Home / user-284891

Nicolas Guérinet's questions

Martin Hope
Nicolas Guérinet
Asked: 2020-09-16 10:03:46 +0800 CST
  • 0

I noticed that when I create a 301 redirection using nginx (rewrite, return 301), I get the following HTML body:

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>

I would like to get rid of the HTML body of this 301 redirect generated by Nginx. Facebook and twitter got rid of those HTML bodies of their 301 redirect long time ago. It is a way to save some unsolicited bytes during 301 redirects.

So, I guess it is possible to create the HTTP header fields of the 301 redirect manually without calling rewrite or return 301. If I call "rewrite" or "return 301" in a location block of nginx, it will also generate the HTML body that I don't want. I can't modify the configuration files because I use Plesk. The Nginx configuration files are automatically generated.

So, I guess it is possible to manually create the following HTTP header fields with NGINX in a location block:

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 15 Sep 2020 17:48:13 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://bloup.com/

How would you do it?

nginx 301-redirect
Martin Hope
Nicolas Guérinet
Asked: 2018-07-23 23:39:14 +0800 CST
  • 0

I would like my web server to refuse to answer queries to a domain name. In Iptables I have added to my iptables file: 

-A INPUT -p tcp --dport 80 -m string --string "Host: mydomain.example" --algo bm -j REJECT

However, no rejection packet is received. I get a timeout from the client side. I would like the other end to be aware that the web server blocks this domain.

on the client side, right now I get: 

MacBook-Pro-de-nicolas:~ nicolasguerinet$ curl mydomain.example
curl: (56) Recv failure: Operation timed out

I would like a "connection refused" error.

iptables
Martin Hope
Nicolas Guérinet
Asked: 2016-04-25 02:56:17 +0800 CST
  • 6

On one of my web server the loopback route is in 2nd position and usually it is in 3rd position on other server when displaying the routes:

>ip route show

Results on what is displayed on one centos 7 server:

default via 85.x.x.254 dev enp32s0 
85.x.x.192/26 dev enp32s0  proto kernel  scope link  src 85.x.x.201 
169.254.0.0/16 dev enp32s0  scope link  metric 1002

Result for another centos 7 server:

default via 217.x.x.1 dev em1 
169.254.0.0/16 dev em1  scope link  metric 1002 
217.x.x.0/24 dev em1  proto kernel  scope link  src 217.x.x.216

Does it make any differences? Does it have any consequences? Can anyone explain why it happens?

linux centos networking
Martin Hope
Nicolas Guérinet
Asked: 2016-04-21 12:34:32 +0800 CST
  • 2

I wonder whether my 2 nameservers need a PTR record. As you may know the PTR record or reverse DNS is important for mail server hostname as it improves chances for your outgoing emails to be accepted by major email providers.

I also wonder if there are any cases where the PTR records (aka rDns) are checked against nameservers.

I have checked PTR records for the nameservers of big online companies and found that they all have a PTR record in place for all of their nameservers. (I think about the nameservers from Cloudflare, Cisco, Microsoft among others...). Note that i talk about nameservers and not about mail servers.

domain-name-system reverse-dns nameserver
Martin Hope
Nicolas Guérinet
Asked: 2016-03-29 22:57:18 +0800 CST
  • 0

In the context of a web server with HTTP, HTTPS, IMAPS, POP3S, SMTPS, SFTP and WebDav services, is it necessary to get a SSL certificate for the FQDN hostname of a server (example: something.example.com), if we never use the FQDN hostname for HTTPS (like: https://something.example.com)?

Can't we just install an SSL certificate for the "root" domain (like example.com) and use it for all secured services?

ssl
Martin Hope
Nicolas Guérinet
Asked: 2016-02-15 09:16:51 +0800 CST
  • 4

I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7. However, with firewalld, i have discovered i am unable to

  • drop packets in invalid states
  • create a set of rules to protect from portscan
  • create a rule against SYN attacks (meaning looking for packets with syn flags)
  • Use hash limit to limit number of connections per second per IP

Am i right to think that firewalld has way less possible features as compared to Iptables?

iptables
Martin Hope
Nicolas Guérinet
Asked: 2015-10-11 20:40:59 +0800 CST
  • 2

When i go to my local port range on Debian 7, i can see that my ephemeral port range is:

cat /proc/sys/net/ipv4/ip_local_port_range
32768   61000

My /etc/sysctl.conf is empty.

