BioRod's questions

Every day I backup my wiki database with the following command on a Linux 14.04 on mysql 5.5.62

/usr/bin/mysqldump -u root my_wiki >  wiki.`date +"%m-%d-%Y_%T"`.sql

When I restore the dump to the same machine, the restore is successful. But when I restore the dump to a new ubuntu 20.04 box, I see the following in this table.

mysql> select user_name from user;
+------------------------------------------+
| user_name                                |
+------------------------------------------+
| 0x412E706172646F                         |
| 0x4162656C2E6564756172646F               |
| 0x4164616D2E676F746368                   |
| 0x416C6578616E6465722E6275646E6576696368 |

where it should look like

mysql> select user_name from user;
--------------
select user_name from user
--------------

+---------------------+
| user_name           |
+---------------------+
| A.bardo             |
| Abel.smith          |
| Adam.Mo             |
| Alexander.bud       |

So, what am I not getting here?

I manage an apache web server for a government site. The SSL cert will expired in a few weeks so they sent me a zip file with 3 intermediate certs and the ssl certificate (I have the private key from the csr generator and the crt file provided by gov't). I need to bundle the intermediate certs into one file for apache2.

Here are the 3 intermediate certs they sent me

Jan  1  2004 AAACertificateServices.crt
Nov  2  2018 SectigoRSADomainValidationSecureServerCA.crt
Mar 12  2019 USERTrustRSAAAACA.crt

In what order should I bundled the 3 certs because from reading from other links, the order does matter if the root is provided. Which one is the root?

I used an online ssl validator for the the 3 certs

AAACertificateServices.crt

Common Name: AAA Certificate Services
Organization: Comodo CA Limited
Locality: Salford
State: Greater Manchester
Country: GB
Valid From: December 31, 2003
Valid To: December 31, 2028
Issuer: AAA Certificate Services, Comodo CA Limited
Serial Number: 1 (0x1)

SectigoRSADomainValidationSecureServerCA.crt

Common Name: Sectigo RSA Domain Validation Secure Server CA
Organization: Sectigo Limited
Locality: Salford
State: Greater Manchester
Country: GB
Valid From: November 1, 2018
Valid To: December 31, 2030
Issuer: USERTrust RSA Certification Authority, The USERTRUST Network Write review of Sectigo
Serial Number: 7d5b5126b476ba11db74160bbc530da7

USERTrustRSAAAACA.crt

Common Name: USERTrust RSA Certification Authority
Organization: The USERTRUST Network
Locality: Jersey City
State: New Jersey
Country: US
Valid From: March 11, 2019
Valid To: December 31, 2028
Issuer: AAA Certificate Services, Comodo CA Limited Write review of Sectigo
Serial Number: 3972443af922b751d7d36c10dd313595

This has been a gray area for me since I've been using LetEncrypt and they automatically bundle the intermediate certs on to one file.

I recently built a Ubuntu syslog-ng server that is behind a firewall. I have opened TCP ports 514, 515, and 516. I have noticed that hackers are writing to my syslog-ng server, they are from China. How do I hack proof my syslog server to only recieve log entries from specific servers? What is the best way? Should I do it via iptables (this can be tedious) or through the syslog-ng.conf file on the syslog-ng server?

REVISED

I inherited this apache server from a Perl shop that I now work. When this web server was on ubuntu 14.04, I had no issues starting apache. I upgraded the server to ubuntu 18.04 and now apache does not start, here is the error

apache2: Syntax error on line 225 of /etc/apache2/apache2.conf: Syntax error on line 61 of /etc/apache2/sites-enabled/vhost.conf: no macro defined before Use

line 225 of main apache config

224 # Include the virtual host configurations:
225 IncludeOptional sites-enabled/*.conf

line 61 of vhost file

    <IfModule perl_module>
    Use Pconf /home/xxxx/xxxxx/xxxxx/htdocs 4 10 Hawaii
</IfModule>

This is where I am at a standstill, I have enabled the macro package.

  Module macro already enabled

I can't start apache so there are no errors in the logs.

