I get the following error when I run bower:
bower ESUDO Cannot be run with sudo
Thing is, I'm not running bower with sudo. The command I run is:
bower install foo
or
bower search cats
I am logged in as root to an Ubuntu 12.04 server but I am not using sudo. What gives? How do I get bower working?
How do I determine which file is the newest from a remote server that I am connected to via SFTP? My goal is to retrieve a specific file each day, via SFTP. The steps I will follow are:
Connect to server via SFTP
Retrieve the name of the file I need <-- need help with this step
Download it
I can figure out how to connect via SFTP from a script but I am not sure about the best way to go about determining which file to download.
For example, there are many files on the server named like so:
ABC-Alpha-Sun-May-12-abc123.xml.gz
ABC-Beta-Sun-May-12-abc123.xml.gz
I want to retrieve only that day's Alpha file. I assume that I would check the name for "May-12" to know if this is today's file? Or perhaps I should be checking the file creation date or modified date?
How would I actually retrieve the filename? Perhaps I retrieve the names of all of the files and then sort them somehow?
What would you recommend as the best way to achieve my goal?
I have an Apache server based Wordpress site that rewrites URLs to be "pretty".
When I include a query parameter in the url the site breaks.
So:
http://mysite.com
works fine but:
http://mysite.com/?anything
Does not... loading the page contents but failing to load some plugins that I use on the home page.
If you can explain why this happens I would love to hear it. Failing that I would just like to strip off the query parameters entirely so that a request to:
http://mysite.com/?anything
would behave just like the request to:
http://mysite.com
Either through redirection or through simply removing the query string.
Here is my current .htaccess:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# Handle redirection from https to http
RewriteCond %{HTTPS} =on
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [L,R=301]
# End https to http redirection
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{QUERY_STRING} ^index.php$
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
The problem: I cannot get my site to redirect from https to http.
OK, there are a number of solutions offered on this but none seem to be working for me. To establish a few things, I already have .htaccess working fine on this site so needing to set AllowOverride is taken out of the equation.
The most basic I have seen is to add something like:
RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}
...to my .htaccess file. However this does nothing at all... as if the condition is not being met. After setting that and visiting https://mysite.com I am not redirected to http://mysite.com as I would expect rather I simply get through to https://mysite.com.
What is the cause of this? My expectation would be that with the above in my .htaccess file and with .htaccess files working fine on my site, that when I visit any https url I will be redirected to it's http equivalent.
More info
On Staging Server On my staging server adding the above to htaccess sends me to a url with a parameter appended to it like http://mystaging-site.com/?ysid=2pnd073423ra966tihf22rfr9a2
On Prod Server A quickie test on production results in an apache error page that says the page has been moved and there ws a 500 server error.
The specific of the error message are:
Found
The document has moved here. <--- this link simply points to the same page I am already on
Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.
Here is the existing htaccess:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www.mysite.com [NC]
RewriteRule ^(.*)$ http://www.mysite.com/$1 [R=301,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
And the following fails:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} =on //(with or without the equals symbol this fails)
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}
RewriteCond %{HTTP_HOST} !^www.mysite.com [NC]
RewriteRule ^(.*)$ http://www.mysite.com/$1 [R=301,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Why is this cron job executing repeatedly over time and what can I do to stop it?
I have a cron job that is supposed to run at 4 each morning. It hits a php script that executes some daily data analysis and under normal conditions runs once (taking about 2-3 minutes to complete) and quits. It has been working but lately it is running amuck right about the time the server crashes. I investigated and found the following. The crontab entry looks like this:
* 4 * * * /usr/bin/wget -q -O /dev/null 'http://123.456.78.90/index/thing?param=1'
In my log file I see:
123.456.78.90 - - [28/Nov/2012:04:00:01 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4181 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:04:01:01 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4181 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:04:02:01 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4181 "-" "Wget/1.12 (linux-gnu)"
// and then later it ends with (note that it isn't trying every minute now)
123.456.78.90 - - [28/Nov/2012:05:28:09 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4182 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:05:29:36 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4182 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:05:29:00 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4182 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:06:06:51 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4181 "-" "Wget/1.12 (linux-gnu)"
123.456.78.90 - - [28/Nov/2012:06:06:53 -0800] "GET /index/thing?param=1 HTTP/1.0" 200 4181 "-" "Wget/1.12 (linux-gnu)"
Why would it show repeated runs like this? Is it not reaching something so it keeps trying? Any assistance is appreciated as this multiple runs thing is new to me.
I have created a new user (foo) and when he logs in via ftp he cannot edit the files in the directory to which he has access.
