Son of the Wai-Pan's questions

On our server we have a number of users (i.e. clients) who need their code to be backed up. Their file permissions are usually 650 with user and group being user:user (where user is the actual user name).

In crontab we have a user, backup, that backups all the desired file paths via tarsnap. The problem is that because of the file permissions, backup can't access these. I can think of four solutions:

1. Set the cronjob to run as root. This is the easiest fix but I don't know if there is a security issue here.
2. Create a group that all users we want to backup and backup belong to. Set the default permissions to set the group for all these users to that group...the backup group seems like a good choice for a group name. This seems a bit difficult though. How do I change the default permissions for each user so that each file touched has the user user and group backup?
3. Modify the group permissions on all the files we want to backup. This is also easy but it also means every time a file is touched (i.e. modified or created) we'll have to modify the group. Not ideal.
4. Make the files world-readable. Is this a security issue?

What would be a reasonable configuration so that I can easily backup these files?

Just thought of one more…

5. Add the backup user to each of the user groups I wish to backup. This resolves the problem of shared access.

In doing some research, it seems like the semantics of /var/backups and the backup user are unclear. It doesn't seem dangerous to put backups in /var/backups but the recommendation there was not to use it for user backups since the behavior is undocumented (since 2001). Practically speaking, it seems that a lot of processes use /var/backups and the backup user ("user" is the wrong word to describe this though...since backup is not a proper "user" with a home directory, etc.) so in recommending its usage, we're not advocating something new.

We use pfsense as a router/firewall. Because we're based in China, it is useful for us to have VPN access for all our internal clients. Instead of each individual client connecting to a VPN server stateside, I'd like to configure pfsense as a VPN client and have all the network traffic be routed through it.

Most of the posts I've seen regarding pfsense and VPN are concerning connecting to the LAN from outside; this is not what I want to do.

Another option would be for an SSH tunnel to be initiated on the pfsense box with the LAN traffic routed through it.

How do I configure pfsense to be able to do either of these? One huge caveat is that OpenVPN cannot be used. The solution I am looking for needs to use one of the other VPN protocols.

I'm going through the Puppet 'Learning' VM. Here's my manifest:

$ensure_val = 'present'

define student($full_name) {

  user { "${title}":
    ensure => $ensure_val,
    comment => "${full_name}",
    groups => "student",
    home => "/home/${title}",
    name => "${title}",
    password => "${title}",
    shell => "/bin/bash",
  }

}

$students = {
  'elion' => {full_name => "El Lion"},
  'azee' => {full_name => "Avery Zee"}
}

create_resources(student, $students)

When I do a puppet apply manifest.pp, it says that everything is created. I do a cat /etc/shadow and indeed those users are there. But doing an 'ls /home` shows an directory.

The VM is running on Centos 5.7. Is there something wrong with the puppet VM? Or am I doing something wrong in the manifest?

I've tried to google this, but haven't had any luck. My goal is to have a packaged directory with a puppet file and an accompanying directory holding file resources where I can just type puppet apply setup.pp and then puppet will do its thing.

I know that puppet's recommended workflow is to create modules and place the file resources there for copying. This is too inconvenient for me, as I don't want to have to install my modules there; I just want to be able to carry around this small package (i.e. pp file and file resources).

How can I configure my pp file to look into my sibling directory if I don't want to use absolute paths? Are there other environment variables I can manipulate to force puppet to look "in the right place"?

