Gaia's questions

Using either smartctl 7.0 or nvme 1.7, I get the following data from the SMART log

data_units_written                  : 350,371,149
host_write_commands                 : 2,974,115,785

Via smartctl, the first line also shows [179 TB], which is 350,371,149 x 512 = 179,369,326,592. This is Nand Bytes Written.

Write amplification is Nand Bytes Written/Host Bytes Written, but I am not sure how to derive Host Bytes Written from host_write_commands

If I multiply 2,974,115,785 (host_write_commands) x 32 (I got the 32 suggestion from here), I get 95,163,501,216, which is a WAF of 1.88 (179,369,326,592 / 95,163,501,216). This is a reasonable WAF value.

But I have no clue if host_write_commands should be multiplied by 32 to get the amount of host writes in bytes. Depending on how host_write_commands is interpreted, I can have WAF of 8.48 (if I just divide the values in the smart log) or 60.31 (don't even recall how I got this one), the former very high, the latter absurd.

If I get the number of bytes written from /proc/diskstats, I have 30,725,755,952, which gives me a WAF of 5.83 (high, 179,369,326,592 / 30,725,755,952). But /proc/diskstats does not persist across reboots, so it can't be applied in this case.

How do I derive the amount of bytes write requests by the host from host_write_commands? Intel's support is ofc useless in helping me.

Which is likely to be more reliable (safer data + lower downtime):

having 4 drives in RAID 1 OR having 2 drives in RAID 1 plus 2 spare(s)?

In other words, is there an advantage in having spares when you are setting up RAID 1 with 4 drives?

Background: this is MDADM raid on a current stable Linux distribution. Disks are enterprise grade. Partition in RAID 1 is the root partition (minimal writes), so write performance is not a problem. Hardware allows for hot swapping HDDs. On another partition of the same 4 HDDs I have RAID 10 running for write intensive applications.

On a SATA 3.0, 6.0 Gb/s

*-disk:0
       description: ATA Disk
       product: WDC WD20EFRX-68E
       vendor: Western Digital
       physical id: 0
       bus info: scsi@1:0.0.0

hw_sector_size: 512
logical_block_size: 512
physical_block_size: 4096

# parted /dev/sda print
Model: ATA WDC WD20EFRX-68E (scsi)
Disk /dev/sda: 2000GB
Sector size (logical/physical): 512B/4096B

I have the following fio results on an empty /dev/sda3 (ext4):

fio --name=seqread --rw=read --direct=1 --ioengine=libaio --bs=8k --numjobs=8 --size=1G --runtime=600  --group_reporting
seqread IOPS=8960, BW=70.0MiB/s (73.4MB/s)(8192MiB/117028msec)

fio --name=seqwrite --rw=write --direct=1 --ioengine=libaio --bs=32k --numjobs=4 --size=2G --runtime=600 --group_reporting
seqwrite IOPS=1538, BW=48.1MiB/s (50.4MB/s)(8192MiB/170345msec); 0 zone resets

fio --name=randread --rw=randread --direct=1 --ioengine=libaio --bs=8k --numjobs=16 --size=1G --runtime=600 --group_reporting
randread IOPS=163, BW=1305KiB/s (1337kB/s)(765MiB/600078msec)

fio --name=randwrite --rw=randwrite --direct=1 --ioengine=libaio --bs=64k --numjobs=8 --size=512m --runtime=600 --group_reporting
randwrite IOPS=165, BW=10.3MiB/s (10.8MB/s)(4096MiB/395912msec); 0 zone resets

fio --name=randrw --rw=randrw --direct=1 --ioengine=libaio --bs=16k --numjobs=8 --rwmixread=90 --size=1G --runtime=600 --group_reporting
randrw read IOPS=141, BW=2258KiB/s (2313kB/s)(1324MiB/600086msec)
randrw write IOPS=15, BW=253KiB/s (259kB/s)(148MiB/600086msec); 0 zone resets

At first I thought I had incorrect sector alignment,

Number  Start          End             Size            File system  Name              Flags
 1      1048576B       511705087B      510656512B      fat32                          boot, esp
 2      511705088B     54198796287B    53687091200B                                   raid
 3      54198796288B   215260069887B   161061273600B   ext4         Linux filesystem
 4      215260069888B  2000398917119B  1785138847232B               Linux RAID        raid

but all start sectors are divisible by 4096, and parted tells me that

(parted) align-check opt 1
1 aligned
(parted) align-check opt 2
2 aligned
(parted) align-check opt 3
3 aligned
(parted) align-check opt 4
4 aligned

SMART looks good:

These fio results are similar with the system running on Debian 10 and an Arch Linux Live cd. These are not the fastest spinners, so I can live with the sequential results (though they should be higher) but the random R, W and RW results are unacceptable.

