Journeyman Geek's questions

We currently run our services in a series of LXD containers - we have one running a nginx server as a reverse proxy, pointing at each service, and where I need to connect to a container from the host or another container, I use the LXD assigned hostname. It works very well, and its extremely clean.

I'm currently looking at setting up grafana for monitoring in a container and hook in a prometheus instance in the host to feed it data. It would probably be helpful to be able to refer to the LXD host by a hostname - like I do for the containers for this and other projects. What would be the 'correct' way to refer to the host from a service running on a container?

I'm trying to set up letsencrypt on lighttpd from scratch. I currently run lighttpd on 16.10 xenial and want to move over existing sites to https from http. I know there's an automatic setup process for Apache and ngnix, but I'm disinclined to move things over. I have half a dozen hostnames, over a pair of domains hosted using virtualhosts, and with individual blocks per host.

How would I do this?

Since the hosting service that we use has a paltry 200 mb, we're using gmail as a repository of our mails. It works spectacularly well, for an ugly hack, but there have been incidents where mail has dissappeared off gmail. We haven't been affected, but i'd like to be as sure as possible.

We DO have a spare linux box that runs odds and ends that we can't use as a mail server proper since its on a dynamic ip address.

I'd like to 1) periodically download via imap or pop, email on a gmail account. Sent mails get forwarded there so its a non issue

2) add them to a mail account which can be accessed over IMAP - this will give us the option of using the same mail clients we use, re-export to gmail or other IMAP capable hosts, or an internal web client.

I'm not sure how to go about doing this, since most mailservers are mailservers, not backup boxes.

I'm currently running a few programmes - unreal, anope and the qwebirc web client on startup with crontab.

Anope dosen't take to a non graceful shutdown well, i use flat files for data as opposed to mysql and they corrupt often - i figure if i can get anope shutdown properly via the script it should solve it.

Approaches i suppose might work are using an init script, since crontab dosen't seem to have a @shutdown option, but i'd really like to do shut down apps at shutdown it at as the user i start at.

running ubuntu, but it should be the same on any box running linux

I'm currently working on hardening my servers against hacking- amongst other things, i'm getting a load of attempts to log on as root over ssh. While i've implemented fail2ban, i'm wondering, why root logons would be allowed by default to start with? Even with non sudo based distros, i can always log on as a normal user and switch - so i'm wondering is there any clear advantage to allowing root logons on ssh, or it just something no one bothers to change?

I'm working on writing a set of rules for fail2ban to make life a little more interesting for whoever is trying to bruteforce his way into my system. A good majority of the attempts tend to revolve around trying to get into phpinfo() via my webserver -as below

GET //pma/config/config.inc.php?p=phpinfo(); HTTP/1.1
GET //admin/config/config.inc.php?p=phpinfo(); HTTP/1.1
GET //dbadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1
GET //mysql/config/config.inc.php?p=phpinfo(); HTTP/1.1

I'm wondering if there's any valid reason for a user to attempt to access phpinfo() via apache, since if not, i can simply use that, or more specifically the regex

GET //[^>]+=phpinfo\(\)

as a filter to eliminate these attacks

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like:

66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 1170 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
200.78.247.148 - - [16/Mar/2010:15:26:05 +0800] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 506 "-" "-"
206.47.160.224 - - [16/Mar/2010:17:27:57 +0800] "GET / HTTP/1.1" 200 1170 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:02 +0800] "GET //phpmyadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:03 +0800] "GET //pma/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 476 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:04 +0800] "GET //admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 478 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:05 +0800] "GET //dbadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 479 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:05 +0800] "GET //mysql/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 479 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:06 +0800] "GET //php-my-admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 482 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"

What exactly is happening? Is it a really lame attempt at hacking in? Should I bother blocking the IP addresses these are from, or just leave it?

Edit: they apparently tried SSH as well. Amusingly they got nowhere near getting my name right. ;p

Just curious if this is possible. Lets assume i run a pair of irc servers (or anything else) on a system with different ports- i'd like to have something listen into a single port, and forward packets based on hostname - any connections to A.foo.bar should be forwarded to one port, and any connections to B.foo.bar should be forwarded to another. Most proxies seem to be for http, and well, that's not the use case i have in mind.

I'm currently running ubuntu server 9.04 and 10.04, though i'd be willing to switch to another free OS to do this.

I'm setting up a server for a small office, that is accessable from the internet. Since our ISP has a transparent proxy, most dynamic dns services fail, other than dyndns (who isn't our provider) so we use a script to set it manually- it connects to dyndns, fetches a web page with the info, strips the ip address out, and sets the ip address for a single domain via a web request to our actual dns provider. This whole process is run once an hour by crontab

If i wanted to extend this to more than one hostname, would it be a better idea to have one script running per hostname (ie, single script for obtaining the ip address, and one per hostname) or to have a single monolithic task for the whole thing?

I'm working on moving my current server setup to newer hardware, and migrating from ubuntu karmic koala to lucid lynx. Currently i'm using gw6c (compiled from the gogo6 website, as opposed to the version from the repositories) to get ipv6 access for my systems. On the karmic koala system, i used simple init.d script to get the ipv6 client started

 #! /bin/sh
/usr/local/gw6c/bin/gw6c -f /usr/local/gw6c/bin/gw6c.conf

I figured since this runs at any runlevel, it should translate to

respawn
console none

start on startup

stop on shutdown

script
exec /usr/local/gw6c/bin/gw6c -f /usr/local/gw6c/bin/gw6c.conf
emit free6_ipv6_started
end script

this works fine started from initctrl, but it apparently fails to start when it boots. - its status being stop/waiting. It works fine (and respawns) when started otherwise.Any ideas on where i'm going wrong, and what would be the appropriate 'start on' arguement?

EDIT: the exact error is 'init: gw6c main process (xxx) ended with status 8' followed by the process respawning , with xxx being a PID i suspect. I'm also half suspecting this is cause gw6c starts before networking does, and i need my eth0 up before gw6c is

I've just set up an IPV6 tunnel for my server (running Ubuntu Karmic Koala), with GO6 and I'm trying to work out use cases for it.

I have a dynamic ip address, and some wierd proxy setup that makes automatic DDNS currently not work with most providers - I periodically end up needing to do it manually

My webserver is already running IPv6, and other than that very few people have support for it (something I need to work at fixing!), its a lot less troublesome.

While I do have other options (Google apps), I'm pondering running an e mail server, and want to know if IPv4 'fails' due to port blocks, it'll switch over to IPv6, and how an IPv6 mailserver handles sending mail to an IPv4 system?