I saw a suggestion here that looks like it's extending Facter, but I'm just looking for something to put at the top of my pp file like this:

$basepath = exec{"/usr/bin/pwd":}

...

file {"/home/$title/.nanorc": source => "${basepath}/resources/.nanorc"}

My goal is to define a class that takes, as input, an array of pairs. Since I'm not sure how to define an array of pairs, I'm just going to use a pair of arrays instead.

class student($username, $full_name){
  notify {"user":  message => "username: ${username}\n"}
  notify {"fullname":  message => "fullname: ${full_name}\n"}
  exec {'finger': command => "/usr/bin/finger ${username}", logoutput => true }
}

$users = ['elion', 'azee', 'root']
$names = ['El Lion', 'Avery Zee', "Rooty Root"]

class { 'student':
  username => $users,
  full_name => $names
}

Upon doing a 'puppet apply file.pp' I expect the output to iterate through the two arrays, printing out the notifications and fingering the students (that sounds horrible) in the order given by the arrays. I tried this and what ended up happening, is that puppet conflated the arrays into one string, so the $users value ended up being: elionazeeroot and the $names value ended up being El Lion Avery Zee Rooty Root.

Two questions:

1. Is there a way to define a class to handle a group of data, like I'm trying to do here?
2. I suspect that I'm not using the right construct to achieve my goal. What should I be doing instead?

I'm working through the puppet documentation. One of the exercises is to use some conditional logic to write a general install manifest:

Exercise: Use the $operatingsystem fact to write a manifest that installs a build environment on Debian-based (“debian,” “ubuntu”) and Enterprise Linux-based (“centos,” “redhat”) machines. (Both types of system require the gcc package, but Debian-type systems also require build-essential.)

I wrote code that works, but because my machine is a centos machine, I have no way of checking if the branch works:

$build_packages = $::operatingsystem ? {
  /(?i)centos|redhat/ => 'gcc',
  /(?i)debian|ubuntu/ => ['gcc','build-essential'],
  default => undef
}

notify {"build_packages":
  message => "Build packages for ${::operatingsystem} are: ${build_packages}\n",
  before => Package['build']
}

package {'build':
  ensure => installed,
  name => $build_packages
}

My question is, if I was on a debian or ubuntu system, would this work? Specifically, if I set $build_packages to an array, will the package resource do the right thing and install the two packages? Or should I redefine that resource like this?:

package {$build_packages:
    ensure => installed
}

My puppet file looks like this:

# Test finger harry harry.pp
exec {'harryd':                                                                                                                   
   command => "/usr/bin/finger $title",                                                                                            
   logoutput => true                                                                                                               
 }

When I run puppet apply harry.pp I get this output:

notice: /Stage[main]//Exec[harryd]/returns: finger: main: no such user.
notice: /Stage[main]//Exec[harryd]/returns: executed successfully
notice: Finished catalog run in 0.14 seconds

Running finger harryd gets me the expected output. It looks like puppet is running finger main, but I don't understand why.

I created a VM using vmbuilder but I realize that I had set some of the flags incorrectly. Now when I do a virsh list -all it still appears, laughing at my novicity. How do I delete this? (I've already deleted the corresponding xml and qcow2 files).

dnsmasq is run to help make the user experience smoother for the desktop users. If I run bind/named on this same server will there be conflicts between the two? What are the limitations of dnsmasq, where I should use bind/named instead?

In particular, I've set up bind to run a psuedo-domain locally. It works, but I'm just curious to know if I should've done this through dnsmasq instead of running yet another service that seems to duplicate functionality.

I've been reading a bit on how to configure my own DNS server. I have a host of questions but this is the first that came up:

1. I edited /etc/named.conf and created the appropriate zone files.
2. I tried to restart bind9 with a service bind9 restart.
3. A quick grep of syslog shows that it's not running with the changes I specified in /etc/named.conf.

How do I get /etc/named.conf to be loaded?

