Home / user-167449

Jakov Sosic's questions

Martin Hope
Jakov Sosic
Asked: 2018-07-16 11:36:10 +0800 CST
  • 1

I'm trying to set up nginx as a cache proxy that can cache/serve pages only from one IP range (example: 31.29.100.0/24).

To set up the proxy I use this conf:

server {
    listen 8080;
    location / {
        resolver 127.0.0.1;
        proxy_pass $scheme://$http_host$uri$is_args$args;
        proxy_set_header X-Remote-Addr $proxy_add_x_forwarded_for;
    }
}

Now, this will serve as an open proxy, any destination client requires... Is there a way to limit the destination IPs?

nginx
Martin Hope
Jakov Sosic
Asked: 2018-04-25 15:28:14 +0800 CST
  • 2

I want to pass the RAILS_ENV env variable to nginx and use it to set the value for the rails_env directive.

I can read the value of the variable from the environment with LUA module:

location @app {
    set_by_lua $env_rails_env 'return os.getenv("RAILS_ENV")';
    return 200 'rails env is: ${env_rails_env}';
}

When I curl it, I get the correct answer:

[jsosic@workstation ~]$ curl http://localhost:3005/
rails env is: development

But, if I want to use it as a value for nginx directive:

location @app {
    set_by_lua $env_rails_env 'return os.getenv("RAILS_ENV")';
    rails_env         $env_rails_env;
    limit_req         zone=one burst=100;
    passenger_enabled on;
}

I get the following log:

Message from application: '${env_rails_env}' database is not configured.
Available: ["default", "development", "test", "production"]

Is this even possible?

nginx
Martin Hope
Jakov Sosic
Asked: 2015-08-26 15:58:57 +0800 CST
  • 1

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found:

To lock out an account after 10 days of inactivity, add, as root,
the following line to the auth section of the /etc/pam.d/login file:
auth  required  pam_lastlog.so inactive=10

So, this is my /etc/pam.d/login :

#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       include      system-auth
auth       required     pam_lastlog.so inactive=10
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
-session   optional     pam_ck_connector.so

I log in through ssh as a user, and log out.

After that I set up the time 1 year in the future, as root logged in on TTY1:

# date --set "...."
# hwclock --systohc

I even reboot the VM, but still, when it gets back, I'm able to log in as user through ssh.

Any ideas what am I doing wrong here?

linux
Martin Hope
Jakov Sosic
Asked: 2015-03-14 03:26:32 +0800 CST
  • 6

I'm trying to generate a certificate with the following subjectAltName:

hostname
*.hostname
hostname.mydomain.local
*.hostname.mydomain.local

I generate the CSR via OpenSSL and then get the certificate from Microsoft Active Directory Certificate Services. Certificate works OK for the following alternative names:

hostname
hostname.mydomain.local
*.hostname.mydomain.local

But, *.hostname just doesn't work. Testing with Curl, I get the following output:

% curl https://m.example/
curl: (51) SSL: certificate subject name '*.example' does not match target host name 'm.example'

If, on the other hand, I add 'm.example' as a subjectAltName, then it works. So, wildcard with shortened hostname just refuses to work.

ssl
Martin Hope
Jakov Sosic
Asked: 2015-02-11 07:10:25 +0800 CST
  • 10

Couple of weeks ago I had an issue where I changed DNS addresses in large network of around 300 nodes. After that, some of the nodes still continued to ask old DNS servers, although resolv.conf was ok, and host/nslookup were querying new DNS servers.

Looking at tcpdump and trying to record requests with iptables logging, I confirmed that indeed some of the hosts were still sending queries to old nameservers.

I took one of the hosts out of production and started shutting down services / stracing processes in an attempt to find out the culprit.

At the end - it was lldpd daemon, which obviously cached nameservers at startup and didn't even notice changes in resolv.conf.

So, my question is - is there a more intelligent way to find out which PId is generating specific kind of traffic? I tried with auditctl but without much success. CentOS 6 is in question but if there is solution for any Linux distro, I would appreciate it.

linux
Martin Hope
Jakov Sosic
Asked: 2014-10-03 17:06:55 +0800 CST
  • 3

I've noticed a very peculiar problem with Apache. I have a very high number of virtual hosts set up - it's around 501.

Problems started occuring after vhost number 493. First 493 vhosts work as expected, but as soon as I add vhost number 494, PHP stops communicating with memcache, and it times out on every read/write access.

Actually, I'm using memcache as a backend sessions store, so, php function:

session_start();

simply times out after 30 sec.

If I delete the random one of the 494 vhosts and restart apache, it starts working again.

I've set ulimit really high (65k) but it doesn't help. I've tried switching off ulimits completely, but no luck.

Do you guys have any ideas what more could I try?

I've tried stracing the httpd process to which I'm connected to, after I hit the enter in browser and after 30 sec wait commences.