I have been using Net::SMTP::TLS for my web application to send password reset emails using Google email for years.

my $smtp = Net::SMTP::TLS->new(email-smtp.us-east-1.amazonaws.com,
                                    Hello => ,
                                    Port => 587,
                                    Timeout => 10,
                                    Debug   => 0,
                                    User => [email protected],
                                    Password => password123,
#                                   NoTLS => !$gsmtpssl,
#                                   Blocking => $blocking,
                                    ) or $c = 1;

            print "TLS returned: $c,$smtp\n";

I have changed to Amazon's Simple Email Service. As documented in the AWS documentation, the email address that I'm using to send has been verified by Amazon SES. In the AWS console, I had to create SMTP credentials which were encrypted. Correct me if I am wrong, in order to send emails from a verified email address in AWS Simple Email Service, I need a SMTP username, SMTP password, SMTP server name and SMTP port. Which I was able to obtain.

       smtpuser abc
       smtppassword 123456 
       email-smtp.us-east-1.amazonaws.com

But I want to send emails using the [email protected] and the smtp credentials provided to me by Amazon and it's not working.

#!/usr/bin/perl -w 
use strict;
use Data::Dumper;
use Net::SMTP::TLS;
my $mailer = new Net::SMTP::TLS(
   'email-smtp.us-east-1.amazonaws.com',
   Hello   =>      'World',
   Port    =>      587, #redundant
   User    =>      'abc',
   Password=>      '123456');
print Dumper($mailer);
$mailer->mail('[email protected]');
$mailer->to('[email protected]');
$mailer->data;
$mailer->datasend("Sent thru TLS!");
$mailer->dataend;
$mailer->quit;

I want to know the number of physical cpus and cores in a control domain and LDOM.

In this LDOM environment, I have a control domain with two LDOMs

If I do a psrinfo -p on the control domain, it indicates 1 chip and the following

The physical processor has 8 virtual processors (0-7)
SPARC-T4 (chipid 0, clock 2848 MHz)

I don't see any indication that it has cores. But if I do:

kstat cpu_info | grep core_id  | sort -u | wc -l

It indicates I have 1 core.

But if I do ldm list -e <name of ldom>, I see this core info:

CORE
CID    CPUSET
10     (80, 81, 82, 83, 84, 85, 86, 87)
11     (88, 89, 90, 91, 92, 93, 94, 95)
12     (96, 97, 98, 99, 100, 101, 102, 103)
13     (104, 105, 106, 107, 108, 109, 110, 111)
14     (112, 113, 114, 115, 116, 117, 118, 119)
15     (120, 121, 122, 123, 124, 125, 126, 127)

So, I see 6 cores and I'm confused. So why do I see 1 core with the kstat command but see 6 cores with ldm list -e <NAME of LDOM>?

If I log into the LDOM and do a psrinfo -pv, I see 6 cores which matches what ldm list -e <name of LDOM> on the Control Domain.

root@xxxxxxx0:~# psrinfo -pv
The physical processor has 6 cores and 48 virtual processors (0-47)
The core has 8 virtual processors (0-7)
The core has 8 virtual processors (8-15)
The core has 8 virtual processors (16-23)
The core has 8 virtual processors (24-31)
The core has 8 virtual processors (32-39)
The core has 8 virtual processors (40-47)
SPARC-T4 (chipid 0, clock 2848 MHz)

I have a client windows host that would like to connect to a Postgres database, issue a select query and return that query to the windows host a CSV file.

I do know that Postgres has a copy command that will work.

copy (SELECT * from foo) To '/tmp/forDavid.csv' with CSV DELIMITER ',';

And this customer will be accessing this SELECT query daily. The client windows host and the Postgres database is on an internal network.

I want to avoid using PHPMyAdmin because he is not savvy, I want this to be as simple as possible. I do know Perl but that would involve installing Perl on client windows host which I don't want to do.

What would be the easiest solution for this task?

I need to understand and resolve my issue. I know openswan works because when I connect from home network with an internal ip address of 10.0.0.97 to work's VPN, I'm able to ping but when I use the public xFinity wifi it indicates that the tunnel is up but I can't ping the internal hosts of my VPN.

When I'm successfully connected to the public Xfinity wifi, my IP is:

inet addr:10.232.204.146  Bcast:10.255.255.255  Mask:255.224.0.0

Here is route -n

root@ubuntu:/etc# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref      Use Iface
0.0.0.0         10.224.0.1      0.0.0.0         UG    0      0        0 wlan0
0.0.0.0         10.224.0.1      0.0.0.0         UG    0      0        0 wlan0
10.224.0.0      0.0.0.0         255.224.0.0     U     9      0        0 wlan0

When I"m at this point, I can ping and browse the internet fine.

