Xeoncross's questions

I am trying to setup my development nginx/PHP server with a basic master/catch-all vhost config so that I can created unlimited ___.framework.loc domains as needed.

server {
        listen 80;
        index index.html index.htm index.php;

        # Test 1
        server_name ~^(.+)\.frameworks\.loc$;
        set $file_path $1;
        root    /var/www/frameworks/$file_path/public;

        include /etc/nginx/php.conf;
}

However, nginx responds with a 404 error for this setup. I know nginx and PHP are working and have permission because the localhost config I'm using works fine.

server {
        listen 80 default;
        server_name localhost;
        root /var/www/localhost;
        index index.html index.htm index.php;

        include /etc/nginx/php.conf;
}

What should I be checking to find the problem? Here is a copy of that php.conf they are both loading.

location / {
        try_files $uri $uri/ /index.php$is_args$args;
}

location ~ \.php$ {

        try_files $uri =404;

        include fastcgi_params;
        fastcgi_index index.php;

        # Keep these parameters for compatibility with old PHP scripts using them.
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        # Some default config
        fastcgi_connect_timeout        20;
        fastcgi_send_timeout          180;
        fastcgi_read_timeout          180;
        fastcgi_buffer_size          128k;
        fastcgi_buffers            4 256k;
        fastcgi_busy_buffers_size    256k;
        fastcgi_temp_file_write_size 256k;
        fastcgi_intercept_errors    on;
        fastcgi_ignore_client_abort off;
        fastcgi_pass 127.0.0.1:9000;

}

I am building an application that will be acting as a combined MUA/MTA on different networks. However, many of the networks are with ISP's that block port 25 for SMTP. Therefore I would also like to open up a secondary port so that some of the installs can communicate on that if port 25 is closed.

How do I choose a second port? I know some people use port 26 or port 2525. What is the correct way to choose a port that won't interfere with existing software?

I'm working with a bash script trying to stop it from attempting to replace variables inside my heredoc. How do set a heredoc to either A) escape the variable names instead of parsing them or B) return the entire string untouched?

cat > /etc/nginx/sites-available/default_php <<END
server {
    listen 80 default;
    server_name _;
    root /var/www/$host; <--- $host is a problem child
}
END

As is, when I it finishes injecting it into a file I'm left with this:

server {
    listen 80 default;
    server_name _;
    root /var/www/;
}

In the lines below, I might have a site-specific configuration file that contains additional fastcgi_params unique to that site. If this file exists I want to load it.

server {
        listen 80 default;
        server_name _;
        root /path/www/$host;

        # Pass PHP scripts to php-fastcgi listening on port 9000
        location ~ \.php {
                include fastcgi_params;
                fastcgi_pass 127.0.0.1:9000;


                if (-f /path/www/$host/nginx.conf) {
                        include /path/www/$host/nginx.conf;
                }
        }
}

However, this doesn't work and the error I get is:

nginx: [emerg] "include" directive is not allowed here in ...

Update

I thought that rather than checking separatly, I could let include check for me.

server {
        listen 80 default;
        server_name _;
        root /path/www/$host;

        # Pass PHP scripts to php-fastcgi listening on port 9000
        location ~ \.php {
                include fastcgi_params;
                fastcgi_pass 127.0.0.1:9000;

                include /path/www/$host/*.nginx;
        }
}

However, this doesn't seem to be working.

I am starting a project that uses environment variables to set the database connection and a couple other things. (They didn't want to use configuration files since people are careless and overwrite them).

Anyway, I am using nginx and while it supports env - it doesn't seem to support it well enough. You can't set the env values on a per-server block basis. In other words, this won't work:

server {
    listen 80;
    server_name domain;
    env FOO = "bar";
}

You must do this:

env FOO = "bar";

http {
    server {
        listen 80;
        server_name domain;
    }
}

Which means that I can't have vhost-specific values. So I must create a whole vhost config for each site and only activate the one I want at the moment so that the value is set correctly.

Is there any way to work around this?

I noticed that PostgreSQL and MySQL have a 100 client connection limit by default. I'm wondering if I should turn this down since the webserver is on the same box and I only have about 20 PHP processes that would need to connect.

Should this setting match or exceed the number of processes that will try to connect?

With the nginx HttpLimitReq module requests can be limited by IP. However, I'm not understanding what the "nodelay" option does.

If the excess requests within the limit burst delay are not necessary, you should use the nodelay

limit_req   zone=one  burst=5  nodelay;

I have Postfix setup on my server so that I can send outgoing mail using the command-line:

mail -s "Subject" [email protected]

1. Is this using Sendmail or Postfix ?
2. Is "Sendmail" just a software category or a distinct program ?
3. If something is "Sendmail-ready" does that mean it will work with Postfix ?

