Zareh Kasparian's questions

I'm running a service, which up to today, I have consumed subdomains from my main domain for each customer to reach to their servers as below.

e.g:

  cust1.mydomain.com   --->  Proxy to customer1 
  cust2.mydomain.com   --->  Proxy to customer2

I did this via Fortigate 90D with a combination of web filters.

Now I'm looking for a better solution to stop consuming my subdomains for each customer and use mydomain.com as my main domain (as before) and proxy different customers based on URL to their servers.

e.g:

  mydomain.com/cust1   --->  Proxy to customer1 
  mydomain.com/cust2   --->  Proxy to customer2

is this possible to be done via Fortigate?

I'm preparing to run a MariaDB Cluster with HA and I'm Looking for the best practices.

Years back I used to run MariaDB in master-master mode, and there was a big issue. whenever any of the nodes(two nodes in total) was disconnected and reconnected for a second, the whole database was inaccessible until the sync process was completed.

I did search a lot and there are multiple suggestions, which not sure which one is the best and simple solution to go for.

1. using maxscale as proxy
2. using master-slave mode
3. using master-master mode

I haven't worked with MaxScale, and I would be thankful if someone guides me if this is the best solution to go for a database with high I/O, also I know that I need to have another MaxScale + HAProxy setup to cover MaxScale failures.

The second item is not a proper solution, since if the master DB fails I need to go over some manual processes to make it as master.

The third item, cloud be used with Galera, but as I searched I saw many people complaining about the sync issues which I had before.

I would be thankful if someone can guide me with at least 2-3 years of experience in such a cluster.

I have a log file as below:

12-02-2022 15:18:22 +0330 SOCK5.6699 00000 user144 97.251.107.125:38605 1.1.1.1:443 51766 169369 0 CONNECT 1.1.1.1:443
12-02-2022 15:18:27 +0330 SOCK5.6699 00094 user156 32.99.193.2:51242 1.1.1.1:443 715 388 0 CONNECT 1.1.1.1:443
12-02-2022 15:18:56 +0330 SOCK5.6699 00000 user105 191.184.66.98:40048 1.1.1.1:443 18105 29029 0 CONNECT 1.1.1.1:443
12-02-2022 15:18:56 +0330 SOCK5.6699 00000 user105 191.184.66.98:40070 1.1.1.1:443 674 26805 0 CONNECT 1.1.1.1:443
12-02-2022 15:20:24 +0330 SOCK5.6699 00000 user143 112.199.63.119:60682 1.1.1.1:443 475 445 0 CONNECT 1.1.1.1:443
12-02-2022 15:20:37 +0330 SOCK5.6699 00000 user105 191.184.66.98:40102 1.1.1.1:443 12913 18780 0 CONNECT 1.1.1.1:443
12-02-2022 15:20:42 +0330 SOCK5.6699 00000 user143 112.199.63.119:60688 1.1.1.1:443 4530 34717 0 CONNECT 1.1.1.1:443
12-02-2022 15:20:44 +0330 SOCK5.6699 00000 user127 212.167.145.49:2972 1.1.1.1:443 827 267 0 CONNECT 1.1.1.1:443

my goal is to extract two portions of this log file:

1. Username
2. IP address of the user source

below is a sample of the portions of data needed.

12-02-2022 15:18:22 +0330 SOCK5.6699 00000 user144 97.251.107.125:38605 1.1.1.1:443 51766 169369 0 CONNECT 1.1.1.1:443

So I wrote a Python script to extract both items and store them in separate lists and then joined them with zip function.

import pprint
import collections

iplist=[]
for l in data:
    ip_port=l[53:71]
    iplist.append(ip_port.split(':')[0])


userlist=[]
for u in data:
    user=u[42:52]
    userlist.append(user.replace(" ", ""))

a=list(zip(iplist,userlist))
most_ip=collections.Counter(a).most_common(5)
pprint.pprint(most_ip)

This code works fine, and I'm able to get the top used ip with its corresponding username. Also need to mention that I didn't use re module, since it was listing the second IP (destination IP which is 1.1.1.1- which I don't care about it)

Question: Is there any other way(more neat wey) than the way I've written the code?

I have many shell and python scripts on my crontab that ending either with:

command.sh > /dev/null 2>&1

or

command.sh 2>&1 >/dev/null

I know that:

> is for redirect

/dev/null is a black hole where any data sent, will be discarded

2 is the file descriptor for Standard Error

> is for redirect

& is the symbol for file descriptor (without it, the following 1 would be considered a filename)

1 is the file descriptor for Standard Out

Therefore command.sh >/dev/null 2>&1 redirects the output of my program to /dev/null. Include both the Standard Error and Standard Out.

both have the same result and work fine, but why do some use the first type and some use the other?

