bobo's questions -server

bobo

Asked: 2015-05-14 06:45:04 +0800 CST

VPN (PPTP) connects successfully but unable to ping some devices in the LAN

1

My working company has this router (Cisco RV042G Gigabit Dual WAN VPN Router) and it has the IP 192.168.1.1 with subnet mask 255.255.255.0. It has 3 devices directly connected to its LAN ports, an ASUS access point 192.168.1.245, a D-Link access point 192.168.1.246 and a network printer 192.168.1.247.

I have setup the VPN (PPTP) in the Cisco router in the IP range of 192.168.1.253 - 192.168.1.254. And this range is excluded from the Cisco router DHCP range.

From my home computer (physical line directly connected to the modem), I can connect to the company Cisco router successfully and gets assigned the IP 192.168.1.253. I can ping the Cisco router and the network printer without any problem. However, I cannot ping the two access points and cannot access their web admin interface.

I try to ping them from the Cisco router and find that they can respond the ping request. So I can confirm that the Cisco router can actually reach them. Also, other computer hosts in the company can access the internet through these two access points without any problem. And they can ping and access the web admin interface of these two access points.

I also tried to turn off the firewall in the Cisco router to make sure it's not the cause but it still does not solve the problem.

So why can't my home computer ping and access the web admin interface of the access points when it's connected by VPN?

bobo

Asked: 2014-08-26 22:23:02 +0800 CST

Is the server still vulnerable to attack if we don't turn off cgi.fix_pathinfo?

3

The /etc/nginx/sites-available/default file that comes with nginx installation has the following content:

# You may add here your
# server {
#   ...
# }
# statements for each of your virtual hosts to this file

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
        # Uncomment to enable naxsi on this location
        # include /etc/nginx/naxsi.rules
    }

    # Only for nginx-naxsi used with nginx-naxsi-ui : process denied requests
    #location /RequestDenied {
    #   proxy_pass http://127.0.0.1:8080;    
    #}

    #error_page 404 /404.html;

    # redirect server error pages to the static page /50x.html
    #
    #error_page 500 502 503 504 /50x.html;
    #location = /50x.html {
    #   root /usr/share/nginx/html;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #   fastcgi_split_path_info ^(.+\.php)(/.+)$;
    #   # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
    #
    #   # With php5-cgi alone:
    #   fastcgi_pass 127.0.0.1:9000;
    #   # With php5-fpm:
    #   fastcgi_pass unix:/var/run/php5-fpm.sock;
    #   fastcgi_index index.php;
    #   include fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}
}


# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
#   listen 8000;
#   listen somename:8080;
#   server_name somename alias another.alias;
#   root html;
#   index index.html index.htm;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}


# HTTPS server
#
#server {
#   listen 443;
#   server_name localhost;
#
#   root html;
#   index index.html index.htm;
#
#   ssl on;
#   ssl_certificate cert.pem;
#   ssl_certificate_key cert.key;
#
#   ssl_session_timeout 5m;
#
#   ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
#   ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
#   ssl_prefer_server_ciphers on;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}

You can see there is a note "You should have "cgi.fix_pathinfo = 0; in php.ini". Above it, we also have this line:

fastcgi_split_path_info ^(.+\.php)(/.+)$;

According to the post Security issue on Nginx, PHP & fastcgi_split_path_info, we can mitigate the path info vulnerability by turning off cgi.fix_pathinfo or making use of the fastcgi_split_path_info.

Since it already makes use of the fastcgi_split_path_info directive to counter such vulnerability, why does it still say we should turn off the cgi.fix_pathinfo? If we don't, will our server be vulnerable to attack?

bobo

Asked: 2014-01-29 21:28:16 +0800 CST

Shouldn't we exclude a static IP from the DHCP pool?

1

In my office, I have a printer with static IP 192.168.0.254/24. Normally, it should be excluded from the DHCP pool in the router. So I just set the DHCP pool to be in the range of 192.168.0.2/24 - 192.168.0.240/24, 192.168.0.241/24 - 192.168.0.254/24 will be left for some machines that require static IP like the printer.

Then I also added the static IP 192.168.0.254/24 in the router for the printer. It seems there's nothing wrong. But with these settings, the printer is inaccessible to other machines in the same network. That is, nobody is able to print from their computer and it doesn't respond to any PING request like before.

I had completely no idea. So I just tried some luck by configuring the DHCP range to cover as most IPs as it can, which is 192.168.0.2/24 - 192.168.0.254/24.

