Brian's questions

I run ossec on my server and periodically I receive a warning like this:

Received From: myserver->/var/log/auth.log
Rule: 5701 fired (level 8) -> "Possible attack on the ssh server (or version gathering)."
Portion of the log(s):

Nov 19 14:26:33 myserver sshd[2105]: Bad protocol version identification 'GET /robots.txt HTTP/1.1' from 66.249.73.226

The IP address always corresponds to a google crawler. But why in the world would googlebot be trying to index my SSH server? We run SSH on the standard, well-known port (22), so it seems like google would know better than to look for a web server there. And we definitely haven't published any links that would lead it to believe otherwise.

I have set up a NIS server and several NIS clients. I have a user and a group on the NIS server like so:

/etc/passwd:  myself:x:5000:5000:,,,:/home/myself:/bin/bash
/etc/group:   fishy:x:3001:otheruser,etc,myself,moreppl

I imported the users and groups on the NIS client by adding +:::::: to /etc/passwd and +::: to /etc/group.

I can log in to the NIS client, but when I run groups, fishy is not listed. But getent group fishy shows that it was imported correctly and lists me as a member. And if I do sudo su - myself, then suddenly groups says I am in the group!

I also had nscd installed, and the groups worked correctly for a while. It seemed like after being logged in for a while, I would silently be dropped out of the group. If I restarted nscd and logged in again, then the groups worked correctly...for a while.

There are no UID or GID conflicts with local users or groups.

Update: Contents of /etc/nsswitch.conf:

passwd:         compat
group:          compat
shadow:         compat

hosts:          files nis dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
aliases:        nis files

I get a message like this in my apache error log every few minutes:

Jun 29 11:13:37 www apache2[22839]: [error] [client 129.130.453.734] ping, referer: https://www.example.org/user/262725/downloadhistory

The referer is always a PHP (Drupal) URL, but that may only be because the site is almost all Drupal anyway. I can't find any documentation for "ping" that doesn't refer to a network ping.

We just received a Mac Xserve (donated!) and now I have to find something to do with it. There are personal files scattered all over and a bunch of services running, so I'd like to just reinstall from scratch, but we didn't get any discs with it. And I can't find a place to download Leopard Server from Apple.

I've never installed Mac OS before. But it doesn't look like it uses product keys. So is there a way to reinstall it without the original disc?

The rest of our servers are running Ubuntu 10.04, so I'm also considering just torching Mac OS and installing Ubuntu. However, then it looks like I would have to fiddle with EFI.

At what point is sysctl.conf supposed to be read during boot, and why might it not be running? I have the following settings which are not being applied when I reboot:

net.bridge.bridge-nf-call-arptables = 0
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-filter-pppoe-tagged = 0
net.bridge.bridge-nf-filter-vlan-tagged = 0

fs.nfs.nlm_udpport = 32768
fs.nfs.nlm_tcpport = 32768

The first section is needed for KVM bridging, and the second is to run the NFS lock manager on a known port. However, after booting, these values have not taken effect. If I run sysctl -p, then they do.

This wouldn't be a huge issue, except that I can't figure out how to restart the lock manager without rebooting. I would really like to know why sysctl.conf isn't working at boot, but I'd settle for just being able to restart the lock manager.

This is on Ubuntu server 10.04.2, kernel 2.6.32-31-server. I know some daemons check the permissions on their config files and refuse to work if they're too permissive, but sysctl.conf is 644 root:root, which I'm pretty sure is the default.

Is it possible to force NIS to connect using TCP instead of UDP? I've scoured the documentation for both ypserv (to force listening on TCP only) and ypbind (to connect over TCP only) but found nothing (only an option to specify the listening port). I'm afraid somebody is going to answer "yes, if you compile from source..."

And ypserv listens on both protocols, so why doesn't ypbind try TCP when UDP fails?

Update

I tried Phil's solution, but it turns out that ypbind first contacts portmap on UDP port 111. If it doesn't get a UDP response it just gives up.

This question is similar to set open_files_limit, but there was no good answer.

I need to increase my table_open_cache, but first I need to increase the open_files_limit. I set the option in /etc/mysql/my.cnf:

open-files-limit = 8192

This worked fine in my previous install (Ubuntu 8.04), but now in Ubuntu 10.04, when I start the server up, open_files_limit is reported to be 1710. That seems like a pretty random number for the limit to be clipped to.

Anyway, I tried getting around it by adding a line like this in /etc/security/limits.conf:

mysql   hard   nofile   8192

I also tried adding this to the pre-start script in mysql's upstart config (/etc/init/mysql.conf):

ulimit -n 8192

Obviously neither of those things worked. So where is the hoop that has been added between Ubuntu 8.04 and 10.04 through which I must jump in order to actually increase the open files limit?

I have a server with two interfaces connected to two separate networks, using DHCP for both. When dhclient is writing /etc/resolv.conf, I would like it to append settings that aren't already there. For instance, if I receive from one DHCP server:

nameserver 10.0.0.1
search one.mydomain.com

and from another:

nameserver 10.1.1.254
search two.mydomain.com

Then resolv.conf should look like this:

search one.mydomain.com two.mydomain.com
nameserver 10.0.0.1
nameserver 10.1.1.254

At the moment, it seems the last dhclient overwrites whatever was there. I know I can preconfigure settings in dhclient.conf using supercede or append, but then I have to hard-code the values. I've scoured the man page for dhclient, but it seems like dhclient prefers to work alone (i.e. not in conjunction with any other dhclients)...or am I missing something?

I have been looking at versioned filesystems but I can't find any information on how to back them up. If my disk dies and I have to restore from a backup, I want to be able to restore the filesystem completely, including the past versions of all files.

Obviously the traditional methods like cp and rsync won't work, since they'll only copy the current version (right?). The only other thing I can think of would be to unmount the filesystem and use dd, but that's very inconvenient.

How can I see if a (ext3) filesystem is mounted by asking the filesystem directly (i.e. the same way that the system does when it boots and sees that it was not unmounted cleanly)? Checking the output of mount is no good because the filesystem might be mounted by a virtual machine.

I know I can run fsck and it will abort if the filesystem is mounted, but I don't need to actually check the filesystem.