Rob's questions

I'm currently receiving a fairly large HTTP flood right now, and it's causing my nginx reverse proxy to produce a 502 Bad Gateway.

I have a frontend server running nginx as a proxy to my backend server, but it's just getting a bunch of connect() failed (110: Connection timed out) while connecting to upstream errors. Tons of them. If I bypass the proxy server to connect to the backend, I can run the site just fine, so I know it's in the reverse proxy somewhere. However, I have no idea how to determine why it's timing out.

Any help?

running nginx 1.2.3 on CentOS 6.2

Someone recently decided to show me a POC of a new Denial of Service method using SYN/TCP he's figured out. I thought it was complete nonsense, but after explaining to him about SYN-SYN/ACK-RST, he left me speechless. He told me "what if the server you're using to trick into sending the SYN/ACK packets can't receive the RST packet?"

I have no idea. He claims that the server will continue trying to send SYN/ACK packets, and that the packetrate will continue to build up.

Is there any truth to this? Can anyone elaborate?

Apparently, the way it works is this:

He spoofs the IP of the SYN packet to the target's IP. He then sends the SYN packet to a handful of random servers
They all reply with their SYN/ACK packet to the target IP, of course
The target responds with RST, as we know
BUT somehow he keeps the target from sending the RST or keeps the random servers from processing it
With this, apparently the servers will continue trying to send the SYN/ACK packets, thus producing a somewhat of a "snowball" effect.

For some reason, php-fpm keeps locking up and/or hanging. It works for a little while, and then it will randomly just 'hang' for a long time upon trying to load a webpage. There's absolutely nothing in my php-fpm.log about it, and I have no idea how to track down the problem otherwise. Can you guys help me track it down by pointing me in a new direction?

CentOS 6.2

[root@3AC19 ~]# php-fpm -v    
PHP 5.3.9 (fpm-fcgi) (built: Jul  5 2012 04:04:34)

I constantly have to set up new servers for an employer of mine for an exact purpose of his, and as such they all have to be set up in exactly the same way. So I've created a script in PHP that I run from my own box to automatically send over all the relevant files, compile everything, run updates, and everything else.

However, for some reason these brand new servers come with perl, which is fine, but they have perl installed in different locations. This makes it a pain for me to copy over Config.pm for CPAN without going in and finding the location manually.

Is there perhaps some command I'm unaware of that will hunt down the precise location?

If it helps, usually the servers are CentOS 5

I recently came under a DDoS attack. It was a SYN flood using spoofed IPs. Is it at all possible to trace the attack back to the actual sending server?

Right now I have this config:

location ~ ^/phpmyadmin/(.*)$
{
        alias /home/phpmyadmin/$1;
}

However, if I visit www.mysite.com/phpmyadmin (note the lack of trailing slash), it won't find what I'm looking for a 404. I assume because I don't include the trailing slash. How can I fix this?

I'm trying to set up an alias so when someone accesses /phpmyadmin/, nginx will pull it from /home/phpmyadmin/ rather than from the usual document root. However, everytime I pull up the URL, it gives me a 404 on all items not pulled through fastcgi. fastcgi seems to be working fine, whereas the rest is not. strace is telling me it's trying to pull everything else from the usual document root, yet I can't figure out why. Can anyone provide some insight?

Here is the relevant part of my config:

location ~ ^/phpmyadmin/(.+\.php)$
{
        include fcgi.conf;
        fastcgi_index index.php;
        fastcgi_pass  unix:/tmp/php-cgi.sock;
        fastcgi_param SCRIPT_FILENAME /home$fastcgi_script_name;
}

location /phpmyadmin
{
        alias /home/phpmyadmin/;
}

I'm trying to set up a global location in nginx. It all works perfectly right now, other than PHP scripts requiring fastcgi. They're running a 404.

Is there a way I can see the exact path it's accessing so I can try to debug this a bit and figure out what I'm doing wrong?

I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks all attacks other than HTTP floods. The problem is that I don't have SSH access to the Load Balancer to tell it to block attacking IPs, and by the time it reaches the cloud, the connecting IP is the load balancer's. However, the loadbalancer sends the client IP in a header. Is there some way I can set up my firewall to read (and block) ips from the header?

Using CentOS6.0 on the load balancer

I've been sitting here for a few hours now attempting to get sendmail to send the emails through an external SMTP server. I've gotten very close, but now I'm completely stuck. It seems that sendmail isn't sending the authentication information I've set. Is there some configuration line I'm missing?

Please help. :(

Running CentOS 5.7

EDIT:

As requested, I'll add a few things from my sendmail here.

