Xiè Jìléi's questions

I have two different sites in one server: a.com and b.com.

If I use named virtualhost on ssl port, IE won't work.

So, I decided to use port 444 for SSL for b.com. However, it seems all browsers give error message:

Chrome: Error 107 ssl protocol error
Firefox: Error code: ssl_error_rx_record_too_long
Epiphany: SSL handshake failed

Umm.. I don't know why, but I do have seen some web sites can be accessed like https://example.com:1443.

Or did I miss something?

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    NameVirtualHost *:443
    NameVirtualHost *:444
    Listen 443
    Listen 444
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
    Listen 444
</IfModule>

b.site:

<VirtualHost *:444>
    ServerName  www.b.com:444
    ServerAdmin [email protected]

    LogLevel  error
    ErrorLog  /var/log/apache2/b_error.log
    CustomLog /var/log/apache2/b_access.log combined

    DocumentRoot ...

    <Directory ...>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/b.crt
    SSLCertificateKeyFile /etc/ssl/private/b.pem

</VirtualHost>

CA config file to generate the certificate:

[ca]
default_ca              = CA_default

[CA_default]
x509_extensions         = root_ca_extensions

[req]
default_bits            = 4096
default_keyfile         = 
distinguished_name      = req_distinguished_name
attributes              = req_attributes
prompt                  = no
x509_extensions         = v3_ca
req_extensions          = v3_req

[req_distinguished_name]
C     = ...
ST   = ..
O     = ...
OU   = ..
CN   = ...
emailAddress        = [email protected]

[req_attributes]

[root_ca_extensions]
basicConstraints        = CA:true

[v3_ca]
basicConstraints        = CA:true

[v3_req]
basicConstraints        = CA:false
keyUsage                = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName          = @alt_names

[alt_names]
DNS.1 = b.com
DNS.2 = www.b.com

I can make a single SSL certificate for several different domain names:

www1.example.com
www2.example.com
www3.example.com

But *.example.com doesn't work.

How can I make a single SSL certificate for all sub domains within .example.com?

    X509v3 extensions:
        X509v3 Basic Constraints: 
            CA:FALSE
        X509v3 Key Usage: 
            Digital Signature, Non Repudiation, Key Encipherment
        X509v3 Subject Alternative Name: 
            DNS:*.example.com

It's simply not matched by any sub-domain under example.com by the browser.

It seems fsck.ext4 quit very soon, I guess it only checks the journal logs, and do nothing if the journal is clean. Is it? How to force it to check the whole file system? I've tried the -f option, but it quits again said it's clean very quickly.

Recently, my Ubuntu server had a disk failure, after a LiveCD & fsck.ext4, it seems many inodes are lost. Most of them should be program files of installed apt packages.

Before I'm going to reinstall the whole system, I need to reboot the server and run some server applications to backup some data&configurations. And, sure enough, I couldn't boot the server again because some files are lost.

I think something like apt-cache might remember those program files installed from deb packages. I want it scan over the disk and found out which program files are missing, and then refetch them from the ubuntu repository.

This may just look like the Windows sfc utility, which just re-copy all incorrect versioned system files from the CDROM. But I'm not sure if aptitude support this kind of recovery.

I've just upgraded my EC2 instance to Natty, using do-release-upgrade.

However, the block devices /dev/sdf, /dev/sdg, ... are no longer existed.

(I've already attached EBS to these devices, though.)

Say, I have a big database globalclients which is very very big.

Now, I divide this big database to 100 sub-databases, as:

chinaclients
japanclients
koreaclients
indiaclients
brazilclients
etc.

Each one running in the corresponding country.

Now, I want to do some analysis over all databases. I want to merge them all into the master-database at first: some tables are merged entirely, and some tables are aggregated before merging:

customer_contact:   merged entirely
product_sales:      `select sum(sales), ... group by month` before merging

Do you have any suggestion? What's the english terms related to this technique? "synchronize" or something else?

It will be a great bonus if I can upload only the difference from the sub-database.

I don't know whether I can do it in database-level or not, "synchronize" the distributed databases in Java would be a complex task. is there any support by PostgreSQL-8.4?

I want to setup an DNS record which contains only digits, for example:

www1                    A       1.2.3.4
1                       CNAME   www1

However, the pure number seems not work.

I know some sites which use integer in their host names, something like 400.5432.somefax.com, so I guess maybe I should escape the numbers?

EDIT

It seems BIND do support labels of pure numbers:

$ dig @localhost 1.example.com
...
1.example.com.     43200  IN  CNAME  www1.example.com.
www1.example.com.  43200  IN  A      1.2.3.4
...

However, when I use the Google DNS server (8.8.8.8), it's failed.