Everything I've read online seems to use these two terms interchangeably.

I'm trying to save some time on my development machine by not creating a new nginx server config for each new site I test. I'm wondering if there is a way for nginx to change the root directory based on the domain I'm loading.

So if I have

mysite.loc
myothersite.loc
something.loc

Nginx will look inside

www/mysite.loc
www/myothersite.loc
www/something.loc

That would allow me to test new things on mock domains just a little bit faster since I don't have to mess with a new /etc/nginx/sites-available config for each one.

server {
    listen 80;
    server_name *.loc;
    root /www/$host;
    index index.html;
}

Is this possible? Is there another way to do it?

I was reading over the algoritms used in SSH and I'm trying to figure out which one is the current "recommended" or at least which target audience each is for.

• Should I make sure my SSH key is 1.0 compatible?
• Should I use 1024 bit or 2048? Is 2048 twice as slow?
• Are some better for sensitive uses - while others are for constant data transmission?

I have a single computer running OS X, XP, and ubuntu. Though, sometimes it's running multiples of those OS in VM or actual installs. I have a couple of servers I need to constantly SSH into - but sometimes I change hosts or wipe the servers.

At any rate I'm tired of setting up new SSH key pairs every time I use a new OS or server. All the information on those servers is on my PC - so if someone found me out here, made it pass all the guard dogs, and stole my PC they won't need to break into my severs since none of the operating systems I'm using have file encryption on (I'm not even sure how to turn it on).

How can I sync my key-pair to all the OS I use on this PC? On windows I use Putty/Pageant while Snow Leopard and Linux have native SSH. So the file formats aren't exactly the same.

I see the default hostname for mail and web servers being set as mail.domain.tld and www.domain.tld respectively. Why is this? Does it help as you move from a single server to multiple servers?

I have always used plain domain.tld for both the mail and web server on a VPS (with a redirect rule for anyone that tries "www.").

I am trying to setup a single server to send out email from a single domain but I'm having trouble identifying the correct values for these Postfix settings.

mydomain = example.com
myhostname = example.com
myorigin = $mydomain
mydestination = $example, localhost.$example, localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

Can someone can explain them so I know what I should be setting them to?

Things like $mydomain appear to be added at runtime by the script. This seems to work (emails come from [email protected]) but I am weary of using values for parameters I don't understand.

Given a base directory (like /home/user) is there a command that could be run which would create an archive back up all text files (i.e. files less than 100kb) in that directory and it's children? I know you can tar/gz a directory - but what about excluding files also?

The idea is that most photos, videos, and other large files would be ignored while all important hand-typed documents could easily be backed up quickly when moving around projects and servers.

UPDATE

Using skinp's awesome code I was able to backup a small amount of the files. However, as DerfK pointed out - there is a limit to the size of arguments you can pass to commands. With that in mind I was able to write out the contents of find hoping that I could use something to read the contents to tar and bypass this limit. The other other option seems to be a sh script that could ad each file to the archive at a time.

find /home/username -type f -size -100k > list.of.small.files.txt

Which rendered out a 6MB file.

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only need these starting ports rules and can add mail or game ports later as need.

So far I have the following ruleset and I was wondering if anyone knows of a better script or any improvements that could be added.

*filter

#  Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allows all outbound traffic
#  You can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allows SSH connections (only 4 attempts by an IP every 3 minutes, drop the rest)
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

iptables is one of the most important parts of securing your box (also see fail2ban) and yet there are many people like myself that have trouble understanding everything that goes into making a secure basic firewall for our servers.

What is the most secure way to only open the basic ports needed for a webserver?

Update: cyberciti.biz has another iptables script that looks pretty good.

Also, rather than using Denyhosts or fail2ban you could use iptables itself to block bad repeated attempts at SSH.

I had Debian 5 installed on my VPS but I found that it came with apache2 already up and running. I tried

apt-get remove apache2

but it said that apache2 wasn't running. I checked top and yep, there it was. So then I turned it off.

/etc/init.d/apache2 stop

which worked fine and shut the daemon down. However, I still can't remove it. I tried aptitude remove but it says that it isn't installed.

What is going on?

I am finally getting used to managing a small Ubuntu server VPS. However, I know that I there must be programs installed that I don't need. Even if it is just the overhead of the Ubuntu system on top of Debian.

For example, I don't use Apache since I discovered Nginx. I don't use (S)FTP since I discovered SSH. I can replace bash with dash or OpenSSH with dropbear.

So I am wondering if there is a guide I can study or script that I can run out there which will remove all non-core parts of the system so that I can learn more about what is actually needed and how these libs work. Though I must admit that I'm no where near ready to start messing with the linux core itself.

