Yarin's questions

I'm trying to get some basic Python web servers (Flask, Tornado) turned up on the EC2.

On the Amazon-flavored Linux AMI (Amazon Linux AMI 2013.03.1) they work no problem, but the same web servers installed on the RedHat quicklaunch AMI (Red Hat Enterprise Linux 6.4) don't work at all- All I get is connection failure errors when I try to browse to them.

Both these servers share the same security group, with the relevant ports (5000, 5010) open, so I'm trying to understand why RedHat would not be not working.

Possible Duplicate:
What are the best linux permissions to use for my website?

I'm trying to get a canonical answer on how to set up permissions for apache vis-a-vis the web root (/var/www). According to this highly popular answer, giving apache write-access to /var/www seems ok, whereas elsewhere (see comments) it seems like a no-no.

Can someone shed some light? If this is a security risk in and of itself, can you describe exactly how it would be exploited?

Update:
Let's assume a private server, where the only two users we're concerned about are 'apache' and 'root'.

We want to mimic the behavior of a system-wide 002 umask on a certain directory foo, in order to ensure the following result:

1. All sub-directories created underneath foo will have 775 permissions
2. All files created underneath foo and subdirectories will have 664 permissions
3. 1 and 2 will happen for files/dirs created by all users, including root, and all daemons.

Assuming that ACL is enabled on our partition, this is the command we came up with:

setfacl -R -d -m mask:002 foo

... but this doesn't work. New files created in the directory end up looking like:

-rw--w-r--+

When I run getfacl on the new file, I get:

# file: newfile.py
# owner: root
# group: agroup
user::rw-
group::rwx #effective:-w-
mask::-w-
other::r--

In other words, applying a mask:200 with ACL is not the same as applying umask 200.

So is there a way to apply a per-directory umask with an ACL?

I'm trying to set the default umask to 002 for all users including root on my CentOS box.

According to this and other answers, this can be achieved by editing /etc/profile. However the comments at the top of that file say:

It's NOT a good idea to change this file unless you know what you are doing. It's much better to create a custom.sh shell script in /etc/profile.d/ to make custom changes to your environment, as this will prevent the need for merging in future updates.

So I went ahead and created the following file:
/etc/profile.d/myapp.sh
with the single line:

umask 002

Now, when I create a file logged in as root, the file is born with 664 permissions, the way I had hoped. But files created by my Apache mod_wsgi application, or files created with sudo, still default to 644 permissions...

$ touch newfile (as root):
Result = 664 (Works)

$ sudo touch newfile:
Result = 644 (Doesn't work)

Files created by Apache mod_wsgi app:
Result = 644 (Doesn't work)

Files created by Python's RotatingFileHandler:
Result = 644 (Doesn't work)

Why is this happening, and how can I ensure 664 file permissions system wide, no matter what creates the file?

I've got a server getting some traffic from an SSL terminating load balancer- in which case it comes in as HTTP over port 80 with a http_x_forwarded_proto = "https"

I want a mod_rewrite rule that only allows direct HTTPS traffic or forwarded HTTPS traffic.

I have this so far:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:http_x_forwarded_proto} != https
RewriteCond %{HTTP:http_x_forwarded_proto} != HTTPS
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

but I'm getting

RewriteCond: bad flag delimiters

error.

What do I need to correct to get this working, and is this the best approach?

I'm running supervisord on my CentOS 6 box like so,

/usr/bin/supervisord -c /etc/supervisord.conf

and when I launch supervisorctl all process status are fine, but if I try the reload command in supervisorctl, and then do anything, I get

unix:///tmp/supervisor.sock no such file

but the reload command should take care of recreating the .sock?

I'm using the same config file I've used successfully on other boxes, and im running everything as root. I can't undesrtand what the problem is...

Config file:

; Sample supervisor config file.

