lkraav's questions

I'd like to have access to the lines/tracebacks/whatever whispered by the kernel right before dying. This has proven problematic, because all interfaces I have access to become disabled. Post-reboot, systemd journal has not been able to record anything about the crash, probably because flushing buffers to filesystem is blocked.

Here's what I've tried and failed with

1. console access - X application runs here for dayjob, but after system has crashed, no keyboard input is recognized, so I can't switch to vt

2. netconsole sending data to nc listening on another machine - I expected this to work, but while everything else shows up, no crash-related kernel tracebacks get there, not even with dmesg -n 8

3. ssh via network - impossible after the crash, because network gets blocked off, too

What other option do I have to capture 100% everything? Perhaps serial console? (what would be a suitable device) I think anything with USB is susceptible to also getting the subsystem blocked off.

Note: This box is local, sitting in my room, so all access and methods are available.

It's hard to tell from Apache general access_log which requests are processed by PHP, because direct file hits muddy the waters.

PHP FPM SAPI has a super useful access_log directive, but how do I get the same effect using PHP CGI SAPI?

PHP and Apache level solutions are both fine.

We have a shared IMAP mailbox for a business. Customers are not used to not having to CC tons of people with us, so they CC everybody, which creates noisy duplicates in our shared inbox.

How can I get postfix-3.0 to rewrite the To field on mail receive, deleting off all but the first instance of e-mail addresses from domain.com?

To: Joe Rabbit <[email protected]>, Sally Fox <[email protected]> needs to become just To: Joe Rabbit <[email protected]>

On a development server, I'd like to turn logging on only when needed for specific debugging operations. One way I can think of is Apache checks for the existence of certain dotfile somewhere and decides no a SetEnvIf dontlog variable value based on that. How would I configure this or is there a more optimal way?

I'd like to avoid a full-server reload to toggle this switch.

For the use case where the WAN connection goes down, but employees can still access wifi, I'd like them to be able to check on some sort of a public router status page in their problem reports. This may have been available on DD-WRT at one point (or still is), I can't 100% recall anymore.

Going through all LuCI's screens with a fine-toothed comb and googling a fair amount isn't producing results. Anyone have a solution?

I have configured my postfix as follows:

smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_helo_hostname

This is working well because most spambots don't seem to have correct reverse lookups. But every once in a while I run into mail I care about getting reject, because the mail source server admin doesn't care about configuring his server correctly.

For example here the server introduces itself as "srv1.xbmc.org" which has no DNS record and fails my basic check.

Jan  6 04:42:36 mail postfix/smtpd[660]: connect from xbmc.org[205.251.128.242]
Jan  6 04:42:37 mail postfix/smtpd[660]: NOQUEUE: reject: RCPT from xbmc.org[205.251.128.242]: 450 4.7.1 <srv1.xbmc.org>: Helo command rejected: Host not found; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<srv1.xbmc.org>

I have tried to contact the server admin several times, but there is no response. What is the optimal way to handle this from my side? Is adding these "special" hosts to mynetworks = my only option? Is perhaps my whole smtpd_helo_restrictions setup wrong in some significant way?

There's is an ext3 filesystem on top of Linux md raid1, array consists of two hard drives. Various services, including databases run on and write to it.

Let's say for argument's sake that to minimize services downtime, it would be nicer to be able to:

Option A:

• connect external drive (possibly a multi-drive weekly rotation)
• sync the array to it (--> doesn't really matter how long it takes, services are up)
• switch runlevel -> shut down all but basic non-writing services
• re-mount filesystem read-only
• disconnect external drive from array and physically
• re-mount filesystem read-write
• default runlevel -> restart services

Nicer, as in versus Option B:

• connect external drive
• backup runlevel -> shut down all services
• make file level backup (--> possibly lengthy operation, even with incremental approach, services are down)
• default runlevel -> restart all services

Question is, does the ext3 filesystem stay sane on the external drive in case of Option A? Is it safe to disconnect the drive while filesystem is mounted read-only?

How different is it from cleanly unmounting the filesystem first; will there be a recovery run on next mount? This is a rootfs, which is why I cannot cleanly unmount it.

I believe I've achieved a table that routes packets from and to eth1/192.168.3.x through 192.168.3.1, and packets from and to eth0/192.168.1.x through 192.168.1.1 (helpful source).

Question: when doing tracepath from 192.168.3.20 (from within vserver), I'm getting kernel: [318535.927489] martian source 192.168.3.20 from 212.47.223.33, on dev eth0 at or near the target IP, while intermediary hops go without (log below).

I don't understand why this packet is arriving on eth0, instead of eth1, even after reading this:

Note that you may see packets from non-routable IP addresses when running the traceroute or tracepath commands. While packets cannot be routed to these routers, packets sent between 2 routers only need to know the address of the next hop within the local networks, which could be a non-routable address.

Can someone explain that paragraph in human language? Based on short initial trials so far, everything else seems to work without causing martians. Is this contained to the nature of tracepath operation or do I have some other bigger routing problem that will cause work traffic breakage?