; <<>> DiG 9.7.3 <<>> 1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 20866
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;1.example.com.         IN  A

;; AUTHORITY SECTION:
example.com.        1205    IN  SOA root.example.com. admin.example.com. 5 3600 600 43200 3600

;; Query time: 112 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue May  3 19:09:39 2011
;; MSG SIZE  rcvd: 94

However, Google DNS server should be no problem with number labels, because it can resolve, for example, 83592583.qzone.qq.com:

; <<>> DiG 9.7.3 <<>> 83592583.qzone.qq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18687
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;83592583.qzone.qq.com.     IN  A

;; ANSWER SECTION:
83592583.qzone.qq.com.  600 IN  CNAME   qq.com.edgesuite.net.
qq.com.edgesuite.net.   9439    IN  CNAME   a1574.b.akamai.net.
a1574.b.akamai.net. 18  IN  A   60.254.175.65
a1574.b.akamai.net. 18  IN  A   60.254.175.64

;; Query time: 328 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue May  3 19:12:10 2011
;; MSG SIZE  rcvd: 134

So, BIND9 is okay, Google DNS is okay, my zone config is okay, I can dig @localhost 1.example.com which gives the correct answer. But I can't dig @8.8.8.8 1.example.com, (neither 8.8.4.4), Now I stuck.

For example, I want squid to cache HTTP contents only for *.archive.ubuntu.com, which is blocked by firewall, and don't cache for other domains.

And, only LAN (192.168.0.0/16) users can access the cached contents, but all users are allowed to access non-cached contents.

User-IP              Dest-Domain                    acl             Expect   
----------------     -----------------------       ------      -------------------------                  
192.168.0.0/16       *.archive.ubuntu.com          allow       Cache Proxy, Fast
192.168.0.0/16       *.other                       allow       Pass Proxy, Slow     
Other                *                             allow       Pass Proxy, Slow

It seems like OpenLDAP will prefer to using slapd-config(5) instead of slapd.conf(5). But I don't know how to start with slapd-config(5) because I don't know how to set a root password for it.

So I'm back using slapd.conf(5), with the following /etc/ldap/slapd.conf:

database bdb
suffix "dc=mycompany,dc=net"
rootdn "cn=root,dc=mycompany,dc=net"
rootpw secret
directory /var/lib/ldap

And alternate the /etc/default/slapd to use /etc/ldap/slapd.conf instead of /etc/ldap/slapd.d. However, it can't start then:

sudo /etc/init.d/slapd restart
Stopping OpenLDAP: slapd.
Starting OpenLDAP: slapd - failed: 
Unrecognized database type (bdb)

But, I found their is a bdb backend:

$ ls -al /usr/lib/ldap/*bdb*
lrwxrwxrwx 1 root     21 2010-12-02 18:50 back_bdb-2.4.so.2 -> back_bdb-2.4.so.2.5.6
-rw-r--r-- 1 root 182560 2010-11-20 02:29 back_bdb-2.4.so.2.5.6
-rw-r--r-- 1 root   1106 2010-11-20 02:28 back_bdb.la
lrwxrwxrwx 1 root     21 2010-12-02 18:50 back_bdb.so -> back_bdb-2.4.so.2.5.6

There are two types of glassfish distribution: the executable installer and zip archive.

I have to use the zip archive. But the admin console doesn't work, it only shows a blue footer div, the resource /theme/META-INF/com_sun_faces_ajax.js is not found and error in the page:

http://localhost:4848/:

...
<script type="text/javascript">
    if (true) {
        //submitAndDisable(document.getElementById('loginButton'), 'Login');
        document.getElementById('loginButton').form.submit();

        // ERROR HERE:
        //    Uncaught TypeError: Cannot read property 'form' of null

    }
</script>

when installed by extract from zip archive, but it works very well if install by the executable installer.

I have setup BIND9 to resolve domain names used by my work group, it contains:

• public domain names: *.my-company.com
• our own TLD *.top

but I don't know how to setup clients to add an extra DNS server.

I'll call my DNS server as DNS-mine, and the default DNS servers returned from ADSL as DNS-system.

I must not forward DNS-system through DNS-mine for network-speed reasons and user preferences. (Users are distributed over the world, and DNS-mine is sat in US).

I have tried several ways, as follows:

1. Add IP4 of DNS-mine (1.2.3.4) to resolv.conf:

   nameserver 8.8.8.8   # DNS-system
   nameserver 1.2.3.4   # DNS-mine
   

   however, DNS-mine is never queried. as resolv.conf(5) said the second nameserver is only queried when the first one was timeout, however DNS-system here does never timeout.

   and resolv.conf is reset by network manager, too.

