dragonmantank's questions

We are running Nagios for server monitoring, but are kicking around the idea of setting up a second instance from outside the network to check for connectivity issues outside the network. Is there a way to get a single Nagios instance to use multiple machines for a test? For example, we set up Nagios on nagios.domain.com to run the WebUI and do checking, and have nagios-child.domain.com just run checks.

I'd like to have nagios.domain.com and nagios-child.domain.com run a ping test against mysite.com and alert me if either one is down. Is this possible with Nagios or any other monitoring system?

I'm setting up a new server with PHP 5.3.9 and nginx, so I compiled PHP with the php-fpm SAPI options. By itself it works great using the following server entry in nginx:

server {
    listen 80;
    server_name domain.com www.domain.com;

    root /var/www/clients/domain.com/www/public;
    index index.php;

    log_format gzip '$remote_addr - $remote_user [$time_local] "$request" $status $bytes_sent "$http_referer" "$http_user_agent" "$gzip_ratio"';
    access_log /var/www/clients/domain.com/logs/www-access.log;
    error_log /var/www/clients/domain.com/logs/www-error.log error;

    location ~\.php$ {
            fastcgi_pass 127.0.0.1:9001;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /var/www/clients/domain.com/www/public$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_script_name;
            include /etc/nginx/fastcgi_params;
    }
}

It servers my PHP files just fine. For added security I wanted to chroot my FPM instance, so I added the following lines to my conf file for this FPM instance:

# FPM config
chroot = /var/www/clients/domain.com

and changed the nginx config:

#nginx config for chroot
location ~\.php$ {
            fastcgi_pass 127.0.0.1:9001;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME www/public$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_script_name;
            include /etc/nginx/fastcgi_params;
    }

With those changes, nginx gives me a File not found message for any PHP scripts. Looking in the error log I can see that it's prepending the root path to my DOCUMENT_ROOT variable that's passed to fastcgi, so I tried to override it in the location block like this:

fastcgi_param DOCUMENT_ROOT /www/public/;
fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;

but I still get the same error, and the debug log shows the full, unchrooted path being sent to PHP-FPM.

What am I missing to get this to work?

I'm trying to set up jailkit on one of my servers which is running Debian 5. I created a new ssh user (bob) and a chroot directory for him (/var/www/bob). I gave the chroot the extshellplusnet and limitedshell options with the following commands:

jk_init -c /etc/jailkit/jk_init.ini -j /var/www/bob/ extshellplusnet
jk_init -c /etc/jailkit/jk_init.ini -j /var/www/bob/ limitedshell

And then I jailed him:

jk_jailuser -m -j /var/www/bob bob

When I try to ssh in as bob, it connects, I get the banner, and then it disconnects. My auth.log looks like this:

Aug 25 05:04:36 server sshd[29885]: Accepted password for bob from 123.45.6.7 port 50624 ssh2
Aug 25 05:04:36 server sshd[29885]: pam_unix(sshd:session): session opened for user bob by (uid=0)
Aug 25 05:04:36 server jk_chrootsh[29942]: now entering jail /var/www/bob for user bob (1001) with arguments 
Aug 25 05:04:36 server sshd[29885]: pam_unix(sshd:session): session closed for user bob

My non-jailed users work just fine, and I don't seem to be getting any permission errors. Any ideas?

I'm setting up a Tomcat app running on https://localhost:9443/ on Windows 2008 R2 and I want to put it behind a reverse proxy. I've installed the Advanced Request Routing 2 package from Microsoft, and on the main server node I see a new option called 'Advanced Request Routing Cache'. From all of the tutorials I've seen, I should be able to:

• Open up Advanced Request Routing Cache
• Click on 'Server Proxy Settings'
• Check 'Enable Proxy'
• Add a URL Rewrite Rule with the URL pointing to my tomcat app

I tried setting the URL Rewrite Rule at both the server node level and the site level, but each time I try to access the reverse proxy URL I just get a 404.