[unix_http_server]
file=/tmp/supervisor.sock   ; (the path to the socket file)
;chmod=0700                 ; socket file mode (default 0700)
;chown=nobody:nogroup       ; socket file uid:gid owner
;username=user              ; (default is no username (open server))
;password=123               ; (default is no password (open server))

;[inet_http_server]         ; inet (TCP) server disabled by default
;port=127.0.0.1:9001        ; (ip_address:port specifier, *:port for all iface)
;username=user              ; (default is no username (open server))
;password=123               ; (default is no password (open server))

[supervisord]
logfile=/tmp/supervisord.log ; (main log file;default $CWD/supervisord.log)
logfile_maxbytes=50MB        ; (max main logfile bytes b4 rotation;default 50MB)
logfile_backups=10           ; (num of main logfile rotation backups;default 10)
loglevel=info                ; (log level;default info; others: debug,warn,trace)
pidfile=/tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
nodaemon=false               ; (start in foreground if true;default false)
minfds=1024                  ; (min. avail startup file descriptors;default 1024)
minprocs=200                 ; (min. avail process descriptors;default 200)
;umask=022                   ; (process file creation umask;default 022)
;user=chrism                 ; (default is current user, required if root)
;identifier=supervisor       ; (supervisord identifier, default is 'supervisor')
;directory=/tmp              ; (default is not to cd during start)
;nocleanup=true              ; (don't clean up tempfiles at start;default false)
;childlogdir=/tmp            ; ('AUTO' child log dir, default $TEMP)
;environment=KEY=value       ; (key value pairs to add to environment)
;strip_ansi=false            ; (strip ansi escape codes in logs; def. false)

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket
;serverurl=http://127.0.0.1:9001 ; use an http:// url to specify an inet socket
;username=chris              ; should be same as http_username if set
;password=123                ; should be same as http_password if set
;prompt=mysupervisor         ; cmd line prompt (default "supervisor")
;history_file=~/.sc_history  ; use readline history if available

; The below sample program section shows all possible program subsection values,
; create one or more 'real' program: sections to be able to control them under
; supervisor.

;[program:foo]
;command=/bin/cat

[program:embed_scheduler]
command=/opt/web-apps/mywebsite/custom_process.py
process_name=%(program_name)s_%(process_num)d
numprocs=3

;[program:theprogramname]
;command=/bin/cat              ; the program (relative uses PATH, can take args)
;process_name=%(program_name)s ; process_name expr (default %(program_name)s)
;numprocs=1                    ; number of processes copies to start (def 1)
;directory=/tmp                ; directory to cwd to before exec (def no cwd)
;umask=022                     ; umask for process (default None)
;priority=999                  ; the relative start priority (default 999)
;autostart=true                ; start at supervisord start (default: true)
;autorestart=unexpected        ; whether/when to restart (default: unexpected)
;startsecs=1                   ; number of secs prog must stay running (def. 1)
;startretries=3                ; max # of serial start failures (default 3)
;exitcodes=0,2                 ; 'expected' exit codes for process (default 0,2)
;stopsignal=QUIT               ; signal used to kill process (default TERM)
;stopwaitsecs=10               ; max num secs to wait b4 SIGKILL (default 10)
;killasgroup=false             ; SIGKILL the UNIX process group (def false)
;user=chrism                   ; setuid to this UNIX account to run the program
;redirect_stderr=true          ; redirect proc stderr to stdout (default false)
;stdout_logfile=/a/path        ; stdout log path, NONE for none; default AUTO
;stdout_logfile_maxbytes=1MB   ; max # logfile bytes b4 rotation (default 50MB)
;stdout_logfile_backups=10     ; # of stdout logfile backups (default 10)
;stdout_capture_maxbytes=1MB   ; number of bytes in 'capturemode' (default 0)
;stdout_events_enabled=false   ; emit events on stdout writes (default false)
;stderr_logfile=/a/path        ; stderr log path, NONE for none; default AUTO
;stderr_logfile_maxbytes=1MB   ; max # logfile bytes b4 rotation (default 50MB)
;stderr_logfile_backups=10     ; # of stderr logfile backups (default 10)
;stderr_capture_maxbytes=1MB   ; number of bytes in 'capturemode' (default 0)
;stderr_events_enabled=false   ; emit events on stderr writes (default false)
;environment=A=1,B=2           ; process environment additions (def no adds)
;serverurl=AUTO                ; override serverurl computation (childutils)

; The below sample eventlistener section shows all possible
; eventlistener subsection values, create one or more 'real'
; eventlistener: sections to be able to handle event notifications
; sent by supervisor.


