Home / user-166832

neubert's questions

Martin Hope
neubert
Asked: 2024-06-20 22:00:01 +0800 CST
  • 5

I use several different services to send out emails from my domain. I already have a CNAME record for _dmarc.mydomain.com that's set to mydomain.com.dmarc.emldlv.net for one service, however, another service is now telling me that I need to add a TXT record for _dmarc.mydomain.com* with a value of v=DMARC1; p=none.

I tried to do this in Route 53 and got this error:

Bad request.

(InvalidChangeBatch 400: RRSet of type TXT with DNS name _dmarc.mydomain.com. is not permitted because a conflicting RRSet of type CNAME with the same DNS name already exists in zone mydomain.com.)

So idk what to do now. Can I remove the CNAME record I already have and replace it with a TXT record that contains both entries separated by a new line? eg.

mydomain.com.dmarc.emldlv.ne
v=DMARC1; p=none
domain-name-system
Martin Hope
neubert
Asked: 2022-03-10 13:08:31 +0800 CST
  • 0

I'm using AWS Elastic Container Services to start and stop Docker containers as demand dictates. The problem is that occasionally, in the middle of the day, a subset of employees just lose the ability to access this containerized website. Killing the Docker containers, one by one, forcing new ones to be spun up, seems to resolve the issue, however.

What I don't understand is what's causing the Docker container to be unresponsive. If the Docker container just died out of the blue then a new one would be created to accommodate the demand but in this case the Docker container isn't dying and I'm not seeing errors on AWS either. But maybe I'm just not looking in the right place?

amazon-web-services amazon-ecs
Martin Hope
neubert
Asked: 2022-02-19 11:10:24 +0800 CST
  • 1

Per https://quay.io/repository/phpseclib/php8.1 I should be able to pull down that Docker container by doing docker pull quay.io/phpseclib/php8.1 but when I try I get this error:

Using default tag: latest
Error response from daemon: manifest for quay.io/phpseclib/php8.1:latest not found: manifest unknown: manifest unknown

Any ideas?

docker ubuntu-20.04
Martin Hope
neubert
Asked: 2022-02-03 08:33:22 +0800 CST
  • 0

I'm running this command to change the master user password of a DB Cluster on AWS:

aws rds modify-db-cluster --db-cluster-identifier development-db \
    --region us-east-2 --master-user-password newpassword --apply-immediately \
    --no-cli-pager > /dev/null

When I do this the status of the cluster changes from available to resetting-master-credentials. Sometimes it'll be in this status for minutes at a time and it just doesn't make any sense to me - I'd expect this change to be near instantaneous.

Any ideas as to why it wouldn't be?

amazon-web-services aws-cli
Martin Hope
neubert
Asked: 2021-10-13 08:36:00 +0800 CST
  • 0

I'd like to restore a snapshot from a DB instance in one region to a DB instance in another region.

I can copy the DB identifier but in the Connectivity section I only have two options for "Virtual private cloud (VPC)" - "Default VPC (vpc-21cbe95b)" and "Create new VPC". The VPC I want, however, that's in a different zone, has a totally different ID - vpc-e681478d.

Is what I'm trying to do possible?

The alternative would be to do mysqldump and then import with mysql, which would work, but I figure restoring the snapshot would be waaaaay faster.

amazon-web-services amazon-vpc amazon-rds
Martin Hope
neubert
Asked: 2021-10-12 21:43:52 +0800 CST
  • 0

I'm using the "OpenVPN Access Server" AMI EC2 instance from AWS.

According to https://forums.openvpn.net/viewtopic.php?p=12848#p12848 /etc/init.d/openvpn restart should restart OpenVPN server on Debian (I'm running Ubuntu, which is Debian) but when I try that I get this:

bash: /etc/init.d/openvpn: No such file or directory

When I do service openvpn restart (which should work on CentOS per the above post) I get this:

Failed to restart openvpn.service: Unit openvpn.service not found.

I did locate openvpn but got 3,860 entries back per locate openvpn | wc -l...

If it helps, here's the banner that I see when I login:

Welcome to OpenVPN Access Server Appliance 2.7.5

  System information as of Tue Oct 12 06:00:15 UTC 2021

  System load:  0.0               Users logged in:      0
  Usage of /:   75.6% of 7.69GB   IP address for eth0:  172.31.7.187
  Memory usage: 42%               IP address for as0t0: 172.27.224.1
  Swap usage:   0%                IP address for as0t1: 172.27.232.1
  Processes:    103

Last login: Tue Oct 12 04:04:04 2021 from 70.124.147.35

So how do I restart OpenVPN Access Server?

