Michael Mao's questions

I have a WAS where a particular WAR file is deployed. This WAR file runs okay most of the time, however at times it would run to Java OOM issue.

I'd like to know if there is any control to increase the Java HEAP size for that particular WAR?

When I run a ps -eo command I could see the associated process info:

/IBM/JRE/bin/java -Xmx768M -Xms768M -Xgcpolicy:gencon .....

I am sure the Heap size is set to 768 MB for this WAR, but I received it from the client, and I should not change its content... Or should I adjust one of its XML configuration files inside?

First of all I am new to OpenLDAP setup. I have followed instructions coming from:

HowToForge.com linux openldap setup

#root
dn: dc=localhost,dc=com
dc: localhost
objectClass: dcObject
objectClass: organizationalUnit
ou: rootObject
ou: localhost.com

dn: ou=People,dc=localhost,dc=com
ou: People
objectClass: organizationalUnit

dn: uid=root,ou=People,dc=localhost,dc=com
uid: root
cn: Manager
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword {crypt}$6$l4IzdQnUVegcZdxH$L3winJgau4xxFBcvXgg2dzLs0eQ.8LS9rKWx6DeV/JPNnCZW6i9oCS/9rCtAzrdCie3qrgSMYvz4zKhJXIwcL1
shadowLastChange: 15792
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 0
gidNumber: 0
homeDirectory: /root
gecos: root

dn: uid=operator,ou=People,dc=localhost,dc=com
uid: operator
cn: operator
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}*
shadowLastChange: 15628
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /sbin/nologin
uidNumber: 11
gidNumber: 0
homeDirectory: /root
gecos: operator

dn: uid=adam,ou=People,dc=localhost,dc=com
uid: adam
cn: adam
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$oZVvz21C$HCHh90xQhCYN.9YCHG7P3d.y7Kx3Od6qkBjJy.S0QDSh57STBPJyHjxhuBbe73BB0QGFqj86JqnJCe3HqCJmD.
shadowLastChange: 15806
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 502
gidNumber: 502
homeDirectory: /home/adam

dn: uid=eve,ou=People,dc=localhost,dc=com
uid: eve
cn: eve
......

When I imported all uses contained within this ldif file using command:

slapadd -n 2 -l /etc/openldap/localhost.com.ldif

I ran into NO errors.

Then I used JXplorer to confirm that all objects are there in thr LDAP tree, under localhost.com.

However when I try to authenticate against LDAP users, I always got the feedback from applications that user password is not correct? Why this?!

Is it because of the "hased/shadowed" passwd as defined in this ldif? Shall I use plain passwd instead?

Also I cannot modify the user passwords from within JXploprer GUI as it complains:

"unable to perform modify operation"...

I figured out that it must have something to do with my slapd.conf. Like I cannot modify user passwords. Is there a way to resolve this in slapd.conf?

#######################################################################
# database definitions
#######################################################################

database    bdb
suffix      "dc=localhost,dc=com"
checkpoint  1024 15
rootdn      "cn=Manager,dc=localhost,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw        secret
# rootpw        {crypt}ijFYNcSNctBYg

rootpw {SSHA}ITG/tKlnULV84uCPuZRVUoSvKpqKTwjB

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory   /var/lib/ldap

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

Many thanks in advance

By following this link I am able to just turn SELinux off completely from my Fedora 14. But I wonder how could I disable SELinux only for the httpd daemon? I don't have system-config-selinux installed and due to company firewall policy I have got to search for the RPMs from pkgs.org in order to install any package. So is there a way to get this sorted out?

Edit:

Summary:

SELinux is preventing /opt/ibm/cognos/c10/cgi-bin/cognos.cgi "execute" access to
/opt/ibm/cognos/c10/cgi-bin/libIBJStreamsDLL.so.

Detailed Description:

SELinux denied access requested by /opt/ibm/cognos/c10/cgi-bin/cognos.cgi.
/opt/ibm/cognos/c10/cgi-bin/cognos.cgi is mislabeled.
/opt/ibm/cognos/c10/cgi-bin/cognos.cgi default SELinux type is bin_t, but its
current type is bin_t. Changing this file back to the default type, may fix your
problem.

