GorillaPatch's questions

I am having a setup of a dual boot PC running FreeBSD 12 and Debian 10. There is a three disk zraid in the system created by FreeBSD which I would like to use as a common storage pool for both operating systems.

In principle I can mount the pool from both OSes, however I get an error because the two host IDs of both installations are different and the pool is not exported during shutdown. I can override it using zpool import -f, however it seems not like a very clean solution.

How can I solve this problem? I can think of two possibilities:

1. manually set the host IDs to make the two IDs identical for FreeBSD and Debian (not sure if this is really a good idea, because it is called ID for some reason)

2. put something in the shutdown routine of each OS to make it export the pool automatically. However I would need the corresponding import functionality on startup.

Data consistency and data safety is of big importance, that why I am using ZFS in the first place.

I am experiencing an issue if I want to do a zfs receive on FresBSD 11.3. I start it using zfs receive -vF destpool@snap1 < snapshot.zfsdump. The sending part works fine but the receive says:

receiving full stream into destpool@2019-07-27

And then the whole machine is getting laggy. At first I can still use the mouse, but I cannot for example establish a new SSH connection into it. I also cannot abort the command in the terminal using crtl-C.

I have tried debugging it by looging at suspicious dmesg messages, but there was nothing. Also I tried recreating the zfs pool on the destination disk.

What I want to achieve is to backup my ZFS root system onto another pool in the same machine.

It seems similar to zfs send -i / receive stalling but this is FreeBSD, not Solaris and it has not fully investigated then, too.

I am grateful for any ideas.

Update I have made some more experiments. When receiving small datasets it works, however when I tried to transfer a 2 GB dataset the machine stalled again.

# zfs receive -vd zfsroot < /tmp/test.zdump
receiving full stream of zroot/tmp@2019-07-24 into zfsroot/tmp@2019-07-24
received 4.39MB stream in 1 seconds (4.39MB/sec)

The 2 GB snapshot did not finish.

I am having trouble with my netatalk server 3.0.1 on FreeBSD-9.1 RELEASE. Netatalk was installed from the ports collection and is sharing some directories over the network.

Update also netatalk version 3.0.2 has the same problems on my machine

afpd.conf

[Global]
; Global server settings

[Homes]
basedir regex = /home
home name = $f - $u 's Home

[testvolume]
path = /var/tmp

[Storage]
path = /tank

[Time Machine Backup]
path=/tank/TM_backup
vol size limit = 2000000
time machine = yes

/tank is in my case the root of a ZFS Pool with the different filesystems underneath it. I connected a mac running Mac OS X 10.7.5 to it and it works perfectly as a Time Machine device. However if I want to use the storage share to create a new aperture library on it Aperture just stalls and cannot create a new library on the server. Looking at the server log it outputs the following:

server log

Feb 17 20:09:09 glacier afpd[3501]: afp_disconnect: primary reconnect failed
Feb 17 20:09:09 glacier afpd[3210]: Terminated disconnected child[3229], client rebooted.
Feb 17 20:09:09 glacier afpd[3505]: AFP3.3 Login by towe
Feb 17 20:09:09 glacier kernel: pid 3501 (afpd), uid 501: exited on signal 6
Feb 17 20:09:09 glacier afpd[3505]: afp_disconnect: trying primary reconnect
Feb 17 20:09:09 glacier afpd[3210]: Reconnect: transfering session to child[3501]
Feb 17 20:09:09 glacier afpd[3210]: read: Bad file descriptor
Feb 17 20:09:09 glacier afpd[3210]: Reconnect: error sending DSI id to child[3501]
Feb 17 20:09:14 glacier afpd[3505]: afp_disconnect: primary reconnect failed
Feb 17 20:09:14 glacier afpd[3210]: Terminated disconnected child[3229], client rebooted.
Feb 17 20:09:14 glacier kernel: pid 3505 (afpd), uid 501: exited on signal 6
Feb 17 20:09:14 glacier afpd[3506]: AFP3.3 Login by towe
Feb 17 20:09:14 glacier afpd[3506]: afp_disconnect: trying primary reconnect
Feb 17 20:09:14 glacier afpd[3210]: Reconnect: transfering session to child[3505]
Feb 17 20:09:14 glacier afpd[3210]: read: Bad file descriptor
Feb 17 20:09:14 glacier afpd[3210]: Reconnect: error sending DSI id to child[3505]

So the server is stuck in a 5 second repeating reconnection loop which always fails.