Kernel is 5.0.x (5.2.x in the live CD), and the scheduler is the default (and recommended)

# cat /sys/block/sda/queue/scheduler
[mq-deadline] none

Changing the scheduler to BFQ did not help.

AFAIK the sector alignment is fine, but either I am missing something or I have some defective drives (which are brand new and under warranty). <200 IOPS and <2.5MB/s renders the system unusable at times.

I am at loss here. How do I fix this? Or do I have defective drives (unlikely, since these are two identical drives with similar results) ?

There seems to be conflicting information on how to mount a swapfile.

swap swap:

none swap:

both:

Both ways work. What is the official recommendation and how does each way affect swapping?

I want to use an ubuntu 18.04 box (at 192.168.1.50) running a WireGuard client for a commercial VPN as gateway to the LAN. WG is using wg-quick and enabled as a service. Unbound is installed and systemd-resolved is set to DNSStubListener=no. resolv.conf is set to use the same DNS server designated by the VPN provider (per wg0.conf).

The main router is at 192.168.1.1 and blocks external access to the VPN gateway (I know INPUT is open).

The gateway is working, but the IPtables rules need work. How to tighten the rules when the goal is only to allow the box to work as a gateway? I want to use IPtables only for the config necessary to make this work, all else should go in UFW, which is not yet installed. These IPtables rules will be placed in wg0.conf's PostUp/PostDown.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  192.168.1.0/24       anywhere             tcp dpt:domain
ACCEPT     udp  --  192.168.1.0/24       anywhere             udp dpt:domain
DROP       udp  --  anywhere             anywhere             udp dpt:domain
DROP       tcp  --  anywhere             anywhere             tcp dpt:domain

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

UPDATE: Although the config above works, I've flushed iptables to start anew.

Ubuntu 16.04.5 with kernel 4.4 used to work as intended: IPv4 is default. Since changing to kernel (hwe) 4.15, it uses IPv6 as default.

It has IPv6 available via Tunnelbroker, broadcasted by the router.

It is now defaulting to IPv6: curl ifconfig.co returns the machine's IPv6. Only curl -4 ifconfig.co returns the desired IPv4 address. (curl -6 ifconfig.co as expected returns IPv6)

$ ip rule list
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

$ ip -6 rule list
0:      from all lookup local
32766:  from all lookup main

$ ip route list
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.x

$ ip -6 route list
2001:470:x:999::9999:f6a dev eth0  proto kernel  metric 256  pref medium
2001:470:x:999::/64 dev eth0  proto kernel  metric 256  expires 42905sec pref medium
fe80::/64 dev eth0  proto kernel  metric 256  pref medium
default via fe80::2ac6:8eff:fe65:d117 dev eth0  proto ra  metric 1024  expires 1505sec hoplimit 64 pref medium

PS: Some providers still report IPv4, for example curl ipinfo.io/ip. I've used ifconfig.co for a long time, so I am not sure if they changed their setup (less likely) or the kernel upgrade makes Ubuntu prefer IPv6.

How do I find out what is causing IPv6 to be preferred?

In the scenario described here, I ended up with this config in the client (the endpoint WG server has two public IPs)

[Interface]
Address = <ip_to_use>/32
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
AllowedIPs = 0.0.0.0/0
Endpoint = <wg_server_ip>:51820
PersistentKeepalive = 10

Now I would like to exclude from the Wireguard tunnel either all processes from an user or all packets (to and from) certain ports.

It has been brought to my attention that this can be done using the fwmark set by WG itself, and I don't need to use another mark, as suggested here.

This is IPtables 1.6 on Ubuntu 16.04. How can I exclude from the WG tunnel, using the mark created by wg-quick, either per user or per port?

I have the following policy in place:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUserToSeeBucketListInTheConsole",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "AllooUserFullAccessToBucket",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        }
    ]
}

While accessing the bucket via Key/Secret (using Cloudberry Explorer) I can:

• List all buckets
• List, download, upload and delete into mybucket, but only if this also is in place over at bucket permissions:

OR

I have need to add another item to the policy to do away with the bucket level permission requirement:

{
    "Sid": "AllooUserFullAccessToBucketPre",
    "Effect": "Allow",
    "Action": [
        "s3:*"
    ],
    "Resource": [
        "arn:aws:s3:::mybucket"
    ]
},

Is there syntax that would enable to have only 2 items (AllowUserToSeeBucketListInTheConsole & a single AllooUserFullAccessToBucket) in the policy while not requiring the bucket level permission?

