meder omuraliev's questions

After maybe ~20 minutes it seems like my apache server becomes unconnectable. By unconnectable, I mean if I curl any page, it just results in nothing for 2-3 minutes and then nothing ever shows up. I'm forced to restart apache to make it usable. The actual box itself seems fine, since I'm always SSH'd in... so I think this is just an Apache thing.

After ~3-5 minutes of stopping/starting the apache server, memory usage twindles:

One second it's:

                                          CPU  MEM
21997 root      20   0  459m 208m 8504 R  45.8 20.8  10:14.56 apache2        

The next:

21997 root      20   0  459m 208m 8504 S   8.8 20.8  10:37.37 apache2        

So one second it's at 40% CPU, 20% mem

There are only 2-3 small websites that use PHP, so there's no way they could be consuming that amount of memory. I'm wondering why this happens?!

My config for Apache (prefork) is:

<IfModule mpm_prefork_module>
    StartServers          5
    MinSpareServers       5
    MaxSpareServers      10
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

Server version: Apache/2.2.22 (Debian)

On Debian Wheezy using libapache2-mod-php5

I know mod_php is probably not the most efficient and there might be better alternatives like php-fpm, and/or using nginx but I want to actually get at the root of the problem instead of avoiding it.

Would appreciate any tips.

The configuration for apache2 I believe is stock. Using DigitalOcean VPS, the 1GB Memory / 30 GB SSD / 2TB Transfer tier.

EDIT #1: I just read some Linode optimization article and it mentions turning KeepAlive off on low memory servers. I'm going to try this and see how it goes.

Apache - keep-alive or not keep-alive?

Box got slow and decided to vim /var/log/secure and saw a bunch of brute force methods trying to ssh with names starting from A-Z.

iptables was installed so I added the ip via:

iptables -I FORWARD -s [ip] -j DROP
iptables -I INPUT -s [ip] -j DROP

It seemed like it blocked his ip automatically. I did:

iptables -nvL|less

Which showed his IP being supposedly blocked:

Chain INPUT (policy ACCEPT 26G packets, 9985G bytes)
 pkts bytes target     prot opt in     out     source               destination         
   23  1400 DROP       all  --  *      *       [HIS_IP]         0.0.0.0/0           
  26G 9985G PORTSEN    all  --  *      *       0.0.0.0/0            0.0.0.0/0  

Is this it? Do I need to use any command to actually save it? like service iptables save? Or is this automatically saved?

As a preventative measure, I'm going to follow a guide and add:

iptables -I INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
iptables -I INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j DROP

Are these measures enough for the low to medium level attacks? Would appreciate any input.

I am on Debian Lenny and I had nginx 0.7.65 from lenny-backports installed. I needed the uwsgi module so I added the deb-src for lenny-backports and did apt-get source nginx. This grabbed the 0.7.67-3.

I followed this guide to a T: http://brandonkonkle.com/blog/2010/sep/14/django-uwsgi-and-nginx/ and then did dpkg -i nginx*.deb as per the instructions.

It doesn't seem like it replaced 0.7.65 because I get this:

(Reading database ... 27253 files and directories currently installed.)
Preparing to replace nginx 0.7.67-3~bpo50+1 (using nginx_0.7.67-3~bpo50+1_i386.deb) ...
Unpacking replacement nginx ...
Preparing to replace nginx-dbg 0.7.67-3~bpo50+1 (using nginx-dbg_0.7.67-3~bpo50+1_i386.deb) ...
Unpacking replacement nginx-dbg ...
Setting up nginx (0.7.67-3~bpo50+1) ...
Trying a soft restart
Processing triggers for man-db ...
Setting up nginx-dbg (0.7.67-3~bpo50+1) ...

And, if I try to /etc/init.d/nginx stop and start again, it wont obey. I think I may have caused a conflict of some sorts?

The dpkg -i was supposed to install 0.7.67, and I have 2 deb files after I did the dpkg-buildpackage: nginx_0.7.67-3~bpo50+1_i386.deb and nginx-dbg_0.7.67-3~bpo50+1_i386.deb

Where did I go wrong? Could someone explain why nginx doesnt obey at all now? I can't stop it or start it. If I go into aptitude it tells me that 0.7.67 is the installed version.

