This article describes how to assign host aliases to pods in kubernetes, is there anyway to do it for a deployment and not for a pod as such?
Any other suggestions to add host entries in kubernetes to provide a first line of host name resolution (before checking a server like 8.8.8.8) would be welcomed as an answer as well.
This is very strange and I can't get my head around it. I have set up a nginx server to reverse proxy a docker container. Nginx seems to be able to server some pages, but not sub-directories, or perhaps it can't serve dynamic content. I am not entirely sure what's going on here.
For example I am trying to reverse proxy the activemq admin console as such with the following config, but it doesn't seem to be able to serve subdirectories:
server {
listen 8162;
server_name dockerdev1.site.com;
ssl on;
ssl_certificate /var/certificates/cert.com.crt;
ssl_certificate_key /var/certificates/cert.com.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;
location / {
include /etc/nginx/mime.types;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://dockerdev1.site.com:11113;
try_files $uri $uri/ =404;
}
}
After enforcing strict transport security in a server, it is also forcing https into port 8161 for activemq which of course makes it fail.
I followed this instructions to enable https on activemq console on port 8162 and it works:
http://activemq.apache.org/web-console.html
However this also fails because hsts enforces that the certificate be valid, meaning the same as the website and not a snakeoil certificate
How can I use the same form of configuration that I use for apache or postfix when configuring ssl? I have three files:
SSLCertificateFile file.crt
SSLCertificateKeyFile file.key
SSLCertificateChainFile bundle.crt
And I want to make activemq use those three files. I been looking around online keystore and a bunch of other things but they all take me in circles telling me how to generate keys, however I don't want to generate keys or certificates but use what I already have.
I have been using:
RedirectMatch /(.*) https://www.website.com/$1
to enforce redirection from virtualhost 80 to 443 in apache.
My reasoning is that it makes sense to grab anything that the user puts in and translate it directly to https. Yet, I have seen this used quite often as well:
Redirect permanent / https://www.website.com/
Which I have not been using because I am assuming it would not be an exact translation of the addressed typed by the user to https.
Which one is best to enforce encryption for the whole site together with using Strict Transport Security?
Let’s say you register with a provider and you are given the following NS records:
Name Server: NS18.EXAMPLE.COM
Name Server: NS8.EXAMPLE.COM
Could you add these to increase resilience without having any negative consequences?
Name Server: ns4.google.com
Name Server: ns2.google.com
Name Server: ns3.google.com
Name Server: ns1.google.com
It's hard to make sense of tomcat documentation and looking at server.xml you will find a salad of ports that may be hard to understand because it's not really explained properly, or extensively, in the documentation.
For example, this line in the config file server.xml
<Connector port="8345" protocol="AJP/1.3" redirectPort="9875" />
And here you can find yet another redirect port:
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
I understand what the connector port does. In the first case you use that to create a worker in apache and send it there, in the second you open a port to access tomcat directly. However when it comes to the redirectport things become fuzzy.
Here is the explanation given by tomcat documentation for ajp port:
If this Connector is supporting non-SSL requests, and a request is received for which a matching requires SSL transport, Catalina will automatically redirect the request to the port number specified here.
I always pick a random redirect port over 1024 and it works,
But when would this come into practice? How does it know when a request requires SSL transport?
I have a satellite server running a tomcat module. This module comes into effect by redirecting traffic to the ajp connector with apache from the main server and vice versa.
In the main server https is enforced in apache. Does this mean all requests are sent to the satellite server encrypted or in plain text? I know that if I access the satellite server via port 8080 it's not encrypted, but I am wondering if this applies to the traffic being redirected to the main server as well and where does this redirect port come into effect.
Trying to figure out pricing here so I don't get overcharged. I daily run a backup script where s3cmd checks a folder with over one hundred thousand files to see if any have changed (which by the way, it takes close to an hour to do so), this is of course checking on the bucket and I am guessing this would be considered a list request, even if nothing is transferred. Very important question is, does this count as one list request or one hundred thousand list requests?
Been trying to find an answer for this, but it isn't very clear on their site:
I know folders are not folders within S3, but it would be extremely useful if you could restore a previous version of one when you have versioning enabled. I've been looking at it and I can only see previous version of files, not folders.
If you have a folder with thousands of files and a hundred of them were deleted and you are not sure where or when exactly this is extremely useful.
Is there any way to do this?
(Using Linux)
EDIT:
It looks like the only way to do this efficiently is to use this tool:
https://labs.madisoft.it/amazon-s3-point-in-time-restore/
I am shocked that the official s3 tools and s3cmd don't support this.
Firstly, I have a hard time understanding what the --update parameter does. I thought that without it, it would logically update any file that changes and I believe that's what it does, so why does the --update parameter even exist?