I guess I could just reboot the server but is there a way to restart OpenVPN Access Server without rebooting the entire machine?

amazon-web-services ubuntu-18.04
Martin Hope
neubert
Asked: 2021-10-12 20:49:54 +0800 CST
  • 0

I setup an OpenVPN server but whenever I try to connect with the Windows 10 OpenVPN client I get the following error:

There was an error attempting to connect to the selected server

Here's what I see in the logs:

⏎10/11/2021, 11:17:42 PM EVENT: WAIT ⏎10/11/2021, 11:17:42 PM Connecting to [3.133.152.18]:1194 (3.133.152.18) via UDPv4
⏎10/11/2021, 11:17:46 PM Server poll timeout, trying next remote entry...

It's timing out. I can see why it's timing out - the IP address it's trying to connect to is wrong. If I do ping vpn.neubert.com I get 3.142.17.247. Even the server admin shows 3.142.17.247:

enter image description here

So why is the OpenVPN client trying to connect to 3.133.152.18?

openvpn
Martin Hope
neubert
Asked: 2021-02-25 13:17:39 +0800 CST
  • 0

I'm trying to add a certificate to a domain name through Amazon ACM and it's not working. I mean, I was able to add the certificate and I opted to use DNS validation but it's still showing up as "Pending validation" and that was a few hours ago.

I added the DNS entries after I requested the certs so is there a way I can just tell AWS to recheck for the DNS entries?

amazon-web-services amazon-acm
Martin Hope
neubert
Asked: 2021-02-24 13:20:18 +0800 CST
  • 1

I have a domain with an A record of dualstack.prod-clients-alb-1234567890.us-east-1.elb.amazonaws.com. I'm trying to have another domain point to that same server and am unable to do so. When I do so I get the following error:

Bad request.
(InvalidChangeBatch 400: ARRDATAIllegalIPv4Address (Value is not a valid IPv4 address) encountered with 'dualstack.prod-clients-alb-1234567890.us-east-1.elb.amazonaws.com.'')

If it must be set to an IPv4 address than how did my other domain get an A record of dualstack.prod-clients-alb-1234567890.us-east-1.elb.amazonaws.com.?

I also tried checking the Alias button and selecting "Alias to Network Load Balancer" for the endpoint and setting the region to us-east-1 but I'm not seeing nay resources for the network load balancer. Maybe I need to be using a different endpoint? If so can I figure out which one I would need to use from the A record of the other domain?

(both domains are going to be hosted on the same machine / ECS instance so they should have the same settings it seems to me...)

amazon-web-services amazon-route53
Martin Hope
neubert
Asked: 2018-04-26 14:08:10 +0800 CST
  • 0

I want to create a user with a custom group that only lets me access one S3 bucket and I'm having difficulty doing so.

So I'm at this screen:

enter image description here

I've allowed S3 actions. Now I want to restrict it to just a specific bucket. I click on the "Resources" text and I get this:

enter image description here

I click on "Add ARN" for both and get this:

enter image description here

I use "whatever" as the "Bucket name" for bucket and "whatever" as the "Bucket name" for object (whilst leaving "Object name" blank) and then when I try to use the newly created account, in the newly created group, to access S3, I find that I can't upload or download files from the bucket without getting a 403 Forbidden error. If I use "All resources" instead of "Specific" it works but I only want this user to have access to one particular bucket.

Any ideas?

amazon-web-services
Martin Hope
neubert
Asked: 2017-04-01 08:43:45 +0800 CST
  • 1

Here's my Dockerfile:

FROM php:5.5-apache

COPY sites-enabled.tgz /root/sites-enabled.tgz

RUN cd /etc/apache2/sites-enabled && \
    tar xvf /root/sites-enabled.tgz

I have a number of sites that need to be configured and I figure the easiest way to go about configuring them is to just copy the config files for the sites into the appropriate directories. Unfortunately I'm not able to do so.

I do docker build -t mywebsite . and then docker run -d mywebsite. Both of those commands appear to run just fine. The last one gives me a hex encoded string. But then when I do docker ps I don't see any machines running.

Typically, the files in sites-enabled are symlinks to sites-available. idk if that's the case in every case but if it is then it seems like it might be necessary to copy the sites-available sites over as well. eg.

