I am a programmer, and do not know a lot about crons, but I want to know if this is possible.

Lets say I have an array [option1, option2, option3] and a script which I run in NodeJS called script.js. I want to run this script each day at 1 am. The cron command of this would be:

0 1 * * * node ~/script.js

Well now the tricky part, I want to rotate the options each day, so for example monday I want to run node ~/script.js option1, the next day node ~/script.js option2 and so on. Also, I want to be able to add/remove options when needed, but the rotation should stay intact.

Is this possible in any way? I know I could do this within node also, but I'd rather do this from outside the script, and leave the script as it is.

I am about to deploy a brand new node.js application, and I need some help setting this up.

The way my setup is right now is as follows.

I have Varnish running on external_ip:80

I have Nginx behind running on internal_ip:80

Both are listening on port 80, one internal port, one external.

NOTE: the node.js app runs on WebSockets

Now I have the my new node.js application that will listen on port 8080.

Can I have varnish set up that it is in front of both nginx and node.js.

Varnish has to proxy the websocket to port 8080, but then the static files such as css, js, etc has to go trough port 80 to nignx.

Nginx does not support websockets out of the box, else I would so a setup like:

varnish -> nignx -> node.js

I am creating a production server that will run nginx with php-fpm. I want to have a good mix between securing the server, and still having good quick workflow.

Now one thing that always secures the system is chrooting. Now I have read a lot about this, and chrooting nginx is pretty complicated.

It is said that a good way is using the chroot function that php-fpm has build in. I read several guides, that explain how to set this up, but I haven't read about the implications this brings. I even read that there are none.

Well, the first problem I got was something time related. Solution was to copy /etc/localtime and the folder /usr/share/zoneinfo into the chroot directory.

NONE of the guides tell you this, and it is the first error you notice.

Now I am having trouble with file_get_contents, I get the following error:

failed to open stream: php_network_getaddresses: getaddrinfo failed: Name or service not known

I guess the solution will be to add more files into the chroot. I really don't want to do this for every website I develop.

Question

Now is this the case with chrooting, even in php-fpm, or am I doing something wrong. Is there something I have to enable to get everything working, or should I move everything into the directory.

I am setting up php-fpm with chrooting enabled. Now I see that there are two options, and I want to know what the exact difference is.

The setup has:

chroot = /var/www/domains/domain.tld/
; Chdir to this directory at the start. This value must be an absolute path.
; Default Value: current directory or / when chroot
chdir = /docroot/

Why are there two different locations here, and which path is php allowed to access. Can the php website access /var/www/domains/domain.tld/, or can it only access files withing the docroot directory.

===

Maybe there is some concrete advice for me. I want to have a setup like this:

webroot location: /var/www/

domain.com/
 |---conf/
 |    |--nginx.conf
 |    |--php-fpm.conf
 |
 |---ssl/
 |---logs/
 |---session/
 |---domains/
       |---www/
       |---app/
       |---dev/

Now here the php-fpm settings would be:

chroot = /var/www/domain.com/
chdir  = /domains/www

Now the main question here is, will the application located in the www subdomain be able to access the files in dev or app. Or even the files located in session, which is the session save path, or the other folders such as ssl and logs.

I have a system runnning nginx / php-fpm / varnish / wordpress and amazon s3.

Now I have looked at a lot of configuration files while setting up the system, and in all of them I found something like this:

    /* If the request is for pictures, javascript, css, etc */
    if (req.url ~ "\.(jpg|jpeg|png|gif|css|js)$") {
        /* Remove the cookie and make the request static */
        unset req.http.cookie;
        return (lookup);
    }

I do not understand why this is done. Most of the examples also run NginX as a webserver. Now the question is, why would you use the varnish cache to cache these static files.

It makes much more sense to me to only cache the dynamic files so that php-fpm / mysql don't get hit that much.

Am I correct or am I missing something here?

UPDATE

I want to add some info to the question based on the answer given.

If you have a dynamic website, where the content actually changes a lot, chaching does not make sense. But if you use WordPress for a static website for example, this can be cached for long periods of time.

That said, more important to me is static conent. I have found a link with some test and benchmarks on different cache apps and webserver apps.

http://nbonvin.wordpress.com/2011/03/14/apache-vs-nginx-vs-varnish-vs-gwan/

NginX is actually faster in getting your static content, so it makes more sense to just let it pass. NginX works great with static files.

--

Apart from that, most of the time static content is not even in the webserver itself. Most of the time this content is stores on a CDN somewhere, maybe AWS S3, something like that. I think the varnish cache is the last place where you want to have you static content stored.

I just created a new structure for a website, and I need some help on redirecting to new places.

The code that works is here, but I guess this can be optimized a lot.

location = /nl {
    rewrite ^ $scheme://$server_name permanent;
}

location = /nl/ {
    rewrite ^ $scheme://$server_name permanent;
}

location = /en {
    rewrite ^ $scheme://$server_name permanent;
}

location = /en/ {
    rewrite ^ $scheme://$server_name permanent;
}

location = /nl/contact {
    rewrite ^ $scheme://$server_name/contact/ permanent;
}

location = /en/contact {
    rewrite ^ $scheme://$server_name/contact/ permanent;
}

I have an instance running on Amazon EC2 that I turned into a webserver.