(I gave up after a while and after looking at the output from named-checkconf -p, I started editing files in /var/cache/bind as well as /etc/bind/)

My machine is running off of a AMD Sempron(tm) X2 190 Processor. According the marketing copy, it should be running at around 2.5 Ghz. Why is the cpu speed being reported as something lower? Spec description (in Chinese)

$ cat /proc/cpuinfo 
processor   : 0
vendor_id   : AuthenticAMD
cpu family  : 16
model       : 6
model name  : AMD Sempron(tm) X2 190 Processor
stepping    : 3
microcode   : 0x10000c8
cpu MHz     : 800.000
cache size  : 512 KB
physical id : 0
siblings    : 2
core id     : 0
cpu cores   : 2
apicid      : 0
initial apicid  : 0
fpu     : yes
fpu_exception   : yes
cpuid level : 5
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc rep_good nopl nonstop_tsc extd_apicid pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt npt lbrv svm_lock nrip_save
bogomips    : 5022.89
TLB size    : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 48 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate

processor   : 1
vendor_id   : AuthenticAMD
cpu family  : 16
model       : 6
model name  : AMD Sempron(tm) X2 190 Processor
stepping    : 3
microcode   : 0x10000c8
cpu MHz     : 800.000
cache size  : 512 KB
physical id : 0
siblings    : 2
core id     : 1
cpu cores   : 2
apicid      : 1
initial apicid  : 1
fpu     : yes
fpu_exception   : yes
cpuid level : 5
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc rep_good nopl nonstop_tsc extd_apicid pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt npt lbrv svm_lock nrip_save
bogomips    : 5022.82
TLB size    : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 48 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate

When I enable my vhosts file (i.e. uncomment this line: Include /private/etc/apache2/extra/httpd-vhosts.conf) I am unable to reach localhost. I /am/ able to reach the last virtual host listed in my vhosts file:

<VirtualHost *:80>
  DocumentRoot "/Users/achan/Sites/epwbst"
  ServerName epwbst                                                                                                  
</VirtualHost>

<VirtualHost *:80>
  DocumentRoot "/Users/achan/Sites/pxproj"
  ServerName pxproj
</VirtualHost>

Typing pxproj in my browser brings up the expected web content. But I am unable to reach epwbst or localhost. If I re-comment the vhost line in my httpd.conf, I am able to reach local host (i.e. "It works!") but obviously am unable to reach my virtual hosts. I don't know how to continue troubleshooting this.

Why can't I reach localhost when I've got my vhosts turned on?

OS: Mac OS X 10.7

Server version: Apache/2.2.21 (Unix)

I am running 10.7.4. I have Apache up and running. It serves html and php as expected. I was playing around with apachectl and wanted to see what fullstatus did. The complete command is:

 $ apachectl fullstatus

The response on the command line is:

Go to http://localhost:80/server-status in the web browser of your choice.
Note that mod_status must be enabled for this to work.

A apachectl -t -D DUMP_MODULES | grep status shows:

Syntax OK
 status_module (shared)

Upon doing that I get a 403 saying I don't have access to server-status. In looking at the access log I see:

localhost - - [29/May/2012:17:36:53 +0800] "GET /server-status HTTP/1.1" 403 324

error log:

[Tue May 29 17:36:53 2012] [error] [client ::1] client denied by server configuration: /Library/WebServer/Documents/server-status

I pored over the /etc/apache/httpd.conf but couldn't find anything.

How do I configure Apache so that I can view the server-status?

I am running Apache/PHP on MacOS X Lion 10.7.4. My directory structure is set up as so:

/Users/achan/Sites/
lrwxrwx---   1 achan  staff    23B Apr 27 16:21 epwbst@ -> /Users/achan/dev/epwbst`

where epwbst/ is a symlink inside of ~/Sites.

If I put test.php inside of the Sites/ directory, Apache serves up the file correctly; it spews out phpinfo() like it is supposed to. If I put the same file under the symlink, I get this error:

[Mon May 28 14:47:13 2012] [error] [client ::1] PHP Warning:  Unknown: failed to open stream: No such file or directory in Unknown on line 0
[Mon May 28 14:47:13 2012] [error] [client ::1] PHP Fatal error:  Unknown: Failed opening required '/Users/achan/Sites/epwbst/test.php' (include_path='.:/usr/lib/php/pear') in Unknown on line 0

Just to be sure that Apache was working, I created a test html file under ~/Sites/epwbst/ and Apache served it up as expected.