FROM php:5.5-apache

COPY sites-available.tgz /root/sites-available.tgz
COPY sites-enabled.tgz /root/sites-enabled.tgz

RUN cd /etc/apache2/sites-available && \
    tar xvf /root/sites-available.tgz

RUN cd /etc/apache2/sites-enabled && \
    tar xvf /root/sites-enabled.tgz

Unfortunately, that doesn't work either. With sites-available.tgz it does but not sites-enabled.tgz.

Any ideas?

php
Martin Hope
neubert
Asked: 2017-03-12 11:57:56 +0800 CST
  • 0

I have a production database with master-slave replication being done on it. Production DB backups are done off of the slave server.

I'd like to make it so that an arbitrary number of development environments can be replica's of the slave. The problem is that, whereas the slave server has nothing writing to it, the dev servers might. Like even just logging in through the web interface to the dev site could trigger an INSERT into a loginLog table or some such, which could cause the slave replication to stop with errors like this:

Could not execute Write_rows event on table dbname.tablename; Duplicate entry '15610534' for key 'PRIMARY', Error_code: 1062; handler error HA_ERR_FOUND_DUPP_KEY; the event's master log bin-log.000829, end_log_pos 8209872

My question is... is it possible to setup a slave DB such that when conflicts are found that the master DB's data overwrites the slave DB's data?

The advantage of this would mean that developers could have access to real time data in a development environment. Like if a developer is developing some sort of real time report on sales (eg. a "leader board") this real time data could be useful.

mysql mysql-replication master-slave
Martin Hope
neubert
Asked: 2015-11-12 13:10:03 +0800 CST
  • 2

I'm trying to connect to port 3306 on an Ubuntu box and am unable to do so. When I do iptables -L -n | grep 3306 I see this:

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:3306

So it looks like I should be able to connect.

Are there any rules that I should look for that could undo these? In my cursory glance I didn't see any. Plus, when I do grep 80 and grep 443 I see pretty much the same thing as above, but with 80 and 443 instead of 3306. And I'm able to connect on ports 80 and 443 even tho I'm not able to connect on port 3306.

The webserver is hosted on Rackspace's cloud. I know AWS has additional firewall rules independent of the OS that can be set - does Rackspace? I wasn't able to find any in going through the menu and my Google searches haven't proven very fruitful either.

ubuntu
Martin Hope
neubert
Asked: 2015-08-22 06:23:50 +0800 CST
  • 1

So I created a PKCS7 signed message and am trying to validate it with OpenSSL with the following command:

openssl cms -in demo.p7m -inform DER -verify

Doing so returns me the following error:

140653850015376:error 2E09D08A:CMS routines:CMS_verify:signer certificate not found:cms_smime.c:353:

I don't understand this error. Here's the output of openssl asn1parse -in demo.p7m -i -inform DER:

http://pastebin.com/AgkVbQjS

Here's the base64 encoded PKCS7:

http://pastebin.com/92mMPVw6

The X509 cert is as follows:

-----BEGIN CERTIFICATE-----
MIIB4zCCAU6gAwIBAgIAMAsGCSqGSIb3DQEBBTA5MRwwGgYDVQQKDBNwaHBzZWNsaWIgZGVtbyBj
ZXJ0MRkwFwYDVQQDDBB3d3cud2hhdGV2ZXIuY29tMCIYDzIwMTIwNjA0MDMxMDMxWhgPMjAxMzA2
MDQwMzEwMzFaMDkxHDAaBgNVBAoME3BocHNlY2xpYiBkZW1vIGNlcnQxGTAXBgNVBAMMEHd3dy53
aGF0ZXZlci5jb20wgZ0wCwYJKoZIhvcNAQEBA4GNADCBiQKBgQCtYr+TcpSQ043ZZi+akC1LR5Q6
MJPJ6/0MQ7IFPt/SCywaxsdFsNQ40+TOSFNkG68nscyB5nEPDkNzLJ7AklNSRHItqxTwohuW4a+f
BfzAi0vXS9IrM2iep13cHE9r5QW9pouRQiYfbi5FegEWbtIc5SrmAxHAH9K3KGRaXEeufwIDAQAB
MAsGCSqGSIb3DQEBBQOBgQBYEsMuWBA9ie4ulXxeLhLoQvEo6vgl5LDRFMuP+AhkKzfXUo2yEMWP
/QxbSglcPT/ycb+5+FhYGWxGatM5V+sB43ZBHZD14ZWPN35ePmDIfqXdRmphhXuhdNU7DWwp97ZR
c26CQXzHurRf29VloV8k5JKwsfnLRPVCrbJySMB6dg==
-----END CERTIFICATE-----

The cert parses just fine with openssl x509 -in cert.txt -text -noout.