After router restart, the printer is now completely accessible and can respond to PING just like it was before we replaced the old router with this one (Cisco RV180W).

So my question is, shouldn't we exclude a static IP from the DHCP pool?

I have included some screenshots below that show our current configuration:

enter image description here

Note: you can see there are some machines using static IPs but I still haven't added them in the Static DHCP Client Table because I plan to change them to use dynamic IP later.

bobo

Asked: 2014-01-16 11:35:38 +0800 CST

Is this normal that www-data still needs to have read and execute permissions on htdocs when using PHP-FPM?

1

I have setup an Apache+PHP-FPM environment and I have set the following in the PHP-FPM pool file:

[www]
user = mary
group = mary
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 8
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 4
pm.max_requests = 50

Everything is fine. I have confirmed in the phpinfo that it's running in PHP-FPM, and it's also running as the user mary by the following codes:

<?php
echo `whoami`;
?>

I have set 0750 permissions on htdocs recursively (everything inside this folder also inherits these permissions):

owner: mary RWX
group: www-data RX

It's running fine. But since I am running as mary in PHP-FPM, I think Apache does not actually need to have access to htdocs.

So I tried to set 0700 on htdocs also recursively, which actually means only allowing the owner mary to have RWX permissions on this folder. But then I got permission denied when I access the pages in htdocs, which does not happen when using 0750.

Why does Apache still need access to htdocs in this situation?

bobo

Asked: 2014-01-14 14:51:40 +0800 CST

Should we have one pool for many websites in Apache+PHP-FPM?

2

If there are many small websites (about 300) running in light web traffic, should they all use the same pool, or would it be better to have a separate pool for each of them?

Let us assume the websites are trusted and the benefits of having a separate user/group on the pool (e.g. better control of access/permissions) are not considered here.

bobo

Asked: 2012-08-27 23:54:51 +0800 CST

Is this normal that api-verify.recaptcha.net points to google.com?

1

A user just emailed me saying he could not complete registration in my website. I just checked and already found out it's the recaptcha that is causing the problem.

I have been using this recaptcha php library and it has been working perfectly for more than 3 years until today: https://developers.google.com/recaptcha/docs/php?hl=zh-TW

The recaptcha displays successfully when the registration page loads, but it says Could not open socket when it tries to contact the api-verify.recaptcha.net during captcha verification.

I suspect there's something wrong with api-verify.recaptcha.net, when I ping it, it redirects to www.l.google.com.

Is this normal?

bobo

Asked: 2011-12-21 16:24:23 +0800 CST

Pre-supplying answer to linux program

1

When I run the following command:

yiic webapp main /home/david123/domains/david123.servehttp.com/public_html/main

It waits for my answer:

Create a Web application under '/home/david123/domains/david123.servehttp.com/public_html/main'? [Yes|No]

Rather than entering Yes/No each time I run this command, I would like to pre-supply the answer to the command. What should I append to my original command?

yiic webapp main /home/david123/domains/david123.servehttp.com/public_html/main

bobo

Asked: 2010-04-13 16:19:42 +0800 CST

yum update works but yum --security update fails to work in Fedora 12

4

I had already installed the yum-security before. And I was going to do an update by entering the following command:

[root@localhost /]# yum update
Loaded plugins: presto, priorities, refresh-packagekit, security
Skipping security plugin, no data
Setting up Update Process
Resolving Dependencies
Skipping security plugin, no data
--> Running transaction check
---> Package eject.i686 0:2.1.5-17.fc12 set to be updated
---> Package glibc.i686 0:2.11.1-4 set to be updated
---> Package glibc-common.i686 0:2.11.1-4 set to be updated
---> Package glibc-devel.i686 0:2.11.1-4 set to be updated
---> Package glibc-headers.i686 0:2.11.1-4 set to be updated
---> Package gnome-themes.noarch 0:2.28.1-3.fc12 set to be updated
---> Package gtk2.i686 0:2.18.9-3.fc12 set to be updated
---> Package gtk2-immodule-xim.i686 0:2.18.9-3.fc12 set to be updated
---> Package kernel-PAE.i686 0:2.6.32.11-99.fc12 set to be installed
---> Package kernel-PAE-devel.i686 0:2.6.32.11-99.fc12 set to be installed
---> Package kernel-PAEdebug-devel.i686 0:2.6.32.11-99.fc12 set to be installed
---> Package kernel-debug-devel.i686 0:2.6.32.11-99.fc12 set to be installed
---> Package kernel-devel.i686 0:2.6.32.11-99.fc12 set to be installed
---> Package kernel-firmware.noarch 0:2.6.32.11-99.fc12 set to be updated
---> Package kernel-headers.i686 0:2.6.32.11-99.fc12 set to be updated
---> Package libnetfilter_conntrack.i686 0:0.0.101-1.fc12 set to be updated
---> Package media-player-info.noarch 0:5-1.fc12 set to be updated
---> Package nscd.i686 0:2.11.1-4 set to be updated
---> Package perf.noarch 0:2.6.32.11-99.fc12 set to be updated
---> Package rhythmbox.i686 0:0.12.6-5.fc12 set to be updated
---> Package sysvinit-tools.i686 0:2.87-3.dsf.fc12 set to be updated
--> Finished Dependency Resolution
--> Running transaction check
---> Package kernel-PAE.i686 0:2.6.31.12-174.2.3.fc12 set to be erased
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                  Arch     Version                     Repository  Size
================================================================================
Installing:
 kernel-PAE               i686     2.6.32.11-99.fc12           updates     20 M
 kernel-PAE-devel         i686     2.6.32.11-99.fc12           updates    6.2 M
 kernel-PAEdebug-devel    i686     2.6.32.11-99.fc12           updates    6.2 M
 kernel-debug-devel       i686     2.6.32.11-99.fc12           updates    6.2 M
 kernel-devel             i686     2.6.32.11-99.fc12           updates    6.1 M
Updating:
 eject                    i686     2.1.5-17.fc12               updates     49 k
 glibc                    i686     2.11.1-4                    updates    4.2 M
 glibc-common             i686     2.11.1-4                    updates     14 M
 glibc-devel              i686     2.11.1-4                    updates    953 k
 glibc-headers            i686     2.11.1-4                    updates    590 k
 gnome-themes             noarch   2.28.1-3.fc12               updates    1.5 M
 gtk2                     i686     2.18.9-3.fc12               updates    3.2 M
 gtk2-immodule-xim        i686     2.18.9-3.fc12               updates     60 k
 kernel-firmware          noarch   2.6.32.11-99.fc12           updates    968 k
 kernel-headers           i686     2.6.32.11-99.fc12           updates    749 k
 libnetfilter_conntrack   i686     0.0.101-1.fc12              updates     37 k
 media-player-info        noarch   5-1.fc12                    updates     32 k
 nscd                     i686     2.11.1-4                    updates    189 k
 perf                     noarch   2.6.32.11-99.fc12           updates     79 k
 rhythmbox                i686     0.12.6-5.fc12               updates    4.0 M
 sysvinit-tools           i686     2.87-3.dsf.fc12             updates     58 k
Removing:
 kernel-PAE               i686     2.6.31.12-174.2.3.fc12      @updates    72 M

Transaction Summary
================================================================================
Install       5 Package(s)
Upgrade      16 Package(s)
Remove        1 Package(s)
Reinstall     0 Package(s)
Downgrade     0 Package(s)

Total download size: 75 M
Is this ok [y/N]:

But then I changed my mind, I decided to do a security-only update instead of a full update, so I entered the following command:

[root@localhost /]# yum --security update
Loaded plugins: presto, priorities, refresh-packagekit, security
Setting up Update Process
Resolving Dependencies
Limiting packages to security relevant ones
http://download.fedoraproject.org/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.cuhk.edu.hk/pub/linux/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.cuhk.edu.hk/pub/linux/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.cuhk.edu.hk/pub/linux/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.riken.jp/Linux/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.riken.jp/Linux/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://mirror.cse.iitk.ac.in/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirror.cse.iitk.ac.in/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://mirrors.isu.net.sa/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirrors.isu.net.sa/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
ftp://ftp.chu.edu.tw/linux/Fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno -1] Metadata file does not match checksum
Trying other mirror.
http://mirror.yandex.ru/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirror.yandex.ru/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://linus.iyte.edu.tr/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://linus.iyte.edu.tr/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.jaist.ac.jp/pub/Linux/Fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.jaist.ac.jp/pub/Linux/Fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.kddilabs.jp/Linux/packages/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://srv2.ftp.ne.jp/Linux/packages/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://www.ftp.ne.jp/Linux/distributions/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://srv2.ftp.ne.jp/Linux/distributions/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.rhd.ru/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.rhd.ru/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://mirrors.163.com/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirrors.163.com/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://mirror.nus.edu.sg/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirror.nus.edu.sg/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.yz.yamagata-u.ac.jp/pub/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.yz.yamagata-u.ac.jp/pub/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.linux.org.tr/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.linux.org.tr/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://mirrors.cytanet.com.cy/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://mirrors.cytanet.com.cy/linux/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://fedoramirror.hnsdc.com/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://fedoramirror.hnsdc.com/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.twaren.net/Linux/Fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://c147.twaren.net/pub/Linux/Fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.mirror.tw/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.mirror.tw/pub/fedora/linux/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ftp.cs.pu.edu.tw/Linux/Fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ftp.cs.pu.edu.tw/Linux/Fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
http://ubuntu.cn99.com/fedora/updates/12/i386/repodata/updateinfo.xml.gz: [Errno 14] HTTP Error 416 : http://ubuntu.cn99.com/fedora/updates/12/i386/repodata/updateinfo.xml.gz 
Trying other mirror.
Error: failure: repodata/updateinfo.xml.gz from updates: [Errno 256] No more mirrors to try.
 You could try using --skip-broken to work around the problem    