I ran dpkg-buildpackage after getting a apt-get source nginx of a backports version of nginx and modifying debian/rules to include the uwsgi module. The last results of the command were:

dpkg-deb: building package `nginx' in `../nginx_0.7.67-3~bpo50+1_i386.deb'.
dpkg-deb: building package `nginx-dbg' in `../nginx-dbg_0.7.67-3~bpo50+1_i386.deb'.
 signfile nginx_0.7.67-3~bpo50+1.dsc
gpg: keyring `/home/shogun/.gnupg/secring.gpg' created
gpg: skipped "Faidon Liambotis <[email protected]>": secret key not available
gpg: [stdin]: clearsign failed: secret key not available

 dpkg-genchanges  >../nginx_0.7.67-3~bpo50+1_i386.changes
dpkg-genchanges: warning: the current version (0.7.67-3~bpo50+1) is smaller than the previous one (0.7.67-3)
dpkg-genchanges: not including original source code in upload
dpkg-buildpackage: binary and diff upload (original source NOT included)
dpkg-buildpackage: warning: Failed to sign .dsc and .changes file

It complains that because I'm not the original maintainer of the package, my key didnt match.

Is this really necessary and if so how can I make it use my keys to do the gpg matching?

My current sources.list:

## main & security repositories
deb http://ftp.us.debian.org/debian/ lenny main
deb-src http://ftp.us.debian.org/debian/ lenny main
deb http://security.debian.org/ lenny/updates main
deb-src http://security.debian.org/ lenny/updates main

#deb http://ftp.us.debian.org/debian/ lenny contrib
#deb-src http://ftp.us.debian.org/debian/ lenny contrib
#deb http://security.debian.org/ lenny/updates contrib
#deb-src http://security.debian.org/ lenny/updates contrib

#deb http://ftp.us.debian.org/debian/ lenny non-free
#deb-src http://ftp.us.debian.org/debian/ lenny non-free
#deb http://security.debian.org/ lenny/updates non-free
#deb-src http://security.debian.org/ lenny/updates non-free

deb http://www.backports.org/debian lenny-backports main contrib non-free

Lenny stable has nginx 0.6.32. I have 0.7.6xish from lenny backports. I want to recompile the .deb with the uwsgi module. If I apt-get source nginx I am given the 0.6.32 files.

How can I modify my sources.list such that I get my lenny backports version? Or is that not possible? If so would I solely have to rely on sid? And if so, could someone tell me what exact lines I need to add for sid?

And if I do end up adding a deb-src line for sid, that's just temporary in order for me to run the apt-get source nginx command, because otherwise I'd be grabbing sid packages across the board?

For my future debian setups I'd like to use a common file containing lists of packages and commands to run after initial VPS creation ( I use linode ).

Could anyone advise what I could setup in order to accomplish this? I would want to throw in commands such as aptitude update and then aptitude install screen and dozens and dozens of packages to download.

I have two linode VPS's running debian lenny and I would like to use one of them for my production server and the other for static media ( nginx ).

I have a django admin setup on my production server. I was suggested to use mount to mount my static server through some fileserver ( samba, nfs, ssh-fs ). After mounting I would use the mount path as the upload_to setting in my file uploads on the production box.

As I've never done this before, could anyone offer insight into which of the fileservers I should use and how I should start off? And maybe tips for do's and don'ts?

Things I would like to get tips about:

• Which one of the filesystems should I use?
• How would I handle a dropped connection?
• How can I make the production server mount the static one? What type of authentication would I need to use?

I've added these rules to mime.types:

application/x-font-ttf                ttf;
font/opentype                         otf;
application/vnd.ms-fontobject         eot;
font/x-woff                           woff;

Now the Content-Type header is being set properly per each of those. My only issue now is that Firefox requires Access-Control-Allow-Origin. I have googled this answer and added this to my server directive:

location ~* \.(eot|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
}

but now my fonts aren't being served at all.

Instead the error.log reports that it's trying to open them on the local filesystem..

