Artur Cichosz's questions

I have two dedicated servers: "web" (YYY.YYY.YYY.YYY) and "monitor" (XXX.XXX.XXX.XXX). Both are in the same network of a mass hoster (hetzner).

Now on "web" I have 3 prometheus metric endpoints running : docker-engine (9323) on the bare metal host and neo4j (2004), telegraf (9273) as docker containers. Both docker containers map their output ports to the host correctly, so the following calls executed on "web" work:

lynx http://YYY.YYY.YYY.YYY:9323/metrics => OK
lynx http://YYY.YYY.YYY.YYY:9273/metrics => OK
lynx http://YYY.YYY.YYY.YYY:2004/metrics => OK

But calling those endpoints from "monitor" server works only for the bear metal service docker-engine (9323)

lynx http://YYY.YYY.YYY.YYY:9323/metrics => OK
lynx http://YYY.YYY.YYY.YYY:9273/metrics => timeout
lynx http://YYY.YYY.YYY.YYY:2004/metrics => timeout

UFW status verbose delivers the following

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
[...]
9323/tcp                   ALLOW IN    XXX.XXX.XXX.XXX
9273/tcp                   ALLOW IN    XXX.XXX.XXX.XXX
2004/tcp                   ALLOW IN    XXX.XXX.XXX.XXX
[...]

There are no other rules with those IPs and no general rules which apply to subnets, interfaces etc. All other rules are for discreet ports, likie 22, 80, 443 etc.

The strange thing is, that it worked just few hours before. In the meantime I was experimenting a little with this here https://medium.com/@pitapun_44686/what-is-the-best-practice-of-docker-ufw-under-ubuntu-69e11c826b31 and appended the following block to the very end of /etc/ufw/after.rules

*filter
:ufw-user-forward - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
-A DOCKER-USER -j ufw-user-forward
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
-A DOCKER-USER -j RETURN
COMMIT

Now I commented it out and restarted ufw. Those ports 9273 and 2004 are stil not accessible, so this was not the reason.

I configured ufw log level to high, but I can not see any connection attepmtps or dropped packets from host XXX.XXX.XXX.XXX.

Trying to telnet into the one working port (telnet YYY.YYY.YYY.YYY 9323) I can see the communication in the ufw logs, but not for tho other two ports.

[UFW AUDIT] SRC=XXX.XXX.XXX.XXX DST=YYY.YYY.YYY.YYY DPT=9323 =>
[UFW AUDIT] SRC=YYY.YYY.YYY.YYY DST=XXX.XXX.XXX.XXX SPT=9323

I provisioned ufw using ansible "ufw" module.

What other reasons could there be? What is going on? :-)

Could it be the hosters network imposes some kind of filter between those servers because of "suspisious" activity (frequent communication)? It also happens, that I run some excessive artillery.io tests from XXX.XXX.XXX.XXX to port 80/443 on YYY.YYY.YYY.YYY today, but this hypothesis does not explain why only those two ports are not working anymore.

And the ultimate test, shutdown of ufw on YYY.YYY.YYY.YYY, does not hel either. Ports 9273 and 2004 are not accessible, 9323 is.

Here is the output from iptables -L -v -n https://pastebin.com/HVeJGXb9

Can some "GIT guru" please have a short look here?

We use jenkins CI for simple deployments. Most jobs make use of the "GIT plugin", and there is some issue with this. Even, if we set the plugin to track the "master" branch. At some point we end up to have a "detached state" in the build directory.

like this.

root@jinx [...]/workspace/build # git branch -a
* (detached from 12dbf9b)
  remotes/origin/dev
  remotes/origin/master

The build process does not report an error. This is the log from GIT plugin.

 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url [email protected]:q3i/our-repo.git # timeout=10
Fetching upstream changes from [email protected]:q3i/our-repo.git
 > git --version # timeout=10
 > git fetch --tags --progress [email protected]:q3i/our-repo.git +refs/heads/master:refs/remotes/origin/master
 > git rev-parse origin/master^{commit} # timeout=10
Checking out Revision 12dbf9b8eb8fd71580f874ae963162f72221e577 (origin/master)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 12dbf9b8eb8fd71580f874ae963162f72221e577
 > git rev-list 58f1f1ae97628a0b5f2d5e3090a24416c7952f0e # timeout=10

I see that the detached commit 12dbf9b is in fact the HEAD. Is it an expected state, what might be the advantage of this form the perspective of jenkins GIT plugin?

Thank you for some new GIT knowledge :-)

I try to protect the access to a subdirectory by http auth using .htaccess file configuration.

This is the full working code for apache 2.4 in my case.

# Conditionally set environment variable BACKEND_PROTECTION (version for apache 2.4)

<If "%{HTTP_HOST} == 'www.somedomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
</If>
<If "%{HTTP_HOST} == 'www.someotherdomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
</If>

<RequireAny>
  <RequireAll>
    Require not env BACKEND_PROTECTION
    Require all granted
  </RequireAll>
  <RequireAll>
    AuthType Basic
    AuthName "Protected URI"
    AuthUserFile /var/www/config/.htpasswd
    Require valid-user
  </RequireAll>
</RequireAny>

Now I need to additionally exclude a subdirectory of that directory from authentification, so this is what I tried.

<If "%{HTTP_HOST} == 'www.somedomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
</If>
<If "%{HTTP_HOST} == 'www.someotherdomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
</If>

# disable protection for backend files loaded in frontend
SetEnvIf REQUEST_URI "^/typo3/sysext/" !BACKEND_PROTECTION

But this does not work, after this code, the following <RequireAny> block from above triggers http authentification as if BACKEND_PROTECTION was stil set. But if I put the negation inside <If></If> it works as expected.

<If "%{HTTP_HOST} == 'www.somedomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
    SetEnvIf REQUEST_URI "^/typo3/sysext/" !BACKEND_PROTECTION
</If>
<If "%{HTTP_HOST} == 'www.someotherdomain.de'">
    SetEnvIf REQUEST_URI "^/typo3/" BACKEND_PROTECTION
    SetEnvIf REQUEST_URI "^/typo3/sysext/" !BACKEND_PROTECTION
</If>

Why is it that way? What does the following statement taken from the If-Documentation exactly mean?

Description: Contains directives that apply only if a condition is satisfied by a request at runtime

Is the other code inside .htacces not processed during the same runtime? Or just in a earlier stage of that runtime during some kind of pre-compile step?

Hi I would like to call java using PHP exec() function but it fails (no output of e.g. exec('/usr/bin/java -version').

I am running apache with PHP as Fast-CGI (with fcgid) on debian wheezy.

The java binary is available under /usr/bin/java and is callable from command line, e.g. '/usr/bin/java -version' returns expected information.

Calling this in context of the apache/suexec user works as well from command line (sudo -u www-data /usr/bin/java -version).

But called from PHP usig exec() or checked with is_executable('/usr/bin/java') does not work.

What am I missing?