On Ubuntu 16.04.1 running:

rsyslogd 8.16.0, compiled with:
        PLATFORM:                               x86_64-pc-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

with:

#rsyslogd -N1
rsyslogd: version 8.16.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]

Hangs upon service stop if the below config is in effect:

$ModLoad imfile

##########
# MySQL slow query log (standard log is autosent to syslog):

$InputFileName /var/log/mysql/mysql-slow.log
$InputFileTag mysqld_slow:
$InputFileStateFile state-mysqld_slow
$InputFileSeverity info
$InputRunFileMonitor

##########
# Apache access:

###
$InputFileName /var/log/virtualmin/mysite.com_access_log
$InputFileTag www-access-mysite.com:
$InputFileStateFile state-www-access-mysite.com
$InputFileSeverity info
$InputRunFileMonitor


##########
# Apache Error:

###
$InputFileName /var/log/virtualmin/mysite.com_error_log
$InputFileTag www-errors-mysite.org:
$InputFileStateFile state-www-errors-mysite.com
$InputFileSeverity error
$InputRunFileMonitor

### Main Error Log
$InputFileName /var/log/apache2/error.log
$InputFileTag www-errors-main:
$InputFileStateFile state-www-errors
$InputFileSeverity error
$InputRunFileMonitor

# Setup disk assisted queues
$ActionQueueFileName fwdRule1     # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g       # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on     # save messages to disk on shutdown
$ActionQueueType LinkedList       # run asynchronously
$ActionResumeRetryCount -1        # infinite retries if host is down

#RsyslogGnuTLS
$DefaultNetstreamDriverCAFile /etc/rsyslog.d/keys/ca.d/certs.crt

###
###First BLOCK
###

template(name="access" type="string" string="<%pri%>%protocol-version% %timestamp:::date-rfc3339% Host1 %app-name% %procid% %msgid% [id@40000 tag=\"access\"] %msg%\n")
template(name="errors" type="string" string="<%pri%>%protocol-version% %timestamp:::date-rfc3339% Host1 %app-name% %procid% %msgid% [id@40000 tag=\"errors\"] %msg%\n")

# Send messages over TCP using the template.
:syslogtag, startswith, "www-access" action(type="omfwd" protocol="tcp" target="logs.com" port="6000" template="access" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.com")

:syslogtag, startswith, "www-error" action(type="omfwd" protocol="tcp" target="logs.com" port="6000" template="errors" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.com")

###
###Second BLOCK
###

template(name="standard" type="string" string="<%pri%>%protocol-version% %timestamp:::date-rfc3339% Host1 %app-name% %procid% %msgid% %msg%\n")

# Send messages over TCP using the template.
:syslogtag, startswith, "www-access" action(type="omfwd" protocol="tcp" target="logs.other.com" port="38549" template="standard" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.other.com")
:syslogtag, startswith, "www-errors" action(type="omfwd" protocol="tcp" target="logs.other.com" port="38549" template="standard" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.other.com")
:syslogtag, startswith, "mysqld" action(type="omfwd" protocol="tcp" target="logs.other.com" port="38549" template="standard" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.other.com")

And if ran via rsyslogd -dn you can see:

9744.300605710:main thread    : main Q: EnqueueMsg advised worker start
9744.300724026:main thread    : Terminating main queue...                                                                                                 9744.300734161:main thread    : main Q: initiating worker thread shutdown sequence
9744.300739666:main thread    : main Q: trying shutdown of regular workers
9744.300766918:main thread    : sent SIGTTIN to worker thread 0x9b57a700
9744.300776037:main Q:Reg/w0  : wti 0x16756a0: worker awoke from idle processing
9744.300782296:main Q:Reg/w0  : DeleteProcessedBatch: we deleted 0 objects and enqueued 0 objects
9744.300786960:main Q:Reg/w0  : doDeleteBatch: delete batch from store, new sizes: log 0, phys 0
9744.300791987:main Q:Reg/w0  : regular consumer finished, iret=4, szlog 0 sz phys 0
9744.300797344:main Q:Reg/w0  : wti 0x16756a0: terminating worker terminateRet=5, bInactivityTOOccured=0
9744.300803075:main Q:Reg/w0  : DDDD: wti 0x16756a0: worker cleanup action instances
9744.300807699:main Q:Reg/w0  : wti 0x16756a0, action 0, ptr 0x7f1394004210
9744.300825960:main Q:Reg/w0  : wti 0x16756a0, action 1, ptr 0x7f1394038f80
9744.300835440:main Q:Reg/w0  : wti 0x16756a0, action 2, ptr 0x7f13940022a0
9744.300875784:main Q:Reg/w0  : wti 0x16756a0, action 3, ptr 0x7f1394004470
9744.300885088:main Q:Reg/w0  : wti 0x16756a0, action 4, ptr (nil)
9744.300890048:main Q:Reg/w0  : wti 0x16756a0, action 5, ptr (nil)
9744.300894505:main Q:Reg/w0  : wti 0x16756a0, action 6, ptr (nil)
9744.300898883:main Q:Reg/w0  : wti 0x16756a0, action 7, ptr (nil)
9744.300903665:main Q:Reg/w0  : wti 0x16756a0, action 8, ptr (nil)
9744.300908515:main Q:Reg/w0  : wti 0x16756a0, action 9, ptr (nil)
9744.300912910:main Q:Reg/w0  : wti 0x16756a0, action 10, ptr 0x7f13940023f0
9744.300918720:main Q:Reg/w0  : wti 0x16756a0, action 11, ptr 0x7f13940068f0
9744.300941837:main Q:Reg/w0  : wti 0x16756a0, action 12, ptr 0x7f13940504b0
9744.300951981:main Q:Reg/w0  : wti 0x16756a0, action 13, ptr 0x7f1394462e10
9744.301055305:main thread    : main Q:Reg: waiting 1499ms on worker thread termination, 1 still running
9745.800919600:main thread    : main Q:Reg: timeout waiting on worker thread termination
9745.800976996:main thread    : sent SIGTTIN to worker thread 0x9b57a700
9745.801024045:main thread    : main Q: regular shutdown timed out on primary queue (this is OK)
9745.801030518:main thread    : main Q: checking to see if we need to cancel any worker threads of the primary queue
9745.801035688:main thread    : sent SIGTTIN to worker thread 0x9b57a700, giving it a chance to terminate
9745.811204331:main thread    : cooperative worker termination failed, using cancellation...
9745.811246502:main thread    : wti 0x16756a0: canceling worker thread

I already tried starting/stopping with the firewall off, according to the suggestion in this thread in the support forum (where I got no help)