This is the strace output:

select(1170, [1024 1169], [], NULL, {1, 0}) = 2 (in [1024 1169], left {0, 999998})
select(1170, [1024 1169], [], NULL, {1, 0}) = 2 (in [1024 1169], left {0, 999998})
select(1170, [1024 1169], [], NULL, {1, 0}) = 2 (in [1024 1169], left {0, 999998})
select(1170, [1024 1169], [], NULL, {1, 0}) = 2 (in [1024 1169], left {0, 999998})
select(1170, [1024 1169], [], NULL, {1, 0}) = 2 (in [1024 1169], left {0, 999998})

So basically apache is stuck on select(), and that's it, it repeats the select() system call indefinitely.

Next thing I have come up with is tcpdump, to see if the package actually goes through from apache, and it really does:

22:11:28.366677 IP6 ::1.51404 > ::1.11914: Flags [S], seq 2899674987, win 32752, options [mss 16376,sackOK,TS val 1384759049 ecr 0,nop,wscale 9], length 0
22:11:28.366697 IP6 ::1.11914 > ::1.51404: Flags [S.], seq 2034630080, ack 2899674988, win 32728, options [mss 16376,sackOK,TS val 1384759049 ecr 1384759049,nop,wscale 9], length 0
22:11:28.366709 IP6 ::1.51404 > ::1.11914: Flags [.], ack 1, win 64, options [nop,nop,TS val 1384759049 ecr 1384759049], length 0
22:11:28.366752 IP6 ::1.51404 > ::1.11914: Flags [P.], seq 1:41, ack 1, win 64, options [nop,nop,TS val 1384759049 ecr 1384759049], length 40
22:11:28.366758 IP6 ::1.11914 > ::1.51404: Flags [.], ack 41, win 64, options [nop,nop,TS val 1384759049 ecr 1384759049], length 0
22:11:28.366768 IP6 ::1.51404 > ::1.11914: Flags [P.], seq 41:90, ack 1, win 64, options [nop,nop,TS val 1384759050 ecr 1384759049], length 49
22:11:28.366772 IP6 ::1.11914 > ::1.51404: Flags [.], ack 90, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 0
22:11:28.366779 IP6 ::1.51404 > ::1.11914: Flags [P.], seq 90:122, ack 1, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 32
22:11:28.366783 IP6 ::1.11914 > ::1.51404: Flags [.], ack 122, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 0
22:11:28.367063 IP6 ::1.11914 > ::1.51404: Flags [P.], seq 1:12, ack 122, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 11
22:11:28.367070 IP6 ::1.51404 > ::1.11914: Flags [.], ack 12, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 0
22:11:28.367266 IP6 ::1.11914 > ::1.51404: Flags [P.], seq 12:20, ack 122, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 8
22:11:28.367275 IP6 ::1.51404 > ::1.11914: Flags [.], ack 20, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 0
22:11:28.367477 IP6 ::1.11914 > ::1.51404: Flags [P.], seq 20:25, ack 122, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 5
22:11:28.367489 IP6 ::1.51404 > ::1.11914: Flags [.], ack 25, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 0
22:11:28.367629 IP6 ::1.51404 > ::1.11914: Flags [P.], seq 122:181, ack 25, win 64, options [nop,nop,TS val 1384759050 ecr 1384759050], length 59
22:11:28.367859 IP6 ::1.11914 > ::1.51404: Flags [P.], seq 25:33, ack 181, win 64, options [nop,nop,TS val 1384759051 ecr 1384759050], length 8
22:11:28.367869 IP6 ::1.51404 > ::1.11914: Flags [P.], seq 181:230, ack 33, win 64, options [nop,nop,TS val 1384759051 ecr 1384759051], length 49
22:11:28.368102 IP6 ::1.11914 > ::1.51404: Flags [P.], seq 33:41, ack 230, win 64, options [nop,nop,TS val 1384759051 ecr 1384759051], length 8
22:11:28.368138 IP6 ::1.51404 > ::1.11914: Flags [F.], seq 230, ack 41, win 64, options [nop,nop,TS val 1384759051 ecr 1384759051], length 0
22:11:28.368195 IP6 ::1.11914 > ::1.51404: Flags [F.], seq 41, ack 231, win 64, options [nop,nop,TS val 1384759051 ecr 1384759051], length 0
22:11:28.368206 IP6 ::1.51404 > ::1.11914: Flags [.], ack 42, win 64, options [nop,nop,TS val 1384759051 ecr 1384759051], length 0

Next thing I did is GDB of Apache process when I issue a curl call to a page containing session_start(), and this is the output:

