nulltek's questions

I have a simple LAMP stack with httpd/Apache installed on Centos 6.5. I've set my vhost up in /etc/httpd/sites-available/acute.conf like so:

<VirtualHost *:80>

    ServerName acutemedical.co
    ServerAlias acutemedical.co
    DocumentRoot /var/www/html
    ErrorLog /var/www/log/error.log
    CustomLog /var/www/log/requests.log combined
    Redirect permanent / https://acutemedical.co/
</VirtualHost>

<VirtualHost *:443>

        ServerName acutemedical.co
        ServerAlias acutemedical.co
        DocumentRoot /var/www/html
        ErrorLog /var/www/log/error.log
        CustomLog /var/www/log/requests.log combined    
        SSLEngine on
        SSLCertificateFile /etc/httpd/ssl/server.crt
        SSLCertificateKeyFile /etc/httpd/ssl/server.key
</VirtualHost>

Also here is the output of my iptables ruleset:

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443 

When visiting the site at port 80 without the redirect the site will come up no problem. When visiting the site on port 443 it gets a connection refused. Same problem when I leave the redirect directive in the 80 vhost block.

I've tried to curl each url with http and https and only http works.

I've set this up before but it's been a year or so (I'm mostly using nginx now). So I was wondering if anyone can look at my configuration and tell me what I'm doing wrong.

I have a sensu handler that gets triggered on an endpoint Linux box (Centos 6.6. Here is the script I'm using:

#!/bin/bash --login
sudo -n -u deploy bash --login -c "cd /var/www/vhosts/sc/current; pwd; BUNDLE_GEMFILE=/var/www/vhosts/sc/current/Gemfile RAILS_ENV=production bundle exec pumactl -F /var/www/vhosts/sc/shared/config/puma.rb stop "
sudo -n -u deploy bash --login -c "cd /var/www/vhosts/sc/current; pwd; BUNDLE_GEMFILE=/var/www/vhosts/sc/current/Gemfile RAILS_ENV=production bundle exec pumactl -F /var/www/vhosts/sc/shared/config/puma.rb start "

Running this script locally as another user works fine and I can get puma to restart sanely. Even when I give sensu a shell and execute the script on the endpoint.

When it's triggered from the sensu server I get the output of:

{"timestamp":"2016-04-18T16:45:17.581962-0500","level":"info","message":"handler output","handler":{"type":"pipe","command":"/bin/sh /etc/sensu/handlers/puma_restart.sh","name":"puma_restart"},"output":["sudo: a password is required\n","sudo: a password is required\n"]}

I thought this might be an issue with sudoers so here's my setup:

Defaults:sensu !requiretty
Defaults:sensu secure_path = /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
sensu ALL = NOPASSWD: /etc/sensu/handlers/puma_restart.sh

I've also tried setting the sudo NOPASSWORD for all commands like:

sensu  ALL=(ALL)       NOPASSWD: ALL

But I still get the error when the script is fired.

Anyone have an idea what I have setup wrong? If you need more details or context, please let me know.

I'm working on several Ansible playbooks to spin up a new server instance. There are approximately 15 different playbooks I need to run in a specific order to successfully spin up a server.

My initial thought was to write a shell script that executes ansible-playbook playbook_name.yml and duplicate it one entry for each playbook I need to run.

Is there a smarter/better way to do this using a master playbook and if so what would it look like (examples are appreciated).

I could write one monolithic playbook that does it all but there are some plays that run as root first then as a sudo user later.

I'm writing a pretty simple ansible playbook for setting up our iptables firewall in centos. Here is the playbook I wrote:

---
- hosts: test
  remote_user: deploy
  sudo: True
  tasks:
  - name: Get iptables rules
    shell: /sbin/iptables -L
    register: iptablesrules
    always_run: yes
  - name: Add nginx iptables rule
    command: /sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Nginx_HTTP"
    when: iptablesrules.stdout.find("Nginx_HTTP") == -1
  - name: Add nginx ssl iptables rule
    command: /sbin/iptables -I INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Nginx_SSL"
    when: iptablesrules.stdout.find("Nginx_SSL") == -1
  - name: Add postgres rule on ham0 interface
    command: /sbin/iptables -I INPUT -p tcp -s 0/0 --sport 1024:65535 -d 0.0.0.0/0 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment "Postgres"
    when: iptablesrules.stdout.find("Postgres") == -1
  - name: save iptables
    command: service iptables save
  - name: ensure iptables is set to start at boot
    action: command /sbin/chkconfig iptables on

Everything works as expected although I'm sure it can be better. But my question is regarding the Postgres rule. I want to dynamically replace the destination address of 0.0.0.0/0 with the IP of a specific interface (ham0) on the target box. I'm assuming I can do something like ansible_ham0.ipv4.address to get the IP address. But I'm not sure how to pass that into the Postgress rule as a variable.