The cert is a self-signed cert. The issuer DN is as follows:

   92:d=6  hl=2 l=  57 cons:       SEQUENCE          
   94:d=7  hl=2 l=  28 cons:        SET               
   96:d=8  hl=2 l=  26 cons:         SEQUENCE          
   98:d=9  hl=2 l=   3 prim:          OBJECT            :organizationName
  103:d=9  hl=2 l=  19 prim:          UTF8STRING        :phpseclib demo cert
  124:d=7  hl=2 l=  25 cons:        SET               
  126:d=8  hl=2 l=  23 cons:         SEQUENCE          
  128:d=9  hl=2 l=   3 prim:          OBJECT            :commonName
  133:d=9  hl=2 l=  16 prim:          UTF8STRING        :www.whatever.com

That matches the issuer DN in the SignerInfo:

  782:d=14 hl=2 l=  57 cons:               SEQUENCE          
  784:d=15 hl=2 l=  28 cons:                SET               
  786:d=16 hl=2 l=  26 cons:                 SEQUENCE          
  788:d=17 hl=2 l=   3 prim:                  OBJECT            :organizationName
  793:d=17 hl=2 l=  19 prim:                  UTF8STRING        :phpseclib demo cert
  814:d=15 hl=2 l=  25 cons:                SET               
  816:d=16 hl=2 l=  23 cons:                 SEQUENCE          
  818:d=17 hl=2 l=   3 prim:                  OBJECT            :commonName
  823:d=17 hl=2 l=  16 prim:                  UTF8STRING        :www.whatever.com

Here's the serial number of the SignerInfo:

  841:d=12 hl=2 l=   1 prim:             INTEGER           :00

This matches the serial number of the of the X509 cert:

   77:d=6  hl=2 l=   0 prim:       INTEGER           :00

So why isn't it finding the signing cert?

openssl
Martin Hope
neubert
Asked: 2014-11-28 08:53:55 +0800 CST
  • 1

I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I can't seem to get it to work:

http://www.frostjedi.com/terra/dev/x509/test.php

Every time I visit that page and send the new SPKAC (as generated by ) I get an error 207: ERR_CERT_INVALID in Google Chrome. The signing cert is has been imported into my browser as a CA cert.

I even tried it over https (on another server) and it didn't work there either.

The source (in the off chance that it matters):

http://pastebin.com/QkDA3pq0

Any ideas?

chrome
Martin Hope
neubert
Asked: 2013-12-25 06:50:35 +0800 CST
  • 2

I'm trying to install mcrypt under php and can't. If I do php test.php | grep mcrypt (where test.php contains phpinfo()) nothing comes up so I want to install it.

If I do sudo apt-get install php5-mcrypt I get this:

E: Unable to locate package php5-mcrypt

If I do sudo apt-cache search mcrypt nothing comes up.

Here's my /etc/apt/sources.list

deb cdrom:[Ubuntu 13.04 _Raring Ringtail_ - Release amd64 (20130424)]/ raring main restricted
deb http://archive.ubuntu.com/ubuntu raring main restricted
deb-src http://archive.ubuntu.com/ubuntu raring main restricted

deb http://security.ubuntu.com/ubuntu raring-security main restricted
deb-src http://security.ubuntu.com/ubuntu raring-security main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://archive.ubuntu.com/ubuntu raring-updates main restricted
deb-src http://archive.ubuntu.com/ubuntu raring-updates main restricted

## Uncomment the following two lines to add software from the 'universe'
## repository.
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
 deb http://archive.ubuntu.com/ubuntu raring universe
 deb-src http://archive.ubuntu.com/ubuntu raring universe
 deb http://archive.ubuntu.com/ubuntu raring-updates universe
 deb-src http://archive.ubuntu.com/ubuntu raring-updates universe
 deb http://security.ubuntu.com/ubuntu raring-security universe
 deb-src http://security.ubuntu.com/ubuntu raring-security universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
 deb http://archive.ubuntu.com/ubuntu raring multiverse
 deb-src http://archive.ubuntu.com/ubuntu raring multiverse
 deb http://archive.ubuntu.com/ubuntu raring-updates multiverse
 deb-src http://archive.ubuntu.com/ubuntu raring-updates multiverse
 deb http://security.ubuntu.com/ubuntu raring-security multiverse
 deb-src http://security.ubuntu.com/ubuntu raring-security multiverse

deb http://us.archive.ubuntu.com/ubuntu/ quantal universe
deb-src http://us.archive.ubuntu.com/ubuntu/ quantal universe
deb http://us.archive.ubuntu.com/ubuntu/ quantal-updates universe
deb-src http://us.archive.ubuntu.com/ubuntu/ quantal-updates universe