232     *(*new)->local_addr = *sock->local_addr;
241     if (sock->local_addr->sa.sin.sin_family == AF_INET) {
238     (*new)->local_addr->pool = connection_context;
241     if (sock->local_addr->sa.sin.sin_family == AF_INET) {
238     (*new)->local_addr->pool = connection_context;
241     if (sock->local_addr->sa.sin.sin_family == AF_INET) {
245     else if (sock->local_addr->sa.sin.sin_family == AF_INET6) {
246         (*new)->local_addr->ipaddr_ptr = &(*new)->local_addr->sa.sin6.sin6_addr;
249     (*new)->remote_addr->port = ntohs((*new)->remote_addr->sa.sin.sin_port);
250     if (sock->local_port_unknown) {
256     if (apr_is_option_set(sock, APR_TCP_NODELAY) == 1) {
257         apr_set_option(*new, APR_TCP_NODELAY, 1);
266     if (sock->local_interface_unknown ||
267         !memcmp(sock->local_addr->ipaddr_ptr,
266     if (sock->local_interface_unknown ||
276         (*new)->local_interface_unknown = 1;
293     apr_pool_cleanup_register((*new)->pool, (void *)(*new), socket_cleanup,
292     (*new)->inherit = 0;
293     apr_pool_cleanup_register((*new)->pool, (void *)(*new), socket_cleanup,
296 }   
unixd_accept (accepted=0x7fff14ecddf0, lr=0x7fe93a905aa8, ptrans=<value optimized out>) at /usr/src/debug/httpd-2.2.15/os/unix/unixd.c:507
507     if (status == APR_SUCCESS) {
508         *accepted = csd;
649 }   
child_main (child_num_arg=<value optimized out>) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:650
650         SAFE_ACCEPT(accept_mutex_off());      /* unlock after "accept" */
652         if (status == APR_EGENERAL) {
656         else if (status != APR_SUCCESS) {
665         current_conn = ap_run_create_connection(ptrans, ap_server_conf, csd, my_child_num, sbh, bucket_alloc);
666         if (current_conn) {
667             ap_process_connection(current_conn, csd);

At this location there's a big pause (~30 sec), until php times out. After that, I got this:

668             ap_lingering_close(current_conn);
676         if (ap_mpm_pod_check(pod) == APR_SUCCESS) { /* selected as idle? */
680                  ap_scoreboard_image->global->running_generation) { /* restart? */
679         else if (ap_my_generation !=
680                  ap_scoreboard_image->global->running_generation) { /* restart? */
679         else if (ap_my_generation !=
551     while (!die_now && !shutdown_pending) {
559         apr_pool_clear(ptrans);
562              && requests_this_child++ >= ap_max_requests_per_child)) { 
561         if ((ap_max_requests_per_child > 0
562              && requests_this_child++ >= ap_max_requests_per_child)) {
561         if ((ap_max_requests_per_child > 0
562              && requests_this_child++ >= ap_max_requests_per_child)) {
561         if ((ap_max_requests_per_child > 0
566         (void) ap_update_child_status(sbh, SERVER_READY, (request_rec *) NULL);
573         SAFE_ACCEPT(accept_mutex_on());
575         if (num_listensocks == 1) {

The weirdest thing is I cannot reproduce this on another machine. Same OS, same packages, same config (puppet) same kernel, different HW.

apache-2.2
Martin Hope
Jakov Sosic
Asked: 2014-09-14 06:34:19 +0800 CST
  • 0

to allow me to easier debug my providers, I sometimes wanna use 'command' in my own ruby code.

Trying to figure out how is problem.

This is how I use it inside a provider:

commands :wget    => '/usr/bin/wget',
         :cp      => '/bin/cp'

Later, I can run the command with simple:

wget('http://example.com')

Now, I tried doing this:

something = Puppet::Provider.commands({:wget => '/usr/bin/wget'})
something.wget('http://example.com')

but, I get this:

test.rb:15: undefined method `wget' for {:wget=>"/usr/bin/wget"}:Hash (NoMethodError)

I also tried running:

wget = Puppet::Provider::Command.new('wget', '/usr/bin/wget', Puppet::Util, Puppet::Util::Execution)
puts Puppet::Util::Execution.execute(['wget','http://example.com'],{})

but the output is blank...

Any ideas?

puppet
Martin Hope
Jakov Sosic
Asked: 2014-02-05 10:45:43 +0800 CST
  • 0

I would like to use nginx as a proxy to a Tomcat non-root app but am having problems to do that. This is the code that I use:

location / {
    proxy_pass         http://127.0.0.1:8080/app_v1.1.0/;
        proxy_redirect     off;

        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_max_temp_file_size 0;

        client_max_body_size       10m;
        client_body_buffer_size    128k;

        proxy_connect_timeout      90;
        proxy_send_timeout         90;
        proxy_read_timeout         90;

        proxy_buffer_size          4k;
        proxy_buffers              4 32k;
        proxy_busy_buffers_size    64k;
        proxy_temp_file_write_size 64k;
    }

Now, this works ok for the app login screen but doesn't work for anything beyond that. After I login, the login page comes back so I think something is wrong with this kind of proxying, some kind of rewrite is obviously missing.

If I change it to something like:

location / {
    proxy_pass         http://127.0.0.1:8080/;
}

or: 

location /app_v1.1.0 {
    proxy_pass         http://127.0.0.1:8080/app_v1.1.0
}

Then it works but i have to access my app via 'http:///app_v1.1.0' ... Can this be circumvented somehow?

Thank you.

nginx