Normally that would mean that all requests coming out from this nameserver resolver should use ports in that range. However, using tcpdump, when i look at a DNS request & answer created with dig, I can see that the request can use a sending port as low as 1500.

For instance, in the following tcpdump example (tcpdump udp and port 53 and host server.domain), the request came from port 15591. It is way below the server lowest port limit for ephemeral ports that we saw before: 32768. In other words, using dig, DNS requests are out of the local port range.

11:57:33.704090 IP baremetal.15591 > M.ROOT-SERVERS.NET.domain: 41939% [1au] A? r.arin.net. (39)
11:57:33.704400 IP baremetal.41573 > M.ROOT-SERVERS.NET.domain: 40945% [1au] A? t.arin.net. (39)
11:57:33.704541 IP baremetal.22658 > M.ROOT-SERVERS.NET.domain: 44090% [1au] AAAA? t.arin.net. (39)
11:57:33.705295 IP baremetal.13277 > M.ROOT-SERVERS.NET.domain: 42356% [1au] A? v.arin.net. (39)
11:57:33.705499 IP baremetal.48755 > M.ROOT-SERVERS.NET.domain: 32253% [1au] A? w.arin.net. (39)
11:57:33.705639 IP baremetal.55309 > M.ROOT-SERVERS.NET.domain: 64660% [1au] AAAA? w.arin.net. (39)
11:57:33.705812 IP baremetal.56652 > M.ROOT-SERVERS.NET.domain: 43023% [1au] A? y.arin.net. (39)
11:57:33.706012 IP baremetal.26383 > M.ROOT-SERVERS.NET.domain: 42377% [1au] AAAA? y.arin.net. (39)
11:57:33.706172 IP baremetal.12895 > M.ROOT-SERVERS.NET.domain: 13206% [1au] AAAA? z.arin.net. (39)

I wonder what could have change the port range of ephemeral ports on my Debian 7 & 8. Only thing that is perhaps worth to mention. I have used on one of them ifenslave & one uses ifenslave to bond two ethernet ports.

The resolver is the server itself and 

#cat /etc/resolv.conf
nameserver ::1

but it does exactly the same with nameserver 127.0.0.1 because ipv4 & ipv6 shares /proc/sys/net/ipv4/ip_local_port_range (reference) & also I have tried it.

To avoid confusion with IPv6, I have decided to use Ipv4 only. I have only added nameserver 127.0.0.1 to /etc/resolv.conf.

Results below are with nameserver 127.0.0.1 in /etc/resolv.conf only.

Then, I issued rndc flush to flush the DNS cache from resolver and dig google.com

I opened a second terminal window and typed tcpdump udp and port 53:

Lots of records but I noticed, whatever the request (A,PTR...) & receiving host, DNS requests CAN be issued from port lower than 32768 

>strace -f dig www.google.com 2>&1 | egrep 'sendmsg|recvmsg|connect|bind'
open("/usr/lib/libbind9.so.80", O_RDONLY) = 3
[pid 10651] bind(20, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
[pid 10651] recvmsg(20, 0x7f5dd95cab60, 0) = -1 EAGAIN (Resource temporarily unavailable)
[pid 10651] sendmsg(20, {msg_name(16)={sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.1")}, msg_iov(1)=[{"\251\261\1\0\0\1\0\0\0\0\0\0\3www\6google\3com\0\0\1\0\1", 32}], msg_controllen=0, msg_flags=0}, 0 <unfinished ...>
[pid 10651] <... sendmsg resumed> )     = 32
[pid 10651] recvmsg(20, {msg_name(16)={sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.1")}, msg_iov(1)=[{"\251\261\201\200\0\1\0\1\0\4\0\4\3www\6google\3com\0\0\1\0\1"..., 65535}], msg_controllen=32, {cmsg_len=32, cmsg_level=SOL_SOCKET, cmsg_type=0x1d /* SCM_??? */, ...}, msg_flags=0}, 0) = 184

This issue is related to my firewall. Since ephemeral ports can be issued from (my own guess) 1024 to 65000, it means that I can't block input traffic coming from ports higher than 1024 just like in the old days. If I do this I will slow down or block DNS resolution.

