Home / user-44687

Mike's questions

Martin Hope
Mike
Asked: 2013-03-24 19:04:53 +0800 CST
  • 5

I am trying to rotate outgoing IPs using iptables. I want to rotate outgoing connections between three IPs, one by one. Here is what I'm doing with iptables:

root@server:~# iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 80 -o eth0 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to-source XXX.XXX.XXX.133
root@server:~# iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 80 -o eth0 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to-source XXX.XXX.XXX.134
root@server:~# iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 80 -o eth0 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to-source XXX.XXX.XXX.135

It seems like it's kind of working, but something is not reliable about it. The ordering of the outgoing IPs is not quite predictable, and it sometimes distributes them unevenly.

This is on a completely bare Ubuntu install so I don't think there are any other outgoing connections on this port, but I could be wrong.

Does anyone know how to make this more reliable? Or is it already doing the right thing and I'm interpreting the results wrong?

I want the IPs distributed perfectly evenly and reliably, one after another.

Here's what the results are:

{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.134","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.134","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.134","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.134","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.134","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.135","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
{"ip":"XXX.XXX.XXX.133","about":"/about","Pro!":"http://getjsonip.com"}root@server:~# curl jsonip.com
linux
Martin Hope
Mike
Asked: 2013-03-05 22:35:42 +0800 CST
  • 21

I am curious if it is possible to have a VPS that has data on it that is not readable by the hosting provider, but is still usable on the VPS.

Obviously there are some things that you could do to prevent them from reading anything...

  1. You could change all the passwords, including root. But then, they could still use some alternate boot to reset the password, or they could just mount the disk another way.

  2. So, you could encrypt the disk or at least some of the contents on the disk. But then it seems that if you decrypted the content, they could still "peer in" to see what you were doing at the console, because after all, the virtualization platform should allow this.

  3. And even if you could stop that, it seems they could just read the RAM of the VPS directly.

Of course, the VPS can store data on it and as long as the key is not on the VPS and the data is never decrypted there, then the host cannot get the data.

But it seems to me that if any point the data on the VPS is decrypted...for use on the VPS...then the hosting provider can get the data.

So, my two questions are:

  1. Is this correct? Is it true that there is no way to 100% secure data on a VPS from a host from seeing it, while keeping it accessable by the VPS?

  2. If it is possible to make it 100% secure, then how? If it is not possible, then what is the closest you can get to hiding data from the web host?

virtualization linux security amazon-ec2 encryption
Martin Hope
Mike
Asked: 2011-01-21 23:33:32 +0800 CST
  • 1

I do most of my work in vim. I much prefer to edit files using vim locally rather than sshing into a server and running vim there, for many reasons, one of the most important being UI responsiveness on a slow connection.

I know that I can edit remote files using vim and scp and I also have a setup with sshfs that allows me to quite simply cd to a mount point and vim up some files.

However, it really bothers me that every time I save the file, it writes the whole file to the remote server. This really slows down my workflow.

What I really would like to do is have some sort of setup like this:

  1. When opening a remote file with local vim, pull the file's contents and a hash of the file
  2. When saving the file, check if the remote hash has not changed, and if it has not, upload a diff and patch the remote file with the new changes.
  3. Preferably do this all through a persistent ssh connection, so that no time is lost opening a new connection each time.

This would be much faster and much more bandwidth efficient, and have the same functionality.

I usually use git or svn to achieve a similar result, but I really want this kind of minimal functionality for situations when I do not have the luxury of using such SCM systems.

My questions are:

1. Does anyone know of any existing scripts or programs that will do some or all of this for me?

2. Anyone care to whip up some bash one liners that will do the trick? I know it should be able to be done with a few of these...

bash vim ssh scp
Martin Hope
Mike
Asked: 2010-06-06 18:19:57 +0800 CST
  • 0

I'd like to verify that nothing within /foo/bar is chmod 777. Or, alternatively, I'd like to make sure that nothing within /foo/bar us owned by user1 or in group1.

Is there any way I can recursively verify the permissions within a given subdirectory to make sure there aren't any security holes?

Notice that I do not want to change all the permissions to something specific, nor do I want to change the owner to something specific, so a recursive chmod or chown won't do it...

Thanks!

unix permissions
Martin Hope
Mike
Asked: 2010-06-06 06:24:02 +0800 CST
  • 0

I'm on Mac OSX and i I have apache2 installed via MacPorts, running as the _www user.

