DanRan's questions

I am trying to get amplify to monitor mysql database on ubuntu server 20.04 running on a raspberry pi 4. I am sure I have set everything up correctly and have crossreferenced my work with many internet guides. However, mysql does not appear in the nginx amplify web interface after setting things up. My logs show the following errors:

2022-08-08 10:32:41,134 [1824839] supervisor ps nginx output: ['   2074       1 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf', '1740162    2074 nginx: worker process', '1740163    2074 nginx: worker process', '1740165    2074 nginx: worker process', '1740166    2074 nginx: worker process', '1740168    2074 nginx: cache manager process', '']
2022-08-08 10:32:41,161 [1824839] supervisor nginx objects: ['5057a79cf47c63d99f326ae55fea2c99bc0e2dcfd6bc5cdc5492d770f0a55284']
2022-08-08 10:32:41,162 [1824839] supervisor status objects: []
2022-08-08 10:32:41,162 [1824839] supervisor api objects: []
2022-08-08 10:32:41,228 [1824839] supervisor failed to find running mysqld via "ps xao pid,ppid,command | grep -E 'mysqld( |$)'" due to AmplifySubprocessError
2022-08-08 10:32:41,228 [1824839] supervisor additional info:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/amplify/ext/mysql/managers.py", line 154, in _find_local
    ps, _ = (ps, None) if ps is not None else subp.call(PS_CMD)
  File "/usr/lib/python3/dist-packages/amplify/agent/common/util/subp.py", line 34, in call
    raise AmplifySubprocessError(message=command, payload=dict(returncode=process.returncode, error=raw_err))
amplify.agent.common.errors.AmplifySubprocessError: (message=ps xao pid,ppid,command | grep -E 'mysqld( |$)', payload={'returncode': 1, 'error': ''})
2022-08-08 10:32:41,229 [1824839] supervisor mysql objects: []

Does anyone understand these errors and could you help me fix this to get mariaDB showing up on Nginx Amplify?

I am running postfix on an ubuntu 20.04 server. I am trying to fix some warnings in my /var/log/mail.err file I am getting the following:

Aug  9 09:34:45 mail postfix/proxymap[281260]: error: open /etc/postfix/sql/mysql_virtual_domains_maps.cf: Permission denied
Aug  9 09:36:49 mail postfix/proxymap[282230]: error: open /etc/postfix/sql/mysql_virtual_alias_maps.cf: Permission denied
Aug  9 09:36:49 mail postfix/proxymap[282230]: error: open /etc/postfix/sql/mysql_virtual_alias_domain_maps.cf: Permission denied
Aug  9 09:36:49 mail postfix/proxymap[282230]: error: open /etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf: Permission denied
Aug  9 09:36:49 mail postfix/proxymap[282230]: error: open /etc/postfix/sql/mysql_virtual_domains_maps.cf: Permission denied
Aug  9 10:25:49 mail postfix/proxymap[304446]: error: open /etc/postfix/sql/mysql_virtual_alias_maps.cf: Permission denied
Aug  9 10:27:49 mail postfix/proxymap[304446]: error: open /etc/postfix/sql/mysql_virtual_alias_domain_maps.cf: Permission denied
Aug  9 10:27:49 mail postfix/proxymap[304446]: error: open /etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf: Permission denied
Aug  9 10:27:49 mail postfix/proxymap[304446]: error: open /etc/postfix/sql/mysql_virtual_domains_maps.cf: Permission denied

In my /var/log/mail.log file I am getting:

Aug  9 10:53:49 mail postfix/proxymap[304446]: warning: mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf is unavailable. open /etc/postfix/sql/mysql_virtual_alias_maps.cf: Permission denied
Aug  9 10:53:49 mail postfix/cleanup[306706]: warning: proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf lookup error for "[email protected]"
Aug  9 10:53:49 mail postfix/cleanup[306706]: warning: 359E0123381: virtual_alias_maps map lookup problem for [email protected] -- message not accepted, try again later
Aug  9 10:53:49 mail postfix/pickup[282225]: 36D3B123381: uid=997 from=<netdata>
Aug  9 10:53:49 mail opendmarc[1127]: ignoring connection from localhost
Aug  9 10:53:49 mail postfix/cleanup[306428]: 36D3B123381: message-id=<[email protected]>
Aug  9 10:53:49 mail postfix/proxymap[304446]: warning: mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf is unavailable. open /etc/postfix/sql/mysql_virtual_alias_maps.cf: Permission denied
Aug  9 10:53:49 mail postfix/cleanup[306428]: warning: proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf lookup error for "[email protected]"
Aug  9 10:53:49 mail postfix/cleanup[306428]: warning: 36D3B123381: virtual_alias_maps map lookup problem for [email protected] -- message not accepted, try again later