2. Add zone '*.top.my-company.com' to DNS-mine, and make it the same as .my-company.com zone. Then Change /etc/hostname to a1.my-company.com, a2.my-company.com, etc. in each client. This works as:

   www.top -> www.top.my-company.com == www.my-company.com
   

   However, I must add all client host names in DNS-mine at the same time, otherwise the client stucks:

   127.0.0.1 a1.my-company.com
   127.0.0.1 a2.my-company.com
   127.0.0.1 a3.my-company.com
   

   The clients don't have WAN IP(s), as they are behind the firewall. And new clients may join in in any time.

3. The same as above, but don't change /etc/hostname, add to /etc/resolv.conf instead:

   domain my-company.com
   

   This works very well, however, the /etc/resolv.conf file is automatically reset by network manager.

4. Add all names *.top to /etc/hosts file, then just ignore DNS-mine, this works very well, but hard to maintain.

I have a lot of data (svn repository and postgresql database) in EC2 instance, yesterday the server doesn't respond to http requests, and I `sudo reboot', after that the server couldn't boot up again, what should I do?

The system log in the AWS console shows nothing output from the instance, and the most recent sys log is:

Ubuntu 9.10 domU-12-31-39-00-A0-06 tty1 

domU-12-31-39-00-A0-06 login: [1796075.232506] INFO: task rsyslogd:22423 blocked for more than 120 seconds. 

[1796075.232522] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.232509] INFO: task pdflush:17 blocked for more than 120 seconds. 

[1796195.232525] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.232639] INFO: task kjournald:296 blocked for more than 120 seconds. 

[1796195.232646] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.232728] INFO: task rsyslogd:22423 blocked for more than 120 seconds. 

[1796195.232735] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.232858] INFO: task amuled:874 blocked for more than 120 seconds. 

[1796195.232865] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.232962] INFO: task master:1716 blocked for more than 120 seconds. 

[1796195.232968] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.233065] INFO: task qmgr:1724 blocked for more than 120 seconds. 

[1796195.233071] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.233190] INFO: task java:4554 blocked for more than 120 seconds. 

[1796195.233196] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.233296] INFO: task java:4745 blocked for more than 120 seconds. 

[1796195.233302] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

[1796195.233353] INFO: task java:11614 blocked for more than 120 seconds. 

[1796195.233360] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 

It seems I can't do anything now, I can't SSH into it, and can't operate in single user mode, too. Any idea??

I can't restart my EC2 instance, and there are important data in both the EC2 instance and external EBS volume.

Now I want to mount the EBS in my new temporarily created EC2 instance, and fix that old EC2 instance later. I detached the EBS volume in the AWS Console, but the EBS state is still remains in `i-6da1cf05:/dev/sdf (detaching)' state and can't be attached to the new EC2 instance.

What can I do now?

Many say that, if you have a 2GB RAM, you should configure a 2GB or more swap. FWIK the hibernation may need the same size swap to persist memory when power off, but generally, if you got a big RAM, you even don't need swap at all, isn't it?

For Linux users, when you install Linux without swap, the installer will warn you that you didn't have swap mount. No I just don't need it because my RAM is just big enough, right?

Just a few hours after having made some changes in the HTML of my site, I found that Google had updated its search result against my website. The Internet is so huge, how did the Google crawler do that? Doesn't it use too much bandwidth?

For example I want to set up a forward proxy to forward HTTP requests to a.com, b.com, c.com to a.mirror.com, b.mirror.com, c.mirror.com.

Currently I have to configure 3 vhosts as:

host-a: 
  ServerName a.com
  ProxyPass / http://a.mirror.com/
host-b: 
  ServerName b.com
  ProxyPass / http://b.mirror.com/
host-c: 
  ServerName c.com
  ProxyPass / http://c.mirror.com/

Is there any way to rewrite the domain part of http request? as:

ProxyPassMatch http://(.*).com/ http://$1.mirror.com/

I wonder if I must do it by RewriteRules, but I don't know how to write the rule exactly and the performance of RewriteRule v. ProxyPass, but performance isn't a big problem.

I know how setgid works, but I don't know why it is designed, is there any example to illustrate what problems it solves?

Here is the code:

(root:)

# mkdir /test
# cp /bin/bash /test/sbash
# chmod a+s /test/sbash

(user1:)

$ cd /test
$ ./sbash
$ mkdir trycreate
mkdir: cannot create directory `trycreate': Permission denied

And bash scripts with setuid bit set not work, either.

By the way, my setuid perl script works:

test.pl: (with setuid bit set, owner=root)

#!/usr/bin/perl
mkdir('/test/tryperlcreate') or die 'failed'; 

execute test.pl by user1 will create the directory owned by root.