Secondly, related to what I asked because I thought it would solve my issue, but it doesn't, I have a bunch of config files that I would want updated into a different folder every time they change by having a cronjob that runs the below command every hour or every day, this way I can have a few previous versions in case something goes awry. The problem is that these files rarely change, but rsync creates another folder with hard links regardless it changes or not, which is a bit annoying because then you have loads of folders of the same thing, even them being a hard link and not taking space, it creates a lot of clutter.
Isn't there any way to stop rsync --link-dest from doing this? That is, create the folder only if anything changes, otherwise do nothing. Seems like a pretty basic case scenario so I would have thought there is an easy way to do this with a parameter, but I can't find the answer anywhere.
rsync -azP --delete --stats --update --log-file=/var/log/rsync/apacheconfdate +%F_%T.log -e "ssh -i /home/user/.ssh/id_rsa" /etc/apache2/sites-available --link-dest=/mnt/backup/apache2/apache [email protected]:/mnt/backup/apache2/apachedate +%F_%T.log
In Posgresql you can set a variable called PGPASSWORD (and PGUSER) so you don't have to use password when using postgresql commands such as psql or pg_dump
But I am a bit confused because I can't get it to work on Postgresql 9.3.10 and it's still documented on their site as if it should work.
so commands like
PGPASSWORD=password psql -l
will not work.
Neither can I declare them before hand such as
PGUSER=root
PGPASSWORD=password
psql -l
It still asks for password (although in this case, it uses the root user as it should)
The only way I have got it to work somehow was by doing the .pgpass file but it only works when using a specific database, asterisk doesn't work and it only works with pg_dump, not all postgresql commands like psql -l:
localhost:5432:*:root:password
These are my pg_hba.conf settings if it helps any:
local all root md5
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all peer
# IPv4 local connections:
host all all 127.0.0.1/32 md5
# IPv6 local connections:
host all all ::1/128 md5
When I add rules to ufw and then enable it, some of my settings in sysctl.conf become void so I have to do sysctl -p after doing ufw enable.
So for example one of my settings in sysctl.conf is to not reply to ping, after enabling ufw, you can ping the server again.
Why is this?
Here are some of the settings in my sysctl.conf:
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.icmp_echo_ignore_all = 1
kernel.panic = 10
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
kernel.sysrq = 0
net.ipv4.ip_local_port_range = 1204 65000
net.core.rmem_max = 262140
net.core.rmem_default = 262140
net.ipv4.tcp_rmem = 4096 131072 262140
net.ipv4.tcp_wmem = 4096 131072 262140
net.ipv4.tcp_sack = 0
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_keepalive_time = 60000
net.ipv4.tcp_keepalive_intvl = 15000
net.ipv4.tcp_fin_timeout = 30
EDIT
Thank you Aaron! I have come to rely on Google so much that I didn't think of inspecting the config files for ufw in etc - and there it was, so easy!
For anyone looking for an answer to this, you can either set your config in that file or even better, edit /etc/default/ufw file so it uses the system default sysctl.conf file in /etc/sysctl.conf
I am having a really tough time setting up nagios3 to do what I want. Far too many config files and not sure where exactly the problem is as everything seems correct.
First, notifications were sent for down hosts and critical services, then I wanted to configure it so it also sent notifications on recovery and now it only sends that, but not for everything.
The way I want to configure it is so it uses the generic service as template and then configure additional details if I need to, but it's not playing ball, here are my config files see if you see anything wrong:
What I want is simple. Send email when host is down, when service is critical, and when it recovers - that's it!
----File contacts.cfg ---
define contact{
contact_name admin
alias administrator
service_notification_period 24x7
host_notification_period 24x7
service_notification_options u,c,r
host_notification_options d,u,r
service_notification_commands notify-service-by-email
host_notification_commands notify-host-by-email
email [email protected]
}
define contactgroup{
contactgroup_name admins
alias Nagios Administrators
members admin
}
---------------------EOF----------
------file generic-service.cfg ---------
define service{
name generic-service ; The 'name' of this service template
active_checks_enabled 1 ; Active service checks are enabled
passive_checks_enabled 1 ; Passive service checks are enabled/accepted
parallelize_check 1 ; Active service checks should be parallelized (disabling this can lead to major performance problems)
obsess_over_service 1 ; We should obsess over this service (if necessary)
check_freshness 0 ; Default is to NOT check service 'freshness'
notifications_enabled 1 ; Service notifications are enabled
event_handler_enabled 1 ; Service event handler is enabled
flap_detection_enabled 1 ; Flap detection is enabled
failure_prediction_enabled 1 ; Failure prediction is enabled
process_perf_data 1 ; Process performance data
retain_status_information 1 ; Retain status information across program restarts
retain_nonstatus_information 1 ; Retain non-status information across program restarts
notification_interval 0 ; Only send notifications on status change by default.
is_volatile 0
check_period 24x7
normal_check_interval 1
retry_check_interval 1
max_check_attempts 4
notification_period 24x7
notification_options w,u,c,r
contact_groups admins
register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL SERVICE, JUST A TEMPLATE!