I saw that there was an extra option called 'Use URL Rewrite to inspect incoming requests', but if I check that box it wants a proxy server entered. No matter what I enter, the server then starts responding with 502 on all requests, not just the ones I wanted proxied.

Am I missing something here or does this not work the same between IIS 7.0 (which all the tutorials seem written against) and 7.5?

Possible Duplicate:
Can you help me with my software licensing question?

One of the projects I'm working on is looking like we're going to need to migrate from CentOS 5.4 over to something else (we need to run Postgresql 8.3+, and CentOS/RHEL only support 8.1), and one of the options will be Windows Server.

Since 2008 R2 is out that's what I'm looking at. I'll need to run Postgres and Tomcat and don't really require anything that Windows has like IIS (if I can run Server Core, even better!). The other kicker is it will be virtualized through VMWare ESXI 4.0 so that we have three separate boxes: development, Quality, and Production servers.

From a licensing standpoint though, and I good enough with just the Web Server edition? Am I right in assuming that will be three licenses? Or should I just jump up to Enterprise so that I get 4 VM licenses?

I'm looking at setting up automatic failover for Apache and MySQL. I'm planning on putting a small proxy server in front of two Apache boxes, and two MySQL boxes. Apache will rsync data from the master -> slave every so often, and MySQL will be set up in Master/Slave for replication. In the event of failure the backup box(es) could take over until the master is rebuilt.

The proxy server in front will just be run as a traffic cop with some sort of heartbeat software (I'm not looking for load balancing at this point). This way I don't have to worry about changing our firewall in case the main boxes go down. Is Linux-HA the best option or are there any suggestions?

We're running CUPS with about 10 different printers, and recently one of them started to jam. While we wait for tech support to bless us with a repair, is there a way to redirect all jobs from say Printer 1 to just print to Printer 2?

I know that I can use lpmove to move individual jobs, but I'd rather have something put into place to just automatically forward jobs until the printer is replaced.

I have a few Tomcat installs where there is only a single main application on them (in addition to things like Manager). Other than just changing the default Tomcat homepage to include a redirect to the app, is there a better way? Or, one better, how can I map http://domain.com:8080/app to just http://domain.com:8080 and leave the other apps (like Manager) alone?

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up:

# /etc/httpd/modsecurity.d/modsecurity_crs_15_customrules.conf
<LocationMatch "^/phpMA/">
    SecRuleEngine Off
</LocationMatch>

# /etc/httpd/modsecurity.d/modsecurity_crs_60.custom.conf
<LocationMatch '^/phpMA/*'>
    SecRuleRemoveById 950004
    SecRuleRemoveById 950005
    SecRuleRemoveById 950006
    SecRuleRemoveById 960010
    SecRuleRemoveById 960012
</LocationMatch>

From what I can find the first file should disable it, but it still trips, so I tried adding the rule IDs it is tripping to the 60 file, but it still complains.

I'm running the following packages on CentOS 5.3:

• mod_security-2.5.0-jason.2
• httpd-2.2.8-jason.3
• mod-php5-apache2-zend-ce-5.2.10-65

We have a Windows 2003 Active Directory domain called 'domain.com', which also happens to be the domain name of our website. Recently we switched to using our AD servers as our DNS servers but have run into a little snag. Boxes that were using their own SMTP servers now cannot send out mail because AD doesn't contain a DNS record according to 'dig':

[user@hostname]$ dig MX domain.com
; <<>> DiG 9.4.2-P2 <<>> MX domain.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41859
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;domain.com.             IN      MX

;; AUTHORITY SECTION:
domain.com.      3600    IN      SOA     win2003adserver.domain.com. hostmaster.domain.com. 6168 900 600 86400 3600

;; Query time: 3 msec
;; SERVER: 10.10.10.27#53(10.10.10.27)
;; WHEN: Mon Jul 27 12:42:44 2009
;; MSG SIZE  rcvd: 98

So what it's trying to do is, since there is no valid MX record, send mail through the primary AD server which isn't running SMTP. I should get back an MX record for mail.domain.com with a valid IP for the mail server.