^C[root@localhost /]#

As it can be seen in the output, when I run the yum --security update command, it did show the Limiting packages to security relevant ones message so it's aware of the option.

But I don't know why it keeps reporting the http error 416. I searched in google and found the following description of the error but it doesn't seem to help much.

HTTP ERROR 416 - Requested Range Not Satisfiable
A 416 status code indicates that the server was unable to fulfill the request. This may be, for example, because the client asked for the 800th-900th bytes of a document, but the document was only 200 bytes long.

It suggests me to use the --skip-broken option, I tried and the output is the same.

I already tested many times, it just doesn't work when the --security option is used.

What could be the possible cause for this problem?

bobo

Asked: 2010-04-11 23:08:20 +0800 CST

Failed pinging a LAN card of the server from the client using shared internet connection

2

The server (Windows XP Pro SP3) has two LAN cards (LAN card A and B) and is connected to the internet using ADSL. The ADSL connection is shared to LAN card B using Internet Connection Sharing.

The client (Windows XP Pro SP3) has one LAN card, and is connected to LAN card B of the server so that it has access to the internet.

The IP address on the LAN cards are defined as follows:

Server:
 LAN card A: 192.168.0.3/24 (manually defined by me)
 LAN card B: 192.168.0.1/24 (manually defined by Internet Connection Sharing)

Client:
 LAN card: 192.168.0.123/24 (assigned by DHCP) Default gateway: 192.168.0.1

From the server, I can ping 192.168.0.123 successfully.

From the client, it can access the internet without any problem. I can also ping 192.168.0.1 successfully but for 192.168.0.3, it failed with the Request Timeout error message.

Why did the ping fail, and what should be done to make the ping possible? (all firewalls have been turned off.)

bobo

Asked: 2010-04-06 15:49:50 +0800 CST

Creating a development environment from a shared hosting production environment (LAMP)

2

The production server is shared, I don't have access to php.ini and httpd.conf and most PHP settings cannot be set or overrided using ini_set PHP function.

So I would like to create a local development environment having configurations as close as it can be to those of the production environment (LAMP). I don't have shell access to the server but using exec PHP function to run some simple commands is possible.

I am using Windows XP Pro and I am going to install on VMWare a linux distribution that is more or less the same as the production server. However, installing apache, mysql and php, and then configuring them like those on the production server is not a easy task.

It would be great if there exists any tools that are useful in this situation, tools that can analyze/ inspect the production server and then produce something that can help replicating the environment would be useful.

If not, what should I be aware of when I try to manually replicate the production environment?

bobo

Asked: 2010-02-18 08:26:24 +0800 CST

How should we set up a web server that supports ongoing development?

3

I have rented a VPS (Linux - Fedora) and it's to be used as a web server for both development and production of the same web application.

I have yum-installed apache, subversion, and all packages necessary for running PHP.

In apache, I have created two virtual hosts:

dev.mydomain.com (for ongoing development, /var/domains/dev.mydomain.com/public_html )
www.mydomain.com (for production, /var/domains/www.mydomain.com/public_html )

There will be only one developer and he will use Netbeans as the IDE on Windows XP.

I can imagine that the first thing he will do is to checkout a copy from the SVN repository to his computer in Netbeans. What I am going to do is to just setup two SVN repositories on these folders.