I'm reading the documentation and having a bit of a hard time with it. I'll keep researching but in the interim if anyone has an idea of how to do this, I'd really appreciate the help.

I'm moving a Ruby/Rails app to a Centos 6.7 server (from Ubuntu) and am installing ruby via rbenv.

I run rbenv install -v 1.9.3-p194 and it will start to compile but the build fails. The build output log gives the following output showing a failed build.

ossl_pkey_ec.c:816: error: ‘EC_GROUP_new_curve_GF2m’ undeclared (first use in this function)
ossl_pkey_ec.c:816: error: (Each undeclared identifier is reported only once
ossl_pkey_ec.c:816: error: for each function it appears in.)
make[2]: *** [ossl_pkey_ec.o] Error 1
make[1]: *** [ext/openssl/all] Error 2

I have all of the development tools installed on the box and also have openssl-devel installed and it matches the Centos version. But I'm sort of hitting a wall here.

Has anyone had problems with this before and if so, how can I fix it? Full output in pastebin here

I have the latest sensu-core installed and I've installed the sensu-plugin gem using the omnibus package.

Sensu is up and running no problem, but I'm running into major issues with handlers. I've setup both the standard ruby mailer.rb from the community plugins, as well as the pagerduty handler.

When I add the handlers to a check that I know is failing in the logs I see this:

{\"id\":\"a1e807d2-425f-4891-b291-ed5bda5b6105\",\"client\":{\"name\":\"mfp\",\"address\":\"25.147.26.157\",\"subscriptions\":[\"test\"],\"version\":\"0.20.0\",\"timestamp\":1437673191},\"check\":{\"command\":\"/etc/sensu/plugins/check-disk.sh -d /dev/md1 -w 80 -c 90\",\"interval\":10,\"handlers\":[\"default\",\"pagerduty\",\"mailer\"],\"occurrences\":3,\"subscribers\":[\"test\"],\"name\":\"disk\",\"issued\":1437673279,\"executed\":1437673201,\"duration\":0.01,\"output\":\"CRITICAL - /dev/md1 space used=94% | '/dev/md1 usage'=94%;80;90;\\n\",\"status\":2,\"history\":[\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\",\"2\"],\"total_state_change\":0},\"occurrences\":513,\"action\":\"create\"}"]}
{"timestamp":"2015-07-23T12:41:20.873279-0500","level":"info","message":"handler output","handler":{"type":"pipe","command":"/etc/sensu/handlers/pagerduty.rb","api_key":"2e24c101ef754ff6add39aaaffa846c9","name":"pagerduty"},"output":["only handling every 180 occurrences: ws/disk\n"]}
{"timestamp":"2015-07-23T12:41:20.873561-0500","level":"info","message":"handler output","handler":{"type":"pipe","command":"/etc/sensu/handlers/pagerduty.rb","api_key":"2e24c101ef754ff6add39aaaffa846c9","name":"pagerduty"},"output":["only handling every 180 occurrences: wwv/disk\n"]}
{"timestamp":"2015-07-23T12:41:21.055407-0500","level":"info","message":"handler output","handler":{"type":"pipe","command":"/etc/sensu/handlers/pagerduty.rb","api_key":"2e24c101ef754ff6add39aaaffa846c9","name":"pagerduty"},"output":["only handling every 180 occurrences: mfp/disk\n"]}

So what it looks like is the handler is firing but being filtered by the sensu-handler.rb gem and not creating emails or pagerduty events.

Here's the offending line

only handling every 180 occurrences

Does anyone know what the problem is? Is this a bug? Do I need to override something? I have a ton of occurrences in sensu for this particular check (check_disk) so it should be firing to pagerduty and the mailer.

