Kami's questions

Context

I have two linux based servers which are remotely located. It has already happened twice: after a system or kernel update, the system wasn't responding/reachable over ssh anymore (configuration errors or disk failure, ...). I had travel to the location to rescue the server. When the boot process fails, the systems lands in the emergency/rescue shell which need to be administrated locally.

Question:

Is there a way or a feature of the bootloader to monitor the booting process (i.e. a watchdog), if the system is stuck after some time, a timeout triggers a the system reboot with a different image with network capabilities, ssh, ... (stored on a dedicated media, i.e USB key) in order to be administrated over ssh ?

Thanks

Since the last Fusion Passenger update, all my Sinatra applications have stopped working on the following env: Apache (2.4.17), Phusion Passenger (5.0.21). Everything was working as expected before updating the passenger middleware.

The problem is, apache directory is trying to proceed to a listing of the public directory when I'm requesting the url (https://myapp.ch) of my vhost.

The ODD part: If a route defined in the Sinatra controller is requested (i.e: https://myapp.ch/infos), passenger is started and the requested page is served as expected.

Here is the Virtual Host part:

<VirtualHost *:443>
  DocumentRoot /home/user1/sinatra/app1/public
  ServerName myapp.ch

  <Directory /home/user1/sinatra/app1/public>
      AllowOverride all
      Order allow,deny
      Allow from all
      Options -MultiViews
      Require all granted
  </Directory>

Config.ru

# encoding: UTF-8

require 'rubygems'
require 'sinatra'

require File.expand_path '../start.rb', __FILE__

run Sinatra::Application

Apache Log Error when requesting the root of the Sinatra App (/):

[Mon Oct 26 22:10:30.728795 2015] [autoindex:error] [pid 3535:tid 140103510914816] [client 176.127.182.162:50956] AH01276: Cannot serve directory /home/user1/sinatra/app1/public/: No matching DirectoryIndex (none) found, and server-generated directory index forbidden by Options directive

Apache is trying to do directory listing (which has been disabled by configuration).

Has someone experience the same issue ? How to make apache launch passager and serves the root of the Sinatra app ?

I want to share file from my linux box to OSX clients. I don't want to use SMB !

I'm using netatalk 2.1.2 but apparently there is a filname length limitation :

I've tried "123456789012345678901234567.avi" (31 characters long), and it works but when the filename is >31 char long. Some programs like Quicktime can't open the file.

I've started the share with :

... -unixcodepage utf8 -maccodepage utf8

Is there any way to make netatalk/afpd to work with filenames longer than 31 char ?

Here is my virtualhost configuration:

<VirtualHost *:80>
    DocumentRoot /home/user1/htdocs/folder1
    ServerName folder1.hostname.tld
    <Directory /home/user1/htdocs/folder1>
            AuthType Digest
            AuthName "private"
            AuthUserFile /home/user1/passwd
            Require user superman
            #Order allow,deny
            #Allow from all
    </Directory>
</VirtualHost>

I've added the user with :

htdigest -c /home/user1/passwd private superman

Apache keep giving me in its log :

client denied by server configuration: /home/user1/htdocs/folder1/

I don't know what's wrong... Apache has the right to read the passwd file. In addition if I comment the AuthDigest... lines and uncomment the Order and Allow, apache serves the folder like a charm. Apache responds me with a 403 and doesn't prompt my browser for user/pass ..

Any help ?

I'm trying to enable DNSSEC on my authoritative dns Bind machine. So far I've done the following Tutorial :

• Generate the KSK and ZSK Keys :

  dnssec-keygen -a RSASHA1 -b 1024 -n ZONE zonename

  dnssec-keygen -a RSASHA1 -b 4096 -n ZONE -f KSK zonename

• Include the pub key in the zone and sign the zone :

  dnssec-signzone -o zonename -k KSKfile zonefile ZSKfile

• Add the signed zone in place of the old one in named.conf

• Restart Bind

I don't know if I've missed something but the registrar that support DNSSEC keep telling me :

Error Signature DNSKEY entries is not valid.
Error Signature SOA entry is not valid.

Does anyone know how to solve this ? Is there any online DNSSEC tool that display more infos about the dnssec status ?

I would like to set better user access to my mercurial repos trough the cgi web interface. This is my current hgweb.config :

[web]
contact = first.lastname
description = HG Repos
allow_push=user1,user2,user3
allow_read=user1,user2,user3
[paths]
repo01 = /home/mercurial/repo01
repo02 = /home/mercurial/repo02
repo03 = /home/mercurial/repo03
repo04 = /home/mercurial/repo04

How to setup the following ? :

• user1 has only access (push/read) to repo01 and repo02
• user2 has only access (read only) to repo01 and repo02
• user3 has only access (read) to repo01 and repo02, (push/read) repo03

I've checked multiple mercurial config tutorials but nothing helped me so far.

I have 6 servers both with 2 power supplies attached to an UPS. I want to add 4 more servers but the UPS is full and due to budget restriction I couldn't buy a new one for months. The 6 + 4 new servers are running essential services (high uptime required).

Questions :

• What is the power supply failure rate or how many failure have you experienced so far ?
• If the failure rate is low, how safe is it to use only one psu per server and keep the redundant one as backup if the first one fails ?
• Does it make sense to connect one psu to the UPS and the second one to a normal plug ?

I have a Dell 1950 Poweredge server with two Quad Core Intel Xeon 2.33 GHZ and 16 GB of RAM under Gentoo Linux. I'm running heavy calculation task which I don't know how they were implemented ...

Top gives my partial infos (%CPU, ...) but I don't know if the script is running on the 2 CPUs

I would like to monitor both CPU load/activity (like top does for the entire system) to see if the script takes advatage of the dual CPU or not ?

Except recoding the script, how to optimize the payload for 2 CPU ?

We have about 7 Linux servers and from time to time we setup a new one...

For each new install we have to create the same users and ask them to change their default passwords to new ones ... Plus for us, we have to copy our user preferences and other personal stuff (ssh keys, .vimrc, default user's shell...) to the new server.

I would like to have all users' home folders + the authentication system centralized on one server only! When a user tries to log into a server, it has to check username/pass and retrieves user's home folder from one centralized server.

I've heard about LDAP, but regarding my LDAP experiences: are there other solutions?

Requirements:

• Easy to maintain and to setup
• Supports ssh authentication by RSA/DSA public keys
• Makes user's remote folder accessible locally
• Keep user's rights same on all machines (if user can sudo on the centralized server then he can on every server)
• Possibility to restrain user's rights on a particular server

Is it possible that a single machine running avahi advertises other machines sharing files over afp ?

I have different machines running Gentoo but I don't want to run avahi on each server.