Here is the output of:

namei -l /etc/postfix/sql/mysql_virtual_domains_maps.cf

f: /etc/postfix/sql/mysql_virtual_domains_maps.cf
drwxr-xr-x root root /
drwxr-xr-x root root etc
drwxr-xr-x root root postfix
drwxr-xr-x root root sql
-rw-r-x--- root root mysql_virtual_domains_maps.cf

What exactly might be the problem here? How can I debug and then fix this?

I am running an Ubuntu based LEMP server with the Nginx's google pagespeed, fastcgi, and modsecurity modules active. I am going through my Nginx error logs, and cannot figure out what these errors mean, what to attribute them to, and how to fix them. It seems as if something is looking for a file inside of invalid directories, and I don't know why. If someone could please take a look at my Nginx logs located at /var/log/nginx/error.log, and let me know what is going on, why, and how to solve it, it would be greatly appreciated! Please let me know if you have any ideas!

cat /var/log/nginx/error.log
2022/02/27 00:23:32 [error] 396723#502023: [ngx_pagespeed 1.15.0.0-8811] PageSpeed Serf fetch failure rate extremely high; only 9 of 28 recent fetches fully successful; is fetching working?
2022/02/27 00:58:49 [error] 396723#396723: *94537 open() "/etc/nginx/html/us" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /us HTTP/1.1", host: "localhost"
2022/02/27 00:58:49 [error] 396723#396723: *94538 open() "/etc/nginx/html/us" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /us HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:58:50 [error] 396723#396723: *94539 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status?full&json HTTP/1.1", host: "localhost"
2022/02/27 00:58:50 [error] 396723#396723: *94540 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status?full&json HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:58:52 [error] 396723#396723: *94541 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "localhost"
2022/02/27 00:58:52 [error] 396723#396723: *94542 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:58:53 [error] 396723#396723: *94543 open() "/etc/nginx/html/stub_status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /stub_status HTTP/1.1", host: "localhost"
2022/02/27 00:58:53 [error] 396723#396723: *94544 open() "/etc/nginx/html/stub_status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /stub_status HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:58:53 [error] 396723#396723: *94545 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status HTTP/1.1", host: "localhost"
2022/02/27 00:58:53 [error] 396723#396723: *94546 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:58:53 [error] 396723#396723: *94547 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status?full&json HTTP/1.1", host: "localhost"
2022/02/27 00:58:53 [error] 396723#396723: *94548 open() "/etc/nginx/html/status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status?full&json HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396723#396723: *94549 open() "/etc/nginx/html/admin/api.php" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /admin/api.php?version HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396721#396721: *94550 open() "/etc/nginx/html/admin/api.php" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /admin/api.php?version HTTP/1.1", host: "localhost"
2022/02/27 00:59:10 [error] 396721#396721: *94551 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "localhost"
2022/02/27 00:59:10 [error] 396721#396721: *94552 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396721#396721: *94553 open() "/etc/nginx/html/basic_status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /basic_status HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396721#396721: *94554 open() "/etc/nginx/html/stub_status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /stub_status HTTP/1.1", host: "localhost"
2022/02/27 00:59:10 [error] 396721#396721: *94555 open() "/etc/nginx/html/stub_status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /stub_status HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396721#396721: *94556 open() "/etc/nginx/html/status/format/json" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /status/format/json HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:10 [error] 396721#396721: *94557 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?format=plain HTTP/1.1", host: "localhost"
2022/02/27 00:59:11 [error] 396722#396722: *94558 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?format=plain HTTP/1.1", host: "127.0.0.1"
2022/02/27 00:59:11 [error] 396721#396721: *94559 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "localhost"
2022/02/27 00:59:11 [error] 396722#396722: *94560 open() "/etc/nginx/html/server-status" failed (2: No such file or directory), client: 127.0.0.1, server: 127.0.0.1, request: "GET /server-status?auto HTTP/1.1", host: "127.0.0.1"
2022/02/27 02:48:21 [error] 396721#474341: [ngx_pagespeed 1.15.0.0-8811] PageSpeed Serf fetch failure rate extremely high; only 3 of 8 recent fetches fully successful; is fetching working?