If you believe this is a bug, please file a bug report against this package.

Allowing Access:

You can restore the default system context to this file by executing the
restorecon command. restorecon '/opt/ibm/cognos/c10/cgi-bin/cognos.cgi'.

Fix Command:

/sbin/restorecon '/opt/ibm/cognos/c10/cgi-bin/cognos.cgi'

Additional Information:

Source Context                unconfined_u:system_r:httpd_t:s0
Target Context                unconfined_u:object_r:usr_t:s0
Target Objects                /opt/ibm/cognos/c10/cgi-bin/libIBJStreamsDLL.so [
                              file ]
Source                        cognos.cgi
Source Path                   /opt/ibm/cognos/c10/cgi-bin/cognos.cgi
Port                          <Unknown>
Host                          mm2fedora.syd.cog
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-3.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   restore_source_context
Host Name                     mm2fedora.syd.cog
Platform                      Linux mm2fedora.syd.cog 2.6.35.6-45.fc14.i686 #1
                              SMP Mon Oct 18 23:56:17 UTC 2010 i686 i686
Alert Count                   18
First Seen                    Fri 15 Apr 2011 02:12:44 PM EST
Last Seen                     Fri 15 Apr 2011 02:33:11 PM EST
Local ID                      409e250f-049f-49c0-89f6-7155e4643868
Line Numbers                  

Raw Audit Messages            

node=mm2fedora.syd.cog type=AVC msg=audit(1302841991.999:22392): avc:  denied  { execute } for  pid=28242 comm="cognos.cgi" path="/opt/ibm/cognos/c10/cgi-bin/libIBJStreamsDLL.so" dev=dm-0 ino=138263 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file

node=mm2fedora.syd.cog type=SYSCALL msg=audit(1302841991.999:22392): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=1bc08 a2=5 a3=802 items=0 ppid=27923 pid=28242 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="cognos.cgi" exe="/opt/ibm/cognos/c10/cgi-bin/cognos.cgi" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

As advised I run the suggested fix command: /sbin/restorecon '/opt/ibm/cognos/c10/cgi-bin/cognos.cgi' many times but unfortunately. by disabling SELinux completely I can see this web app works. I am researching on this topic myself right now like how to enable SELinux globally while only disabling it for httpd. Must not be the best approach but since this is only a test case that would be just fine for me and my team.

The hint I got from Fedora 13's SELinux FAQ is here so I personally believe there is a way with system-config-selinux, I just don't know the details...

Please consider the following:

192-168-1-106:~ michael$ telnet <remote_server_ip> 25
Trying <remote_server_ip>...
Connected to li*****.linode.com.
Escape character is '^]'.
220 mindinscription.net ESMTP Postfix (Ubuntu)
quit
221 2.0.0 Bye
Connection closed by foreign host.

Is this very bad? how to protect port 25 from malicious attackers? I've already set up a firewall, but not very sure what to do in this case.

Basically I'd like to use this server to only send emails as alert messages, not receiving any external emails.

Many thanks to the help in advance.

I've setup the ufw firewall for my Ubuntu server on linode as follows:

Note that this is in the Lish terminal, unfortunately as soon as I turn on the ufw, I cannot:

• view my test website via port 80 from browser, or even curl -I to get its response headers;

• I cannot ssh to the server, even port 22 is "allowing access";

The default action for ufw is denying, which I believe is good practice for a "defensive" firewall. I am new to system admin stuff so I am not very sure which part I've done wrong...

Any thoughts?