2010/10/02 22:20:21 [error] 1641#0: *15 open() "/usr/local/nginx/html/fonts/mgopenmodernabold-webfont.woff" failed (2: No such file or directory), client: 69.164.216.142, se rver: static.arounds.org, request: "HEAD /fonts/mgopenmodernabold-webfont.woff HTTP/1.1", host: "static.arounds.org"

Any ideas what could be off with the syntax? Do I need to explicitly add a rule saying don't try to open it locally or what?

EDIT: I think the problem is that I'm serving 2 different locations now. And instead of that I should do the regex check inside of the main one then feed the header.

Sometimes I need to ssh to a new remote server and immediately fix something without ssh trying to find any private keys on my host. It usually stalls at this point:

debug1: Next authentication method: gssapi-with-mic


debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/blah' not found

debug1: Unspecified GSS failure.  Minor code may provide more information
Credentials cache file '/tmp/blah2' not found

debug1: Unspecified GSS failure.  Minor code may provide more information

Is there a way I can specify for ssh to just do password based authentication immediately?

-v which has a max limit of 3-4 controls the verbosity for the ssh command.

I'm behind a proxy and I have ssh setup to use a proxy, so this could be the case but I've noticed that

ssh [email protected] -vvvv is more reliable than ssh [email protected]. Call me crazy, but if I don't specify the verbosity sometimes it just doesn't connect. If I do specify the verbosity, it will be more informative and connect.

Is there any explanation for this behaviour? And for me this is pretty consistent behaviour. Does the verbosity somehow change a variable in the way the ssh connects and returns data such that it forces it to work?

man screen:

   Screen is a full-screen window manager that multiplexes a physical ter‐
   minal between several processes (typically interactive  shells).   Each
   virtual terminal provides the functions of a DEC VT100 terminal and, in
   addition, several control functions from the ISO 6429  (ECMA  48,  ANSI
   X3.64)  and ISO 2022 standards (e.g. insert/delete line and support for
   multiple character sets).  There is a  scrollback  history  buffer  for
   each virtual terminal and a copy-and-paste mechanism that allows moving
   text regions between windows.


   When screen is called, it creates a single window with a  shell  in  it
   (or  the  specified  command) and then gets out of your way so that you
   can use the program as you normally would.  Then, at any time, you  can
   create new (full-screen) windows with other programs in them (including
   more shells), kill existing windows, view a list of windows, turn  out‐
   put  logging  on and off, copy-and-paste text between windows, view the
   scrollback history, switch between windows in whatever manner you wish,
   etc.  All  windows  run  their  programs completely independent of each
   other. Programs continue to run when their window is currently not vis‐
   ible and even when the whole screen session is detached from the user's
   terminal.  When a program terminates, screen (per  default)  kills  the
   window  that  contained  it.  If this window was in the foreground, the
   display switches to the previous  window;  if  none  are  left,  screen
   exits.

With the technical explanation out of the way, how does it differ from say, creating tabs in a regular gnome terminal?

For the list of things you can do from the manual, I can already create new tabs, kill tabs, view a list of my tabs, switch between windows. Is it just more convenient with screen? Could someone explain in layman's terms the benefits?

I have nginx setup as the defacto port 80. I want to setup django+mod_wsgi on Apache2. I'm worried if I leave Apache2 as 80 it will cause a conflict.

Is it better to avoid the headache and change Apache to a different port?

server {
    listen 80;
    server_name work.domain.org;

    access_log /www/work.domain.org/log/access.log;
    error_log /www/work.domain.org/log/error.log;

    location / {
        proxy_pass http://127.0.0.1:8080/;
        proxy_redirect off;

        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header        X-Magic-Header "secret";
        client_max_body_size       10m;
    }
}

Possible Duplicate:
My server’s been hacked EMERGENCY

I got a 32-bit Debian VPS from http://linode.com and I really haven't done any sort of advanced configuration for securing it ( port 22; password enabled ).

It seems somehow there is ssh scanning going on from my IP, I'm being flagged as this is against the TOS. I've been SSHing only from my home Comcast ISP which I run Linux on.

Is this a common thing when getting a new vps? Are there any standard security configuration tips? I'm quite confused as to how my machine has been accused of this ssh scanning.