;[eventlistener:theeventlistenername]
;command=/bin/eventlistener    ; the program (relative uses PATH, can take args)
;process_name=%(program_name)s ; process_name expr (default %(program_name)s)
;numprocs=1                    ; number of processes copies to start (def 1)
;events=EVENT                  ; event notif. types to subscribe to (req'd)
;buffer_size=10                ; event buffer queue size (default 10)
;directory=/tmp                ; directory to cwd to before exec (def no cwd)
;umask=022                     ; umask for process (default None)
;priority=-1                   ; the relative start priority (default -1)
;autostart=true                ; start at supervisord start (default: true)
;autorestart=unexpected        ; whether/when to restart (default: unexpected)
;startsecs=1                   ; number of secs prog must stay running (def. 1)
;startretries=3                ; max # of serial start failures (default 3)
;exitcodes=0,2                 ; 'expected' exit codes for process (default 0,2)
;stopsignal=QUIT               ; signal used to kill process (default TERM)
;stopwaitsecs=10               ; max num secs to wait b4 SIGKILL (default 10)
;killasgroup=false             ; SIGKILL the UNIX process group (def false)
;user=chrism                   ; setuid to this UNIX account to run the program
;redirect_stderr=true          ; redirect proc stderr to stdout (default false)
;stdout_logfile=/a/path        ; stdout log path, NONE for none; default AUTO
;stdout_logfile_maxbytes=1MB   ; max # logfile bytes b4 rotation (default 50MB)
;stdout_logfile_backups=10     ; # of stdout logfile backups (default 10)
;stdout_events_enabled=false   ; emit events on stdout writes (default false)
;stderr_logfile=/a/path        ; stderr log path, NONE for none; default AUTO
;stderr_logfile_maxbytes=1MB   ; max # logfile bytes b4 rotation (default 50MB)
;stderr_logfile_backups        ; # of stderr logfile backups (default 10)
;stderr_events_enabled=false   ; emit events on stderr writes (default false)
;environment=A=1,B=2           ; process environment additions
;serverurl=AUTO                ; override serverurl computation (childutils)

; The below sample group section shows all possible group values,
; create one or more 'real' group: sections to create "heterogeneous"
; process groups.

;[group:thegroupname]
;programs=progname1,progname2  ; each refers to 'x' in [program:x] definitions
;priority=999                  ; the relative start priority (default 999)

; The [include] section can just contain the "files" setting.  This
; setting can list multiple files (separated by whitespace or
; newlines).  It can also contain wildcards.  The filenames are
; interpreted as relative to this file.  Included files *cannot*
; include files themselves.

;[include]
;files = relative/directory/*.ini

I'm setting up monit and want to monitor a given python application. Monit does this by looking at the .pid files for processes, but I don't know where this would be.

I also tried creating my own simple executable and running it- here too I can't figure out where the .pid file is created.

And do all processes have a .pid file?

I'm trying to get it supervisord running on my Mac. The instructions call for using a $BINDIR path variable and I can't figure out what that should be. I tried using the directory I got from $ which python, which = /Library/Frameworks/Python.framework/Versions/2.7/bin/, but when I use that I get an error:

$ /Library/Frameworks/Python.framework/Versions/2.7/bin/supervisord: No such file or directory

From the docs:

This section makes reference to a BINDIR when explaining how to run the supervisord and supervisorctl commands. This is the “bindir” directory that your Python installation has been configured with. For example, for an installation of Python installed via ./configure --prefix=/usr/local/py; make; make install, BINDIR would be /usr/local/py/bin. Python interpreters on different platforms use a different BINDIR. Look at the output of setup.py install if you can’t figure out where yours is.

I've just finished installing mysql and mysqlserver on centOS as part of a larger install script (the full script is here, though I uncommented the mysql part).

The script ran fine, and it even walked me through the paces of setting up the mysql root password etc.

Script output:

Installed:
mysql.x86_64 0:5.1.61-1.el6_2.1
mysql-server.x86_64 0:5.1.61-1.el6_2.1

Now, in the same session is SSH, I'm unable to access mysql or find any reference to it.

$ mysql -u root -p
-bash: mysql: command not found

$ which mysql
/usr/bin/which: no mysql in (/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)

It's just weird- where is it??