I have setup sensu on a Centos 6.5 box and installed/configured the client on the sensu box so it monitors itself like so

/etc/sensu/conf.d/client.json

{
  "client": {
    "name": "sensu",
    "address": "10.100.1.200",
    "subscriptions": [
      "ALL"
    ]
  }
}

This works fine and it shows up in Uchiwa, but now I have another host I want to register with Sensu/Uchiwa and it does not show up in clients under Uchiwa/Sensu

Here's the configuration on the client "coffee"

/etc/sensu/conf.d/rabbitmq.json

{
 "rabbitmq":{
  "host": "10.100.1.200",
  "port": "5672",
  "vhost": "/sensu",
  "user": "user",
  "pass": "pass"
 }
}

/etc/sensu/conf.d/client.json

{
  "client": {
    "name": "coffee",
    "address": "10.100.1.19",
    "subscriptions": [
      "ALL"
    ]
  }
}

When I tail the /var/log/sensu/sensu-client.log on coffee I see the following:

{"timestamp":"2015-07-13T07:15:52.856009-0500","level":"warn","message":"loading config file","file":"/etc/sensu/conf.d/client.json"}
{"timestamp":"2015-07-13T07:15:52.856157-0500","level":"warn","message":"config file applied changes","file":"/etc/sensu/conf.d/client.json","changes":{"client":{"subscriptions":[["ALL","ALL"],["ALL"]]}}}
{"timestamp":"2015-07-13T07:15:52.856235-0500","level":"warn","message":"loading config file","file":"/etc/sensu/conf.d/rabbitmq.json"}
{"timestamp":"2015-07-13T07:15:52.856330-0500","level":"warn","message":"config file applied changes","file":"/etc/sensu/conf.d/rabbitmq.json","changes":{"rabbitmq":{"port":[5672,"5672"],"pass":"REDACTED"}}}
{"timestamp":"2015-07-13T07:15:52.859696-0500","level":"warn","message":"loading extension files from directory","directory":"/etc/sensu/extensions"}
{"timestamp":"2015-07-13T07:15:53.051176-0500","level":"warn","message":"reconnecting to transport"}

It looks like it's talking to RabbitMQ but for some reason the client does not appear in Uchiwa. How can I dive into this further and figure out what's going on and get the coffee server to register?

I am re-learning bash after years of not using it very much and need to figure out a way to automate pg_dump of a single database to a directory.

Currently I manually ssh into the box, su to postgres user, then run pg_dump database > outfile.

This works fine, but I'm getting tired of having to do this manually.

I'm really rusty with bash and would like to figure out a way to do the following.

1.) Write a script that will pg_dump my database to a specific directory 2.) The script should output the outfile name as hostname-date (to allow for multiple backups) 3.) Hopefully provide some form of error handling.

I've looked at the Postgres wiki and found a pretty elaborate script that does this, but was wondering if there's something quick and dirty that will get the job done.

Any hints or a point in the right direction would be greatly appreciated.

Thanks guys and gals!

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a bruteforce attack, it does add the offending IP address properly, however it flushes out my BLACkLIST chain, which I need to keep intact.

Any thoughts on why this is happening and how I can persist the BLACKLIST chain?

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following:

apt-get install fail2ban

Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
bantime  = 600
maxretry = 3

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 600

Then I ran service fail2ban restart and I do see it running. Now I try to login as a user (root, random user, etc) multiple times in a row and it does not block my IP address. I have iptables installed and it working with rules I have setup and I do have a INPUT chain in place of course.