UPDATE: thank you, I understand that if I want to use a server as a DNS resolver it means that I have to consider that UDP port range 1024:65535 is the ephemeral port range.

linux
Martin Hope
Nicolas Guérinet
Asked: 2015-05-03 11:09:10 +0800 CST
  • 2

When i perform a strace on apache process, i see many gettimeofday before & after GET request, even when Apache returns a static file like an image file. It results in a long downtime period before Apache 2.4 (with php 5.6, fcgid) answers the GET request.

 1616       0.000048 read(156, "GET / HTTP/1.1\r\n", 8000) = 16
1616       0.000099 gettimeofday({1430592206, 931114}, NULL) = 0
1616       0.000044 gettimeofday({1430592206, 931156}, NULL) = 0
1616       0.000035 read(156, 0x7f01d4007018, 8000) = -1 EAGAIN (Resource temporarily unavailable)
1616       0.000042 poll([{fd=156, events=POLLIN}], 1, 7915439 
1670       0.020724 <... epoll_wait resumed> {}, 100, 100) = 0
1670       0.000039 gettimeofday({1430592206, 951998}, NULL) = 0
1670       0.000037 gettimeofday({1430592206, 952034}, NULL) = 0
1670       0.000033 gettimeofday({1430592206, 952066}, NULL) = 0
1670       0.000032 epoll_wait(155, {}, 100, 100) = 0
1670       0.100265 gettimeofday({1430592207, 52366}, NULL) = 0
1670       0.000041 gettimeofday({1430592207, 52405}, NULL) = 0
1670       0.000033 gettimeofday({1430592207, 52437}, NULL) = 0
1670       0.000033 epoll_wait(155, {}, 100, 100) = 0
1670       0.100324 gettimeofday({1430592207, 152804}, NULL) = 0
1670       0.000066 gettimeofday({1430592207, 152865}, NULL) = 0
1670       0.000073 gettimeofday({1430592207, 152941}, NULL) = 0
1670       0.000060 epoll_wait(155, {}, 100, 100) = 0
1670       0.100251 gettimeofday({1430592207, 253247}, NULL) = 0
1670       0.000039 gettimeofday({1430592207, 253284}, NULL) = 0
1670       0.000032 gettimeofday({1430592207, 253316}, NULL) = 0
1670       0.000032 epoll_wait(155, {}, 100, 100) = 0
1670       0.100241 gettimeofday({1430592207, 353597}, NULL) = 0
1670       0.000061 gettimeofday({1430592207, 353653}, NULL) = 0
1670       0.000071 gettimeofday({1430592207, 353727}, NULL) = 0
1670       0.000045 epoll_wait(155, {}, 100, 100) = 0
There are a lot of them before the server actually returns the response to GET.

What i have done:

  • I have setup ExtendedStatus off in httpd.conf just in case.
  • I have followed the advice of red Hat team by doing a 
    echo "kernel.vsyscall64 = 2" >> /etc/sysctl.conf
    & editing sysctl afterwards.
  • echo 1 > /proc/sys/kernel/vsyscall64

That slightly increased the reponse speed of Apache 2.4 but it is still slow and there is a lot of Gettimeofday. I have no modsecurity and only standard modules of Apache. Nevertheless, i suspect a module.

I have checked whether it was ioncube 5.0.2 but it wasn't.

Is it normal? If no, do you think it could come from a module from Apache?

edit: it looks like it matches with 3 timestamps copied to 3 logs, writing down three errors/warnings.

thank y.

linux