In the directory he can log into ls -l gives me:
-rw-rw-r-- 1 root www-pub 6427 Nov 17 04:21 index.html
The user belongs to the group www-pub. Here is the output of cat /etc/group to demonstrate that he is indeed in that group:
...
www-pub:x:1001:ftpuser,www-data,foo
foo:x:1002:
*edit the permissions on the containing directory are:
drwxrwsr-x 5 root www-pub 4096 Nov 17 02:53 thecontainingdir
and the one above that:
drwxrwsr-x 49 root www-pub 4096 Nov 16 02:40 thenextdirup
So since he can log in via ftp and since the file he needs to edit has the correct permissions to let the group www-pub read and write the file and he is a member of that group, why can't he edit it (or upload anything)?
Only when I change the file to 777 can he edit it. It's as if he's NOT in the group... but he is! What's going on?
Apache failed and Monit did not restart it as expected. The error in monit's log is:
Error opening Monit id file '/root/.monit.id' for writing-Cannot allocate memory
The problem is that Apache went down due to a lack of memory so... is there simply nothing to be done in such a case? The lack of memory killed both the process and the thing monitoring that process.
Anyone know of any strategies for working with such a situation in Monit?
I set up a new instance of Ubuntu 12.04. This has, of course, the root user. I have apache running and it has it's own user and group and I created a single ftp user as well (that has it's own user and group). I also created a new group that I thought I had set up to contain the apache and the ftp user to upload/create/manage files.
So now, in my web root and with regard to users and groups, I have something that looks like this:
-rw-r--r-- 1 root www-pub 22 Jul 30 06:21 index.html
drwxr-sr-x 5 www-data www-data 4096 Jul 30 06:26 test
drwxr-sr-x 8 ftpacct www-data 4096 Jul 30 06:03 stuff
index.html was created by root (via ssh), test dir was created by apache and stuff dir was created by the ftp user.
(Additionally, www-data and ftpacct both belong to the group www-pub.)
My problem: if a file or dir is owned by apache (www-data) it is not modifiable by the ftp user (ftpacct) and vice versa. I can give the element 775 permissions and THEN it is editable as all users are in the same group but this seems insecure (maybe it isn't? I'm of the impression that anything more than 755 isn't a good idea).
So what is the solution? How can I make it so that files uploaded by ftpacct can be modified by user www-data and so that files created by that user can be modified by ftpacct? Or should I even be thinking like this?
Can I do this or is this permissions setup just not the best way to do things?
I have a standard Ubuntu install. Apache web root is /var/www.
I want to host my "main" site and a handful of others.
Normally I would put the files for mysite.com right in the web root. However, if I want to host multiple sites that seems like it could get messy. It seems like I would end up with a structure like:
My "main" site's files:
/var/www/index.html
/var/www/images/
/var/www/js/
etc...
and then my virtual sites like:
/var/www/somesite/ #somesite's files in here
/var/www/foobar/ #foobar's files in here
How should I be organizing such a setup? Mixing files from the main site with directories for virtualhost sites seems wrong and messy. I thought about putting my "main" site into its own directory in the webroot (like "somesite" and "foobar" are above) but then people visiting my IP address would get the web root without any site files in it. Should I do this and then redirect anything to the main IP to the "main" site's dir? Maybe with htaccess? Maybe in the apache configuration somewhere?
How would you approach this?
What I ended up doing (thanks to the suggestions below, all of which were helpful)...
Here is what the config file (/etc/apache2/sites-enabled/default) had originally:
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
By changing it to:
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/mysite/public
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www/mysite/public>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
I was able to get visits to go to "mysite.com" (I have the public files served out of the public directory so I can have some system files up one level and not web accessible)
I then set up another site at next.mysite.com by creating a new config file in /etc/apache2/sites-enabled/nextconfig that looks like:
<VirtualHost *:80>
DocumentRoot /var/www/next
<Directory "/var/www/next">
allow from all
Options +Indexes
</Directory>
ServerName next.mysite.com
</VirtualHost>
Looking to upgrade our aging and clunky Windows development server setup. We have a small group (5 people, all working remotely) that do PHP and Javascript web development.
The options are dizzying. Cloud, Dedicated, Colocation, Managed. And the prices all over the place (with Cloud pricing the hardest to nail down).
What would you do? Cloud seems good for things like on-demand scaling and resource allocation but this shouldn't be an issue with our small development environment. It would only be us and clients ever needing to use the server so scaling isn't an issue at all. Additionally, we can manage our own server (and would prefer to, in fact) which makes me think Managed is out. Colocation is probably more expensive than we would prefer so... Dedicated? Any other options I am not thinking of here? Am I off on cloud? Is it a better solution than I am assuming?
We essentially want a linux server (SSH access and all the goodness that comes with managing your own linux server) where we can manage resources ourselves, setup persistent testing and dev environments and have plenty of resources to keep things fast and efficient.