I have some files I want to serve in the /Users/Me/Documents/abc folder.

Right now, though, the permissions of /Users/Me/Documents are 700. So, _www can't get in, even if abc is chmod 777.

I recognize the following options:

  1. Allow _www access to my Documents folder.
  2. Put the files I want to share outside of my Documents folder.
  3. Hard-link the files outside of my Documents folder, and point apache to the hard links.

None of these solutions are acceptable to me, however. I don't feel safe allowing _www access to my entire Documents folder. I really want to keep the files in my Documents folder for other reasons. The files are changing all the time, so hard-linking would not always reflect the right file structure, and, as I understand it, you can't hard-link a directory (though, if you could, that would solve it).

Any ideas for a solution? Is there a way to run a few httpd processes as my user account so it can get in there?

Or, is there some way to hard-link a directory, or some way to get httpd to follow a symlink past a directory that is 700 not owned by _www?

Thanks!

mac-osx apache-2.2 unix permissions
Martin Hope
Mike
Asked: 2010-06-02 12:24:30 +0800 CST
  • 14

Set-Up

I've been a programmer for quite some time now but I'm still a bit fuzzy on deep, internal stuff.

Now. I am well aware that it's not a good idea to either:

  1. kill -9 a process (bad)
  2. spontaneously pull the power plug on a running computer or server (worse)

However, sometimes you just plain have to. Sometimes a process just won't respond no matter what you do, and sometimes a computer just won't respond, no matter what you do.

Let's assume a system running Apache 2, MySQL 5, PHP 5, and Python 2.6.5 through mod_wsgi.

Note: I'm most interested about Mac OS X here, but an answer that pertains to any UNIX system would help me out.

My Concern

Each time I have to do either one of these, especially the second, I'm very worried for a period of time that something has been broken. Some file somewhere could be corrupt -- who knows which file? There are over 1,000,000 files on the computer.

I'm often using OS X, so I'll run a "Verify Disk" operation through the Disk Utility. It will report no problems, but I'm still concerned about this.

What if some configuration file somewhere got screwed up. Or even worse, what if a binary file somewhere is corrupt. Or a script file somewhere is corrupt now. What if some hardware is damaged?

What if I don't find out about it until next month, in a critical scenario, when the corruption or damage causes a catastrophe?

Or, what if valuable data is already lost?

My Hope

My hope is that these concerns and worries are unfounded. After all, after doing this many times before, nothing truly bad has happened yet. The worst is I've had to repair some MySQL tables, but I don't seem to have lost any data.

But, if my worries are not unfounded, and real damage could happen in either situation 1 or 2, then my hope is that there is a way to detect it and prevent against it.

My Question(s)

Could this be because modern operating systems are designed to ensure that nothing is lost in these scenarios? Could this be because modern software is designed to ensure that nothing lost? What about modern hardware design? What measures are in place when you pull the power plug?

My question is, for both of these scenarios, what exactly can go wrong, and what steps should be taken to fix it?

I'm under the impression that one thing that can go wrong is some programs might not have flushed their data to the disk, so any highly recent data that was supposed to be written to the disk (say, a few seconds before the power pull) might be lost. But what about beyond that? And can this very issue of 5-second data loss screw up a system?

What about corruption of random files hiding somewhere in the huge forest of files on my hard drives?

What about hardware damage?

What Would Help Me Most

  1. Detailed descriptions about what goes on internally when you either kill -9 a process or pull the power on the whole system. (it seems instant, but can someone slow it down for me?)

  2. Explanations of all things that could go wrong in these scenarios, along with (rough of course) probabilities (i.e., this is very unlikely, but this is likely)...

  3. Descriptions of measures in place in modern hardware, operating systems, and software, to prevent damage or corruption when these scenarios occur. (to comfort me)

  4. Instructions for what to do after a kill -9 or a power pull, beyond "verifying the disk", in order to truly make sure nothing is corrupt or damaged somewhere on the drive.

  5. Measures that can be taken to fortify a computer setup so that if something has to be killed or the power has to be pulled, any potential damage is mitigated.

  6. Some information about binary files -- isn't it true that the apache binary file or some library could have a random byte or two corrupted in the middle, that wouldn't come out and cause a problem until later? How can I assure myself that this didn't happen as a result of the power pull or the kill?

Thanks so much!

corruption electrical-power kill