This is the output of the zfs list command:

NAME                                    USED  AVAIL  REFER  MOUNTPOINT
tank                                    725G  4.62T   682K  /tank
tank/Downloads                         1.61G  4.62T  1.61G  /tank/Downloads
tank/TM_backup                          495G  4.62T   495G  /tank/TM_backup
tank/movies                             169G  4.62T   169G  /tank/movies
tank/music                             26.4G  4.62T  26.4G  /tank/music
tank/pictures                          24.3G  4.62T  24.3G  /tank/pictures

My questions

1. How can I fix this reconnection loop?
2. How can I prevent a mounted AFP share from being unmounted after some time of inactivity?

UPDATE What I now found out is that the problem arises only if I write to a RAIDZ filesystem. A plain ZFS volume works.

I have the following situation: I configured a FreeBSD 9.1 machine as the endpoint of a heartbeat SixXS tunnel on a gif0 interface. It works so far, and I can ping6 via IPv6.

I assigned to another interface lagg0 which is an aggregated interface a static IPv6 out of the assigned IPv6 subnet which is connected to the LAN. Now I would like to advertise this network prefix to my LAN using the rtadvd deamon.

This is its /etc/rtadvd.conf file:

lagg0:\
     :addr="xxxx:yyyy:zzzz:aaaa::":prefixlen#64:tc=ether:

with xxxx:yyyy:zzzz:aaaa::/64 being the network prefix. When I now add clients to the network, they take the network prefix and generate their autoconf and temporary adresses. That works great.

However what they are missing is the correct IPv6 default route. In the routing table the default route for IPv6 is the fe80:: link-local adress of the router.

Now no packets are routed to the internet. If I add the default route manually to the host it works.

My questions

I thought that the router advertisement should configure the right default route on the clients. Am I missing something here? Why does it advertise its link-local adress instead of the right one?

I am using a Strongswan VPN server on a Debian Squeeze machine. The incoming VPN clients get an IP of the 192.168.99.0/24 subnet.

As I am using this VPN mainly to have encryption when using non-encrypted WLANs I am doing a source NAT into the internet using iptables. (I prefere source NATing because the server has a static ipv4 adress.)

At the moment I am using the following iptables command

# used for StrongSWAN
iptables -t nat -I POSTROUTING -s 192.168.99.0/24 -o eth0 -j SNAT --to-source <public IP adress of server>

My question is: when using this rule, every traffic that is incoming from this 192.168.99.0/24 subnet is now accepted and NATted. I would like to be more specific that only traffic that entered the server through this VPN tunnel is accepted by this rule.

In a classic router setup with two network devices I would check for the incoming device to achieve that. Is there something equivalent in Strongswan (e.g. virtual network devices)?

How can I filter out the packets that reached the server through the tunnel so that only these packets are NATed?

It is a bit embarrassing to admit, but I have problems getting my NFS server exporting the right directories. I am using an up-to-date CentOS 6.2 on both the client and the server.

The server is up and running, the firewall was disabled during the tests.

On the server side I have created this /etc/exports:

/home/user1/documents/   *(ro,sync)

this directory is the root of a volume of a software raid. mount output as follows:

/dev/mapper/lvm--raid-lvol0 on /home/user1/documents type ext4 (rw,nosuid,nodev)

the command showmount -e on the server shows the correct output:

Export list for servername:
/home/user1/documents (everyone)

I try to mount that share from the client and get the following output:

mount.nfs: access denied by server while mounting servername:/home/user1/documents

However when I look afterwards on the server at the file /proc/fs/nfsd/exports I see more than one mountpoint, but not the right one

# Version 1.2
# Path Client(Flags) # IPs
/       *(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=696f3ea6:3d7641f3:b6315631:bd63c833)
/home   *(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=696f3ea6:3d7641f3:b6315631:bd63c833)
/home/user1     *(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=696f3ea6:3d7641f3:b6315631:bd63c833)

Where do these entries come from and why is there no line starting with /home/user1/documents ? I tried mounting /home/user1 instead of /home/user1/documents from the client and this strangely works.