What do you say, Serverfault?
Visiting all of the following sends you to the login screen:
http://mysite.com/admin/configuration.php
http://mysite.com/admin/login.php
However if you visit (note the last two portions of the url string are both .php):
http://mysite.com/admin/configuration.php/login.php
You can see the configuration screen and all of its data!
Further, if you append some GET variables you can even get editable fields:
http://mysite.com/admin/configuration.php/login.php?cID=1&action=edit
What is going on here?
I should note that this is on site using an absolutely horrible shopping cart called oscommerce. The code is a nightmare to deal with but I am stuck with it for now.
A fix based on vstm's excellent and accurate comment below:
This would go just before the check to see if $current_page != FILENAME_LOGIN (around lines 141-143 in /admin/includes/application_top.php). Mind you this is just an emergency patch as the real solution is to never use oscommerce as it is about as secure as a hooker's belt.
//$current_page = basename($PHP_SELF); //this is the default
$current_page = basename($_SERVER['SCRIPT_NAME']); //change that default to this
if ( ($current_page == FILENAME_LOGIN) && !tep_session_is_registered('redirect_origin') ) {
$current_page = FILENAME_DEFAULT;
$HTTP_GET_VARS = array();
}
If anyone tries this don't forget that the redirect_origin session var might already be set so this will appear to not work. Just unset it and try again.
When I start openvpn on the server with:
sudo openvpn /etc/openvpn/server.conf
It works and I can connect my client to it.
When I start it with:
sudo /etc/init.d/openvpn start
It appears to work as I see:
* Starting virtual private network daemon(s)...
* Autostarting VPN 'openvpn': missing /etc/openvpn/openvpn.conf file !
But I cannot connect the client to it.
Checking the port shows it as "closed" (in the sense that nothing is listening there... it is not closed by the firewall) in the latter case while "open" in the former.
So where is the disconnect? Is init.d not starting what I thought it would? Is it not loading the correct conf file (but then why do I not need to load openvpn.conf when I start the server directly)? Am I missing a parameter somewhere?
EDIT: Reason behind the solution
Examining the init.d script as suggested by JeffG showed it was getting the $NAME of the conf file from:
NAME=${NAME%%.pid}
Which then looks for:
$CONFIG_DIR/$NAME.conf
This made: NAME=openvpn so then the script went looking for openvpn.conf which does not exist as I named the file server.conf (which is how the instructions on the openvpn site say to name the file). Simply copying that file over to be named as the init.d script wanted (Hyppy's solution) fixed the problem.
Our MySQL log displayed a warning on restart about 2 root users not having passwords.
I went into MySQL and checked all users:
mysql> select * from mysql.user;
and see:
Host | User | Password
localhost root *76685yt868itetc
web12-b0 root
127.0.0.1 root
First off, why are there 3 root users (and do we need 127.0.0.1 since we have localhost)?
Second, why would two of them not have passwords set?
Third, do the web12-b0 and 127.0.0.1 hosts have full root access without having to use a password (as it appears)?
Fourth, is there some valid reason for this or should I suggest the admin put passwords on those two hosts?
Thanks for your answers.
In my error logs I see:
server reached MaxClients setting, consider raising the MaxClients setting
My MaxClients setting is 150. However when I calculate what seems to be an optimal MaxClients setting I come up with:
Mem used by 1 Apache process = 16
Mem available to Apache = 197
MaxClients = 12 (197/16)
So should I knock MaxClients way down to 12 because my calculations show that is all the RAM I have available or should I raise the limit as the error log suggests (or are my calculations worthless because I'm misunderstanding something)?
In the following log snippet what could cause certain requests to return a 302 status and the last one to return a 200 status? As I understand it 302 means "The requested resource resides temporarily under a different URI" but why would this be? I would expect the response code to be 200, as in the last line of the log example, for every request.
Also wondering about the HTTP/1.0 versus 1.1 but I think I know that one so... really, just why the 302 versus 200 status codes for the same resource (that has not moved)?
123.201.40.136 - - [09/Feb/2011:14:13:23 -0800] "GET /report/now HTTP/1.0" 302 20 "http://foo.bar.com/reports/nowreport.swf"
123.201.40.136 - - [09/Feb/2011:14:13:28 -0800] "GET /report/now HTTP/1.0" 302 20 "http://foo.bar.com/reports/nowreport.swf"
123.201.40.136 - - [09/Feb/2011:14:13:41 -0800] "GET /report/now HTTP/1.0" 302 20 "http://foo.bar.com/reports/nowreport.swf"
208.319.74.24 - - [09/Feb/2011:14:13:56 -0800] "GET /report/now HTTP/1.1" 200 355 "http://foo.bar.com/reports/nowreport.swf"
I found a whole bunch of this in my maillog (after my site went down from excessive resource usage):
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: [email protected]
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: [email protected]
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: hook_dir = '/var/qmail//handlers/before-queue'
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: recipient[3] = '[email protected]'
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]'
Dec 3 05:24:23 mysite qmail-queue-handlers[24524]: starter: submitter[24525] exited normally
Which looks like someone is using my system to send spam. What do you folks think and how would you go about tracking down their entry point and/or blocking them?
