Marco Ceppi's questions

I'm curious if this is the expected state for virtual machines under Xen. I've set up two machines and their states remain -b---- and never seem to move to r---- which Domain-0 is at.

Name                                        ID   Mem VCPUs      State   Time(s)
Domain-0                                     0  5788     6     r-----   5870.5
kirk                                         3  1024     1     -b----     20.2
picard                                       2  1024     1     -b----   1987.8

If I console to either, I can log in. If I ssh to either it also works. From what I can tell these two machines are functioning fine, just can't seem to figure out why they're not "ready".

In the root of several of our old CentOS machines (CentOS release 5.8 (Final)) In the root of the ext3 file system I see the following:

I've removed some of these, but they seem to continue coming back.

Here are the timestamps

-rw-rw----   1 root   root       0 2011-12-15 01:20 .?????????????????????????????????????????????????Z]Y?+
-rw-rw----   1 root   root       0 2011-12-16 01:14 .???????????????????????????????????????????????????ֽ*
-rw-rw----   1 root   root       0 2011-12-20 01:20 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2011-12-22 01:23 .??????????????????????????????????????????????????\X?*
-rw-rw----   1 root   root       0 2011-12-26 01:20 .????????????????????????????????????????????????????]+
-rw-rw----   1 root   root       0 2012-01-01 01:16 .?????????????????????????????????????????????????*???+
-rw-rw----   1 root   root       0 2012-01-04 01:15 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-01-11 01:14 .???????????????????????????????????????????????????;?+
-rw-rw----   1 root   root       0 2012-01-12 01:17 .?????????????????????????????????????????????????ZF.?*
-rw-rw----   1 root   root       0 2012-02-29 01:16 .?????????????????????????????????5?;J+
-rw-rw----   1 root   root       0 2012-02-29 01:17 .???????????????????????????????????e?*
-rw-rw----   1 root   root       0 2012-03-01 01:16 .??????????????????????????????????B)Q+
-rw-rw----   1 root   root       0 2012-03-06 01:08 .??????????????????????????????????'??+
-rw-rw----   1 root   root       0 2012-03-07 01:09 .?????????????????????????????????%?F?+
-rw-rw----   1 root   root       0 2012-03-22 01:07 .?????????????????????????????????%??+
-rw-rw----   1 root   root       0 2012-04-06 01:12 .?????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-05-06 01:16 ??X?7+.?????????????????u{?7+

I'm trying to setup Python3 and Python2 via mod_wsgi on Ubuntu, so I've installed the mod_wsgi_py3 package but also wish to run the py2 version and have it switched depending on a flag within the virtualhosts config. Is there any way to do this withing Apache 2.2?

I'm trying to track the last time a user logged into a Linux server with a certain key. So user secure has 5 keys in ~/.ssh/authorized_keys, how can I track when each key was used and what IP was used to access the server?

Ideally I would be able to see that Key 1 was last used 5 days ago from 127.0.0.1, Key 2 was used 10 mins ago from 10.0.0.5, Key 3 and 4 were never used, Key 5 was used 2 weeks ago from 8.8.8.8.

I'm trying to create a setup where I have one public facing IP address that feeds to several different internal servers where each server has a unique IP in private IP space - the route is determined by the incoming domain request (similar to Apache Virtual Hosts, but for all traffic - not just HTTP). What services would I need in place to create something described above? A proxy server, load balancer, etc?

On a server with several users I'm looking to reserve port ranges so that only one user has access to a specific port range, IE

user1: 2000-2005
user2: 2006,3003
user3: 1025

In doing so, an application spawned by that user can only access ports allotted to that user. All other ports would fail to bind. Is there a way to do this on a Linux (Ubuntu) server?

I've noticed some hosting providers have Apache setup so that if I create a directory (foo.example.com) Apache will automatically know that the DNS entry for foo.example.com routes to that document root.

What I am to do is setup something like this:

<VirtualHost *:80>
   ServerName *.example.com
   DocumentRoot /home/user/*.example.com
</VirtualHost>

Where the DocumentRoot would match based on the pattern from the ServerName wild card.

In doing so all I should need to do is create /home/user/foo.example.com after the configuration is in place and not need to modify anything in Apache. This would allow me to add sub-domains on the fly without needing to restart or reload or even edit anything in Apache.

A use case would be something like this.

1. mkdir /home/user/baz.example.com/
2. ?????
3. Profit

Where I wouldn't need to do anything but simply make the directory.

I've setting up a Hosting service, as part of that service I need to automatically create DNS records in our nameservers for all the domains hosted.