On one of my vps servers I've setup both Apache2 and nginx, nginx on port 8080 and Apache2 on 80, and have created a static HTML file.

static HTML/Apache2:

meder@meder-desktop:~$ sudo ab -n 1000 -c 5 http://medero.org/index.html
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking medero.org (be patient)
Completed 100 requests
Completed 200 requests
Completed 300 requests
Completed 400 requests
Completed 500 requests
Completed 600 requests
Completed 700 requests
Completed 800 requests
Completed 900 requests
Completed 1000 requests
Finished 1000 requests


Server Software:        Apache/2.2.9
Server Hostname:        medero.org
Server Port:            80

Document Path:          /index.html
Document Length:        1014 bytes

Concurrency Level:      5
Time taken for tests:   6.186 seconds
Complete requests:      1000
Failed requests:        0
Write errors:           0
Total transferred:      1334000 bytes
HTML transferred:       1014000 bytes
Requests per second:    161.67 [#/sec] (mean)
Time per request:       30.928 [ms] (mean)
Time per request:       6.186 [ms] (mean, across all concurrent requests)
Transfer rate:          210.61 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:       12   15   2.1     14      35
Processing:    12   16   3.4     15      48
Waiting:       12   16   2.8     15      37
Total:         25   31   4.3     29      63

Percentage of the requests served within a certain time (ms)
  50%     29
  66%     30
  75%     31
  80%     32
  90%     35
  95%     39
  98%     47
  99%     51
 100%     63 (longest request)

static HTML/Nginx:

meder@meder-desktop:~$ sudo ab -n 1000 -c 5 http://medero.org:8080/index.html
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking medero.org (be patient)
Completed 100 requests
Completed 200 requests
Completed 300 requests
Completed 400 requests
Completed 500 requests
Completed 600 requests
Completed 700 requests
Completed 800 requests
Completed 900 requests
Completed 1000 requests
Finished 1000 requests


Server Software:        nginx/0.6.32
Server Hostname:        medero.org
Server Port:            8080

Document Path:          /index.html
Document Length:        1014 bytes

Concurrency Level:      5
Time taken for tests:   6.424 seconds
Complete requests:      1000
Failed requests:        0
Write errors:           0
Total transferred:      1226000 bytes
HTML transferred:       1014000 bytes
Requests per second:    155.67 [#/sec] (mean)
Time per request:       32.119 [ms] (mean)
Time per request:       6.424 [ms] (mean, across all concurrent requests)
Transfer rate:          186.38 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:       13   15   2.5     14      36
Processing:    12   17  11.0     15     184
Waiting:       11   16   9.6     14     171
Total:         25   32  11.4     30     200

Percentage of the requests served within a certain time (ms)
  50%     30
  66%     31
  75%     33
  80%     33
  90%     35
  95%     38
  98%     45
  99%     50
 100%    200 (longest request)

I've done this numerous times and the results are pretty much the same, with Apache2 taking less time to process than Nginx.

Here's the config for nginx:

user www-data;
worker_processes  4;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    access_log  /var/log/nginx/access.log;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay        on;

    gzip  on;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

And Apache 2.2.9-10 (prefork - nonthreaded):

MaxKeepAliveRequests 100
KeepAliveTimeout 15
<IfModule mpm_prefork_module>
    StartServers          5
    MinSpareServers       5
    MaxSpareServers      10
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

Loaded modules:

meder@host:~$ sudo apache2ctl -t -D DUMP_MODULES
Loaded Modules:
 core_module (static)
 log_config_module (static)
 logio_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 alias_module (shared)
 auth_basic_module (shared)
 authn_file_module (shared)
 authz_default_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgi_module (shared)
 dir_module (shared)
 env_module (shared)
 mime_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 status_module (shared)
 wsgi_module (shared)
Syntax OK

Server details:

Debian Lenny 5.0.3
32-bit Unmanaged VPS
384MB Ram

processor   : 7
vendor_id   : GenuineIntel
cpu family  : 6
model       : 23
model name  : Intel(R) Xeon(R) CPU           E5405  @ 2.00GHz
stepping    : 6
cpu MHz     : 1995.006
cache size  : 6144 KB
physical id : 1
siblings    : 4
core id     : 3
cpu cores   : 4
apicid      : 7
fpu     : yes
fpu_exception   : yes
cpuid level : 10
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm
bogomips    : 3990.03
clflush size    : 64
cache_alignment : 64
address sizes   : 38 bits physical, 48 bits virtual
power management:

Memory info:

cat /proc/meminfo 
MemTotal:       393216 kB
MemFree:        304828 kB
Buffers:             0 kB
Cached:              0 kB
SwapCached:          0 kB
Active:              0 kB
Inactive:            0 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:       393216 kB
LowFree:        304828 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
AnonPages:           0 kB
Mapped:          88388 kB
Slab:                0 kB
PageTables:          0 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:         0 kB
Committed_AS:   354892 kB
VmallocTotal:        0 kB
VmallocUsed:         0 kB
VmallocChunk:        0 kB
HugePages_Total:     0
HugePages_Free:      0
HugePages_Rsvd:      0
Hugepagesize:     2048 kB

It appears that mod_deflate isn't even enabled so I'm not even using gzip on Apache2, yet it serves the static HTML faster than nginx. I'm a bit puzzled, could it be that I need to just reconfigure the settings for nginx? Any advice appreciated.

Update #1 - I installed apache2-utils and ran dstat. I also changed the test file so it's now using a 9.7 mb html file, Apache2 and nginx are still pretty consistent. Perhaps I need to limit the amount of memory available or something to bottleneck it..

Here is the dstat running while I queried the 9.7 mb consecutive times:

sudo dstat
----total-cpu-usage---- -dsk/total- -net/total- ---paging-- ---system--
usr sys idl wai hiq siq| read  writ| recv  send|  in   out | int   csw 
  0   0 100   0   0   0|   0     0 |   0     0 |   0     0 |   0  7230 
  0   0 100   0   0   0|   0     0 |6071B   20k|   0     0 |   0  5534 
  0   0 100   0   0   0|   0     0 | 720B   21k|   0     0 |   0  4749 
  0   0 100   0   0   0|   0     0 | 822B 4788B|   0     0 |   0  5487 
  0   0 100   0   0   0|   0     0 | 288B  408B|   0     0 |   0  4625 
  0   0 100   0   0   0|   0     0 |5595B 4057B|   0     0 |   0  5966 
  0   0 100   0   0   0|   0     0 | 957B 3710B|   0     0 |   0  4904 
  0   0 100   0   0   0|   0     0 | 986B 5013B|   0     0 |   0  6906 
  0   0 100   0   0   0|   0     0 | 872B 3636B|   0     0 |   0  5614 
  0   0 100   0   0   0|   0     0 |  80B  368B|   0     0 |   0  5506 
  0   0 100   0   0   0|   0     0 |  80B  660B|   0     0 |   0  4883 
  0   0 100   0   0   0|   0     0 |1604B 5105B|   0     0 |   0  5087 
  0   0 100   0   0   0|   0     0 | 860B 3708B|   0     0 |   0    13k
  0   0 100   0   0   0|   0     0 | 909B 3619B|   0     0 |   0    11k
  0   0 100   0   0   0|   0     0 |  16k   44k|   0     0 |   0  5920 
  0   0 100   0   0   0|   0     0 | 132B 3256B|   0     0 |   0  6946 
  0   0 100   0   0   0|   0     0 | 184B 3589B|   0     0 |   0  5083 
  0   0 100   0   0   0|   0     0 | 869B 3637B|   0     0 |   0  5528 
  0   0 100   0   0   0|   0     0 | 917B 3576B|   0     0 |   0  5638 
  0   0 100   0   0   0|   0     0 | 9.8k 2299B|   0     0 |   0  5255 
  0   0 100   0   0   0|   0     0 |6205B   11k|   0     0 |   0  7230 
  0   0 100   0   0   0|   0     0 |1712B   35k|   0     0 |   0  4863 
  0   1  99   0   0   0|   0     0 | 243k   25M|   0     0 |   0  7432 
  0   1  99   0   0   0|   0     0 | 337k   33M|   0     0 |   0  8716 