Now I have been looking at cloudwatch, but I do not know if it is the correct tool for the job. Basically I want to get informed when the server is down, for whatever reason.

Maybe the server got hacked, or the server shut down for whatever reason, I want to get a notification on that.

I have enabled clouwatch, and tried to set up a alert, but I only see things like network in-out or cpu usage, an d metrix. Now I do not know if these will do the trick.

I am just analyzing my logwatch logs, and I see the following entries:

 SMTP SESSION, MESSAGE, OR RECIPIENT ERRORS
 ------------------------------------------

 Mail Rejected:
       Total:  6

 Mail Deferred:
       Total:  229

 Total SMTP Session, Message, and Recipient Errors handled by Sendmail:  235

 ---------------------- sendmail End -------------------------

I only use sendmail for logwatch, so what is causing all these errors, and especially, what are deferred emails.

I know this must have been answered already, but I have been searching for quite a while, and cannot find the answer. Just not looking in the right place I guess, maybe someone can help me out.

Basically I am running phpmyadmin through SSL on a non-standard port, in this example 12345.

Now I have https://example.com:12345 set up ok, it works and everything. Now I want to add the ability to just type http://example.com:12345 and be redirected to the https://.

I asumed the following would work, but it does not.

server {
  listen        12345;
  server_name   php.myadmin.com;

  if ( $scheme = http ) {
    rewrite ^ https://php.myadmin.com:12345$request_uri? redirect;
  }
  root         /var/www/php;

  ssl           on;

  [....]
}

This gives me a 400 bad request.

Now before posting an answer make sure to have a good look at the redirect form. Check the pitfall in the link bellow.

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

Further, it would be nice if this can even be done without an if-statement:

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#using-if

I am trying to change the port of SSH on an EC2 instance, but I am not getting this to work.

What I am doing is the following:

Open the file /etc/ssh/ssh_config

Uncomment and change the line Port 2345

Save and close

run the command service sshd restart

Now I can still connect to port 22. And when I run the command ssh -p 2345 localhost i get:

ssh: connect to host localhost port 2345: Connection refused

I am trying to set up DNSSEC for my domains. Everything seems to work but I get the following error:

DNSKEY found at child, but no DS was found at parent.

Check for DS records in parent zone

We found that none of your DNSKEY records are published at parent. All KSKs (Key Signing Keys) should have a corresponding DS record containing the digest of the key at the parent zone.

Recommendation
Publish DS records for all your DNSKEY (KSK) records in parent DNS zone. This will establish a chain of trust from the parent to your zone.

Anyone know what the problem could be?

I am using webmin for my BIND configuration and it has an option called dnssec verification and I think its done via https://dlv.isc.org/.

I made a screenshot for this:

I have some domain names and a hosting package at a certain provider. It is not a very advanced package, so I have no option to create a nameserver there.

I have one domain name that I want to turn into a nameserver for the other domains.

So all my domain names would have ns1.thedomain.com, ns2.thedomain.com, ns3.thedomain.com; thedomain.com would have the same nameservers as well.

I do not want to a rent a whole VPS just for this purpose, nor do I want to use other free services where the nameserver of the primary domain becomes ns2.freedns.eu.com or something like that.

Is there a cheap alternative to do this?

Is it better to use a A record or CNAME record for FTP.

Can you rely on Nginx to be your only webserver. I know in terms of performance it works well, but how does it do in terms of security. I know Apache is stable and has ModSecurity. This is not the case for Nginx.

I am going to use Nginx as only webserver, and only for dynamic content. All my static content is delivered by a CDN.

I am planning on moving my static files to Google's App Engine. I was wondering if this is a good idea to do.

I have read that is it possible that Google will cache your files on multiple locations, which is a good thing in my opinion.

The setup should also be quite easy in eclipse with the GAE plugins.

But i still have my doubts on the performance of this. Is the setup of App Engine optimized for serving static content. Now I have Nginx server my static content, will App Engine perform the same way.

Are there any other ups or downs using this method?

Can someone explain to me what the exact difference is between named and BIND?

I have read that there is an option of using Gmail as your primary mail server. In the sense that you can add mx records etc and you do not have to do it on your own server.

Do you think this is a recommended setup in terms of security. Will Gmail do the fight against virusses, spam, and brute force attacks for you?

[UPDATE]

I have seen that this post has some attention by a couple of people. I must say that right after this post I switched my whole communication system to Google. With communication being email, calendar, documents, etc. I must say that this is in my opinion the best step we made.

[switching webhosts]
We were a starting company, and I had to switch webhosts and servers a lot due to configuration/price/etc. with every switch I had to set over all the websites, and also every time the email adresses, and always losing the emails that were on the other server. With having your email 'in the cloud'. Your emails are always at one place, and you just have to set over the websites when switching hosting providers.

