Tom's questions

I have two machines, Client and Server.

Client (who is behind a corporate firewall) opens a reverse SSH tunnel to Server, which has a publicly-accessible IP address, using this command:

ssh -nNT -R0:localhost:2222 [email protected]

In OpenSSH 5.3+, the 0 occurring just after the -R means "pick an available port" rather than explicitly calling for one. The reason I'm doing this is because I don't want to pick a port that's already in use. In truth, there are actually many Clients out there that need to set up similar tunnels.

The problem at this point is that the server does not know which Client is which. If we want to connect back to one of these Clients (via localhost) then how do we know which port refers to which client?

I'm aware that ssh reports the port number to the command line when used in the above manner. However, I'd also like to use autossh to keep the sessions alive. autossh runs its child process via fork/exec, presumably, so that the output of the actual ssh command is lost in the ether.

Furthermore, I can't think of any other way to get the remote port from Client. Thus, I'm wondering if there is a way to determine this port on Server.

One idea I have is to somehow use /etc/sshrc, which is supposedly a script that runs for every connection. However, I don't know how one would get the pertinent information here (perhaps the PID of the particular sshd process handling that connection?) I'd love some pointers.

Thanks!

I have an LVM logical volume spread over eight separate physical volumes on Amazon AWS. The logical volume is formatted using ext3.

One of my physical volumes has failed. Is there any way to recover some or all of the data from the remaining volumes?

Thanks!

This may be a bit of a noobish question, but I was taking a look at /etc/hosts on my new Xubuntu install and saw this:

127.0.0.1 localhost
127.0.1.1 myhostname

On most 'nixes I've used, the second line is omitted, and if I want to add my hostname to the hosts file, I'd just do this:

127.0.0.1 localhost myhostname

Is there a difference between these two files in any practical sense?

I'm using a combination of mdadm, lvm2, and XFS on Amazon EC2.

So far, I've had success running a RAID 5 volume built from a number of EBS volumes. The EBS volumes are attached and used with mdadm to create the RAID 5. Then, I use LVM to present the resulting RAID as a single physical volume and single logical volume.

In the past, I've been able to grow the file system by adding a new EBS volume, attaching it, and then running the following process.

mdadm --add /dev/md0 /dev/xvdi

# grow the raid... (could take a while for a large disk!)
mdadm --grow /dev/md0 --raid-devices=4

# grow the LVM physical volume
pvresize /dev/md0

# grow the LVM logical volume ... fairly certain
# -l100%PVS will make the extents use as much space
# as possible on physical disks (and hopefully won't overwrite anything)
lvresize -l100%PVS /dev/data_vg/data_lv

# resize the file system, too!
xfs_growfs /dev/data_vg/data_lv

# yay!
df -h

My most recent attempt at doing this has worked just fine, ostensibly. Running df -ih/fh shows that I have a mounted filesystem with an additional terabyte available, as expected. Also, the total number of inodes used is ONLY 1%. Also, pvdisplay and lvdisplay also show the proper volume sizes.

I've even been able to add some data (about 150GB) to the volume since growing it. However, today I attempt to create a directory and get

mkdir: no space left on device

Why would I encounter this problem if I allegedly have plenty of inodes availble?

I've unmounted the disk and run xfs_check, but that does not report any issues.

Thanks!

I'm running MongoDB in a virtualized Linux environment. In this situation, I have multiple physical disks that I can use for the database. However, I'd rather not manage a RAID (mostly because I have little to no experience with RAIDs.)

I'm also reluctant to use LVM because I want to minimize the impact of a drive failure should one occur.

Is there a way to configure MongoDB to use multiple physical disks?

I've been skimming through the NSA suggestions for hardening Mac OS X and Linux and noticed this little tidbit of info:

Setuid programs run with the privileges of the file's owner (which is often root), no matter which user executes them. Bugs in these programs can allow privilege escalation attacks. To find setuid and setgid programs, use the commands:

find / -perm -04000 -ls
find / -perm -02000 -ls

After identifying setuid and setgid binaries, disable setuid and setgid bits (using chmod ug-s programname) on those that are not needed for system or mission operations.

My question is, how does one identify which apps can have their setuid/setgid bits disabled? For example, I'm assuming some apps like su, sudo, and login must have setuid. On the other hand, something like write probably does not need setuid. Is there a good way to find out whether an app really needs it?

I created a passwordless ssh login for one of my servers by using the authorized_keys file.

The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (connection timeout.) If I disable fail2ban, I can once again log in. Is there a way to configure fail2ban to not count my successful logins against me?

Thanks!

I have a few Ubuntu boxes that run various cron jobs daily. As far as I know, there is no postfix or sendmail installed. What's the easiest and/or best way to get cron to send me an email when one of its jobs fail with an error?

Thanks!

I've got an Ubuntu 9.10 64-bit server that seems to use up all available memory. According to my munin graphs, almost all of the memory used up is in the swap cache, cache, and slab cache. (I take this to mean virtual memory caches, am I right in assuming this?)

Once memory usage approaches 100%, some (although not all) system services such as SSH become sluggish and unresponsive. After rebooting the system, performance and memory usage become normal for a time.

Some interesting tidbits:

• The system runs Apache 2, MySQL, Munin, and sshd.
• The memory usage spikes happen at the same time every night (at 10 PM sharp.)
• There appears to be nothing in the crontab for any of the users, and nothing in /etc/cron.d/* out of the ordinary, let alone something that would occur at 10 PM.

My question is, how do I figure out what is causing the memory suckage? I've tried the usual utilities (e.g. ps, top, etc) but I can't seem to find anything unusual.

Any ideas? Thanks in advance!

I recently had to move an Ubuntu server to a new network. After I hooked it up again, I find I can no longer sudo, even though I was able to previously.

Does this mean a network problem is interfering with sudo (perhaps via PAM or something?) I don't really know the ins and outs of linux security.

Thx! Tom

This is undoubtedly a duplicate question, but my search skills have failed me.

How can I determine whether an app is 64-bit or 32-bit on Windows?

Ideally, I'd like to be able to do this on both 64-bit Windows XP and 64-bit Windows 7.

Thanks!

EDIT: thanks for the responses. Is there a way I can do this when the app is not running? For example, on Linux we've got "readelf"--a command line util to inspect binaries. Is there a comparable tool on Windows?

I'm trying to change the boot order on a VM that uses PhoenixBIOS. I can get to the setup utility. However, I can't figure out how to get into supervisor mode, which is required to change the boot order.

Can anyone tell me how to do this? My Google-fu fails me.