Currently I'm using the following template:

;
; [USER] - [DOMAIN]
;
$TTL    604800
@    IN    SOA    [PRIMARY-NS].    [NS-ADMIN]. (
                       [SERIAL] ; Serial
                           10800 ; Refresh
                            3600 ; Retry
                         1209600 ; Expire
                           43200 ; Negative Cache TTL
)
;
@    IN    NS    [NS1]. ; Nameserver
@    IN    NS    [NS2]. ; Nameserver
@    IN    A     [SERVER-IP] ; Primary IP
*    IN    A     [CATCH-ALL-IP] ; Catch-all IP
@    IN    MX    0 mail

What I'm interested in knowing is, if I replace the primary A record statement with a CNAME to that server's DNS entry - will there be any adverse affects? This would make IP management on my servers far easier as I would only need to update one DNS record.

@    IN    CNAME     [SERVER-DOMAIN-NAME]
*    IN    CNAME     [SERVER-DOMAIN-NAME]

Is this a good idea? Or will this only cause trouble for DNS lookups on those records?

I've setup VSFTPD so when a user connects it'll use a user_config_dir search for that connected user and setup a chroot guest session (since there are multiple FTP accounts belonging to multiple users on the server). This works fine with user names that have no special characters. To avoid collisions on usernames I'm setting up each username with a postfix '@domain.tld' - however, the custom rules in user_config_dir don't load when the user has an @ symbol in the name. Is there a way around this in VSFTPD - or a setting that needs to be switched?

vsftpd.conf

listen=YES
anonymous_enable=NO
local_enable=YES
guest_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
chroot_local_users=YES
pam_service_name=scftp
user_config_dir=/etc/vsftpd/virtual

pam.d/scftp

auth required /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login
account required /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login

vitrtual/usernamewithoutspecialchars

write_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
anon_upload_enable=YES
local_root=/home/marco
chroot_local_user=YES
dirlist_enable=YES
download_enable=YES
guest_username=marco

virtual/[email protected]

write_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
anon_upload_enable=YES
local_root=/home/marco
chroot_local_user=YES
dirlist_enable=YES
download_enable=YES
guest_username=marco

It really just seems it won't match the FTP user [email protected] to the proper virtual file - while usernamewithoutspecialchars works just fine.

I've recently setup Exim4 on an Ubuntu 10.04 server with Courier. Everything is working fine for local mail deliver, the only missing piece is SMTP Authentication. I have an account setup on the server in Courier however whenever I try to send to the host it never prompts me for authentication and reports back the following:

Error while Sending message.

RCPT TO <[email protected]> failed: relay not permitted

I ran exim in "super debug mode" and received the following:

Exim version 4.71 uid=0 gid=0 pid=28644 D=fbb95cfd
Berkeley DB: Berkeley DB 4.8.24: (August 14, 2009)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS move_frozen_messages Content_Scanning DKIM Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
GnuTLS compile-time version: 2.8.5
GnuTLS runtime version: 2.8.5
changed uid/gid: forcing real = effective
  uid=0 gid=0 pid=28644
  auxiliary group list: <none>
seeking password data for user "uucp": cache not available
getpwnam() succeeded uid=10 gid=10
configuration file is /var/lib/exim4/config.autogenerated
log selectors = 00000ffc 00612001
cwd=/etc/exim4 5 args: exim -d+acl+auth -oX 588 -bd
trusted user
admin user
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=8
seeking password data for user "mail": using cached result
getpwnam() succeeded uid=8 gid=8
user name "root" extracted from gecos field "root"
originator: uid=0 gid=0 login=root name=root
28644 daemon_smtp_port overridden by -oX:
28644   <: 588
28644 listening on 205.186.156.60 port 588
28644 changed uid/gid: running as a daemon
28644   uid=111 gid=113 pid=28644
28644   auxiliary group list: 113
28644 LOG: MAIN
28644   exim 4.71 daemon started: pid=28644, no queue runs, listening for SMTP on [205.186.156.60]:588
28644 set_process_info: 28644 daemon: no queue runs, listening for SMTP on [205.186.156.60]:588
28644 daemon running with uid=111 gid=113 euid=111 egid=113
28644 Listening...
28644 Connection request from 173.66.235.14 port 32994
28644 search_tidyup called
28644 1 SMTP accept process running
28644 Listening...
31812 sender_fullhost = [173.66.235.14]
31812 sender_rcvhost = [173.66.235.14]
31812 Process 31812 is handling incoming connection from [173.66.235.14]
31812 host in host_lookup? no (option unset)
31812 set_process_info: 31812 handling incoming connection from [173.66.235.14]
31812 host in host_reject_connection? no (option unset)
31812 host in sender_unqualified_hosts? no (option unset)
31812 host in recipient_unqualified_hosts? no (option unset)
31812 host in helo_verify_hosts? no (option unset)
31812 host in helo_try_verify_hosts? no (option unset)
31812 host in helo_accept_junk_hosts? no (option unset)
31812 SMTP>> 220 dagobah.seacrow.org ESMTP Exim 4.71 Sat, 13 Nov 2010 22:20:22 -0500
31812 Process 31812 is ready for new message
31812 smtp_setup_msg entered
31812 SMTP<< EHLO [192.168.1.6]
31812 [192.168.1.6] in helo_lookup_domains? no (end of list)
31812 sender_fullhost = ([192.168.1.6]) [173.66.235.14]
31812 sender_rcvhost = [173.66.235.14] (helo=[192.168.1.6])
31812 set_process_info: 31812 handling incoming connection from ([192.168.1.6]) [173.66.235.14]
31812 host in pipelining_advertise_hosts? yes (matched "*")
31812 host in auth_advertise_hosts? yes (matched "*")
31812 host in tls_advertise_hosts? no (option unset)
31812 SMTP>> 250-dagobah.seacrow.org Hello [192.168.1.6] [173.66.235.14]
31812 250-SIZE 52428800
31812 250-PIPELINING
31812 250 HELP
31812 SMTP<< MAIL FROM:<[email protected]>
31812 using ACL "acl_check_mail"
31812 processing "accept"
31812 accept: condition test succeeded
31812 SMTP>> 250 OK
31812 SMTP<< RCPT TO:<[email protected]>
31812 using ACL "acl_check_rcpt"
31812 processing "accept"
31812 check hosts = :
31812 host in ":"? no (end of list)
31812 accept: condition test failed
31812 processing "deny"
31812 check domains = +local_domains
31812 search_open: dsearch "/etc/valiases"
31812 search_find: file="/etc/valiases"
31812   key="gmail.com" partial=-1 affix=NULL starflags=0
31812 LRU list:
31812   4/etc/valiases
31812   End
31812 internal_search_find: file="/etc/valiases"
31812   type=dsearch key="gmail.com"
31812 file lookup required for gmail.com
31812   in /etc/valiases
31812 lookup failed
31812 search_open: dsearch "/var/mail/virtual"
31812 search_find: file="/var/mail/virtual"
31812   key="gmail.com" partial=-1 affix=NULL starflags=0
31812 LRU list:
31812   4/var/mail/virtual
31812   4/etc/valiases
31812   End
31812 internal_search_find: file="/var/mail/virtual"
31812   type=dsearch key="gmail.com"
31812 file lookup required for gmail.com
31812   in /var/mail/virtual
31812 lookup failed
31812 gmail.com in "@:localhost:dsearch;/etc/valiases:dsearch;/var/mail/virtual"? no (end of list)
31812 gmail.com in "+local_domains"? no (end of list)
31812 deny: condition test failed
31812 processing "deny"
31812 check domains = !+local_domains
31812 cached no match for +local_domains
31812 cached lookup data = NULL
31812 gmail.com in "!+local_domains"? yes (end of list)
31812 check local_parts = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
31812 marco.ceppi.use in "^[./|] : ^.*[@%!`#&?] : ^.*/\.\./"? no (end of list)
31812 deny: condition test failed
31812 processing "accept"
31812 check local_parts = postmaster
31812 marco.ceppi.use in "postmaster"? no (end of list)
31812 accept: condition test failed
31812 processing "deny"
31812 check !acl = acl_local_deny_exceptions
31812 using ACL "acl_local_deny_exceptions"
31812 processing "accept"
31812 check hosts = ${if exists{/etc/exim4/host_local_deny_exceptions}{/etc/exim4/host_local_deny_exceptions}{}}
31812 host in ""? no (end of list)
31812 accept: condition test failed
31812 processing "accept"
31812 check senders = ${if exists{/etc/exim4/sender_local_deny_exceptions}{/etc/exim4/sender_local_deny_exceptions}{}}
31812 [email protected] in ""? no (end of list)
31812 accept: condition test failed
31812 processing "accept"
31812 check hosts = ${if exists{/etc/exim4/local_host_whitelist}{/etc/exim4/local_host_whitelist}{}}
31812 host in ""? no (end of list)
31812 accept: condition test failed
31812 processing "accept"
31812 check senders = ${if exists{/etc/exim4/local_sender_whitelist}{/etc/exim4/local_sender_whitelist}{}}
31812 [email protected] in ""? no (end of list)
31812 accept: condition test failed
31812 end of ACL "acl_local_deny_exceptions": implicit DENY
31812 check senders = ${if exists{/etc/exim4/local_sender_callout}{/etc/exim4/local_sender_callout}{}}
31812 [email protected] in ""? no (end of list)
31812 deny: condition test failed
31812 processing "accept"
31812 check hosts = +relay_from_hosts
31812 host in ": 127.0.0.1 : ::::1"? no (end of list)
31812 host in "+relay_from_hosts"? no (end of list)
31812 accept: condition test failed
31812 processing "accept"
31812 check authenticated = *
31812 accept: condition test failed
31812 processing "require"
31812 check domains = +local_domains : +relay_to_domains
31812 cached no match for +local_domains
31812 cached lookup data = NULL
31812 gmail.com in "empty"? no (end of list)
31812 gmail.com in "+local_domains : +relay_to_domains"? no (end of list)
31812 require: condition test failed
31812 SMTP>> 550 relay not permitted
31812 LOG: MAIN REJECT
31812   H=([192.168.1.6]) [173.66.235.14] F=<[email protected]> rejected RCPT <[email protected]>: relay not permitted
31812 SMTP<< QUIT
31812 SMTP>> 221 dagobah.seacrow.org closing connection
31812 LOG: smtp_connection MAIN
31812   SMTP connection from ([192.168.1.6]) [173.66.235.14] closed by QUIT
31812 search_tidyup called
28644 child 31812 ended: status=0x0
28644 0 SMTP accept processes now running
28644 Listening...