I have the following configuration as L4 proxy over Nginx and everything works fine.

  stream {
 

    
    map $ssl_preread_server_name $name {
    hostnames;
    .ipchicken.com          $ssl_preread_server_name;
    .bbc.com                $ssl_preread_server_name;
    .bbc.co.uk              $ssl_preread_server_name;
    .bbci.co.uk             $ssl_preread_server_name;
    .neverssl.com           $ssl_preread_server_name;  #<-------
    
}


server {

    resolver 8.8.8.8;
    listen 443;
    ssl_preread on;
    proxy_connect_timeout 5s;
    proxy_pass $name:$server_port;
}

But when HTTP site is requested, like "http://neverssl.com/" Nginx is not responding. Any idea for this issue?

I have set up an Nginx server as L4 Proxy(Forward Proxy With Stream Module), with the following configuration in the nginx.conf file;

stream {
resolver 8.8.8.8;
server {
    listen 443;
    ssl_preread on;
    proxy_connect_timeout 5s;
    proxy_pass $ssl_preread_server_name:$server_port;
  } 
}

everything works fine, with the configuration above. but let's say I want to limit the access of the URLs passing to my proxy server.Not by limiting the IP address but with URL names.
I did a research and setup the following configuration file and somehow I was able to control the URLs passing to my proxy.
But the issue starts from here. If a large website is called, since it has many links or subdomains loaded behind the scene, and knowing that I have limited the URLs allowed to pass, and wildcarding subdomains is not working in stream block, I am not able to load the requested website completely.
Is there a solution to have it used in stream block to support wildcard for subdomain of domain? my new configuration is as below:

stream {


 map $ssl_preread_server_name $name {
     ipchicken.com ipchicken.com;
     www.bbc.com www.bbc.com;
     www.bbc.co.uk www.bbc.co.uk;
     bbci.co.uk bbci.co.uk;
}


server {

    resolver 8.8.8.8;
    listen 443;
    ssl_preread on;
    proxy_connect_timeout 5s;
    proxy_pass $name:$server_port;
   }
 }

 events {
}

I have an Issable server running and integrated with Cisco Call Manager correctly. I am using Issabel server as my IVR system to answer calls without any direct extension callings.

My Scenario is as below: When callers call my DID number I have defined IVR which plays fine and ask the user to enter '0' for the operator.

Here is the configuration for the main ivr.

[ivr-4] ; Main-Menu
include => ivr-4-custom
include => from-did-direct-ivr
exten => s,1,Set(TIMEOUT_LOOPCOUNT=0)
exten => s,n,Set(INVALID_LOOPCOUNT=0)
exten => s,n,Set(_IVR_CONTEXT_${CONTEXT}=${IVR_CONTEXT})
exten => s,n,Set(_IVR_CONTEXT=${CONTEXT})
exten => s,n,Set(__IVR_RETVM=)
exten => s,n,GotoIf($["${CDR(disposition)}" = "ANSWERED"]?skip)
exten => s,n,Answer
exten => s,n,Wait(1)
exten => s,n(skip),Set(IVR_MSG=custom/WelcomeMessage)
exten => s,n(start),Set(TIMEOUT(digit)=3)
exten => s,n,ExecIf($["${IVR_MSG}" != ""]?Background(${IVR_MSG}))
exten => s,n,WaitExten(5,)
exten => 291,1,Set(__IVR_DIGIT_PRESSED=291)
exten => 291,n(ivrsel-291),Goto(ext-miscdests,4,1)

exten => 0,1,Set(__IVR_DIGIT_PRESSED=0)
exten => 0,n(ivrsel-0),Goto(ext-miscdests,3,1)

The above works fine if the caller enters only one digit, and in my case, this is '0' which works correctly. if the caller enters '291' although the "Direct Dial" option is enabled, the call is not passed to CUCM. In other words, the IVR is only able to understand one digit & if there is more than one digit dialed by the caller, the call drops.

I hope you understand my problem since I am new to VOIP services.

Many thanks and best regards

I am running Unbound resolver on FreeBSD, and i am looking for a solution to measure its performance.sometimes there are some delays in regard of resolving domain names,and my customers are complaining. Also using Zabbix monitoring system to monitor QPS.But is there any solution to monitor the performance of unbound itself? i have come-up to measure this delay via Cisco SLA, but i am looking for non-Cisco based solution.

There is an option, i have seen in Fortimail, that makes you able to filter/drop all newsletter emails. I don't understand how Fortimail detects these type of emails. And I am keen to know whether someone has any solution for this on Postfix mail server.

i have used the following rules, to block port-scanners for 24 hours, and unblock scanner ip address after 24 hour, and log the attacker ip address.

iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400    -j DROP 
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove

 
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

everything works fine,and the scanner ip address is getting blocked by iptables. but i am not able to find the blocked ip in any of iptables chains. Scanner ip is only getting logged in the kernel.log file, and i looking for a possible way to remove a single ip instead of re-starting iptables itself.