When I cat /var/log/auth.log this is what I see

Oct 26 08:55:21 prod sshd[10935]: reverse mapping checking getaddrinfo for firewall.jaincpa.com [75.89.97.25] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 26 08:55:23 prod sshd[10935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:55:25 prod sshd[10935]: Failed password for root from 75.89.97.25 port 61449 ssh2
Oct 26 08:55:32  sshd[10935]: last message repeated 2 times
Oct 26 08:55:32 prod sshd[10935]: Connection closed by 75.89.97.25 [preauth]
Oct 26 08:55:32 prod sshd[10935]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:55:34 prod sshd[10944]: reverse mapping checking getaddrinfo for firewall.jaincpa.com [75.89.97.25] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 26 08:55:35 prod sshd[10944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:55:37 prod sshd[10944]: Failed password for root from 75.89.97.25 port 61452 ssh2
Oct 26 08:55:44  sshd[10944]: last message repeated 2 times
Oct 26 08:55:44 prod sshd[10944]: Connection closed by 75.89.97.25 [preauth]
Oct 26 08:55:44 prod sshd[10944]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:55:47 prod sshd[10951]: reverse mapping checking getaddrinfo for firewall.jaincpa.com [75.89.97.25] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 26 08:55:51 prod sshd[10951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:55:52 prod sshd[10951]: Failed password for root from 75.89.97.25 port 61455 ssh2
Oct 26 08:56:00  sshd[10951]: last message repeated 2 times
Oct 26 08:56:00 prod sshd[10951]: Connection closed by 75.89.97.25 [preauth]
Oct 26 08:56:00 prod sshd[10951]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:56:13 prod sshd[10971]: reverse mapping checking getaddrinfo for firewall.jaincpa.com [75.89.97.25] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 26 08:56:15 prod sshd[10971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:56:16 prod sshd[10971]: Failed password for root from 75.89.97.25 port 61459 ssh2
Oct 26 08:56:22  sshd[10971]: last message repeated 2 times
Oct 26 08:56:22 prod sshd[10971]: Connection closed by 75.89.97.25 [preauth]
Oct 26 08:56:22 prod sshd[10971]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.89.97.25  user=root
Oct 26 08:57:18 prod sshd[11002]: Connection closed by 50.116.16.93 [preauth]
Oct 26 09:00:01 prod CRON[11099]: pam_unix(cron:session): session opened for user deploy by (uid=0)
Oct 26 09:00:02 prod CRON[11099]: pam_unix(cron:session): session closed for user deploy
Oct 26 09:02:18 prod sshd[11186]: Connection closed by 50.116.16.93 [preauth]
root@prod:/etc/fail2ban# 

So it looks like I'm authenticating with PAM via sshd but fail2ban is not blocking my IP address and I can still attempt login and login when supplying the proper credentials.

I'd like to get this working as I've seen a lot of brute force attacks on my server lately. Any help would be greatly appreciated.

I am running the following command every 5 minutes in my crontab to keep Phusion Passenger alive.

*/5 * * * * wget mysite.com > /dev/null 2>&1

When I run this it performs a wget on the site url routes STDOUT/STDERR to /dev/null. When I run this from a command line it works fine and doesn't produce an index.html file in my home directory.

When it runs from cron, it creates a new index.html file every five minutes, leaving me with a ton of index files which I don't want.

Is my syntax incorrect for running the cron job? From a command line it works without a problem but from cron it generates a index.html file in my home directory.

I'm sure I'm making a simple mistake, would appreciate it if anyone could help out.

I have an Ubuntu 12.10 LTS server running apache2 with a simple wordpress install. I created the virtual host in /etc/apache2/sites-available and used a2ensite to enable it. All was working fine for two days.

This morning I woke up to check the site and it seemed the virtual host was not working at all. It kept going to the default site in apache2.

Here is my config:

default

<VirtualHost *:80>
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

virtual host: domain.com

<VirtualHost *:80>
     ServerAdmin [email protected]
     ServerName domain.com
     ServerAlias www.domain.com
     DocumentRoot /srv/www/domain.com/public_html/
     ErrorLog /srv/www/domain.com/logs/error.log
     CustomLog /srv/www/domain.com/logs/access.log combined
</VirtualHost>

As you can see I have two separate configs with no conflicts. But apache2 keeps reverting to the default site instead of the name-based vhost. My /etc/hosts file is correct and has a FQDN and host name pointed to the public-facing IP as well. This just happened overnight.

I ran a a2dissite on domain.com, apache2 reload, then a2ensite on domain.com with no results. I ended up having to a2dissite the default config. Once I did that the domain.com site came up with my wordpress site just fine.

Any idea why this happened? I've ran apache2 and nginx for years and have never had a problem with virtual hosting. This one is a bit weird. I shouldn't have to disable the default site for my other virtual host to work.

Any thoughts?

I'm walking into an environment that uses MySQL and Innodb as the storage engine. I'd like to enable innodb_file_per_table to increase performance. Considering all of the databases/tables are currently stored in ibdata1/default ibdata file will the innodb_file_per_table option only affect new tables created after I set this directive?

What would be the best way to take the existing database and split each table into it's own ibd file? Would I have to dump/recover all of the tables to make this happen?