UPDATED as suggested: Here are the print outs from iptables-save:

# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010
*security
:INPUT ACCEPT [80376:49275670]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [39230:5028423]
COMMIT
# Completed on Tue Dec 14 09:55:24 2010
# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010
*raw
:PREROUTING ACCEPT [81286:49365430]
:OUTPUT ACCEPT [39230:5028423]
COMMIT
# Completed on Tue Dec 14 09:55:24 2010
# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010
*nat
:PREROUTING ACCEPT [1419:87729]
:POSTROUTING ACCEPT [2334:168647]
:OUTPUT ACCEPT [2334:168647]
COMMIT
# Completed on Tue Dec 14 09:55:24 2010
# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010
*mangle
:PREROUTING ACCEPT [81286:49365430]
:INPUT ACCEPT [81274:49361314]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [39230:5028423]
:POSTROUTING ACCEPT [39230:5028423]
COMMIT
# Completed on Tue Dec 14 09:55:24 2010
# Generated by iptables-save v1.4.4 on Tue Dec 14 09:55:24 2010
*filter
:INPUT ACCEPT [713:54735]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [666:62866]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input 
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input 
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input 
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input 
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input 
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input 
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input 
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " 
-A ufw-before-forward -j ufw-user-forward 
-A ufw-before-input -i lo -j ACCEPT 
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ufw-before-input -m state --state INVALID -j ufw-logging-deny 
-A ufw-before-input -m state --state INVALID -j DROP 
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT 
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT 
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT 
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT 
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT 
-A ufw-before-input -j ufw-not-local 
-A ufw-before-input -s 224.0.0.0/4 -j ACCEPT 
-A ufw-before-input -d 224.0.0.0/4 -j ACCEPT 
-A ufw-before-input -j ufw-user-input 
-A ufw-before-output -o lo -j ACCEPT 
-A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A ufw-before-output -j ufw-user-output 
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] " 
-A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN 
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " 
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN 
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN 
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN 
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny 
-A ufw-not-local -j DROP 
-A ufw-skip-to-policy-forward -j DROP 
-A ufw-skip-to-policy-input -j ACCEPT 
-A ufw-skip-to-policy-output -j ACCEPT 
-A ufw-track-input -p tcp -m state --state NEW -j ACCEPT 
-A ufw-track-input -p udp -m state --state NEW -j ACCEPT 
-A ufw-track-output -p tcp -m state --state NEW -j ACCEPT 
-A ufw-track-output -p udp -m state --state NEW -j ACCEPT 
-A ufw-user-input -p tcp -m tcp --dport 23 -j DROP 
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] " 
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable 
-A ufw-user-limit-accept -j ACCEPT 
COMMIT
# Completed on Tue Dec 14 09:55:24 2010

I am basically a casual Linux user, an able web developer, and a guy who always wants to try something new. I've experienced with commercial web hostings, their names will be omitted from this thread :)

I came across the ad for Linode the other day and to be frank I am interested in its features. I have just ended one of my hosting plan (after 2 years) and I am planning to play around with a test Linux server in house before going to Linode and purchase a service.

So my question is, which distro to pick among those available? Maybe my understanding is wrong but they seems not very up to the most recent releases, actually, not even close... Say, for instance, you can have a Ubuntu server version 7.10... that's 3 years back, right?

I think this is probably for resources consumption reasons, but if I were to pick one, which one should I choose from? Any good reasons behind?

Ubuntu 7.10
Arch Linux 2007.08
CentOS 5.0
Debian 4.0
Gentoo 2007.0
Mandrake 9.1
Slackware 12.0
Fedore Core 6

I would use this site half for hosting my blog and other materials, half for experiments like coding in C, PHP, Ruby, NodeJS, etc...

Thanks for the answers in advance.

I've notices several topic on how to check the memory usage of Java application on linux, but I can hardly find anything, even on Google, about a quick and easy way to perform such a check on Windows.

The situation is, I've got Tomcat up and running as the Java Servlet container, inside which a Servlet is running and listening on port 9300. How can I check/monitor/log its memory usage?

I am not a pro in web development and Apache server still remains a mystery to me. we've got a project which runs on LAMP, pretty much like all the commercial hosting plans.

I am confused about one problem : does modern browsers support image loading in parallel? or this requires some special feature/config set up from server side? Can this be done with PHP coding or by some server-side configuration? Is a special content delivery networking needed for this?

The benchmark demonstration will be the flickr website. I am too suprised to see how all image thumbnails are loaded in a short time after a search as if there were only one image to load.

Sorry I cannot present any code to you... completed lost in this:(