I am very new to mod-security, and have been struggling quite a bit with rule exclusions that are beyond the scope of examples shown in this tutorial from Linuxbabe.com. I am running a Wordpress LEMP Server, and my issue is specific to getting the iOS Wordpress app working properly, without mod-security interpreting posts from the iOS Wordpress app as attacks. Also, note, I am using the OSWAP ruleset with mod-security.

The core issues I am having with my wordpress app, are that when turning plugin's on and off from the iOS app, mod-security denies that action. The second (and more important) issue I am having with the iOS app is making (photo) blog posts from the iOS app. Specifically I am having trouble making posts that have a single picture, or a picture gallery in the iOS app.

Initially, the iOS app would not let me make any posts whatsoever, including plain text posts. As of now, I have managed to create a rule exclusion to allow plain text posts, however, that is as far as I have gotten, and any other attempts to unblock (with rule exclusions) picture uploads and gallery posts containing photos, have been a failure. Furthermore any attempts to unblock plugin deactivation and activation from the iOS Wordpress app have also been a failure.

Hopefully a mod-security Pro can read my logs and help me create the proper rule exclusions to get my iOS app fully working while running mod-security on Nginx with wordpress.

Problem 1) Solved

To begin, these are the logs that were created when trying to make a TEXT BASED POST on the Wordpress iOS app: https://pastebin.com/N0UugaAc

After looking at these logs and grasping a mild understanding from linuxbabe.com's tutorial, i created the following rule in the REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf file:

# Allow iOS app to create and save TEXT BASED posts.
SecRule REQUEST_URI "@streq /xmlrpc.php" "id:1030,phase:1,ctl:ruleRemoveById=941180"

This rule alone successfully allows iOS to make text based posts, but does not allow posting photos or uploading photos. Problem 1 solved.

Problem 2) Unsolved

The next problem I am having is trying to upload photos (multiple as well as single) and make a photo based post from the iOS app. These are the logs that were created when trying to make a TEXT BASED POST on the Wordpress iOS app:

https://pastebin.com/nN7h5stb

I have tried the following rules exclusions to allow multi-photo blog posts in wordpress, and none have worked thus far.

#Allow iOS Wordpress app to create and save picture based posts.
SecRule REQUEST_URI "@streq /xmlrpc.php" "id:1031,phase:1,ctl:ruleRemoveById=941100"
SecRule REQUEST_URI "@streq /xmlrpc.php" "id:1033,phase:1,ctl:ruleRemoveByID=941160"
SecRule REQUEST_URI "@streq /xmlrpc.php" "id:1034,phase:1,ctl:ruleRemoveByID=932140"

Could someone please do me a big great favor and take a look at the above logs, and help me create a proper rule exclusion for posting photos with the Wordpress iOS app?

Problem 3) Unsolved

The Final exclusion I need is to allow the wordpress iOS app to turn on and off plugins. Currently plugins are on. Below is the log posted when trying to turn a plugin off....

https://pastebin.com/jsbC2HBd

I have tried the following rules exclusions to plugin activation and deactivation (Specifically the Flamingo plugin) from within the iOS Wordpress App, and none have worked thus far.

# Allow enable/disable plugins in the wordpress app (flamingo) for iOS
SecRule REQUEST_URI "@within /wp-json/wp/v2/plugins/flamingo/flamingo" "id:1040,phase:2,ctl:ruleRemoveById=1642837425"

Could someone, again, please do me a big great favor and take a look at the above logs, and help me create a proper rule exclusion for activating and deactivating plugins in the Wordpress iOS app?

Thank you supremely to any and all people who can help me out here with the proper exclusions!

