Phuong Nguyen's questions

I'm having this in my /etc/sysconfig/docker-storage

DOCKER_STORAGE_OPTIONS="--storage-driver=overlay2"

Then I mount /dev/xdvcz to /var/lib/docker/overlay2. Then I do a df -h:

# df -h /dev/xvdcz
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme1n1    938G   72M  888G   1% /var/lib/docker/overlay2

That's correct, I have 1000G EBS device. Now I start docker with service docker start.

df -h report is now changing to:

# df -h /dev/xvdcz
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme1n1    7.8G  7.8G     0 100% /var/lib/docker/overlay2

Okay, stop docker: service docker stop

df -h report is now changing back to:

# df -h /dev/xvdcz
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme1n1    938G   72M  888G   1% /var/lib/docker/overlay2

We want to temporary disable reboot on update for a CoreOS machine, since we haven't implemented high availability of our services yet. Is there away to achieve that other than editing the cloud-init configuration (provided when the machine being provisioned the first time)

Does systemd restart the service or the system just refuse to let the service allocate more memory?

I'm having this definition file:

*filter

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:Firewall-INPUT - [0:0]
-A INPUT -j Firewall-INPUT
-A FORWARD -j Firewall-INPUT
-A Firewall-INPUT -i lo -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Ping
-A Firewall-INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Accept any established connections
-A Firewall-INPUT -m conntrack --ctstate  ESTABLISHED,RELATED -j ACCEPT

# Enable the traffic between the nodes of the cluster
-A Firewall-INPUT -s 10.0.1.1 -j ACCEPT

# Allow connections from docker container
-A Firewall-INPUT -i docker0 -j ACCEPT

# Accept ssh, http, https and git
-A Firewall-INPUT -m conntrack --ctstate NEW -m multiport -p tcp --dports 22,2222,80,443 -j ACCEPT

# Log and drop everything else
-A Firewall-INPUT -j LOG
-A Firewall-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

I then invoke iptables-restore with these rules:

/sbin/iptables-restore < /tmp/iptables-rules-save

After that, I run iptables -L and get this:

Chain INPUT (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain Firewall-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.1             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            ctstate NEW multiport dports ssh,EtherNet/IP-1,http,https
LOG        all  --  anywhere             anywhere            LOG level warning
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

As you can see it is adding a dangerous rule that accept all packets from any source to any interface on the server.

What is the wrong thing with my setup that lead to that? How to fix it?

P/S: I run this one on a Digital Ocean CentOS 6.5 droplet

I have monit configuration like this:

check process unicorn
with pidfile /tmp/pids/unicorn.0.pid
start program = "/etc/init.d/unicorn start"
stop program = "/etc/init.d/unicorn stop"
restart program = "/etc/init.d/unicorn reload"
if mem is greater than 250.0 MB for 2 cycles then restart
if cpu is greater than 22% for 3 cycles then alert
if cpu is greater than 25% for 2 cycles then restart

But look like whenever monit tries to reload the app (e.g due to memory > 250MB), it issues a stop and then a start, rather than use the restart program. Is there a way to tell monit to run the restart instead? Since issue a stop and a start cause the website to goes down for some moment.

I've just setup PostgreSQL (9.3) as a replication to another server. When I started it with service postgresql-9.3 start, it reported [FAILED] without any further explanation. I don't see any thing being reported to /var/lib/pgsql/9.3/pgstartup.log nor /var/lib/pgsql/9.3/data/pg_log. What should I do? (I'm on CentOS)

I've got a VPS with Centos 6.4 installed. I used to have a VPS at Digital Ocean that when I start PostgreSQL or Monit that bind to localhost, they all work fine. But on the new VPS, when I have PostgreSQL listen to "localhost", PostgreSQL is saying:

WARNING: could not create listen socket for "localhost"

And Monit, when I tell Monit to listen on "localhost", Monit is saying:

http server: Could not create a server socket at port 2812 -- Cannot assign requested address

I wonder what could be wrong on my VPS that lead to such behavior. If I have PostgreSQL listen on '*' instead of "localhost" then it runs just fine.

Update:

My ifconfig -a

eth0      Link encap:Ethernet  HWaddr 00:50:56:0A:01:3D
          inet addr:xxx.xx.xxx.xxx  Bcast:103.27.236.127  Mask:255.255.255.192
          inet6 addr: fe80::250:56ff:fe0a:13d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:198875 errors:0 dropped:0 overruns:0 frame:0
          TX packets:49492 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:135854898 (129.5 MiB)  TX bytes:7779876 (7.4 MiB)

lo        Link encap:Local Loopback
          LOOPBACK  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

My /etc/hosts

127.0.0.1               localhost.localdomain localhost localhost4 localhost4.localdomain4 CentOS64
::1             localhost localhost.localdomain localhost6.localdomain6 localhost6

I'm trying to run this on my CentOS: openssl ecparam -name secp256k1 -genkey

And I'm getting: unable to create curve (secp256k1)

I guess I need to update my openssl. But not sure how that can be done. I do a yum update openssl and it's reporting No Packages marked for Update.

How to install openssl that support secp256k1 on my CentOS?

Update: My openssl version -a:

OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:39:29 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic

My question: How to add a custom iptables rule to accept connection on a certain port?