It has been suggested that the admin section of a custom CMS we use require VPN access to reach. How feasible is this? The site has a front end http://thesite.com and a backend http://thesite.com/admin so how feasible is it to set things up so that anyone accessing the admin areas has to log in via VPN?
I have some experience in setting up an openvpn server (under Ubuntu... this one is under CentOS) but that was for use as a secure proxy for access from remote locations (i.e. fire up the laptop, login to the VPN and surf securely). This situation is different as, in an effort to help secure a too frequently hacked site, the owner has decided a VPN is the solution.
So, is this doable? Completely the wrong direction? We are working on securing this mess of code (and have closed some vulnerabilities) but in the meantime... suggestions/tips/links?
This relates to a hacking incident we had to deal with. The hackers inserted a php file into our system. The directory in question does receive uploads (images) from our cmsadmin. However, all files uploaded through our cmsadmin have the same owner and permissions (owner: theadminsname, permissions: 777). The illegally inserted file, on the other hand, has owner: apache, permissions: 644
My question: Does this difference in owner and permissions give any clue as to how the file was inserted? If they had uploaded the file through our cmsadmin, wouldn't it have the same owner and permissions as other uploaded files? Does the fact that the owner is apache indicate a different route in or did they just change it to that because that is such a common apache owner name?
Another thing. The inserted file was placed in a section of our custom cms. It then provided a form for the hackers to make changes to files in a third party advertising program (amongst other things). It seems odd that they would upload a file into our custom cmsadmin (located in a completely different directory structure from the ad system and with no interoperability between the two) and then use it to manipulate this third party ad program. The cmsadmin and advertising program admin are in different directories and not connected, programmatically, in any way. This all makes me suspect the attack was conducted not through a weakness in our cmsadmin or in the ad system but through a weakness in the webhost.
What do you all think?
I want to help guard against getting hacked (again). One thing I want to do is watch the files that have been hacked in the past (twice in fact, always the same files modified) so i can be alerted if this happens again. What is the best way to watch files for modification? This is on a linux server (and I tried installing the program "audit" but am unable to run it on this shared host so using it is out of the question).
I'm really looking for the simplest, low resource, solution. A basic unix script I could run via cron would be ideal.
EDIT I am using a unix shell script called Filetraq to handle watching my files. It is available here: http://filetraq.xidus.net/ I had to modify the script a bit as it is old and doesn't play well with diff plus I wanted to add some other variables and text, but it is quite basic and easy to use.
Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over.
The code is always appended, always in one specific directory (one used by a third party ad program), affects a number of files in a number of directories inside this one ad dir (20 or so) and is inserted at roughly the same overnight time. The adsense account belongs to a Chinese website (located in a town not an hour from where I will be in China next month. Maybe I should go bust heads... kidding, sort of), btw... here is the info on the site: http://serversiders.com/fhr.com.cn
So, how could they append text to these files? Is it related to the permissions set on the files (ranging from 755 to 644)? To the webserver user (it's on MediaTemple so it should be secure, yes?)? I mean, if you have a file that has permissions set to 777 I still can't just add code to it at will... how might they be doing this?
Here is a sample of the actual code for your viewing pleasure (and as you can see... not much to it. The real trick is how they got it in there):
<script type="text/javascript"><!--
google_ad_client = "pub-5465156513898836";
/* 728x90_as */
google_ad_slot = "4840387765";
google_ad_width = 728;
google_ad_height = 90;
//-->
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
Since a number of folks have mentioned it, here is what I have checked (and by checked I mean I looked around the time the files were modified for any weirdness and I grepped the files for POST statements and directory traversals:
*UPDATE:** OK, solved it. Hackers from China had physically placed a file in our site that allows them to do all manner of administrative things (database access, delete and create files and dirs, you name it, they had access). We were lucky they didn't do something more destructive. There was nothing in the normal apache log files but I found a different set of log files in a web server log analyzer and the evidence was in there. They were accessing this file with their own admin username and password and then editing whatever they needed right there on the server. Their file has "apache" set as the user while all other files on our site have a different user name. Now I need to figure out how they physically got this file onto our system. I suspect blame for this will eventually rest with our web host (Media Temple), unless they actually had our FTP login... not sure how I will determine that, however, as this file has probably been there for a while.