The tail end of strace shows

6700  14:13:02 write(6, "Oct  6 14:13:02 hostname rsyslogd: [origin software=\"rsyslogd\" swVersion=\"8.16.0\" x-pid=\"6696\" x-info=\"http://www.rsyslog.com\"] exiting on signal 15.\n", 146) = 146
6700  14:13:02 futex(0x1a3516c, FUTEX_WAIT_PRIVATE, 99, NULL <unfinished ...>
6696  14:13:02 <... futex resumed> )    = 1
6696  14:13:02 futex(0x1a3516c, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x1a35168, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1} <unfinished ...>
6700  14:13:02 <... futex resumed> )    = 0
6700  14:13:02 futex(0x1a34f80, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...>
6696  14:13:02 <... futex resumed> )    = 1
6696  14:13:02 tgkill(6696, 6700, SIGTTIN <unfinished ...>
6700  14:13:02 <... futex resumed> )    = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
6700  14:13:02 --- SIGTTIN {si_signo=SIGTTIN, si_code=SI_TKILL, si_pid=6696, si_uid=104} ---
6700  14:13:02 rt_sigreturn({mask=~[KILL STOP TTIN RTMIN RT_1]}) = -1 EINTR (Interrupted system call)
6700  14:13:02 futex(0x1a34f80, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...>
6696  14:13:02 <... tgkill resumed> )   = 0
6696  14:13:02 futex(0x1a34f80, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
6700  14:13:02 <... futex resumed> )    = 0
6700  14:13:02 futex(0x1a34f80, FUTEX_WAKE_PRIVATE, 1) = 0
6700  14:13:02 writev(14, [{"\25\3\3\0\32\0\0\0\0\0\0\1qv\373\273}\275\276\252\207\\~\7\343p\237[\343'\363", 31}], 1) = 31
6700  14:13:02 recvfrom(14,  <unfinished ...>
6696  14:13:02 <... futex resumed> )    = 1
6696  14:13:02 futex(0x1a35014, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, {1475763183, 729652779}, ffffffff <unfinished ...>
6700  14:13:02 <... recvfrom resumed> "\25\3\3\0\32", 5, 0, NULL, NULL) = 5
6700  14:13:02 mprotect(0x7fd3145d8000, 16384, PROT_READ|PROT_WRITE) = 0
6700  14:13:02 recvfrom(14, "w_\345'\310\3473\3\\q\32 \37\276\237A\270a\260\200\24\34p\262G\277", 26, 0, NULL, NULL) = 26
6700  14:13:02 close(14)                = 0
6700  14:13:02 writev(25, [{"\25\3\3\0\32\0\0\0\0\0\0\1\20\3535\fh\5\324bZ\211U\203AX.\37\205`m", 31}], 1) = 31
6700  14:13:02 recvfrom(25, "\25\3\3\0\32", 5, 0, NULL, NULL) = 5
6700  14:13:02 recvfrom(25, "\307y\343\27z#\31\373\232\333\371\263\275R\203\31\332?)>\201\245\301z\335;", 26, 0, NULL, NULL) = 26
6700  14:13:02 close(25)                = 0
6700  14:13:02 writev(24, [{"\25\3\3\0000\26f\310\217\23\247d?\4\3\301\252\277+\207\250q[9L\306\274\2414}\306\237\253X\221\35\27:\376\206\203\36PP\177\363\362I\321\223\372\203W", 53}], 1) = 53
6700  14:13:02 recvfrom(24,  <unfinished ...>
6696  14:13:03 <... futex resumed> )    = -1 ETIMEDOUT (Connection timed out)
6696  14:13:03 tgkill(6696, 6700, SIGTTIN) = 0
6700  14:13:03 <... recvfrom resumed> 0x7fd31449c17b, 5, 0, NULL, NULL) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
6700  14:13:03 --- SIGTTIN {si_signo=SIGTTIN, si_code=SI_TKILL, si_pid=6696, si_uid=104} ---
6700  14:13:03 rt_sigreturn({mask=~[KILL STOP TTIN RTMIN RT_1]}) = -1 EINTR (Interrupted system call)
6700  14:13:03 recvfrom(24,  <unfinished ...>
6696  14:13:03 futex(0x1a34fe8, FUTEX_WAKE_PRIVATE, 1) = 0
6696  14:13:03 tgkill(6696, 6700, SIGTTIN) = 0
6700  14:13:03 <... recvfrom resumed> 0x7fd31449c17b, 5, 0, NULL, NULL) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
6700  14:13:03 --- SIGTTIN {si_signo=SIGTTIN, si_code=SI_TKILL, si_pid=6696, si_uid=104} ---
6700  14:13:03 rt_sigreturn({mask=~[KILL STOP TTIN RTMIN RT_1]}) = -1 EINTR (Interrupted system call)
6700  14:13:03 recvfrom(24,  <unfinished ...>
6696  14:13:03 select(0, NULL, NULL, NULL, {0, 10000}) = 0 (Timeout.)
6696  14:13:03 select(0, NULL, NULL, NULL, {0, 10000}) = 0 (Timeout.)
6696  14:13:03 select(0, NULL, NULL, NULL, {0, 10000}) = 0 (Timeout.)
6696  14:13:03 select(0, NULL, NULL, NULL, {0, 10000}) = 0 (Timeout.)
.
.
.
and it repeats until
6696  14:14:32 select(0, NULL, NULL, NULL, 0x7ffe5e77b200 <ptrace(SYSCALL):No such process>
6700  14:14:32 +++ killed by SIGKILL +++
6696  14:14:32 +++ killed by SIGKILL +++

For the SSL cert on the domain example.com, some tests tell me that the chain is incomplete and since Firefox keeps its own certificate store, it might fail on Mozilla (1, 2, 3). Others tell me it is fine, as does Firefox 36, which tells me that the cert chain is fine.

UPDATE: I tested on Opera, Safari, Chrome and IE on both Windows XP and MacOS X Snow Leopard, they all work fine. It only fails on Firefox < 36 on both OSes. I dont have access to test on Linux, but for this website it is less than 1% of visitors, and most are probably bots. So, this answers the original questions "does this setup bring up warnings in Mozilla Firefox or not" and "Is this SSL certificate chain broken or not?".

Therefore, the question is how do I find out which certs do I need to place in the ssl.ca file so they can be served by Apache to keep Firefox < 36 from choking?

PS: As a side note, the Firefox 36 I used to test the cert was a brand new install. There is no chance it didn't complain because it had downloaded an intermediate cert during a previous visit to a site that uses the same chain.