Where I've specified to use auth information:

FEATURE(authinfo',hash -o /etc/mail/auth/client-info.db')dnl

/etc/mail/auth/client-info:

AuthInfo:in.mailjet.com "U:myusername" "P:mypassword" "M:PLAIN"

Attempting to send an email:

# sendmail -AM -t -v
to:[email protected]
from:[email protected]
.
[email protected]... Connecting to in6.mailjet.com. via relay...
220 in6.mailjet.com ESMTP Mailjet
>>> EHLO mydomain.com
250-in6.mailjet.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-AUTH=PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
>>> STARTTLS
220 2.0.0 Ready to start TLS
>>> EHLO mydomain.com
250-in6.mailjet.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-AUTH=PLAIN LOGIN DIGEST-MD5 CRAM-MD5
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
>>> MAIL From:<[email protected]> SIZE=37
250 2.1.0 Ok
>>> RCPT To:<[email protected]>
>>> DATA
554 5.7.1 <[email protected]>: Relay access denied
554 5.5.1 Error: no valid recipients
>>> RSET
250 2.0.0 Ok
/root/dead.letter... Saved message in /root/dead.letter
Closing connection to in6.mailjet.com.
>>> QUIT
221 2.0.0 Bye

My host has given me a new IP to use instead of the one I'm currently using. How can I set my server's IP from the old one to the new one?

Using CentOS 5.7, no control panels.

I'm trying to install the ssh2 extension for PHP, and after hours of working on it, I've near figured it out. I think.

It's compiled and the ssh2.so is in the correct directory and all. The problem, I believe, is version mismatches.

Here's the error it's spouting for me:

PHP Warning:  PHP Startup: ssh2: Unable to initialize module
Module compiled with module API=20050922, debug=0, thread-safety=0
PHP    compiled with module API=20060613, debug=0, thread-safety=0
These options need to match
 in Unknown on line 0

I'm pretty much at a dead end. How can I get the correct ssh2 module API?

Okay, so normally my sysadmin takes care of this, but he's been rather slack lately and I cannot wait any longer.

I've used PECL to install PHP's ssh2 extension. I've put the extension=ssh2.so in the php.ini and checked the ssh2.so is in the extension_dir. When I php -m | grep ssh2, it displays ssh2. When I run this script:

<?php

if (function_exists('ssh2_connect'))
{
    echo "true";
}

?>

and run it from the command line, it echos true.

When I run phpinfo() through the webserver, I can't find ssh2 anywhere. When I run ssh2_connect() through the webserver, it tells me that the function is undefined.

My OS is CentOS 5.7 PHP Version 5.2.14 nginx/0.7.67

I've been looking all over Google and tried everything I could find, but I can't figure it out. Can anyone help?

EDIT:

Just to keep you guys updated, Shish was right. I found a program php-fpm, that when called, seems to be what I'm looking for. However, it's failing to load the ssh2 extension due to mismatched API numbers

Starting php_fpm PHP Warning:  PHP Startup: ssh2: Unable to initialize module
Module compiled with module API=20050922, debug=0, thread-safety=0
PHP    compiled with module API=20060613, debug=0, thread-safety=0
These options need to match
 in Unknown on line 0
 done

After some short research, it seems it might be an issue of me installing the ssh2 module via PECL, and I believe my sysadmin compiled PHP from source.

Looking into it now.

EDIT:

After additional research, it appears two versions of PHP are installed on my system. One that I probably installed via yum, and one that my sysadmin probably installed. It appears php-fpm is loading the one he installed, and naturally my updates aren't affecting it. Perhaps I'll wait for him in case I screw something up.

EDIT:

On second thought, I'm just going to remove everything and try it myself. At worst I'll just need to get him to reinstall everything, and at best it'll work and I won't have to wait for him any longer. Wish me luck.

EDIT:

Nope. Scratch that. No idea what I'm doing. I think I hate my life. I have about 30 tabs open in Chrome now. I'm going to bed. Hopefully someone can provide further insight while I sleep.

EDIT:

Yup, probably destroyed everything. Gonna try to repair my damage and then let my sysadmin handle it again. Going to accept the current answer because, well, it was right. Past that was just problems with the module API mismatch.

Is there a way I can monitor incoming network traffic in real time on my server? Preferably in terms of *bps

Running Ubuntu

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I get around that?

My firewall is iptables, my distro is CentOS5.5.

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if so, how I can find the IP address of the attacker. I'd really like to pass the logs on to his ISP.

Thanks

I have PHP running as a DSO. As such, my installer script (which writes to a config file) can't do any writing.

How do I give apache (user: nobody) the ability to write to the file?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python script that would DoS a server using SYN packets with a spoofed IP address.

However, if you sent a SYN packet to a server, with a spoofed IP address, the target server would return the SYN/ACK packet to the host that was spoofed. In which case, wouldn't the spoofed host return an RST packet, thus negating the 75 second long-wait, and ultimately failing in its attempt to DoS the server?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python script that would DoS a server using SYN packets with a spoofed IP address.

However, if you sent a SYN packet to a server, with a spoofed IP address, the target server would return the SYN/ACK packet to the host that was spoofed. In which case, wouldn't the spoofed host return an RST packet, thus negating the 75 second long-wait, and ultimately failing in its attempt to DoS the server?

EDIT: And what if I'm not using SYN cookies?

Okay, I recently bought a dedicated server from santrex.net

If you go here: http://domaintoip.com/ip.php?domain=188.72.215.27

It displays the whois information for that IP, santrex.net

I want to modify my whois information, so that it displays my information instead, and doesn't link to santrex or santrex's ISP at all.

Is this possible? If so, how would I go about doing it?