I am running postfix/dovecot with spamassasin and amavis on Ubuntu server 20.04. I am also using this server as an LEMP Wordpress server. I have configured everything (email wise) according to Linuxbabe.com tutorials located at [https://www.linuxbabe.com/mail-server/setup-basic-postfix-mail-sever-ubuntu][1]

Recently, while navigating my directories from the terminal, in noticed the /var/vmail/ directory which contains all of my proper email domains i.e. example.com example2.com example3.com and example4.com.

However, there I have spotted an oddity and am wondering if someone got into or hacked my email system (highly unlikely) somehow. There is a domain (in the form of a folder name) in that directory called "pl.d.sender-sib.com" as well as a folder called "gmail.com".

ls -la /var/vmail/
drwxr-xr-x  9 vmail vmail 4096 Dec 29 09:03 .
drwxr-xr-x 16 root  root  4096 Dec  9 12:39 ..
drwx------  4 vmail vmail 4096 Jun 16  2021 mydomain1.com
drwx------  9 vmail vmail 4096 Sep 26 11:51 mydomain2.com
drwx------  3 vmail vmail 4096 Sep  9 17:17 gmail.com
drwx------  6 vmail vmail 4096 Dec 30 16:48 mydomain3.com
drwx------  7 vmail vmail 4096 Jan 21 18:41 mydomain4.com
drwx------  3 vmail vmail 4096 Dec 29 09:03 pl.d.sender-sib.com
drwx------  2 vmail vmail 4096 Feb  2 16:52 spamassassin

Inside the gmail.com directory is: /var/vmail/gmail.com/myemailaddressWithout"@gmail.com"/spamassassin/bayes_toks

and

/var/vmail/gmail.com/myemailaddressWithout"@gmail.com"/spamassassin/bayes_seen

Inside the pl.d.sender-sib.com directory is:

/var/vmail/pl.d.sender-sib.com/unsubscribe-t/spamassassin/bayes_seen

and

/var/vmail/pl.d.sender-sib.com/unsubscribe-t/spamassassin/bayes_toks

Could this be the work of an attacker and have I been hacked? Or are these directories that have been created by maybe spamassassin or amavis, wordpress emails, or some security program that I installed? How can I figure out where these directories came from, and is it safe or kosher or safe to delete these? Please let me know as soon as possible! I do not want to be working on a compromised server, even though I am certain my server is relatively secure. [1]: https://www.linuxbabe.com/mail-server/setup-basic-postfix-mail-sever-ubuntu

I am running an Ubuntu LEMP server with postfix/dovecot, as well as clamscan, amavis, and spamassassin. As of now, everything is working just fine. However, I am glancing over my mail error logs located in /var/log/mail.err, and noticed two lines, that may or may not be related. I am very new to understanding mail logs, so need some help in understanding what this is trying to tell me, and how to fix it. Please advise.

cat /etc/log/mail.err
Jan 20 12:58:52 mail amavis[2768]: (02768-01) (!!)AV: ALL VIRUS SCANNERS FAILED
Jan 20 13:49:21 mail spamass-milter[2185]: Could not retrieve sendmail macro "i"!.  Please add it to confMILTER_MACROS_ENVFROM for better spamassassin results

Could someone please tell me what these lines regarding amavis and spamass-milter are telling me and how to fix this? Thank you kindly.

I am attempting to create a strong and secure content-security-policy in nginx, running a wordpress based LEMP Server. I believe I am using the ngx_pagespeed.so module, and have implemented FastCGI on my server. I believe one of these features renders my jpeg images into webP images on the fly.

In my content-security-policy directive on Nginx, I am attempting to eliminate XSS attacks, while still embracing the use of webP images created by either the pagespeed module or FastCGI.

However, for the CSP to allow webP images, I need to put img-src 'self' data:; in my content security policy header directive like so:

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:;";

The problem with this is that enabling the data: block makes my website vulnerable to XSS attacks, effectively rendering the content security policy pointless. So it seems as though I can either have a super secure but slow website using regular jpegs, or, I can have a super insecure but fast website using server rendered webP images.

