I want to open a range of TCP ports in nftables on my servers.
Normally, in netfilter/iptables I can write the rule like this
iptables -A INPUT -p tcp 1000:2000 -j ACCEPT
I tried to write in the same way in /etc/nftables.conf
tcp dport {1000:2000} accept
but nft reports
/etc/nftables.conf:24:15-24: Error: mapping outside of map context
tcp dport {1000:2000} accept
^^^^^^^^^^
i've just installed nginx on an Archlinux box and encounter this problem:
Nginx is configured to run as "nginx", a new user/group that I added, in /etc/nginx/nginx.conf:
user nginx nginx;
For doublecheck:
$ ps aux | grep nginx
nginx 9678 0.0 0.5 28472 2856 ? S 17:37 0:00 nginx: worker process
nginx 9679 0.0 0.5 28472 2856 ? S 17:37 0:00 nginx: worker process
root 31912 0.0 0.6 28084 3364 ? Ss 17:24 0:00 nginx: master process /usr/bin/nginx -g pid /run/nginx.pid; error_log stderr;
The root of the server is at:
location / {
root /home/lamnk/sites/host.com;
index index.html index.htm;
}
and the owner of the file is set to nginx too:
$ ls -la /home/lamnk/sites/host.com
total 12
drwxr-xr-x 2 lamnk http 4096 Jan 12 09:37 .
drwxr-xr-x 3 lamnk users 4096 Jan 12 09:36 ..
-rw-r--r-- 1 nginx nginx 21 Jan 12 09:37 index.html
When I go to host.com, I got the 403 forbidden error. In the error.log:
2016/01/12 17:28:23 [error] 31914#0: *2 open() "/home/lamnk/sites/host.com/index.html" failed (13: Permission denied), client: 171.233.242.40, server: host.com, request: "GET /index.html HTTP/1.1", host: "host.com"
But when I change nginx to run as my own username lamnk, then nginx can return the content correctly, without any other changes in file permission. What gives??
EDIT: the permissions on parent directories:
$ namei -l /home/lamnk/sites/host.com
f: /home/lamnk/sites/host.com
drwxr-xr-x root root /
drwxr-xr-x root root home
drwx------ lamnk users lamnk
drwxr-xr-x lamnk users sites
drwxr-xr-x lamnk http host.com
I've used the ssh-agent from oh-my-zsh to manage my SSH key. So far, so good, i only have to type the passphrase for my private key once when I start my shell and public key authentication works great.
The problem is however that key forwarding doesn't work. There are 2 servers A & B which I can use public key to login. When I ssh into A then from there ssh into B, I must provide my password, which should not be the case.
A is a CentOS 5.6 box, B is an Ubuntu 11.04 box. I have this on my local .ssh/config:
Host *
ForwardAgent yes
OpenSSH on A is standard openssh 4.3 package provided by CentOS. I also enable ForwardAgent for ssh client on A, but forwarding still doesn't work.
I have a Ubuntu 10.04 server with 2 public static addresses. There is a KVM guest (also Ubuntu) installed and running. What i want is to give the guest an IP of the host, so that both machines have public IPs.
When i create a bridge for the guest, add interfaces to the bridge then the host loses connectivity but the guest begins to be able to ping from outside.
What should i do to have connection for host and guest ?
This is network conf:
# ifconfig -a
br0 Link encap:Ethernet Hardware Adresse ee:29:4b:xx:xx:xx
BROADCAST MULTICAST MTU:1500 Metrik:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0 Link encap:Ethernet Hardware Adresse 00:1a:4b:xx:xx:xx
inet Adresse:abc.def.xyz.100 Bcast:129.206.218.255 Maske:255.255.255.0
inet6-Adresse: fe80::21a:4bff:fe46:eca4/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:16101 errors:0 dropped:0 overruns:0 frame:0
TX packets:13577 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:6470077 (6.4 MB) TX bytes:2058971 (2.0 MB)
Interrupt:19
eth0:0 Link encap:Ethernet Hardware Adresse 00:1a:4b:46:ec:a4
inet Adresse:abc.def.xyz.101 Bcast:129.206.218.255 Maske:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
Interrupt:19
# route
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
abc.def.xyz.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 1000 0 0 eth0
default abc.def.xyz.1 0.0.0.0 UG 100 0 0 eth0
# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.000000000000 no eth0
vnet0
There is no firewall enabled and DNS is configured properly.
What I want to achieve:
| |
+----+-------------------------+--------+
| | Host | |
| | | |
| | +------------+------+ |
| eth0 | eth0:0 | |
| x.x.x.100 | | |
| | | |
| | br0 vnet0 | |
| +------------+------+ |
| | |
| | |
| +------------+------+ |
| | | | |
| | eth0-+ | |
| | x.x.x.101 | |
| | | |
| | Guest | |
| +-------------------+ |
+---------------------------------------+
Let's say you have your favorite settings with zsh, vim, screen, etc., behaving the way you want on some boxes.
What is the best way to apply these settings / environments to a new server? Assuming all the necessary software is installed on the same distro.
I have a remote Xen server running some virtual machines and i want to share some files between them. Can you recommend a good pratice doing this ?
Currently network setup is the standard Xen networking (bridging), each VM has an eth interface with dedicated public IP. I'm thinking of adding a bridge for private networking in dom0, but not sure what to do from there.