In the global config section for Apache 2.2.15, I have the following (per recommendation)

<IfModule mod_headers.c>
Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" env=HTTPS
</IfModule>

I would like to add this header only when the request is NOT for a specific host (dev.host.com). Which directive do I use to make header add occur only when not for a specific host?

PS: The second part of this question has been moved.

I have two parallel versions of PHP installed on CentOS 6.5 via this method

[root@host ~]# php -i | grep "PHP Version"
PHP Version => 5.3.3
[root@host ~]# /opt/rh/php54/root/usr/bin/php -i | grep "PHP Version"
PHP Version => 5.4.16

The installs came from

[root@host ~]# rpm -q php php-mcrypt
php-5.3.3-27.el6_5.1.x86_64
php-mcrypt-5.3.3-3.el6.x86_64
[root@host ~]# rpm -q php54 php54-mcrypt
php54-1-7.el6.centos.alt.x86_64
package php54-mcrypt is not installed
[root@host ~]# rpm -q libmcrypt
libmcrypt-2.5.8-4.el6.art.x86_64
[root@host ~]# rpm -q libmcrypt-devel
libmcrypt-devel-2.5.8-4.el6.art.x86_64

On sites running PHP 5.3.3, mcrypt works fine. I need to make mcrypt available to the sites running 5.4.16. Naturally I tried yum install php54-mcrypt, but that returns No package php54-mcrypt available.. The following repos are enabled:

asl-4.0 
base 
epel 
extras 
scl 
updates 
virtualmin 
virtualmin-universal

So I searched for an RPM, and found this one. But if I try to install this RPM, it tries to update the currrent PHP mcrypt, which I need to keep running for sites on 5.3.3. I'm under the impression that php-mcrypt needs to be an exact to the php version and it's not backwards compatible.

I need to install mcrypt for PHP 5.4.16, where PHPZTS="" and PHPAPI=20100525. How can I do this?

Using rsyslog v8.2.2, I would like to group multi-line messages, such as those output by the MySQL Slow Query log.

Each new message begins with three consecutive lines having '#' as the first char of the line, though some messages have only two lines having a '#' at the beginning of the message. (I suspect queries triggered by PHP cli, instead of standard PHP, do not carry the # Time: stamp). Example:

# Time: 140817  0:59:22
# User@Host: root[root] @ localhost []
# Query_time: 5.864315  Lock_time: 0.000033 Rows_sent: 857715  Rows_examined: 857715
SET timestamp=1408237162;
SELECT /*!40001 SQL_NO_CACHE */ * FROM `sales_flat_quote_shipping_rate`;
# Time: 140817  1:00:06
# User@Host: user2[user2] @ localhost []
# Query_time: 4.070595  Lock_time: 0.000068 Rows_sent: 0  Rows_examined: 1536
use db2;
SET timestamp=1408237206;
DELETE FROM `catalog_product_index_price_idx`;
# User@Host: db3[db3] @ localhost []
# Query_time: 3.892674  Lock_time: 0.046493 Rows_sent: 0  Rows_examined: 659
use db3;
SET timestamp=1408237206;
UPDATE user SET cert = 'yes' WHERE site_id < 10;
# Time: 140817  1:00:06
# User@Host: user2[user2] @ localhost []
# Query_time: 4.070595  Lock_time: 0.000068 Rows_sent: 0  Rows_examined: 1536
use db2;
SET timestamp=1408237206;
DELETE FROM `catalog_product_index_price_idx`;
# User@Host: db3[db3] @ localhost []
# Query_time: 3.892674  Lock_time: 0.046493 Rows_sent: 0  Rows_examined: 659
use db3;
SET timestamp=1408237206;
UPDATE user SET cert = 'yes' WHERE site_id < 10;

How do I configure rsyslog to send them over as a single message?

On CentOS 6.5, du -sk /home and sh -c (du -sk \/home) 2>/dev/null run because a scheduled disk usage for /home, but du is causing 100% CPU usage. Plus, before it's even finished, another du gets run and it piles up, bringing the system down to its knees.

I've since disabled the automated checks, but I can't run du -sk /home manually either. du runs fine (fast) on other directories (though /home is the largest - 4912620 - it shouldn't take as long as it does)

I would like to find out why is DU causing high CPU usage on /home

UPDATE 1: A full restart (host+guest) solved the problem.

UPDATE 2: Problem came back. While du is running, CPU usage is split nearly half and half between (us) and (sy). (wa) never creeps over 1%. Also, IOWAIT shows only disk writes?