My question is, is there a way to specify only webP images to be allowed in the CSP directive img-src 'self' data;";? Ideally, I want to tell nginx that webP images should be approved in the CSP, but any other images outside of my site or the webP format, should be blocked.

Is this possible? If not, it seems like a CSP is rather pointless for at least 50% of servers out there. If so, then could you help me figure this out and let me know how I can implement a directive that defines webP as an allowed format in my CSP?

Thanks for any help!

I am running an Ubuntu 20.04 LEMP server with wordpress installed on it. I am using the nginx.org repository for nginx, but I compiled the cache-purge module (ngx_http_cache_purge_module.so) from source with my current nginx.org installation. However, I don't know how to automatically purge the cache using this module.

1. Is this recompiled module now compatible with my nginx.org installation (i used --compat)

   if so

2. How can I use this module to automatically purge my cache?

BACKGROUND I still consider myself sort of a noob when it comes to setting up server. So when answering this question, please give as much detail as possible in your answers.

ENVIRONMENT I run a LEMP server off of a Raspberry Pi 4, which is a perfectly functional email server as well as a functional web server.

THE PROBLEM Since I'm still a noob, I'm prone to mistakes. Therefore, there have been, and will be in the future, times where I accidentally misconfigure something or multiple things without realizing (or rememberding) exactly what I misconfigured or how to fix it. Therefore, I am looking for a proper local backup solution for an Ubuntu server on a Raspberry Pi (arm). Below are the specifics of what I need my backup solution to include...

THE DESIRED SOLUTIONS In these cases, it seems most desireable to have 2 backup drives to provide two for two different types of Automated Backup Solutions:

1. Incremental Backups - The First backup drive, would ideally be required to work exactly like a COMMAND-LINE only Time Machine on Mac OS. The only difference is it would create incremental backups for all files (including the root directory) as opposed to just the user directory like Mac OS Time machine. This would ensure that all of my server applications (PHP, Nginx, Postfix, Wordpress, etc.) and configurations installed under the root, the /var, the /etc and other important root user directories, would be backed up and restorable to an earlier date. The other requirement would be that the backup tool maintain proper exact permissions, and have an easy way to fully restore all files to the server from an earlier date.

2. Cloned Backups - The second drive should have a COMMAND-LINE backup solution that functions similarly to an application on MacOS called ApplePi-Baker which creates clones of your linux drive, by first shrinking all partitions with extra space, and then creating an clone in ".iso" format which can be DD'd directly to a usb drive and booted up into linux as an exact copy of the original drive. On my Ubuntu Server, I desire a solution with similar functionality. Except, I need the solution to be able to clone the drive of the running server. Ideally, I'd want the second drive to be used to create local exact clones of the original server (in ISO format), so that if anything went severly wrong beyond restoring from an incremental backup, that I could just DD the ISO image to a new drive, and boot up, for an easy regression to a once again perfectly working server. Again, I need the format of these clones to be in ".ISO" format as a proper disk image, with all extra space in each partition shrunk to elminate free space, to make the cloned ISO files as small as possible.

THE QUESTIONS

1. Can anyone recommend a tool, tools, or commands that can be run as a cron job to accomplish the above two desired solutions?
2. In addition, can you recommend any other PROPER solutions to fully backing up an Ubuntu 20.04 LEMP server, incase of severe disaster or administration misconfiguration?

Thanks for any help and advice here. I am very lost finding a proper linux solution for this!

Ive been wracking my brains out for weeks trying to debug a once perfectly functioning LEMP web server. I'm using a relatively complicated setup. Lets start with my setup from the beginning when things were working perfectly.

Step 1 (Working setup): lemp server/nginx > Raspberry Pi > Secondary router w forwarded ports > Primary router with forwarded ports > Public Internet serving web pages

I'm running a Lemp server off of Raspian OS on a Raspberry Pi 4. Nginx is running a reverse proxy, through my secondary router which is connected to my primary router/modem. The primary router/modem is forwarding https and http ports to the secondary router, which then forwards those same ports to the raspberry pi. The raspberry pi successfully obtains certificates from certbot, and runs a fully functioning website accessible from the public internet.