There's going to be a lot of ignorance in this question so please bear with:

My understanding of a standard browser-client to server SSL connection involves:

1. Browser connects to server via HTTPS
2. Browser requests server SSL certificate
3. Browser verifies certificate against the third party CA (certificate authority) that issued it.
4. Browser and server speak over an open SSL-connection, and certificate is not needed/downloaded again until a new connection is established (i.e. the next postback).

If I've already mangled it, correct me so far, but now I'm trying to wrap my head around what happens when an SSL-connection is made from one server acting as a client to another server acting as server, and PHP is making the call. Is it essentially the same process? Does the client-server go through the same steps as the browser-client?

In an apache environment, does the the client-server need to be set up in a certain way?

If I have an .htaccess file in a given directory within my website, and want to specify an ErrorDocument relative to the .htaccess file, NOT relative to the document root, is this possible?

Something like: ErrorDocument 404 $CURRENT_DIRECTORY/404.php

The firm I'm working with want to host WordPress on Windows servers. They also want to use WIMP instead of WAMP. I don't like the idea, but can't explain intelligently why it's bad- Can someone help me?

What are the potential issues hosting WordPress on WIMP? WAMP? Windows in general?

This may be too broad to cover comprehensively, but if there are some fundamental known issues I'd like to hear about them.

Thanks-

EDIT: Some things that come to mind...

1. No mod-rewrite in IIS, so are permalinks a problem?

I can't get WordPress pretty permalinks to work on my Fedora LAMP server. If I set them and click a page/post link I'll get a ""Oops! This link appears to be broken."

• The .htaccess file is writable and being updated,
• mod_rewrite module seems to be loaded in my httpd.conf (See below)
• The errors in my apache log say simply "Document not found".

I'm at the end of my rope! Here's the httpd.conf:

### Section 1: Global Environment

# start the rewrite engine (I ADDED THIS)
RewriteEngine on 

ServerTokens OS

ServerRoot "/etc/httpd"

PidFile run/httpd.pid

Timeout 120

KeepAlive Off

MaxKeepAliveRequests 100

KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       8
MinSpareServers    5
MaxSpareServers   20
ServerLimit      256
MaxClients       256
MaxRequestsPerChild  4000
</IfModule>


<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75 
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

#
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the <VirtualHost>
# directive.
#
# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80
Listen 80

LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule cgi_module modules/mod_cgi.so

#
# The following modules are not loaded by default:
#
#LoadModule cern_meta_module modules/mod_cern_meta.so
#LoadModule asis_module modules/mod_asis.so

Include conf.d/*.conf

User apache
Group apache

### Section 2: 'Main' server configuration


ServerAdmin root@localhost

UseCanonicalName Off

DocumentRoot "/var/www/html"

<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>

<Directory "/var/www/html">


    Options Indexes FollowSymLinks


    AllowOverride None


    Order allow,deny
    Allow from all

</Directory>


<IfModule mod_userdir.c>

    UserDir disabled

</IfModule>


DirectoryIndex index.html index.html.var

#
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

TypesConfig /etc/mime.types

DefaultType text/plain

<IfModule mod_mime_magic.c>
#   MIMEMagicFile /usr/share/magic.mime
    MIMEMagicFile conf/magic
</IfModule>

HostnameLookups Off

ErrorLog logs/error_log

CustomLog logs/access_log combined

ServerSignature On

Alias /icons/ "/var/www/icons/"

<Directory "/var/www/icons">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<IfModule mod_dav_fs.c>
    # Location of the WebDAV lock database.
    DAVLockDB /var/lib/dav/lockdb
</IfModule>

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>


IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable Charset=UTF-8

ReadmeName README.html
HeaderName HEADER.html

IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t

AddDefaultCharset UTF-8

AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

AddHandler type-map var

AddType text/html .shtml
AddOutputFilter INCLUDES .shtml


Alias /error/ "/var/www/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
    <Directory "/var/www/error">
        AllowOverride None
        Options IncludesNoExec
        AddOutputFilter Includes html
        AddHandler type-map var
        Order allow,deny
        Allow from all
        LanguagePriority en es de fr
        ForceLanguagePriority Prefer Fallback
    </Directory>