}
---------------EOF--------
----generic-host.cfg file----
define host{
name generic-host ; The name of this host template
notifications_enabled 1 ; Host notifications are enabled
event_handler_enabled 1 ; Host event handler is enabled
flap_detection_enabled 1 ; Flap detection is enabled
failure_prediction_enabled 1 ; Failure prediction is enabled
process_perf_data 1 ; Process performance data
retain_status_information 1 ; Retain status information across program restarts
retain_nonstatus_information 1 ; Retain non-status information across program restarts
# check_command check-host-alive
check_command check_tcp_alive
max_check_attempts 10
notification_interval 0
notification_period 24x7
notification_options d,u,r
contact_groups admins
register 0 ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL HOST, JUST A TEMPLATE!
}
----Excercept from servicegroups.cfg-----
define service {
hostgroup_name Live, inhouse
service_description USERS
check_command check_nrpe_1arg!check_users
use generic-service
normal_check_interval
10
retry_check_interval 10
contact_groups admins
notification_interval 0 ; set > 0 if you want to be renotified
}
# check the LOAD
define service {
hostgroup_name Live, inhouse
service_description LOAD
check_command check_nrpe_1arg!check_load
use generic-service
normal_check_interval 5
retry_check_interval 1
notification_interval 0 ; set > 0 if you want to be renotified
}
# check the HDD
define service {
hostgroup_name Live, inhouse
service_description HDD
check_command check_nrpe_1arg!check_all_disks
use generic-service
normal_check_interval 600
retry_check_interval 30
notification_interval 0 ; set > 0 if you want to be renotified
}
-----EOF-----
--- Excerpt from Hostgroups.cfg----
define hostgroup {
hostgroup_name http-servers
alias HTTP servers
members *
}
----EOF-----
I am trying to setup syslog-ng to send tomcat logs (as well as all the other system logs) to a log server but it doesn't seem to be working, this is the line I have:
destination d_tomcat { file("/opt/tomcat/logs/*.log"); };
And then of course this:
log { source(s_src); destination(d_net); };
and this
destination d_net { tcp("x.x.x.x" port(1514) log_fifo_size(1000)); };
I am running a few tomcat servers to which we deploy applications that our coders write and implement. Problem is that in some of our servers, especially the ones that have multiple requests, memory gets full very quickly and the server starts performing badly, if at all. I am new to this role and my predecessor mentions this is due to the code in the apps not being written correctly that it eats all the memory up... which is fair enough, but I am wondering if there is anything I can do to mitigate or eliminate this as currently the solution implemented until the code is improved is multiple weekly tomcat restarts, which in my opinion feels like an overkill! (no pun intended)
Below is the output of htop before tomcat needs to be killed and restarted (and that's another thing, most often tomcat can't be asked to politely quit, you must kill it -9, not sure if this is normal)
I've checked some resources but I wasn't able to find anything specific that could sort my problem out, so any good expertise would be welcomed!
I've included an image, as you can see the process seems to be repeated multiple times but it's not using over 300 gig memory like some people have been saying but only 7 gigs, not entire sure what that means.
Actually it could be a problem with htop as if you do a ps you can only see the below process:
root 5215 3.4 64.8 8310716 5301436 ? Sl Nov04 146:25 /usr/bin/java -Djava.util.logging.config.file=/opt/tomcat/conf/logging.properties -Djava.awt.headless=true -Xms5G -Xmx5G -XX:PermSize=512m -XX:MaxPermSize=512m -XX:NewSize=1G -XX:MaxNewSize=1G -Duser.langua
Anyway to get back to my point, it gets overloaded far too easy, any ways to prevent this in Tomcat version 7.0.28?
Here is the server.xml
<?xml version='1.0' encoding='utf-8'?>
<Server port="8105" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.core.JasperListener" />
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<GlobalNamingResources>
<Environment name="databasePlaceHolder" type="java.lang.String" value="com_xxx_yyy_au"/>
<Environment name="com.xxx.databasename" type="java.lang.String" value="com_xxx_yyy_au"/>
<Environment name="com.xxx.JMS.url" type="java.lang.String" value="tcp://localhost:61616"/>
<Environment name="remoteServerURL" type="java.lang.String" value="https://yyy.xxx.com/"/>
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<Connector port="8109" protocol="AJP/1.3" redirectPort="0443" />
<Engine name="Catalina" defaultHost="localhost">
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
</Service>
</Server>
This is the setenv.sh file content:
JAVA_OPTS="-Djava.awt.headless=true -Xms5G -Xmx5G -XX:PermSize=512m -XX:MaxPermSize=512m -XX:NewSize=1G -XX:MaxNewSize=1G -Duser.language=en -Duser.region=GB"
JAVA_OPTS="${JAVA_OPTS} -XX:+UseParallelGC -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintTenuringDistribution"