/var/domains/dev.mydomain.com/public_html
/var/domains/www.mydomain.com/public_html

So, when he does some changes on his local copy and then commits the changes, then he can visit dev.mydomain.com on his browser to view the pages and do the code debugging.

Later when he thinks the codes in dev.mydomain.com can be used in production, he can use Netbeans to commit the changes to www.mydomain.com.

Is there any problem with the above scenario? Is this how such a web server should be setup?

bobo

Asked: 2010-02-10 22:56:20 +0800 CST

Choosing between CentOS + remi repository and Fedora

1

I have rented a VPS and it will be used as a LAMP server.

I like using latest versions of LAMP packages and applying updates to them using yum rather than 'compile from source'.

As you may already know, for example, installing the latest version of PHP requires adding an extra repository such as the remi on CentOS, while the official repository for Fedora already includes the latest versions of LAMP packages.

The VPS only has 256mb RAM. Which OS should be chosen?

bobo

Asked: 2010-02-10 08:46:48 +0800 CST

What packages inside EPEL are for LAMP?

2

I heard that latest version packages related to LAMP for CentOS can be found in remi repository.

I googled and found more than one article (e.g. http://timt881.wordpress.com/2009/02/17/installing-phpmyadmin-and-php-52-on-a-centos-52-server/) suggesting the following steps in installing latest version of PHP from remi repository:

$ wget http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm

$ wget http://rpms.famillecollet.com/el5.i386/remi-release-5-7.el5.remi.noarch.rpm

$ rpm -Uvh remi-release-5-7.el5.remi.noarch.rpm epel-release-5.3.noarch.rpm

$ yum –enablerepo=remi install php

However, there is something I don't understand. The LAMP packages are in remi repository, it makes sense to download and install the remi rpm.

But for the EPEL (Extra Packages for Enterprise Linux) rpm, why should it also be downloaded and installed if what's needed is already in the remi repository?

bobo

Asked: 2010-02-10 03:25:44 +0800 CST

Can yum avoid major upgrade but still apply necessary security fix?

1

For example, if the server (CentOS) has PHP 5.2.6 installed and has added a third party repository that provides both PHP 5.2.12 and PHP 5.3.1.

PHP 5.2.12 and PHP 5.3.1 are the latest versions for PHP 5.2 and PHP 5.3 respectively.

When yum update command runs, will yum simply upgrade PHP 5.2.6 to PHP 5.3.1?

Or it has some intelligence that a major upgrade (5.2 to 5.3) may cause problems and thus to be safe, it decides to upgrade to PHP 5.2.12 instead?

By the way, will a repository contain multiple versions of a package, or it only contains the latest version?

bobo

Asked: 2010-02-08 16:14:58 +0800 CST

Local .htaccess strangely allowed running PHP in CGI/FastCGI mode in Apache under shared hosting environment

1

I am using a shared web hosting service. Running phpinfo, I can see the Server API shows CGI/FastCGI rather than Apache 2 Handler.

In this article: http://docs.joomla.org/Should_PHP_run_as_a_CGI_script_or_as_an_Apache_module%3F

It says 'If your server is configured to run PHP as an Apache module, then you will have the choice of using either php.ini or Apache .htaccess files, however, if your server runs PHP in CGI mode then you will only have the choice of using php.ini files locally to change settings, as Apache is no longer in complete control of PHP.'

I think it's really strange that the rewrite rules in the .htaccess that I created have been working perfectly while it's running in CGI mode. Why is this happening?

bobo

Asked: 2010-02-08 04:52:42 +0800 CST

How can the applications get upgraded if they were not installed using yum?

2

On the VPS (CentOS), after running the following commands,

[root@yukiko local]# pwd
/usr/local

[root@yukiko local]# ls
Zend  apache  bin  etc  games  include  lib  lib64  libexec  man  mysql  php  sbin  share  src  var

[root@yukiko local]# find / -iname httpd.conf
/usr/local/apache/conf/httpd.conf
/usr/local/apache/conf/original/httpd.conf

[root@yukiko local]# find / -iname php
/usr/local/php
/usr/local/php/lib/php
/usr/local/php/include/php
/usr/local/php/bin/php

[root@yukiko local]# /usr/local/php/bin/php -v
PHP 5.2.9 (cli) (built: Mar 18 2009 01:02:07)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies
    with Zend Extension Manager v1.2.2, Copyright (c) 2003-2007, by Zend Technologies
    with Zend Optimizer v3.3.3, Copyright (c) 1998-2007, by Zend Technologies

[root@yukiko local]# yum list installed | grep php
[root@yukiko local]# yum list installed | grep apache
[root@yukiko local]# yum list installed | grep mysql

I suspect that apache, mysql and php were not installed using yum. I don't know how they were installed but they were already there since day one the VPS was rented. Now I would like to know how to upgrade them to newer version to be safe from security holes.