</IfModule>
</IfModule>


#
# Proxy Server directives. Uncomment the following lines to
# enable the proxy server:
#
#<IfModule mod_proxy.c>
#ProxyRequests On
#
#<Proxy *>
#    Order deny,allow
#    Deny from all
#    Allow from .example.com
#</Proxy>

#
# Enable/disable the handling of HTTP/1.1 "Via:" headers.
# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
# Set to one of: Off | On | Full | Block
#
#ProxyVia On


NameVirtualHost *:80


<VirtualHost *:80>
 # start the rewrite engine
 RewriteEngine on
 ServerName www.example.com
 DocumentRoot /var/www/html/com_example_www
</VirtualHost>

I can't get wordpress permalinks working on my Fedora LAMP server and expect it's due to mod_rewrite issue, but I can't figure out

1. How do I check if mod_rewrite exists/is enabled?
2. How do I install it (yum?) if it's not?

Any help appreciated. Thanks-

I've just installed vsftpd, and started the service. The service is running, and my netstat dump shows it (See below). I've also enabled anonymous access for good measure. However, when I try to access the server with an FTP client, or even just telnet to port 21, I get a "connection refused".

How do I troubleshoot this?

netstat -a:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 localhost:11110             *:*                         LISTEN
tcp        0      0 *:mysql                     *:*                         LISTEN
tcp        0      0 *:macromedia-fcs            *:*                         LISTEN
tcp        0      0 *:ndmp                      *:*                         LISTEN
tcp        0      0 *:ftp                       *:*                         LISTEN
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 localhost:19350             *:*                         LISTEN
tcp        0      0 *:lmsocialserver            *:*                         LISTEN
tcp        0      0 localhost:19350             localhost:60863             ESTABLISHED
tcp        0      0 mischost:ssh                c-71-56-64-141.hsd1.g:62946 ESTABLISHED
tcp        0      0 localhost:60863             localhost:19350             ESTABLISHED
tcp        0    196 mischost:ssh                c-71-56-64-141.hsd1.g:18606 ESTABLISHED
tcp        0      0 *:http                      *:*                         LISTEN
tcp        0      0 *:ssh                       *:*                         LISTEN
tcp        0      0 mischost:http               baiduspider-123-125-7:25479 FIN_WAIT2
udp        0      0 *:ndmp                      *:*

/etc/sysconfig/iptables:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:92]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1935 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1111 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT

iptables -L -n:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
REJECT     all  --  0.0.0.0/0            127.0.0.0/8         reject-with icmp-port-unreachable
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:10000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:1935
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:1111
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
LOG        all  --  0.0.0.0/0            0.0.0.0/0           limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `iptables denied: '
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

I've just installed vsftpd, and started the service, but now what?

• How and where do FTP users get set up?
• I've got a wordpress install that needs to use FTP. Should I set up a special user for it?

I'm trying to wrap my head around FTP for local users.

For example, I have a local WordPress install that requires FTP to update certain plugins. My understanding is that I would create an FTP server, and WordPress would get access as a local user. But...

• Why is this necessary? When WordPress downloads the plugin files from the remote plugin site, it isn't using FTP, and when it needs to install it in its folder, why can't it just have writable access to that folder?
• Does FTP vs FTPS matter in this case. I understand FTP transmits passwords in clear text, but if it's not being transmitted remotely, why would that matter?

Thanks-

I've got a Github repo I want to access from two different Linux machines.

For the first machine, I followed Github's instructions for generating SSH keys, and added the resulting public key to Github. This client works fine.

For the second client, I copied the /home/{user}/.ssh/id_rsa file from the first client. I thought this might be all I had to do, but when I try to connect I get 'Permission denied (publickey).'

What am I missing?

I'm using Amazon EC2 and trying to choose a machine image (AMI) for my project. It seems all their LAMP AMIs are Fedora Core 4, but this seems like quite an old version, considering the current release is apparently Fedora 12, and < 10 releases are no longer supported.

My question is how significantly different are the early fedora releases- is it crazy to be on versions 4 or even 8?

(I realize this is probably a broad question)

I'm trying to understand the process for enabling an a core extension (dom) in php. When I run phpinfo, I see '--disable-dom' in the configure command. Am I supposed to re-install PHP?