Side note: is it possible to inspect martian packet with tcpdump or wireshark or anything of the sort? I'm have not been able to get it to show up on my own.

vserver-20 / # tracepath -n 212.47.223.33
 1:  192.168.3.2                                           0.064ms pmtu 1500
 1:  192.168.3.1                                           1.076ms
 1:  192.168.3.1                                           1.259ms
 2:  90.191.8.2                                            1.908ms
 3:  90.190.134.194                                        2.595ms
 4:  194.126.123.94                                        2.136ms asymm  5
 5:  195.250.170.22                                        2.266ms asymm  6
 6:  212.47.201.86                                         2.390ms asymm  7
 7:  no reply
 8:  no reply
 9:  no reply
^C

Host routing:

$ sudo ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
2: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:24:1d:de:b3:5d brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.2/24 scope global eth0
4: eth1: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:46:46:a3:6a brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.2/27 scope global eth1
    inet 192.168.3.20/27 brd 192.168.3.31 scope global secondary eth1  # linux-vserver instance

$ sudo ip route
default via 192.168.1.1 dev eth0  metric 3 
unreachable 127.0.0.0/8  scope host 
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.2 
192.168.3.0/27 dev eth1  proto kernel  scope link  src 192.168.3.2

$ sudo ip rule
0:      from all lookup local 
32764:  from all to 192.168.3.0/27 lookup dmz 
32765:  from 192.168.3.0/27 lookup dmz 
32766:  from all lookup main 
32767:  from all lookup default

$ sudo ip route show table dmz
default via 192.168.3.1 dev eth1  metric 4 
192.168.3.0/27 dev eth1  scope link  metric 4

Gateway routing

# ip route
10.24.0.2 dev tun0  proto kernel  scope link  src 10.24.0.1 
10.24.0.0/24 via 10.24.0.2 dev tun0 
192.168.3.0/24 dev br-dmz  proto kernel  scope link  src 192.168.3.1 
192.168.1.0/24 dev br-lan  proto kernel  scope link  src 192.168.1.1 
$ISP_NET/23 dev eth0.1  proto kernel  scope link  src $WAN_IP 
default via $ISP_GW dev eth0.1

Additional background

Options for non-virtualized network interface isolation?

I would like to have my "dmz"-connected visitors to be able to access services by their global DNS IP (wan) that are redirected to another zone, let's say "lan".

• openwrt wan - 12.23.34.45
• client is sitting in dmz - 192.168.2.101
• httpd is in lan - 192.168.1.2, configured for vhost someservice.net (resolves to 12.23.34.45)

Now dmz guy tries to access someservice.net with his browser and therefore will try to connect to 12.23.34.45:80, which in my imagination should go through wan zone, then get redirected back to lan.

Somewhere along the chains openwrt blocks this, because this connection does not succeed.

My traffic control configuration currently looks like this:

• lan -> wan
• dmz -> wan
• lan -> vpn
• lan -> dmz

Any pointers welcome!

Does anyone know a good way to achieve replying to a message into the same IMAP folder without sending another duplicate copy over SMTP? This is to be achieved with a conventional GUI mail client, especially Thunderbird.

Goal is to have an in-folder conversation. This is possible with shared IMAP folders, with per-user Seen indices, where subscribed recipients are guaranteed to see the new messages without them arriving from internet.

Thunderbird is capable of storing a copy of a reply in the same folder as original message (Account Options), which is half way there. Just pressing Save sends the message into Drafts and that is probably an even bigger patch to try to put a "draft message" into the same folder as original.

All options, client, server or logic-wise are an acceptable answer, including programming i.e. patching/creating add-on for Thunderbird.

note: all = all that i've found

All the "cloning with dd" information talks about how dd copies all the "empty space", but literally all writings seem to be responding to a situation where filesystems fill up the entire disk.

What about the situation where i have two partitions that together fill up only 10% of 160G disk. What is the image size going to be for the good ol "dd if=/dev/sda of=disk.img" run: 16G or 160G?

Unless i'm blind, Using DD for disk cloning does not have this information.

Scenario in question:

Slowish Atom netbook. I resume from sleep or hibernation. Windows 7 login prompt displays. I have a loooong password stored in YubiKey. I plug in YubiKey, it lights up, like it's ready to do work. I press button on YubiKey to send password, nothing new appears on screen. I wait a while till whatever running background processes get their thing done coming out of sleep. I press YubiKey button again. still nothing. It's a loud environment and it's impossible to hear the "new device connected" Windows beep. I wait some more, I press YubiKey button - and finally I get my password input.

As you can probably imagine, it's annoying as hell. Because of the Atom CPU, it takes rather long for running background and OS processes to get back into a steady state after coming out of sleep and the USB subsystem to re-initialize devices.

Q: Is there some way to have some "USB device connected" popup/whatever notification displayed at Windows 7 login prompt? Is custom GINA the only way? Anything else I might've missed that would solve this usability problem?