The UIDs of the user are the same on the server and the client. Could it be a problem that the directory to be exported is mounted itself?

Edit

The file /var/lib/nfs/xtab is empty.

I would like to have a small dynamic adress part and the most clients are assigned a fixed IP adress.

My dhcpd.conf looks like this:

use-host-decl-names on;
authoritative;
allow client-updates;
ddns-updates on;

# Einstellungen fuer DHCP leases
default-lease-time 3600;
max-lease-time 86400;

lease-file-name "/var/lib/dhcpd/dhcpd.leases";

  subnet 192.168.11.0 netmask 255.255.255.0 {
        ddns-updates on;
    pool {
        # IP range which will be assigned statically
        range 192.168.11.1 192.168.11.240;
        deny all clients;
    }
    pool {
        # small dynamic range
        range 192.168.11.241 192.168.11.254; # used for temporary devices
    }
}    

 group {
    host pc1 {
        hardware ethernet xx:xx:xx:xx:xx:xx;
        fixed-address 192.168.11.11;
        }
}

The motivation for the pool declaration with deny all hosts comes from the ISC DHCPD homepage http://www.isc.org/files/auth.html This will allow hosts to be first added to the network, where they will receive a temporary IP from the 241-254 adress range and then later write an explicit host declaration. Upon next connect it will receive the right configuration.

The problem is that I am getting error messages that 192.168.11.13 has a dynamic and a static lease. I am a bit confused as I expected the pool declaration with deny all clients would not count as dynamic.

  Dynamic and static leases present for 192.168.11.13.
  Remove host declaration pc1 or remove 192.168.11.13
  from the dynamic address pool for 192.168.11.0/24

Is there a way to have the DHCP server send an DHCPNA to clients if they have a host statement and retain this dynamic range?

I am looking for a web interface to administer an ISC DHCP server. I have the setup of one Debian Linux box running an ISC DHCP server and I would like to add a second DHCP server as failover.

To facilitate administration for non-UNIX experienced users, I would like to run a web interface which can be used to add and change DHCP adresses with their corresponding MAC adresses. The DHCP server will be serving IP adresses based on the client's MAC adress.

Idealy it would also support synching the IP/MAC adress pairs to the second dhcp server, but this could be done with some scripting, too.

I would like to set up a VPN server on debian linux to encrypt wireless traffic coming from my Mac or iOS device. I would like to use a certificate-based solution. Setting up a PKI infrastructure and managing certificates is OK for me.

1. Which server to pick?

By looking through the internet and here on stackoverflow I found the following possible solutions:

• strongSwan
• IPSec and racoon

Which solution is feasible for a linode running debian squeeze?

2. How to configure the network?

If I understood correctly a VPN has a virtual network interface as an endpoint on the server side. Naively I would think that I need a DHCP server running on the server to assign a dynamic private IP (like of the class C network 192.168.xxx.xxx) to the connecting clients. Next I think I would need to set up masquerading to NAT the incoming VPN traffic to the real interface directly connected to the internet.

Is this the right way to go? Do you have any configuration examples? I often saw VPN configurations used to connect to your home network, but that is not what I am looking for. I have a server up in the internet and want to use it as a proxy to encrypt traffic in insecure network environments like public WLANs.

My problem

I have a debian squeeze installation running nginx as my webserver and handling PHP5 requests using php-fpm, which works fine. I have one directory, which holds static zip files of a program in different versions. What I would like to have is a nice download statistics about which file was downloaded how often. I am not sure what would be the best way to implement it. I have set up a separate location block in my configuration file to log these downloads separately.

Acquiring raw data

For the acquisition of the raw data, meaning the download numbers I have two possibilities in mind:

1. Using a script written in perl to parse the log files on a regular basis.
2. Using the post_action directive in my separate location block to trigger a logging script when the download has finished.

Processing the data

To process and log the data I could imaging using different tools:

1. Store the values like filename and download times in a sqlite database and read data from there.
2. Use rrdtool to directly store the data in a round-robin manner which would also make generating graphs very easy.

There is another possibility of making all the above steps obsolete, but I do not know if it could work out. I am using google analytics for this site, could I somehow log these download numbers with this? By doing this I would not have to implement anything.