My goal is to fit a complete PHP webserver in about 50MB so that I can give the FS and memcache all the rest of the RAM. I'm mostly interested in Debian since I know it already - but I've heard good things about CentOS also.

I had to switch from Ubuntu so that I could use Adobe Suite at full speed and now I'm finding that SSH on windows is not as unified as on linux.

So I installed msysgit and putty but I'm finding that git is having trouble using putty for SSH. (I did install msysgit on the windows path and using plink).

I am trying to add a remote on my git project now to a server on a non-standard port by using a /.ssh/config file like

Host 255.255.255.255
Port 22222

Then I add the data to my git repo:

git remote add origin [email protected]:~/git/repo

But when I try to push I get an error message.

$ git push origin master
FATAL ERROR: Network error: Connection refused
fatal: The remote end hung up unexpectedly

So then I tried just using SSH from the git console:

ssh [email protected]

Which prompts me for my private key passphrase (which it doesn't have) and when I fail at that it asks me for my SSH user password (which works).

Since I am going to disable SSH login by password I need git to start using my key correctly.

Updated Summary

The /var/www directory is owned by root:root which means that no one can use it and it's entirely useless. Since we all want a web server that actually works (and no-one should be logging in as "root"), then we need to fix this.

Only two entities need access.

1. PHP/Perl/Ruby/Python all need access to the folders and files since they create many of them (i.e. /uploads/). These scripting languages should be running under nginx or apache (or even some other thing like FastCGI for PHP).

2. The developers

How do they get access? I know that someone, somewhere has done this before. With however-many billions of websites out there you would think that there would be more information on this topic.

I know that 777 is full read/write/execute permission for owner/group/other. So this doesn't seem to be needed correct as it gives random users full permissions.

What permissions are need to be used on /var/www so that:

1. Source control like git or svn
2. Users in a group like "websites" (or even added to "www-data")
3. Servers like apache or lighthttpd
4. And PHP/Perl/Ruby

can all read, create, and run files (and directories) there?

If I'm correct, Ruby and PHP scripts are not "executed" directly - but passed to an interpreter. So there is no need for execute permission on files in /var/www...? Therefore, it seems like the correct permission would be chmod -R 1660 which would make

1. all files shareable by these four entities
2. all files non-executable by mistake
3. block everyone else from the directory entirely
4. set the permission mode to "sticky" for all future files

Is this correct?

Update 1: I just realized that files and directories might need different permissions - I was talking about files above so i'm not sure what the directory permissions would need to be.

Update 2: The folder structure of /var/www changes drastically as one of the four entities above are always adding (and sometimes removing) folders and sub folders many levels deep. They also create and remove files that the other 3 entities might need read/write access to. Therefore, the permissions need to do the four things above for both files and directories. Since none of them should need execute permission (see question about ruby/php above) I would assume that rw-rw-r-- permission would be all that is needed and completely safe since these four entities are run by trusted personnel (see #2) and all other users on the system only have read access.

Update 3: This is for personal development machines and private company servers. No random "web customers" like a shared host.

Update 4: This article by slicehost seems to be the best at explaining what is needed to setup permissions for your www folder. However, I'm not sure what user or group apache/nginx with PHP OR svn/git run as and how to change them.

Update 5: I have (I think) finally found a way to get this all to work (answer below). However, I don't know if this is the correct and SECURE way to do this. Therefore I have started a bounty. The person who has the best method of securing and managing the www directory wins.

One of my favorite things about Linux is also the most annoying - file system permissions. In production machines and web servers I love how everything is so secure and locked down - but on development machines it really slows me down. I'll give one example out of the many that I discover weekly.

Like most people, I dual-boot Ubuntu and Windows so I can continue using the Adobe CS4 suite. I often design web themes and other things while I'm still using windows. Later I'll boot into Ubuntu to take the themes and write the backend PHP for them. After mounting the windows C: drive partition I can copy the template files over so I can begin editing them.

However, thanks to Linux desire to protect me I find that after coping the files I end up with a totally locked set of files where even I don't have read-write permissions. So after carful consideration about the tremendous risks that the HTML files pose to me - I chmod them so that I and apache can begin using them.

Now given, the chmod process isn't that hard - but after you chmod enough files per day you get sick of doing it. I'm constantly creating, fetch, editing, and removing files from my user, git repos, php, or other random processes. This is a personal development machine after all. Everything changes on a day by day basis.

So my question is, how can I get linux to relax about what I'm doing with my HTML/JS/PHP/TXT/SQL/etc. files so that I can work faster without constantly stopping to chmod things?

I pinky-promise I won't hack into my account with an HTML file. ;)