  0   1  99   0   0   0|   0     0 | 297k   35M|   0     0 |   0  6786 
  0   1  99   0   0   0|   0     0 | 349k   33M|   0     0 |   0  7655 
  0   1  99   0   0   0|   0     0 | 338k   33M|   0     0 |   0  7605 
  0   1  99   0   0   0|   0     0 | 324k   34M|   0     0 |   0  7967 
  0   1  99   0   0   0|   0     0 | 320k   35M|   0     0 |   0  7235 
  0   1  99   0   0   0|   0     0 | 333k   35M|   0     0 |   0  7062 
  0   1  99   0   0   0|   0     0 | 355k   35M|   0     0 |   0  6209 
  0   1  99   0   0   0|   0     0 | 299k   33M|   0     0 |   0  8732 
  0   1  99   0   0   0|   0     0 | 369k   34M|   0     0 |   0  8610 
  0   0 100   0   0   0|   0     0 | 352k   34M|   0     0 |   0  7635 
  0   1  99   0   0   0|   0     0 | 331k   34M|   0     0 |   0  8087 
  0   1  99   0   0   0|   0     0 | 312k   35M|   0     0 |   0  6445 
  0   0 100   0   0   0|   0     0 |  81k 7879k|   0     0 |   0  6131 
  0   0 100   0   0   0|   0     0 |  80B 1848B|   0     0 |   0  5124 
  0   0 100   0   0   0|   0     0 | 120B 6216B|   0     0 |   0  5426 
  0   0 100   0   0   0|   0     0 | 120B 3256B|   0     0 |   0  4947 
  0   0 100   0   0   0|   0     0 |  15k   43k|   0     0 |   0  5632 
  0   0 100   0   0   0|   0     0 | 829B 8504B|   0     0 |   0  5913 
  0   0 100   0   0   0|   0     0 |  92B  384B|   0     0 |   0  8680 
  0   0 100   0   0   0|   0     0 | 926B  571B|   0     0 |   0  4843 
  0   0 100   0   0   0|   0     0 | 795B  675B|   0     0 |   0  5479 
  0   0 100   0   0   0|   0     0 | 280B 2048B|   0     0 |   0  4536 
  0   0 100   0   0   0|   0     0 | 172B 1760B|   0     0 |   0  6334 
  0   0 100   0   0   0|   0     0 | 120B  456B|   0     0 |   0  5710 
  0   0 100   0   0   0|   0     0 |  80B  408B|   0     0 |   0  6225 
  0   0 100   0   0   0|   0     0 | 120B  368B|   0     0 |   0  6639 
  0   0 100   0   0   0|   0     0 | 140B  328B|   0     0 |   0  5507 
  0   0 100   0   0   0|   0     0 |7487B 9697B|   0     0 |   0  7201 
  0   0 100   0   0   0|   0     0 | 920B   37k|   0     0 |   0  6086 
  0   0 100   0   0   0|   0     0 | 320B  536B|   0     0 |   0  5756 
  0   0 100   0   0   0|   0     0 |  40B  384B|   0     0 |   0  7153 
  0   0 100   0   0   0|   0     0 |  80B  368B|   0     0 |   0  5227 
  0   0 100   0   0   0|   0     0 |  80B  408B|   0     0 |   0  6042 
  0   0 100   0   0   0|   0     0 | 160B  368B|   0     0 |   0  6730 
  0   0 100   0   0   0|   0     0 |  80B  280B|   0     0 |   0  5424 
  0   0 100   0   0   0|   0     0 |  80B  336B|   0     0 |   0  8042 
  0   0 100   0   0   0|   0     0 |  40B  384B|   0     0 |   0  5559 
  0   0 100   0   0   0|   0     0 |  80B  280B|   0     0 |   0  6266 
  0   0 100   0   0   0|   0     0 |  80B  296B|   0     0 |   0  6198 
  0   0 100   0   0   0|   0     0 |  80B  456B|   0     0 |   0  6499 
  0   0 100   0   0   0|   0     0 |  80B  368B|   0     0 |   0  7143 

On my server/vps after I initially get the credentials I:

adduser meder
visudo

in visudo, at the far bottom:

meder    ALL=(ALL) ALL

And from then on I use meder, along with the sudo command. Is this pretty much how I should be doing it?