I would like to install gitorious on my Debian squeeze server. For doing so I have to install some gems like the ruby database driver for MySQL.

I have the choice of using a Debian package and install it via apt-get or use gem to install it. To make the latter work I installed the necessary development packages of MySQL.

So it works fine until now.

My question is: What is easier in the long run: using the language's specific package manager like gem for Ruby, CPAN for Perl, etc. or is it better to look for Debian packages of these extensions?

I appreciate the ideas and best practices of better admins than me.

My Setup
I am running nginx 0.7.67 on Debian Lenny as a webserver, not as a reverse proxy. I am using php5-fpm to handle my PHP requests, which works fine.

My Aim
I would like to have a WordPress installation that is laid out as described here clean wordpress subversion installation. I would like to have a clean WordPress installation without cluttering my server root directory with all the WordPress files.
That means that my wordpress installation would be in /wordpress and my themes and plugins inside /wordpress-content.

The important point however is that if you navigate to my domain www.example.com then you would be taken directly to the WordPress blog, without having to specify the subdirectory where WordPress lives.

I found a how-to at the nginx site installing wordpress but unfortunately this is for moving the entire WordPress directory instead of redirecting the traffic to it.

I tried with the following configuration:
example.conf in sites-available

server {
  listen 80;
  server_name     www.example.com;
  access_log      /var/log/nginx/www.example.com.access.log main;
  root            /var/www/example/htdocs;

  location / {
     try_files $uri $uri/ /wordpress/index.php?q=$uri&$args;
  }


  include /etc/nginx/includes/php5-wordpress.conf;
  include /etc/nginx/includes/deny.conf;
}

php5-wordpress.conf in includes

location /wordpress {
   try_files $uri $uri/ /wordpress/index.php?q=$uri&$args;
}

location ~ \.php$ {
       fastcgi_split_path_info ^(/wordpress)(/.*)$;
       fastcgi_ignore_client_abort on;
       fastcgi_pass   unix:/var/run/php5-fpm.socket;
       fastcgi_index  index.php;
       include        /etc/nginx/fastcgi_params;
}

fastcgi_params

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

The problems I have is that when I go to the address "http://www.example.com" I get a 403 error as I disabled directory listing. Instead I would like my WordPress to appear then. Also if I navigate to "http://www.example.com/wordpress" I get a "file not found" error. However if I comment out the fastcgi_split_path_info line in my php5-wordpress.conf at least the WordPress installation works inside /wordpress.

I need help how to debug this behavior or where I can find more information.

Update: Added error log entry for the 403 error.

in the error.log I get the following entry for the 403 error:

2010/12/11 07:54:24 [error] 9496#0: *1 directory index of
"/var/www/example/htdocs/" is forbidden, client: XXX.XXX.XXX.XXX,
 server: www.example.com, request: "GET / HTTP/1.1", host: "www.example.com"

Update 2: Added the nginx.conf below:

user www-data;
worker_processes  1;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format   main '$remote_addr - $remote_user [$time_local]  $status '
    '"$request" $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;
    tcp_nodelay        on;

    gzip  on;

    index index.php index.html;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

I have a question concerning the setup of nginx on a server handling different virtual hosts. I am now a bit confused where the root directive should be. I have seen the following two possibilities.

Variant A

server {
listen          80;
server_name     www.site.com;
access_log      /var/log/nginx/www.site.com.access.log main;
root            /var/www/$server_name/htdocs;

location / {
   index index.html;
   }
}

or the other one

Variant B

server {
listen          80;
server_name     www.site.com;
access_log      /var/log/nginx/www.site.com.access.log main;

location / {
   root         /var/www/$server_name/htdocs;
   index        index.html;
   }
}

I am a bit confused if the two variants are equal. For the different vhosts I planned to have individual .conf files with different server_name and root directives in /etc/nginx/sites-available. To activate a vhost I would have a symbolic link to the conf file in /etc/nginx/sites-enabled. Or would you store the configuration file in /var/www/$server_name to have it "close" to the www data?

So to sum up, I have two questions:
1. Which of the two variants of the nginx.conf file is better for the multiple vhost setup and why?
2. Where would you store the configuration files for each vhost?

Thanks.