What is the proper way to add an MX record in this situation? According to our Windows admin there is an MX record in the DNS for AD, but according to the above its not relaying it to anyone.

Solution

In this case the AD servers were doing exactly what they were told to do as there was no MX record entered for 'domain.com' that pointed to our mail server (Our AD Admin had entered in an MX record for the subdomain of 'mail.domain.com' instead of 'domain.com' as he didn't read the instructions on the screen for entering a new MX record).

I deleted the MX record and added a new one correctly and everything started working.

We recently got done doing a massive IP scheme change at work and since then I've noticed a few oddities. First, our setup:

IPCop firewall which has
    - Wireless network (completely segregated)
    - Firewalled DMZ
    - Internal network [eth0] (10.10.10.x)
    - OpenVPN network [tun0] (172.16.20.x)
    - Internet

Before the IP change, our OpenVPN network could talk to our internal network without any problem. Since the change we have a few servers that no longer want to talk across the boundary properly.

For example, I will connect to the VPN with 172.16.20.10 and try to talk to a server at 10.10.10.19. Running tcpdump I see the packets leave my machine (running wireshark), travel through tun0, travel through eth0, hit 10.10.10.19, and nothing comes back. Other servers work fine on the same network (10.10.10.8, for example, works fine) and I cannot find a common piece between them on what would cause some servers to just stop responding to some requests.

I checked things like hosts.(allow|deny), pf/iptables, etc, that would normally filter traffic but none of them have exclusion rules that would stop traffic like this.

Any ideas on where to go from here?

Solution

The boxes that were having the problem did indeed have bad gateways that got overlooked. Made the changes in the appropriate places and everything seems to be working!

Current situation:

• 2xESX 3.5 (Soon to be vSphere)
• 2xESXi 3.5

All four servers are running standalone. The two ESX servers are beginning to run out of hard drive space but still doing very well on the processing and memory fronts. We're not running any external iSCSI or SAN storage for the servers at all.

The ESX servers are also running Ultra320 SCSI drives which are beginning to get very pricey at low storage rates ($550 for 300GB!), so I want to shy away from just throwing more 'small' drives at the ESX servers knowing the hard drives will become rarer with time in the event of drive failure.

What is probably the best solution? Right now I'm looking at the DroboPros which will allow for more growth over a longer period of time, which looks nice for budgets, or at a Dell Poweredge 2950 with 2TB of storage (using 3 bays out of 6 in RAID 5) but still room to grow since it runs SATA for around $3400.

I'm also looking at trying to get vCenter and vMotion, but would there be any advantages to the above two solutions over each other? By switching to external storage I'm hoping to not have to replace these servers until they are maxed out on RAM usage or the CPU load is finally too great.

Update

I will be going with either the PowerEdge bumped up to support SAS drives or a PowerVault with SAS, with the intention to end up running our VMWare from the external storage. The DroboPro is nice but not a long term solution. Here's hoping I get the PowerVault!

Thanks for the great answers everyone!

I'm running OpenBSD's chrooted httpd process and for the last few days I'm getting random hangups that clear themselves without any intervention on my part. At first I thought it might be a resource problem as SSH was hanging at the same time, but have left 'top' running on the console which shows nothing out of the ordinary (memory usage is low, no high load, etc).

I managed to get my users to call me exactly when this happens instead of 20-30 minutes later, and noticed in my error logs the following:

Timeout
^@Timeout
^@Timeout
^@Timeout

That's all that is on the line. Sometimes the number of ^@Timeout's vary, but that is all that is sitting there. I've looked at the access logs to see if some of the potentially hanging processes like curl calls might be doing it, but I didn't see any correlation.

The site that is running in a custom PHP app that has, up until lately, not had any problems. No new code changes were pushed up at the same time this started happening.

Anyone else come across a situation like this, or have any ideas?

[Edit - 06-11-2009]

Looks like something else is going on outside of this server. The Timeout prints seem to happen randomly, but I think I'm seeing this same thing happen on a network level were connections are hanging.

Thanks for the input though!