The last set of deb / deb-src stuff is from http://forums.linuxmint.com/viewtopic.php?f=90&t=135896

According to https://stackoverflow.com/q/19446679/569976 this should work:

sudo ln -s /etc/php5/conf.d/mcrypt.ini /etc/php5/mods-available
sudo php5enmod mcrypt

Only problem: I do not have /etc/php5/conf.d/mcrypt.ini.

Any ideas? Do I have to compile mcrypt myself from source to get it working on ubuntu? I'm running Ubuntu 13.04.

Thanks!

ubuntu
Martin Hope
neubert
Asked: 2013-08-23 12:21:35 +0800 CST
  • 1

If I request /file-name I get /file-name.php's content back. I want to know how this is happening but can't seem to figure it out.

I emptied the .htaccess and it's still doing it. I verified that the .htaccess I emptied was the correct one by placing "zzz" in it and that resulted in an internal server error, as I'd expect.

I can't find anything in the httpd.conf file in /etc/apache2/sites-enabled either.

Any ideas?

apache-2.2
Martin Hope
neubert
Asked: 2013-08-08 11:10:50 +0800 CST
  • 2

So I installed mod_auth_mysql via the following:

sudo apt-get install libapache2-mod-auth-mysql 
sudo a2enmod auth_mysql 
sudo /etc/init.d/apache2 restart

I updated my .htaccess file to make it connect to the DB as well but it's not working. Here's what I'm getting in the error logs:

[Wed Aug 07 16:35:23 2013] [error] [client xxx.xxx.xxx.xxx] user username not found: /admin/, referer: https://www.domain.tld/

The username very definitely does exist. If I do SELECT * FROM userTable WHERE userName = 'username' it comes up. So I'm at a bit of a loss.

Is there a way I could see the SQL mod_auth_mysql is generating?

From my .htaccess file...

AuthBasicAuthoritative Off
AuthUserFile /dev/null
Auth_MYSQL On
Auth_MySQL_Host localhost
Auth_MySQL_User username
Auth_MySQL_Password password
Auth_MySQL_Authoritative On
Auth_MySQL_DB "dbname"
Auth_MySQL_Password_Table "apache_auth"
Auth_MySQL_Username_Field username
Auth_MySQL_Password_Field password
Auth_MySQL_Group_Field group
Auth_MySQL_Encryption_Types Plaintext

Any ideas?

apache-2.2
Martin Hope
neubert
Asked: 2013-04-01 08:31:43 +0800 CST
  • 1

In my nginx conf.d file I have the following:

  location ~ \.php$ {
    try_files $uri = 404;
    fastcgi_pass unix:/tmp/php5-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location ^~ /dev/ {
    fastcgi_param PHP_VALUE display_errors=On;
  }

My goal was to have it so *.php was parsed by PHP in any directory, including the /dev/ directory and that, within the /dev/ directory, display_errors would be enabled. But it seems that the locations aren't being ANDed together but rather ORd. So if it matches *.php it parses it as a PHP file unless it's in the /dev/ directory.

Do I have to be redundant and have the PHP config code duplicated twice or is there a way I can avoid that redundancy?

Thanks!

php
Martin Hope
neubert
Asked: 2013-03-29 07:54:34 +0800 CST
  • 1

I have in the *.conf file for my domain the following:

server { 
  listen 80; 
  server_name domain.tld; 
  access_log /var/log/nginx/domain.tld.accesslog; 
  root /var/www/domain.tld; 
  index index.htm index.html;
}

My question is... what if I wanted to make all subdomains use the same document root (and same settings in general) as domain.tld?

I tried this:

server { 
  listen 80; 
  server_name domain.tld; 
  server_name *.domain.tld; 
  access_log /var/log/nginx/domain.tld.accesslog; 
  root /var/www/domain.tld; 
  index index.htm index.html;
}

But that didn't work, even after reloading. Any ideas?

nginx