geerlingguy's questions

I'm trying to set up some firewall rules for allowing SSH, incoming ping, munin, and MySQL between one server and another (all those services are working fine with my rules), but when I apply the rules, I can no longer ping or resolve any DNS (so I can ping 74.125.225.65 but not google.com).

Here are the rules I'm using:

# Accept traffic on localhost:
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow SSH from anywhere:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Accept ICMP Ping requests (incoming and outgoing):
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

# Allow munin from subdomain.example.com:
iptables -I INPUT -p tcp -s 123.23.45.1 --dport 4949 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I OUTPUT -p tcp -d 123.23.45.1 --dport 4949 -m state --state ESTABLISHED -j ACCEPT

# Allow MySQL from subdomain.example.com:
iptables -I INPUT 2 -p tcp -s 123.23.45.1 --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d 123.23.45.1 --dport 3306 -j ACCEPT

# Drop all other traffic:
iptables -A INPUT -j DROP

resolv.conf, /etc/hosts, etc. are all correct, and if I simply do a $ iptables -F, and ping google again, it works fine. Only after the firewall rules are applied do I get ping: unknown host google.com.

I'ved noticed that munin graphs a few bits of information about timing/kernel statistics that I've never quite understood. Most of my servers seem to stay close to 0, which I presume is good, but one of them is slowly but steadily getting more and more negative on one of the graphs.

Munin graphs the following statistics over time:

• NTP kernel PLL estimated error (secs)
• NTP kernel PLL frequency (ppm + 0)
• NTP kernel PLL offset (secs)
• NTP timing statistics for system peer

Here's an example from munin's docs: http://demo.munin-monitoring.org/time-year.html

Searching around the web for a concise, understandable definition of NTP turns up nothing (except for a bunch of Nagios and Munin graphs), and searching Server Fault turns up a ton of answers that presume the reader knows something about NTP already.

Stack Overflow defines it thusly:

NTP stands for Network Time Protocol, and it is an Internet protocol used to synchronize the clocks of computers to some time reference.

But that seems a little obtuse—does this affect, say, a web server, encryption, or database synchronization?

What is NTP, and why should I care? Are there any stats in particular I should make sure don't get out of control?

... and it's driving me insane.

Basically (this has been happening over the past couple months), I log into a few different CentOS servers (one Linode, another VPS, and a shared host to which I have shell access), running 5.5, 5.7, and 6, from my Mac running OS X Lion, using Terminal.

Basically:

$ ssh [email protected]

[remote-host] $ nano somefile.txt

Once I start editing the file, if I use the arrow keys to move around the cursor, or start deleting, then typing again, the cursor jumps around a bit, and if I save the file and reopen it, it's obvious that the cursor was, in fact, jumping all over the place on a line for no apparent reason.

I end up getting things like "This is a neof text." When I had typed in (to the cursor-crazy editor) "This is a line of text."

It's a big problem when it comes to editing configuration files, because I often have to edit one line, save and close, then reopen just to make sure that line is right... then edit another line... and it's getting quite annoying.

I found Linode Lish Shell Vim and Nano rendering troubles: lines not appearing / cursor positions wrong, but I don't know if that relates much, since that's specifically referring to lish.

About three days ago, I noticed the exim mailqueue started filling up on one of my servers, and upon inspecting some of the emails using # exim -Mvb $ID, I noticed they were being sent to some system email address (which is not a real address), and the body of the messages were as follows:

(process:8259): Pango-WARNING **: Invalid UTF-8 string passed to pango_layout_set_text()

I'm wondering what could be causing this strange issue, as I've never heard of 'pango' at all... I've never seen that function used in my lifetime!

It seems the process id (PID) is for an apache process, though, as the pids are always gone by the time I use # ps -aux to look them up.

Edit: Whoops! Forgot to include the subject - looks like it's actually munin-cron that's bringing up the issue:

Subject: Cron  /usr/bin/munin-cron --force-root

I am behind a corporate proxy server/firewall, and this firewall seems to not be too happy with my idea of local development. On my home computer (Mac/Leopard), I have MAMP running, with a rule in /etc/hosts that directs dev.example.com to 127.0.0.1, and I have a virtualhost set up in the httpd.conf file which works great for me.

However, at work, I set up the exact same configuration, but am not able to access dev.example.com, likely due to some address/DNS translation going on via the proxy server.

Here are the relevant details from Terminal:

$ ping dev.example.com
PING dev.example.com (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.025 ms

$ host dev.example.com
Host dev.example.com not found: 3(NXDOMAIN)

I've tried adding dev.example.com to the list of bypass addresses in System Preferences (the 'Bypass proxy settings for these Hosts & Domains' list), but that had no effect.

Is there any way I can develop locally using name-based hosts at work? I can access localhost, but can't get to the dev.example.com (or any other custom virtualhosts) here at work, which complicates other matters related to the sites on which I'm working...

I am using the following iptables rule to try allowing access to port 8080 from one IP address:

iptables -A INPUT -s 12.34.56.78 -p tcp -m tcp --dport 8080 -j ACCEPT

However, this rule isn't working. If I remove the -s 12.34.56.78 part, then it works, but it allows anyone access to port 8080 (not desired).

When I run iptables -L after applying the rule above, I get the following (which mystifies me - why won't it just display the actual IP in the source?):

root@wso-solr:/etc# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  host-12-34-56-78.host.com  anywhere            tcp dpt:http-alt 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I'm wondering if this might be some sort of dns oddity that causes iptables to see the wrong IP address/DNS entry for my particular server (it returns the host-ip.host.com for source instead of the IP address...).

For a site I manage, http://archstl.org/, the DNS entry returns an empty (::) IPv6 address when I run $ host archstl.org in the Terminal.