[server security]
Another big issue was the security. We had to move over to a dedicated, with more power. With the greater power came greater complexity. I had to work with linux now, and build my own solid server, with great protection to the outside world. I had to say I was amazed by the numbers of attacks we got each day. Being brute force hacks, sniffing etc. After months of work I had finally build a somewhat 'safe' system. The only weak point in my opinion was the email system. Getting a good spam protection, and I had no idea what kind of risks there are more. This is a thing of the past now, as all the email of the company is safely delivered and protected against spam.

[server performance]
Another small benefit is the resources used by the email programs. I don't have any spam protection or antivirus running on the machines now, this has to be a small benefit.

[conclussion]
Finally the service is great. There are a lot of synchronisation options, also for mobile devices. Being a small company this would be hard for us to set up on our primary server, so having this all work from the cloud is a great thing.

I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this:

My apache version is apache v2.2.3 and I use mod_security2.c

This were the entries from the error log:

[Wed Mar 24 02:35:41 2010] [error] 
[client 88.191.109.38] client sent HTTP/1.1 request without hostname 
(see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

[Wed Mar 24 02:47:31 2010] [error] 
[client 202.75.211.90] client sent HTTP/1.1 request without hostname 
(see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

[Wed Mar 24 02:47:49 2010] [error]
[client 95.228.153.177] client sent HTTP/1.1 request without hostname
(see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

[Wed Mar 24 02:48:03 2010] [error] 
[client 88.191.109.38] client sent HTTP/1.1 request without hostname
(see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

Here are the errors from the access_log:

202.75.211.90 - - 
[29/Mar/2010:10:43:15 +0200] 
"GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 392 "-" "-"
211.155.228.169 - - 
[29/Mar/2010:11:40:41 +0200] 
"GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 392 "-" "-"
211.155.228.169 - - 
[29/Mar/2010:12:37:19 +0200] 
"GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 392 "-" "-" 

I tried configuring mod_security2 like this:

SecFilterSelective REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind"
SecFilterSelective REQUEST_URI "\w00tw00t\.at\.ISC\.SANS"
SecFilterSelective REQUEST_URI "w00tw00t\.at\.ISC\.SANS"
SecFilterSelective REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind:"
SecFilterSelective REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind:\)"

The thing in mod_security2 is that SecFilterSelective can not be used, it gives me errors. Instead I use a rule like this:

SecRule REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind"
SecRule REQUEST_URI "\w00tw00t\.at\.ISC\.SANS"
SecRule REQUEST_URI "w00tw00t\.at\.ISC\.SANS"
SecRule REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind:"
SecRule REQUEST_URI "w00tw00t\.at\.ISC\.SANS\.DFind:\)"

Even this does not work. I don't know what to do anymore. Anyone have any advice?

Update 1

I see that nobody can solve this problem using mod_security. So far using ip-tables seems like the best option to do this but I think the file will become extremely large because the ip changes serveral times a day.

I came up with 2 other solutions, can someone comment on them on being good or not.

1. The first solution that comes to my mind is excluding these attacks from my apache error logs. This will make is easier for me to spot other urgent errors as they occur and don't have to spit trough a long log.

2. The second option is better i think, and that is blocking hosts that are not sent in the correct way. In this example the w00tw00t attack is send without hostname, so i think i can block the hosts that are not in the correct form.

Update 2

After going trough the answers I came to the following conclusions.

1. To have custom logging for apache will consume some unnecessary recourses, and if there really is a problem you probably will want to look at the full log without anything missing.

2. It is better to just ignore the hits and concentrate on a better way of analyzing your error logs. Using filters for your logs a good approach for this.

Final thoughts on the subject

The attack mentioned above will not reach your machine if you at least have an up to date system so there are basically no worries.

It can be hard to filter out all the bogus attacks from the real ones after a while, because both the error logs and access logs get extremely large.

Preventing this from happening in any way will cost you resources and it is a good practice not to waste your resources on unimportant stuff.

The solution i use now is Linux logwatch. It sends me summaries of the logs and they are filtered and grouped. This way you can easily separate the important from the unimportant.

Thank you all for the help, and I hope this post can be helpful to someone else too.

I have a web server running pleks and get attacked a lot every day. I configured a firewall, and there are some predefined services such as www, and ftp, etc.

I am planning to block all the ports except for the www port and the PLESK port. When I need ftp or ssh access for example i will open the ports in PLESK and then start to work.

Is this a good thing to do or are there some downsides on doing this.

There are some ports I am not sure of, such as SMTP,POP3,IMAP, DNS. Can i close these ports or is there no need to do so.

I am creating a server with a primary nameserver and mutliple domains. Do i need to make TXT records for all the domain, they all have there own email, but use the mailserver from the primary.

EDIT:

I am currently on a server running CentOS and Plesk. One option i can choose is to use Domain Keys"

If i enable the domain keys, there are 2 TXT fields created, one with a long key, and one with a o=- value.

If I enable this do i still need to have the SPF records, or is this inferior to the SPF records, in terms of SPAM.