I have GET and POST requests, both HTTP 1.0 and 1.1, to diverse URLs, mostly running Wordpress(1), which occasionally fail with a 500(2). No user has ever encountered a 500 themselves, nor have visitors ever reported one. But they do show up in the logs. Most of the time, the error is in connection with a bot request (decent bots too, including googlebot, bingbot). All User-Agents that do not seem to be a bot include the Linux string.

The only common thread I can infer across all these 500s is the bot/linux UAs connection.

What else could I try in order to figure out why these specific requests are failing?

16Gb RAM (rarely uses up more than 3GB)
8 cores, rarely goes above 0.50
Apache 2.2.15
mod_fgcid 2.3.7
CentOS 6.4
Kernel 2.6.32

TimeOut 60
KeepAlive on
MaxKeepAliveRequests 100
KeepAliveTimeout 5

<IfModule prefork.c>
StartServers       2
MinSpareServers    2
MaxSpareServers   5
ServerLimit      120
MaxClients      120
MaxRequestsPerChild  4000
</IfModule>

Loaded Modules:
 core_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_file_module (shared)
 authn_alias_module (shared)
 authn_anon_module (shared)
 authn_dbm_module (shared)
 authn_default_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 authz_owner_module (shared)
 authz_groupfile_module (shared)
 authz_dbm_module (shared)
 authz_default_module (shared)
 include_module (shared)
 log_config_module (shared)
 env_module (shared)
 ext_filter_module (shared)
 mime_magic_module (shared)
 expires_module (shared)
 deflate_module (shared)
 headers_module (shared)
 setenvif_module (shared)
 mime_module (shared)
 autoindex_module (shared)
 vhost_alias_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 speling_module (shared)
 alias_module (shared)
 substitute_module (shared)
 rewrite_module (shared)
 cache_module (shared)
 suexec_module (shared)
 disk_cache_module (shared)
 cgi_module (shared)
 version_module (shared)
 cloudflare_module (shared)
 sed_module (shared)
 security2_module (shared)
 unique_id_module (shared)
 fcgid_module (shared)
 evasive20_module (shared)
 php5_module (shared)
 ssl_module (shared)

1) Some of these Wordpress sites are running W3TC, others are not. Some vhosts are running Magento, but they get so few 500s I'm gonna write them off as bad requests.

2) I have setup log monitoring and I get emailed when 500s occur.

PS: If this question gets moved to Wordpress.SO or Webmasters.SO I might as well delete it. I will never get a decent answer there...

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions.

UPDATE: A, B and C are the only ones pending an answer.

A) I would like to use as few queues (and resources) as possible. I send error logs to server A, send access logs to server A, send both logs in one stream to server B. Should I specify one queue per external service (2 queues) or one queue per stream (3 queues, as I have now)? This is what I have:

$ActionResumeInterval 10
$ActionQueueSize 100000
$ActionQueueDiscardMark 97500
$ActionQueueHighWaterMark 80000
$ActionQueueType LinkedList
$ActionQueueFileName logglyaccessqueue
$ActionQueueCheckpointInterval 100
$ActionQueueMaxDiskSpace 1g
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ActionQueueTimeoutEnqueue 10
$ActionQueueDiscardSeverity 0
if $syslogtag startswith 'www-access' then @@logs-01.loggly.com:514;logglyaccess

$ActionResumeInterval 10
$ActionQueueSize 100000
$ActionQueueDiscardMark 97500
$ActionQueueHighWaterMark 80000
$ActionQueueType LinkedList
$ActionQueueFileName logglyerrorsqueue
$ActionQueueCheckpointInterval 100
$ActionQueueMaxDiskSpace 1g
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ActionQueueTimeoutEnqueue 10
$ActionQueueDiscardSeverity 0
if $syslogtag startswith 'www-errors' then @@logs-01.loggly.com:514;logglyerrors

$DefaultNetstreamDriverCAFile /etc/syslog.papertrail.crt # trust these CAs
$ActionSendStreamDriver gtls # use gtls netstream driver
$ActionSendStreamDriverMode 1 # require TLS
$ActionSendStreamDriverAuthMode x509/name # authenticate by hostname
$ActionResumeInterval 10
$ActionQueueSize 100000
$ActionQueueDiscardMark 97500
$ActionQueueHighWaterMark 80000
$ActionQueueType LinkedList
$ActionQueueFileName papertrailqueue
$ActionQueueCheckpointInterval 100
$ActionQueueMaxDiskSpace 1g
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ActionQueueTimeoutEnqueue 10
$ActionQueueDiscardSeverity 0
*.* @@logs.papertrailapp.com:XXXXX;papertrailstandard & ~

B) Does a queue block get used over and over by every send action that follows it or only by the first one or only until it encounters a send followed by a discard action (~)?