I noticed that it doesn't have courier listed in the Authenticators line at the top of the output. Which I believe is the issue I'm encountering. I don't know how to make it look for Courier. I have the following in my Authenticators section:

begin authenticators

plain_courier_authdaemon:
  driver = plaintext
  public_name = PLAIN
  server_condition = \
    ${extract {ADDRESS} \
              {${readsocket{/var/run/courier/authdaemon/socket} \
              {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
              {yes} \
              fail}
  server_set_id = $auth2
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif

login_courier_authdaemon:
  driver = plaintext
  public_name = LOGIN
  server_prompts = Username:: : Password::
  server_condition = \
    ${extract {ADDRESS} \
              {${readsocket{/var/run/courier/authdaemon/socket} \
              {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
              {yes} \
              fail}
  server_set_id = $auth1
  .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
  server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
  .endif


cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
  client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}

PASSWDLINE=${sg{\
                ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}\
            }\
            {\\N[\\^]\\N}\
            {^^}\
        }

plain:
  driver = plaintext
  public_name = PLAIN
.ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  client_send = "<; ${if !eq{$tls_cipher}{}\
                    {^${extract{1}{:}{PASSWDLINE}}\
             ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}\
           }fail}"
.else
  client_send = "<; ^${extract{1}{:}{PASSWDLINE}}\
            ^${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
.endif

login:
  driver = plaintext
  public_name = LOGIN
.ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  client_send = "<; ${if and{\
                          {!eq{$tls_cipher}{}}\
                          {!eq{PASSWDLINE}{}}\
                         }\
                      {}fail}\
                 ; ${extract{1}{::}{PASSWDLINE}}\
         ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
.else
  client_send = "<; ${if !eq{PASSWDLINE}{}\
                      {}fail}\
                 ; ${extract{1}{::}{PASSWDLINE}}\
         ; ${sg{PASSWDLINE}{\\N([^:]+:)(.*)\\N}{\\$2}}"
.endif

(Comments have been stripped from output)

I have a setup as follows:

Linux Server (OpenVZ) with internal IP 10.10.0.4 - Container (10.10.0.5) - Container (10.10.0.6)

Due to limited IP space I only have one public IP mapped to the main server .4 so

192.168.1.2 => 10.10.0.4 on the network side.

Now on the main host the .4 I have apache running accepting connections on port 80, etc. With mod_proxy to have virtual hosts like such:

<VirtualHost 10.10.0.4:80 192.168.1.2>
    ServerAdmin [email protected]
    ServerName host.example.com
    ServerAlias ct1.host.example.com

    ProxyPass / http://10.10.0.5/
    ProxyPassReverse / http://10.10.0.5/
</VirtualHost>

And there is wild card DNS setup so that *.host.example.com maps to 192.168.1.2. On the container a standard vhost like so is setup:

<VirtualHost 10.10.0.5:80 *:80>
    ServerName ct1.host.example.com
    ServerAlias ct1.host.example.com
    ServerAdmin [email protected]
    DocumentRoot /var/www

    <Directory /var/www/>
      Options FollowSymLinks
      AllowOverride All
    </Directory>

    Options Indexes FollowSymLinks

    ErrorLog /var/logs/error_log
    CustomLog /var/logs/access_log common </VirtualHost>

This works fine - however all sites like Joomla, etc that use some backwards way of finding the server name report 10.10.0.5 instead of ct1.host.example.com which I would need as this needs to work outside of the local network. Sure I can hack away at the code for each one of these deployments but that's not fixing the problem that's just applying a band-aid. I'm at a loss for why this is reporting the containers local ip instead of the hostname.

I have also tried the following setup:

/etc/hosts (on .4)

10.10.0.5   ct1.host.example.com

Then the following in the vHost:

ProxyPass / http://ct1.host.example.com
ProxyPassReverse / http://ct1.host.example.com

However that does not yield anything different. Is there anything further I need to setup on the container - maybe some DNS, or actually create internal DNS for these IPs?

Thanks!