I'm trying to open port 3500 on my server but failed. I started by using this command: (From http://wiki.centos.org/HowTos/Network/IPTables)

iptables -A INPUT -p tcp --dport 3500 -j ACCEPT

But then I run iptables -L I still do not see the new rules being listed: (My assumption it should include 3500 in the output)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:rtmp-port 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmptrap 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Edit So I try to insert ACCEPT rule to the INPUT chain and my iptables now look like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3500 
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

But it does not allow me to connect to 3500 from outside. (I can still telnet from inside). When I'm trying to telnet my_host 3500, I get this: telnet: Unable to connect to remote host: Connection refused

Edit 2: My netstat -an | grep "LISTEN " output:

tcp 0 0 127.0.0.1:3500 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:973 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 :::22 :::* LISTEN

Edit 3: I followed lain advise, also have my service bind to 0.0.0.0:3500 instead of 127.0.0.1:3500 and it works.

Given I have a raid 5 of /dev/sda, dev/sdb, /dev/sdc, now with the same size (said 250G) But later, /dev/sda failed, so I replaced it with /dev/sdd of 500G. What happens?

If Later I replace /dev/sdb with /dev/sde of 500G and /dev/sdc with /dev/sdf of 500G then what happen?

Will my array grow it capability?

Just in case for me (and others) when a software raid 5 degraded, how do I know which Sata Channel my dev/sda, /dev/sdb, etc. associated with, so that we can replace them properly?

I was having Ubuntu 10.04 Server running over a software raid 0. Yesterday, I left it running continuously for 10 hours, when I came back, the computer became weird. I cannot shut it down. It was saying "Bus error" or something similar to that. So I force a shutdown by holding power button for 4 seconds. Then I turn it on back. And here come disaster: The raid was broken. System kept dumping out "Failed command: READ DMA EXT". I tried to run fsck.ext4 /dev/md0 from the Alternate CD rescue mode, but fsck.ext4 then said: "Attempt to read block from filesystem resulted in short read". So I use a Hiren CD and run the hard drive scanner and find 12 bad sectors on second hard drive (and at the very end of the drive: more than 80% from the beginning I recall) The told the software to fix the 12 bad sectors but I doubt if Ubuntu understand the fix.

I again ran the Alternate CD rescue mode again, and did e2fsck /dev/sda but it was saying device or resource is busy.

God and geeks, how come that 12 bad sectors mess up my whole RAID. What should I do to have my RAID and Ubuntu work again?

P/S: Once I get stuff work back, I'll switch to RAID 5. I swear.

I'm trying to use mysql (command line utility) to connect to MySQL server through SSH tunnel. The problem is this MySQL client won't use my specified port. For example, I ran this:

$ mysql -uroot --port=1234

And it then just connected to port 3306.

Why does it do that?

How can I force this client to connect to port 1234 (then it should show me that port 1234 is not connectable).

My box encounter a power failure. After booting again, the ubuntu server (which I installed on the box) does not automatically acquire a Network IP (I didn't set a LAN-static ip for that box - the IP is generated by a router). I'm getting freaking because I cannot find a usb keyboard around the place (everyone at my place is using ps2 keyboard which my box does not support any more).

I'm gonna bring it back to my friend house to have thing fixed. However, can anyone help explaining why my Ubuntu 10.04 does not acquire an IP after a power failure? How can I prevent this behavior?

Can any body please explain the use of the key put in /etc/ssh/?

Recently, I did a distro upgrade on my Ubuntu 9.10. The process result in mnemosyne, my favorite flash cards program being removed, since it depends on python-qt3 - which was removed as a result of the upgrading process. When I tried to install python-qt3, I got this error message:

The following packages have unmet dependencies:
  python-qt3: Depends: python-sip4 (<= 4.10) but 4.10.0-0ubuntu1~karmic1~ppa1 is to be installed
E: Broken packages

In such cases, what should I try so that I can install back my mnemosyne?

I'm completely new to wireshark. I have Ubuntu on a Dell with wireless connection. When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed. What is the problem and how can I fix that?

Recently, due to some messy stuff with master boot record, I have to re-install my Ubuntu. Before doing that, I back up all folder (exclude root, bin, sbin, tmp, media, mnt) to a NTFS partition. After installation of Ubuntu, I copied back all the folder using a nautilus (running by sudo nautilus). After that, I reboot my computer. And boom, now I cannot run sudo any more, my network services cannot run. When I run sudo from a terminal, I ge "must be setuid root" error. In ubuntu, root account is disabled by default, I don't know why all these files is no longer under ownership of my account. How would I recover back?

I have a Linksys WRT54GS v7 with a dd-wrt (micro) installed on. When I try to view Active IP Connections, I see too many connection there. Interestingly, there are about 120 connections that originate from my computer. At that time, I have no download programming running, (no torrent). I only have an instance of Chrome, Eclipse, Skype, Empathy running. How come my apps consume such a large amount of connections? I'm running Ubuntu 9.10.

How would I setup my LinkSys WRT54GS v7 with dd-WRT installed on so that I can limit the download/upload speed of each client over the wireless network? (I don't want any guys to be able to download more than 50kBps).