C) How do I reset a queue block so that an upcoming send action does not use a queue at all?

D) Does a TLS block get used over and over by every send action that follows it or only by the first one or only until it encounters a send followed by a discard action (~)?

E) How do I reset a TLS block so that an upcoming send action does not use TLS at all?

F) If I run rsyslog -N1 I get:

rsyslogd -N1
rsyslogd: version 5.8.10, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c5 as the first rsyslogd option.
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad immark
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: MarkMessagePeriod 1200
rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock
rsyslogd: End of config validation run. Bye.

Where do I place the -c5 so that it doesnt run in compatibility mode anymore?

Regarding my particular APC setup:

APC 3.1.9
PHP 5.3.3/fCGI/SuEXEC
Apache 2.2.15
CentOS 6.3

I would like to keep only one copy of apc.php that can be accessed via any of the vhosts on the server. What's the recommended way to do this?

It seems that apc.php doesn't play well with apache Alias directive. apc.php only exists is on one of the vhosts, is set to 644 and it doesn't seem to matter who owns it: if I try to access it via an alias I get only gibberish:

Do I really need to use a symbolic link for this purpose or can I make an Apache alias work?

I'm obviously not the first one to have this problem, but I cannot not find an answer to this situation.

I want to lock down PHP a bit, more specifically the use of disable_functions. The environment is CentOS 6.2/PHP 5.3.3 fcgid/Apache 2.2.15:

1. Whats the proper apache config (AllowOverride, etc) to disable any PHP setting to be changed via .htaccess? All other overrides are ok (current setting is AllowOverride All)

2. Whats the proper config to forbid effective use of disable_functions in all but the master php.ini (as in forbid use of disable_functions in /home/myvhost/etc/php5/php.ini or any directory within in that vhost public_html. another way to say this: the only effective disable_functions comes from the master php.ini)?

3. If #2 is not possible, at least whats the proper config to disallow a vhost owner to effectively use any php.ini but the vhost main one (/home/myvhost/etc/php5/php.ini)?

Thanks

Each Apache process is using about 70MB of private/rss memory, so I would like to lean them up a bit. The server runs Magento and Wordpress only. PHP is run as fcgid.

Which modules would you consider safe to disable?

Loaded Modules:

core_module (static)

mpm_prefork_module (static)

http_module (static)

so_module (static)

auth_basic_module (shared)

auth_digest_module (shared)

authn_file_module (shared)

authn_alias_module (shared)

authn_anon_module (shared)

authn_dbm_module (shared)

authn_default_module (shared)

authz_host_module (shared)

authz_user_module (shared)

authz_owner_module (shared)

authz_groupfile_module (shared)

authz_dbm_module (shared)

authz_default_module (shared)

ldap_module (shared)

authnz_ldap_module (shared)

include_module (shared)

log_config_module (shared)

logio_module (shared)

env_module (shared)

ext_filter_module (shared)

mime_magic_module (shared)

expires_module (shared)

deflate_module (shared)

headers_module (shared)

usertrack_module (shared)

setenvif_module (shared)

mime_module (shared)

dav_module (shared)

status_module (shared)

autoindex_module (shared)

info_module (shared)

dav_fs_module (shared)

vhost_alias_module (shared)

negotiation_module (shared)

dir_module (shared)

actions_module (shared)

speling_module (shared)

userdir_module (shared)

alias_module (shared)

substitute_module (shared)

rewrite_module (shared)

proxy_module (shared)

proxy_balancer_module (shared)

proxy_ftp_module (shared)

proxy_http_module (shared)

proxy_ajp_module (shared)

proxy_connect_module (shared)

cache_module (shared)

suexec_module (shared)

disk_cache_module (shared)

cgi_module (shared)

version_module (shared)

sed_module (shared)

security2_module (shared)

unique_id_module (shared)

fcgid_module (shared)

evasive20_module (shared)

perl_module (shared)

php5_module (shared)

ssl_module (shared)

dav_svn_module (shared)

authz_svn_module (shared)

While there are a handful of tools that let you drop a list of domain names and return any DNS record pertaining to those domain names, I have not been able to find a tool that returns the DNS servers assigned to each domain.

Could someone recommend a tool that would accomplish this? Windows (preferably) or Linux (command line) would work.

Thanks!

PS: not sure if this Q fits here or prowebmaster... I apologize in advance if I chose the wrong stacksite.