Currently, in phpmyadmin, I already found there are three databases (information_schema, mysql, webmail_horde) and the /home/httpd/html/htdocs/ folder also contains some webpage files of this VPS admin web interface (allows the start, stop, restart...etc of the VPS).

Since they were not installed using yum, I cannot use yum update to upgrade them.

I also heard that there are some couplings among apache, mysql and php. How can we upgrade them safely?

Many thanks to you all.

bobo

Asked: 2010-02-07 17:41:33 +0800 CST

Why is the displayed name in bash different from the one in /etc/passwd?

2

I remotely SSH login as root (using PUTTY),

The bash shell prompt becomes:

[root@yukiko /]#

When I entered:

getent passwd

The first line I see is this one:

root:x:0:0:root:/root:/bin/bash

Shouldn't the bash shell prompt look like this? (which corresponds to the first line in /etc/passwd) ?

[root /]#

This is a VPS server with CentOS installed, yukiko is the desired customer login id I provided to the hosting company.

bobo

Asked: 2010-01-23 14:21:20 +0800 CST

Why does firefox need to import the GPG key when updating?

1

I am new to linux and I typed yum update firefox in the shell.
During the process, it says:

Importing GPG key 0x57BBCCBA "Fedora (12) <[email protected]>" from /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-i386
Is this ok [y/N]: y

Why does firefox need to import the GPG key when updating?
Does this happen often when installing or updating software using yum?

bobo

Asked: 2010-01-17 04:38:23 +0800 CST

What does the number inside the brackets mean in the output of whatis command in linux

2

For example,

[root@fedora ~]# whatis pwd
pwd (1p) - return working directory name
pwd (1) - print name of current/working directory
pwd [builtins] (1) - bash built-in commands, see bash(1)
pwd.h [pwd] (0p) - password structure

What are those 0p,1,1p? Sometimes, I also see the word rpm in the brackets.

bobo

Asked: 2009-11-04 18:47:10 +0800 CST

Making backup by copying /mysql/data folder is ok as long as both source and target mysql are of the same version?

6

If there are only MyISAM databases, the backup and restoration is possible by simply copying pasting the data folder, regardless of the versions?

But if there are INNODB databases, and we are sure that the source and target versions will be identical, is this copy-and-paste method possible?

It'd be better to avoid typing any command to do the backup because the person who is going to do this never used command-line before.

VPN (PPTP) connects successfully but unable to ping some devices in the LAN

Is the server still vulnerable to attack if we don't turn off cgi.fix_pathinfo?

Shouldn't we exclude a static IP from the DHCP pool?

Is this normal that www-data still needs to have read and execute permissions on htdocs when using PHP-FPM?

Should we have one pool for many websites in Apache+PHP-FPM?

Is this normal that api-verify.recaptcha.net points to google.com?

Pre-supplying answer to linux program

yum update works but yum --security update fails to work in Fedora 12

Failed pinging a LAN card of the server from the client using shared internet connection

Creating a development environment from a shared hosting production environment (LAMP)

How should we set up a web server that supports ongoing development?

Choosing between CentOS + remi repository and Fedora

What packages inside EPEL are for LAMP?

Can yum avoid major upgrade but still apply necessary security fix?

Local .htaccess strangely allowed running PHP in CGI/FastCGI mode in Apache under shared hosting environment

How can the applications get upgraded if they were not installed using yum?

Why is the displayed name in bash different from the one in /etc/passwd?

Why does firefox need to import the GPG key when updating?

What does the number inside the brackets mean in the output of whatis command in linux

Making backup by copying /mysql/data folder is ok as long as both source and target mysql are of the same version?

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Ping a Specific Port

Check if port is open or closed on a Linux server?

How to automate SSH login with password?

How do I tell Git for Windows where to find my private RSA key?

What's the default superuser username/password for postgres after a new install?

What port does SFTP use?

Command line to list users in a Windows Active Directory group?

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

How to determine if a bash variable is empty?