Keith Palmer Jr.'s questions

Recently upgraded to Debian 11 bullseye, and our Docker swarm nodes had trouble talking to each other, and started dropping some connections.

After much Google-ing, we stumbled on these threads:

• https://github.com/moby/moby/issues/41775
• https://bugzilla.redhat.com/show_bug.cgi?id=1987108

And specifically this command, which fixed the issue:

ethtool -K <interface> tx-checksum-ip-generic off

While I'm thrilled that this fixes it... I'm a little concerned because I'm having trouble figuring out exactly what that setting actually does.

I get that it disables some sort of checksuming (looks like maybe a UDP or TCP checksum of packets coming in through the network) and maybe disables the offloading of that checksum to the hardware (doing the checksum in software too? or on the CPU?), but I'm having trouble finding out any specifics beyond that/if that explanation is even correct.

Similarly, should I be worried about turning this off? Will it impact performance? Will it cause other networking issues?

If anyone can provide any details on what exactly this does and if it has any other impacts I should watch for/metric/measure, I'd be very appreciative!

Thanks!

Is it possible to configure Postgrey to only graylist .com addresses?

e.g. essentially whitelist anything that comes from .edu, .org, .net, etc.?

98% of our spam comes from .com e-mail addresses, while 98% of our customers have .edu e-mail addresses. It would be ideal to only graylist .coms -- that would catch most SPAM while not slowing down e-mail from legitimate customers.

So we got a nice new HP DL380 server with a fancy RAID card about one year ago.

2 months ago a hard drive failed. Thank goodness for RAID5... except that the RAID card only sort of worked and the machine hard reset. After fvck it came back up.

6 weeks ago another drive fails. Machine hard reset again, came back up.

4 weeks ago another drive fails. Machine hard resets. The data center puts a new drive in, and the new drive fails. Replace that drive. After a fvck it comes back up.

This morning, yet another drive (this is the 5th drive now, for those who are counting) reports "SMART imminent failure".

Needless to say, we've moved everything off this server so that it's not in use anymore.

Can anyone think of anything that could be going on to cause this sort of scenario? I find it hard to believe that there could be this many bad hard drives. Is the RAID card toasting hard drives? Power supply issue?

Thought this would be a simple process, but I guess not. I need the latest version of CURL (7.23 or newer) on CentOS 6.3.

If I do this:

sudo yum upgrade curl

It just tells me there is nothing to do (everything is up to date).

So I followed some other ServerFault posts, and tried this:

sudo rpm -i http://mirror.city-fan.org/ftp/contrib/sysutils/Mirroring/libcurl-7.29.0-2.0.cf.rhel6.x86_64.rpm

But that tells me:

warning: /var/tmp/rpm-tmp.4L8Nyj: Header V3 DSA/SHA1 Signature, key ID b56a8bac: NOKEY error: Failed dependencies: c-ares(x86-64) >= 1.9.1 is needed by libcurl-7.29.0-2.0.cf.rhel6.x86_64 libssh2(x86-64) >= 1.4.3 is needed by libcurl-7.29.0-2.0.cf.rhel6.x86_64

So what do I actually have to do to get this upgraded?

We have a Windows desktop app that we want to make available over the Internet to a few users. What version of Windows Server do I need for that RemoteApp functionality?

I tried to figure this out via Microsoft's website, but I couldn't get a clear bead on how exactly what YEARS (2008, 2012, etc.) and/or what EDITIONS (Data Center vs. Standard vs. Foundation vs. Essentials) of Windows Server support RemoteApp stuff.

So I'm looking at this diagram: http://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_(CARP)

Does this assume that the "DSL Router" at the top of the drawing has two physical RJ45 jacks, or a single one that you're splitting via a switch?

i.e. when I walk into the data center with 2 pfSense boxes, should I be expecting them to give me two separate RJ45 jacks to plug into, or a single one that I'm going to throw a switch in front of the 2 pfSense boxes for?

I want files with a .CSS extension to be treated as PHP, and parsed/executed as if they were .PHP files (in addition to retaining the default behavior of parsing .PHP files as PHP).

Is there an easy way to do this with Lighttpd?

I've heard that you can use pam_exec to call an external script, and have that external script perform the actual authentication.

Can anyone provide an example of doing this?

I'd like to prompt a user for some piece of information before they get to their BASH shell when they're logging in via SSH. Ideally, I'd like to execute a script which prompts them for information, check that the information is correct, and then if it is drop them to a shell. So, think:

ssh [email protected]
password: xxxx

do you agree to the terms and conditions of use? enter yes or no:
yes 

OK, here's your shell:
# 

Can anyone provide an example of how to do something like this?

Is there a way to configure sshd so that it sends me an e-mail whenever someone logs in via SSH?

I have a CentOS box that hangs for like 8 hours at "Checking root filesystem" every time it reboots.

Is there some way to skip that check?

We have an existing application that we wish to split across multiple servers (for example: 1000 users total, 100 users split across 10 servers).

Ideally, we'd like to be able relay the HTTPS requests to a particular server based on some component of the URL. For example: Users 1 through 100 go to http://server1.domain.com/ Users 2 through 200 go to http://server2.domain.com/ etc. etc. etc.

Where the incoming requests look like this: https://secure.domain.com/user/{integer user # goes here}/path/to/file

Does anyone know of an easy way to do this? Pound looks promising... but it doesn't look like it supports routing based on URL like this.