I think the errant IPv6 entry may be the cause of my problem: when a Mac user running Apache Web Server (any flavor) tries to visit archstl.org, they get localhost instead (the Mac seems to pick up archstl.org's IPv6 address rather than the IPv4 address, 174.37.22.142).

Does anyone know how to resolve this issue? I'm not even sure how the IPv6 address is being output for our DNS entry; I don't have any other domain names that return an IPv6 address.

See here for more info on my own troubleshooting: http://archstldev.com/node/74

When I run munin-cron (munin-cron --debug), I get the following error:

2010/05/10 13:39:01 [WARNING] Call to accept timed out.  Remaining workers: archstl.org;archstl.archstl.org

2010/05/10 13:39:01 [DEBUG] Active workers: 1/8

These errors simply keep repeating themselves until I quit munin-cron.

I've followed the directions for debugging munin on the 'Debugging Munin plugins' wiki page, but I get the following results when going through their directions:

After telnetting to localhost 4949, I can see a list of plugins, see a node at archstl.archstl.org, but can't fetch anything. The output is as follows:

>fetch cpu
.

However, on the same machine (which is both the node and the master munin server), I can run munin-run cpu, and it prints the results correctly to the command line, like so:

user.value 100829130
nice.value 3479880
system.value 13969362
idle.value 664312639
iowait.value 12180168
irq.value 14242
softirq.value 199526
steal.value 0

Looking at the wiki page mentioned above, it looks like it might be a plugin environment problem, but I can't figure out how to fix/change this...

If the plugin does run with munin-run but not through telnet, you probably have a PATH problem. Tip: Set env.PATH for the plugin in the plugin's environment file.

I am looking for a good short-term solution to storage space concerns on my website. Currently, I have all uploaded files (flash video, images, etc.) inside the 'files' directory in my web root (/home/account/public_html/files).

That directory is located on my high-speed main hard drive (two mirrored 74 GB 15k SCSI drive).

I have another drive with much more capacity (300 GB), but spinning at 10k rpm (so still fast, but not as good for random reads/writes as the main drive). The entire drive is mounted at /backup

Right now I'm just using it as a backup volume. I would like to create a symlink from my /home/account/public_html/files folder to /backup/files, and have all files reside on the second drive.

However, if someone accesses a file at http://www.example.com/files/filename.jpg, would it still work if I symlinked to the second drive? (Basically, would Apache/PHP automatically know to follow the symlink for that directory?).

I'm beginning to run out of space on the main drive, and I can't get the budget to upgrade. I'm running CentOS 5.3, Apache 2.2.x, PHP 5.2.13.

I have been working on this for a few hours now, and haven't yet been able to get munin to output the html files/generated graphs of resource usage on my CentOS 5.3 server.

Here are some things I run as the munin user, and the results:

/usr/share/munin/munin-update --nofork --debug

(above works fine, takes ~2.4 seconds to complete)

munin-run cpu

(And other options/plugins (besides 'cpu'), all work fine and give desired output)

munin-cron

Fails with:

[FATAL] There is nothing to do here, since there are no nodes with any plugins.  Please refer to http://munin-monitoring.org/wiki/FAQ_no_graphs at /usr/share/munin/munin-html line 38

I am wondering if, perhaps, the settings in my munin.conf file might be causing a problem. Here's the contents of that file (below):

bdir   /var/lib/munin/
htmldir /home/archdev/public_html/monitoring
logdir  /var/log/munin
rundir  /var/run/munin/
tmpldir /etc/munin/templates

[archstl.archstl.org]
        address 127.0.0.1
        use_node_name yes

Also, when I run the telnet localhost 4949 command, and list the node's plugins, it returns the default munin list... something seems to be wrong with the munin html creation process. :(

I'm running version 1.4.3.

I can't quite figure out how to use a regex in my .htaccess file to remove index.php from the end of a URL if and only if it is the last thing in the string.

If the url is example.com/path/index.php, it should turn into: example.com/path/

But if the url is example.com/path/index.php?blah=0, it should stay the same.

Any help here? I thought this might work, but it doesn't seem to preserve the latter case above:

RewriteRule ^(.*)$ /index.php/$1 [L]

I've seen only one or two tutorials for installing Solr, and particularly Java, on a CentOS machine, and they seem to be overly complex; heck, I can't quite figure out which version of Java (it seems there are many) to install... I'm not a full time sysadmin, so I would like to know what Java version/package I would need to use, and if there's a good tutorial with relatively easy to follow steps for installation.

I'm going to try to get Solr working with some Drupal sites, and that part of the equation doesn't seem as hard as the Java side...

For some insane reason, the web development company that built out a website I inherited created a separate Joomla installation for each department in a company rather than set up a proper multi-user, multi-section website, and now I have over 45 duplicated site template folders on an Apache server.

I would like to (for the short term) have one template folder with symlinks from all the other locations, so I can at least get that template under control (later I'll be working on rejigging the site and combining databases/users into one)... is this possible? If someone visits www.example.com/address2, would they be able to get the template from elsewhere on the server through a symlink?

I have someone complaining that www.archstl.org (a site I manage) loads fine from his Windows PC, but not on his Mac; and apparently he can't get it anywhere he takes his Mac, either...

I've heard of this happening to one other person, but I can't find an explanation. When they try loading it on their Mac using either Safari or FireFox, they get the default Apache page: "If you can see this, it means that the installation of the Apache web server software on this system was successful. You may now add content to this directory and replace this page."

I have had him ping www.archstl.org, and it always returns the proper IP address of our server (174.37.22.142), so I don't know what could be going wrong. It seems that our server is sending him the wrong page, plain and simple...?