And on the topic of creating a user group such that www-data and meder can access the same files, what specific privileges should I give, how should I set it up so both can touch the same files ( would be great if sample code was provided as I'm not that fluent yet ).

My ultimate goal is to setup ikiwiki, my current goal is to get a fcgi wrapper working for nginx, so I can move on to the next step...

The ikiwiki page points out this page as an example for a fcgi wrapper:

http://technotes.1000lines.net/?p=23

So far I've installed the ikiwiki and libfcgi-perl modules through aptitude:

aptitude install libfcgi-perl
aptitude install ikiwiki

It installed those packages as well as some minimal dependency packages.

So the next step following the guide at technotes, I grabbed http://technotes.1000lines.net/fastcgi-wrapper.pl but I'm not sure where to actually place this file... do I run it as a service?

The script makes a socket file in /var/run/nginx but that directory does not exist.. do I manually create it?

So in addition to the .pl file for the cgi wrapper, I need to also define a separate cgi file for parameters. If my conf looks like this...

    server {
        listen 80;
        server_name notes.domain.org;

        access_log /www/notes/public_html/notes.domain.org/log/access.log;
        error_log /www/notes/public_html/notes.domain.org/log/error.log;

        location / {
                root /www/notes/public_html/notes.domain.org/public/;
                index index.html;
        }

  }

And I don't have a cgi-bin directory, where exactly should I create it within my structure, and regarding that I'd obviously have to update the below before I include it in my conf, but I'm just not exactly sure how this would work out.

# /cgi-bin configuration
location ~ ^/cgi-bin/.*\.cgi$ {
  gzip off;
  fastcgi_pass  unix:/var/run/nginx/perl_cgi-dispatch.sock;  [1]*
  fastcgi_param SCRIPT_FILENAME /www/blah.com$fastcgi_script_name; [2]*
  include fastcgi_params; [3]*
}

Also since the user is www-data and /var/run is root owned, what's the proper way of giving it access?

Any tips appreciated.

I'm trying to write a guide with some essentials that one should do after his/her server has finished "building", important things like setting up a secondary user that's non-root, locales, perhaps even disabling a password login and using keys instead. If you do decide to participate mind providing code examples in addition to a small description?

This may sound like a very silly question, but how could I setup domains ( eg www.foo.com ) on my local network? I know that all a domain is, is just a name registered to a name server and that nameserver has a zone record, and in the zone record there are several records of which the A Record is the most important in dictating where the lookup goes to, which machine it should point to.

I basically want to make it so that I can refer to my other computer/webserver as 'www.foo.com' and make my local sites accessible by that, mess with virtualhost records in Apache and zone records for the domain except locally so I can explore and fiddle around and learn instead of having to rely on the domains I own on a public registrar that I could only access through the internet.

Once again I apologize if this is a silly question, or if I'm completely thinking backwards.

Background information: My OS is Debian, I'm a novice at Linux. I've done very small edits in zone records on a Bind9 Server but that's the extent of my networking experience.

I usually:

1. Update my local near-replica ( ServerName directive and Logs will obviously be different ) of the production conf file and make my changes for things like rewrite rules.
2. /etc/init.d/apache2 restart or graceful locally and ensure it's working
3. scp the conf file to the production server
4. apache2ctl configtest
5. apache2ctl graceful

I never really followed any sort of guide, just picked up some commands. Is this usually the way it's done? I almost always use graceful on the production server since I don't want to lose clients with a full restart - graceful restarting is fairly common, right? Are there any circumstances where graceful isn't sufficient and I need to do a full restart?

I just recently setup apache, I'm setting up a basic site and right now I'm having permissions issues. Firstly,

/www/ /www/sitename_com

are owned by meder:meder

and the permissions are 755 recursively ( or so I think ).

I setup a virtualhost, now in sitename_com there's a 'foo.php' and I'm trying to fopen ( create a new file ) within that directory.. it would be at

/www/sitename_com/en/file.xml

However Apache complains with:

Warning: fopen(en/file.xml) [function.fopen]: failed to open stream: Permission denied

www-user is Apache right? I need to give it permissions to my user group ( meder:meder .. not really a "group" )..

Thanks in advance.