When I start ipsec/openswan. I get.

root@ubuntu:/etc# /etc/init.d/ipsec status
IPsec running  - pluto pid: 4483
pluto pid 4483
1 tunnels up

But I can't ping my internal servers that have 192.168.1.xxx IPs.

Here is my ipsec.conf

    config setup

    dumpdir=/var/run/pluto/
    #
    # NAT-TRAVERSAL support, see README.NAT-Traversal
    #        nat_traversal=yes
    # exclude networks used on server side by adding %v4:!a.b.c.0/24
    # It seems that T-Mobile in the US and Rogers/Fido in Canada are
    # using 25/8 as "private" address space on their 3G network.
    # This range has not been announced via BGP (at least upto 2010-12-21)
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.1.0/24,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    # OE is now off by default. Uncomment and change to on, to enable.
    oe=off
    # which IPsec stack to use. auto will try netkey, then klips then mast
    #protostack=netkey
    # Use this to log to a file, or disable logging on embedded systems (like openwrt)
    plutostderrlog=/var/log/pluto
    plutodebug="all"
    protostack=netkey

    conn work
    authby=secret
    auto=start
    type=tunnel
    left=10.232.204.146
    leftsubnet=10.0.0.0/8
    right=99.xx.xx.xx
    rightsubnet=192.168.1.0/24
    ike=aes256-sha1,aes128-sha1,3des-sha1
    leftxauthusername=xxxxx

Here is my ipsec.secrets

@massivedude : XAUTH  "password"
10.232.204.146   vpnserver-01   : PSK "YouWillNeverKnow"

By the way, even though the tunnel is up and I can't ping internal hosts, I can still ping yahoo.com and google.com

Any help will be appreciated.

I just installed openswan on Ubuntu14. I'm trying to connect to my work's VPN (I have access to the Firewall/VPN btw). When I do a

/usr/sbin/ipsec verify

I get the following:

Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K4.4.0-53-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
  NETKEY:  Testing XFRM related proc values                     [OK]
[OK]
 [OK]
Hardware RNG detected, testing if used properly                 [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                              [FAILED]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                                 [WARNING]
Checking for 'iptables' command                                 [OK]

Opportunistic Encryption Support 
                       [DISABLED]

When I do a

/etc/init.d# /etc/init.d/ipsec status

I get the following

IPsec running  - pluto pid: 7702
pluto pid 7702
No tunnels up

However, I'm not connected to my VPN

Here is my ipsec.conf

config setup

    dumpdir=/var/run/pluto/
    #
    # NAT-TRAVERSAL support, see README.NAT-Traversal
    #        nat_traversal=yes
    # exclude networks used on server side by adding %v4:!a.b.c.0/24
    # It seems that T-Mobile in the US and Rogers/Fido in Canada are
    # using 25/8 as "private" address space on their 3G network.
    # This range has not been announced via BGP (at least upto 2010-12-21)
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.1.0/24,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    # OE is now off by default. Uncomment and change to on, to enable.
    oe=off
    # which IPsec stack to use. auto will try netkey, then klips then mast
    #protostack=netkey
    # Use this to log to a file, or disable logging on embedded systems (like openwrt)
    plutostderrlog=/var/log/pluto
    plutodebug="all"
    protostack=netkey

Here is ipsec.secrets

@admin : XAUTH  "xxxxxxxx"
%any   example.net   : PSK "xxxxxxxx"ny 

I also get the following errors in the pluto.log

ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)
ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists
ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)
ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type   already exists
ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)
| ESP registered with kernel.

Any help will be greatly appreciated.

I'm doing a

slackpkg update
slackpkg upgrade-all

and the copying from the mirror sites are taking too long; if I kill the process, will it start all over again?

Thank in advance.

I only want rsyslog to send the logs to the centralized rsyslog server but it is sending them locally as well. This is for legal reasons, the servers will not have a logs directory, only the centralized rsyslog server will have logs.

I thought by using '&~' in the client's rsyslog.conf, it will send logs remotely only but I am wrong.

Here is the centralized rsyslog server config:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability

module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$klogConsoleLogLevel 3

$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages

*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.*   ?TmplAuth
*.info,mail.none,authpriv.none,cron.none   ?TmplMsg

Here is the client config:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages &~
*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler
if $syslogfacility-text == 'local6' and $programname == 'httpd' then   /var/log/httpd-access.log
if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~
if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log
if $syslogfacility-text == 'local7' and $programname == 'httpd' then ~