Even better would be if it didn't need to be hard-coded- The load balancer could make a separate HTTP request to another server to ask "Hey, what server should I relay to for a request to URL {the URL that was requested goes here}?" and relay to the hostname returned in the HTTP response.

We have a number of Windows XP / Windows 7 machines which need to be backed up nightly to a Linux file server.

We would like to do it with rsync and rsnapshot as that's what we're familiar with already from the rest of our Linux/FreeBSD machines.

We tried DeltaCopy, but DeltaCopy proved to be troublesome- lots of problems getting it to log in via SSH automatically, and the Windows Scheduled Tasks seem to fail often.

Is there a reliable way/application which can back up Windows machines via rsync to a r

I need to be able to deploy new instances of an application from a subversion repository. This is accomplished by running shell_exec() from a PHP script.

However, Subversion won't let me check out the repository, instead throwing this error:

svn: OPTIONS of 'https://www.example.org/svn/repos/project/trunk': Server certificate verification failed: issuer is not trusted (https://www.example.org)

How can I get Subversion to let me check out the code and ignore the certificate error? If I check it out from an SSH session it prompts and and caches the certificate and works fine the second time. When run via the PHP script, however, it never works.

Is it possible to configure Apache to use a different log file for each subdomain, even if all of the subdomains are within the same VirtualHost container?

So, I have only one VirtualHost:

<VirtualHost *:80>
  ServerName example.com
  ServerAlias test1.example.com test2.example.com test3.example.com
</VirtualHost>

And I want to end up with the following log files:

/var/log/httpd-access_test1.log
/var/log/httpd-access_test2.log
/var/log/httpd-access_test3.log

I know I can probably do this with a custom log format and split-logs, but I was wondering if there's a way to just have Apache do it for me.

A PCI Compliance scan has suggested that we disable Apache's MEDIUM and LOW/WEAK strength ciphers for security. Can someone tell me how to disable these ciphers?

Apache v2.2.14 mod_ssl v2.2.14

This is what they've told us:

Synopsis : The remote service supports the use of medium strength SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits. Solution: Reconfigure the affected application if possible to avoid use of medium strength ciphers. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N) [More]

Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. See also : http://www.openssl.org/docs/apps/ciphers .html Solution: Reconfigure the affected application if possible to avoid use of weak ciphers. Risk Factor: Medium / CVSS Base Score : 5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N) [More]

I'd like to restrict SSH logins for a specific FreeBSD user account to a specific IP address (they're automated rsync backups from one machine to another, no actual user should ever be logging in, just the SSH+rsync process).

I feel like I should be able to do this using either hosts.allow or sshd_config... but I can't find any clear-cut example for how to do this. Can anyone tell me?

OK, our data center did a RAID rebuild (and possibly some other stuff) on our server overnight. Something failed at some point, I checked on things this morning, and it appears as if the /var partition has been entirely wiped and brought back to a default install state.

i.e., everything we had in /var/logs is gone and everything we had in /var/db/mysql is gone, it's as if that stuff has been wiped out and replaced by a default install of FreeBSD (i.e. minimal logs, no stored .gzip logs, no more databases, etc.) BAD, REALLY BAD!

Actually, looking at it more, before if I did a "df -h" I'd see a /var partition. Now, I don't see it anymore. But I can get to /var... it just doesn't show up in "df -h". I do see an entry in /etc/fstab for /var.

I have pretty much no idea what they did. I'm waiting to hear from them. So I realize that this is a somewhat unanswerable question. I'm just looking for ideas on what I can check/what might have happened, etc. until I get more details from the data center about what they actually did.

In the meantime, can anyone propose a theory for where the data in /var might have gone... and how I can check if it still exists somewhere?

EDIT We're on the right track, thanks guys!

[kp@afekan /var/log]$ sudo tail -n 10 /var/log/dmesg.today

SMP: AP CPU #2 Launched!
SMP: AP CPU #3 Launched!
Trying to mount root from ufs:/dev/mfid0s1a
WARNING: /tmp was not properly dismounted
/tmp: mount pending error: blocks 24 files 0
WARNING: /usr was not properly dismounted
WARNING: R/W mount of /var denied.  Filesystem is not clean - run fsck
WARNING: R/W mount of /var denied.  Filesystem is not clean - run fsck
bce0: link state changed to UP
bce1: link state changed to UP

They're working on it!

FIXED! Problem solved, /var never got mounted, needed to be fsck'd. Thanks guys!

I'm looking for a reliable free or cheap DNS service.

I've used FreeDNS at FreeDNS.Afraid.org in the past, but it doesn't always seem reliable... sometimes people say they can't access my website (sometimes I can't access it either) by domain name, and yet if I type in the IP address it works fine, so I assume it's some sort of DNS problem.

Are there any other cheap or free DNS services out there? I need something reliable that I can manage via a web interface (or scripts if they have an API) that I can use to manage the DNS for ~100 domain names.

EDIT: To be clear, I'm looking for DNS hosting, not DNS servers to use for my WAN connection.

I need to turn on networking for MySQLd, but every time I do, the server gets brute-forced into oblivion. Some mean password guessing script starts hammering on the server, opening a connection on port 3306 and trying random passwords forever.

How can I stop this from happening?

For SSH, I use denyhosts, which works well. Is there a way to make denyhosts work with MySQLd?

I've also considered changing the port MySQL is running on, but this is less than ideal and only a stop-gap solution (what if they discover the new port?)

Does anyone have any other ideas?

If it makes a different, I'm running MySQL 5.x on FreeBSD 6.x.