Why can't Apache run php under my symlinked directory?

I've pasted my php config here: http://pastebin.com/gg27JyVZ

I've installed CentOS 6.2, encrypting my swap partition and my /home. I'm trying to configure my server to run headless; I'd like it boot and push all of its boot spew to whoever is connected to it that has appropriate access privileges (users in the sudoers list).

There are two problems here:

• How do I delay CentOS asking me to provide a password for swap? It pushes a modal dialog to the monitor, which shatters my dreams of headless boot.

• How do I get CentOS to start up an SSH server process and push all the boot spew to whoever is connected (if someone is connected)? Someone mentioned DropBear to me. I looked at it and still wasn't sure how to configure this.

I'm running into an intermittent error with my Ruby app and I'm trying to figure out the context. I'm running mod_passenger off of Apache (on Dreamhost, if that matters).

The error I'm getting is:

[ pid=12404 file=ext/apache2/Hooks.cpp:727 time=2012-04-30 02:59:02.949 ]:
  Unexpected error in mod_passenger: Could not send data to the ApplicationPool server: write() failed: Bad file descriptor (9)
  Backtrace:
     in 'virtual boost::shared_ptr<Passenger::Application::Session> Passenger::ApplicationPoolServer::Client::get(const Passenger::PoolOptions&)' (ApplicationPoolServer.h:402)
     in 'int Hooks::handleRequest(request_rec*)' (Hooks.cpp:523)

(That's how I know I'm running mod_passenger.) I tried to do a gem list | grep passenger, but that didn't turn up anything. I can see the module in /dh/apache2/template/lib/modules, I just don't know how to figure out what the version is.

(I am aware that security via obscurity is not recommended).

I am trying to hide the fact that I am using Wordpress. This post is helpful, but it only addresses the content (sort of). I am interested in having the following occur:

1. User tries to access any url with wp* as a substring via their browser.

   Result: Redirected to 404 page.

2. Blog user/administrator knows in order to login they should go to http://example.com/blogin/.

   Result: apache redirects them to http://example.com/wp-admin/.

3. If a user tries to directly access wp-admin from their browser they get sent to #1.

   Result: Redirected to 404 page.

Things I've done so far

1. I noticed for a default install of WordPress that I could access any of the wp* files in the (relative) root directory of the WP install. Specifically wp-settings.php was problematic because it gave away information about my set-up. If a user accessed it, it would spew some PHP errors and reveal part of the directory structure. I edited my php.ini file to turn display_errors off. Now accessing http://example.com/wp-settngs.php brings up a blank page.

2. This in itself isn't ideal because it reveals that wp-settings.php exists. In fact, accessing all the different wp* files is possible (with different results). I then put the following in my htaccess file:

         RewriteEngine On
         RewriteBase /
         RewriteCond %{PATH_INFO} wp* [NC]
         RewriteRule .* - [F]
   

   This worked great! Anything with a wp* was routed to my custom 404 page. But now I can't access my admin page.

3. I tried to insert this line into the above code: RewriteRule ^blogin wp-admin [NC,R,L]. It was supposed to be right after RewriteBase but this didn't work.

4. I tried to do a:

   <Directory /home/example/wp*> 
    Order Allow, Deny 
    Allow from example.com 
    Deny from all 
   </Directory> 
   

   hoping that a referer from my site (via the rewrite of the rule) would be able to access wp-admin, but not someone from outside. This didn't work either. apache complained that you can't use this directive from htaccess.

I've read the apache documentation; I understand the concepts, theoretically, but I need some practical help.

EDIT: I'm looking for a solution that uses .htaccess instead of httpd.conf since my particular setup makes using httpd.conf inconsistent.

We want to store our backups of our svn repositories as a flat file. We'd like to tar/zip the whole hotcopied directory. I know that we could dump it to a flat file but let's pretend that we'd rather use hotcopy instead. Are there any gotchas (i.e. byte-order caveats) with zipping/tarring svn repositories?