nowthatsamatt's questions

I'm trying to start the Data Plane API on HAProxy boot using the instructions detailed here: https://www.haproxy.com/documentation/hapee/1-9r1/configuration/dataplaneapi/#using-the-haproxy-process-manager

My issue is I get this:

$ curl -X GET --user admin:mypassword "http://localhost:5555/v1/services/haproxy/info"
{"code":500,"message":"dial unix unix@/run/haproxy-master.sock: connect: no such file or directory"}

Which is odd because the file exists here:

$ ls -lah /run/haproxy-master.sock
srwxr-xr-x 1 root root 0 Jul 31 18:05 /run/haproxy-master.sock

And the process is running as the root user, so it should be able to see it:

$ sudo systemctl status haproxy.service
[sudo] password for user:
● haproxy.service - HAProxy Load Balancer
   Loaded: loaded (/lib/systemd/system/haproxy.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2019-07-31 18:05:49 -05; 18h ago
     Docs: man:haproxy(1)
           file:/usr/share/doc/haproxy/configuration.txt.gz
  Process: 22227 ExecReload=/bin/kill -USR2 $MAINPID (code=exited, status=0/SUCCESS)
  Process: 22739 ExecReload=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=1/FAILURE)
  Process: 24307 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=0/SUCCESS)
 Main PID: 24335 (haproxy)
    Tasks: 12 (limit: 4418)
   CGroup: /system.slice/haproxy.service
           ├─24335 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /run/haproxy-master.sock
           ├─24339 dataplaneapi --host 0.0.0.0 --port 5555 --haproxy-bin /usr/sbin/haproxy --config-file /etc/haproxy/haproxy.cfg --reload-cmd systemctl reload haproxy --reload-delay 5 --userlist controller
           └─24341 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /run/haproxy-master.sock

Jul 31 18:05:47 lb01.private systemd[1]: Starting HAProxy Load Balancer...
Jul 31 18:05:48 lb01.private haproxy[24335]: [WARNING] 211/180548 (24335) : parsing [/etc/haproxy/haproxy.cfg:33]: 'option httplog' overrides previous 'log-format' in 'defaults' section.
Jul 31 18:05:48 lb01.private haproxy[24335]: [WARNING] 211/180548 (24335) : parsing [/etc/haproxy/haproxy.cfg:117]: keyword 'forceclose' is deprecated in favor of 'httpclose', and will not be supported by future versions.
Jul 31 18:05:49 lb01.private haproxy[24335]: [NOTICE] 211/180548 (24335) : New program 'api' (24339) forked
Jul 31 18:05:49 lb01.private haproxy[24335]: [NOTICE] 211/180548 (24335) : New worker #1 (24341) forked
Jul 31 18:05:49 lb01.private systemd[1]: Started HAProxy Load Balancer.
Jul 31 18:05:51 lb01.private haproxy[24335]: dial unix unix@/run/haproxy-master.sock: connect: no such file or directory
Jul 31 18:06:40 lb01.private haproxy[24335]: dial unix unix@/run/haproxy-master.sock: connect: no such file or directory
Aug 01 12:36:07 lb01.private haproxy[24335]: dial unix unix@/run/haproxy-master.sock: connect: no such file or directory

Here are what I think the relevant bits of my haproxy.cfg file are:

global
    stats socket /run/haproxy.sock user haproxy group haproxy mode 660 level admin

userlist controller
    user admin insecure-password mypassword

program api
    command dataplaneapi --host 0.0.0.0 --port 5555 --haproxy-bin /usr/sbin/haproxy --config-file /etc/haproxy/haproxy.cfg --reload-cmd "systemctl reload haproxy" --reload-delay 5 --userlist controller

I fully understand that the "stats socket" declaration says /run/haproxy.sock, I've tried changing that to /run/haproxy-master.sock and restarting it as well. Same error. Not sure where the haproxy-master.sock file is coming from, guessing it's a default?

I didn't see any examples of this on the internet so I thought I'd post the solution here.

My HAProxy adds 'X-Proto: SSL' as a header to requests that are over HTTPS.

I'd like to use tcpdump to see the 'Host:' header of all requests that do not have that 'X-Proto: SSL' header.

Here's what a sample request looks like with it (captured with sudo tcpdump -AA port 80):

14:06:48.834405 IP x.x.x.x.39989 > hostname.com.http: Flags [P.], seq 1:809, ack 1, win 58, length 808: HTTP: GET /req/?key=value&timeid=52989238 HTTP/1.1
..>........
...
.......GET /req/?key=value&timeid=52989238 HTTP/1.1
Host: r457.hostname.com
Origin: https://originhostname.com
User-Agent: Mozilla/5.0 (Linux; Android 8.1.0; TA-1044 Build/OPR1; wv) AppleWebKit/537 (KHTML, like Gecko) Version/4.0 Chrome/65 Mobile Safari/53;]
Accept: */*
Referer: https://originhostname.com/2018/
Accept-Encoding: gzip, deflate
Accept-Language: es-ES,es-MX;q=0.9,en-US;q=0.8
Cookie: cookieid
X-Requested-With: com.request.lite
X-Proto: SSL
X-Forwarded-For: x.x.x.x

I would like to exclude this and only see the output of:

Host: r457.hostname.com

If the 'X-Proto: SSL' header is not present.

So my ubuntu user's .bash_history just won't show up when I hit history. So I check permissions and the .bash_history in /home/ubuntu is now owned by root. Any idea what might've happened? I checked the root user's history and didn't notice anything that would've caused this.

Also, when I use the mysql client, it appends a long string of " " to the end of some lines.

To solve BOTH issues, I chown'd the .bash_history back to ubuntu:ubuntu. Any idea why this happened?

I've run into this issue before and rebooting the instance, I assumed, reset the /root/.ssh/authorized_keys and the /home/ubuntu/.ssh/authorized_keys files.

I've reboot the instance twice now and I'm still not able to SSH in. I just get this:

Connection closed by x.x.x.x

Any ideas?

I'd like to get a list of all domains pointed to a certain IP address. Is there a way to get this information from the command line?

Nothing like "host", "nslookup" or "dig -x". Those return the hostname of the IP address which, while helpful, is only part of what I want returned.

Edit for more information: An example of a website that returns this information is http://www.domaintools.com/reverse-ip/?hostname=74.125.47.104