does not exist, so I am in doubt: should I make the user with the adduser command? What I've read is that if I do so but do not set a password, the user shall be locked. Am I to create a password for this user?

The title of this thread was a bit misleading in saying 'get Rails off the ground' because I actually have had this app running for some time, but I would like to implement best practices.

I'm running svnserve on a server, but I can only access it with the svn+ssh protocol, not svn. (This appears to present a problem when I try to checkout from it with Capistrano.) Can anyone point out what might be wrong?

Svn's machine:

[root@machine ~]# service svnserve status
svnserve (pid  13166) is running...

Local machine:

$ svn info svn+ssh://root@<svnserver>.com/svnrepos/myrepo
-- returns fine
$ svn info svn://<svnserver>.com/svnrepos/myrepo
svn: E170001: Unable to connect to a repository at URL 'svn://<svnserver>.com/svnrepos/myrepo'
svn: E170001: No access allowed to this repository

I have even tried making use of the --username and --password params but have had exactly the same results.

UPDATE:

To set up Subversion, I followed the brief instructions to Setup a Subversion Server in 4 Minutes. My only deviation from its instructions was to kill the daemon svnserve process after I found it wasn't working for the svn:// protocol and then use service to start svnserve. (It likewise didn't work.)