Step 2a (Working setup): lemp server/nginx > Raspberry Pi > Secondary router > EC2 Openvpn-AS tunnel > Primary router with forwarded ports > Public Amazon Internet serving web pages Next, I have created an AWS EC2 OpenVPN-AS instance, and I run it as a server. From there, I install openvpn on my raspberry pi lemp server, change my domains dns to point to the ip address of my OpanVPN-AS instance instead of my home ip, and then run openvpn as a client on my lemp server, sucessfully tunneling my web server through the OpenVPN AWS instance, out to the public internet. This setup works.

Until....

I do something to completely stop all connections to the server through the vpn. The problem is, I have absolutely no idea what I did to alter this once working setup. I know i updated the pi, and I think i might have changed the internal hostname, but that is as much as i can remember before my pi became a dead server.

On the internal network, the webserver still works using the local ip when using the EC2 tunnel.

The odditiy that I have noticed, is that although the AWS tunnel setup stopped my webserver from working, once i plug my server back into my home router without the tunner, and repoint my dns back to my home router, the server starts to work publicly again. I just can not pinpoint, what exactly has changed since my server was working after being tunneled through AWS OVPN, and now, it doesnt resolve, yet, it somehow resolves on my home ip with minimal settings altered. The only things I really change when switching from aws to the home router, is what ip the domains dns points to, and weather or not the vpn tunnel should be up or down.

As for the amazon ovpn tunnel, that also properly resolves and the server properly obtains the new amazon IP address.

I know how to build servers, however, I am litereally a superman-noob when it comes to debugging them and figuring out where there connection is going bad. So my question is...

Could someone please try to walk me through some steps to debug this, and get my websever back up and running through my openvpn instance using an amazon ip address? I havent the slightest idea where to even start aside from my succesfull pings through the amazon tunnel, as well as a healthy looking traceroute.

My EC2 ports are open on 443 and 80, and I have even tried with all firewalls down, to no avail.

Any advice, tips, walkthroughs, or beginner friendly stepping stones to help me debug this an pinpoint where the connection is dropping would be appreciated!

I'm running 2 websites on a LEMP stack with nginx configured as a reverse proxy server. I have successfully installed phpmyadmin in the root folder of one of my sites root directories. When I go to www.example.com/phpmyadmin, I am able to access phpmyadmin login page on public internet as well as on my lan. What I would like to do is configure nginx to block any traffic to phpmyadmin that doesn't originate from my local area network. Currently I also have a /admin folder in the root of my site, and I HAVE SUCCESSFULLY set up a way to block all traffic to that folder that doesn't originate from my LAN. I figured blocking phpmyadmin from the outside world would be as easy using the same ngninx virtual configuration lines I used to block the /admin/ directory, but just changing the location to /phpmyadmin. However, when doing this, phpmyadmin is still blocked on the local network.

Below is the relevant parts of my nginx virtual host configuration for example.com. You can see what blocking configurations work and don't work as noted in the comments. Help me fix the #Not working lines. Note: My Server's local ip address is 192.168.1.20.

server {   
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        ssl on;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        server_name example.com  www.example.com;
        root /var/www/example.com;

        index index.php;
    
        location / {
        # try_files $uri $uri/ =404;
        try_files $uri $uri/ /index.php?$args;
        }


        # Disallow PHP In Upload Folder
        location /wp-content/uploads/ {
                location ~ \.php$ {
                        deny all;
                }
        }
        # LAN ONLY ACCESS WORKING
        location ^~ /admin {
                allow 192.168.1.0/24;
                deny all;
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
        }
        # LAN ONLY ACCESS NOT WORKING!!!
        location ^~ /phpmyadmin {
                allow 192.168.1.0/24;
                deny all;
                include fastcgi.conf;
                fastcgi_intercept_errors on;
                fastcgi_pass local_php;
                fastcgi_buffers 16 16k;
                fastcgi_buffer_size 32k;
        }

        location ~ \.php$ {
                include fastcgi.conf;
                fastcgi_intercept_errors on;
                fastcgi_pass local_php;
                fastcgi_buffers 16 16k;
                fastcgi_buffer_size 32k;
        }
}

What edits to my virtual host config file must I make to properly restrict phpmyadmin to my LAN in Nginx?

I have configured a webserver locally. I am running an Ubuntu 18.04 EC2 instance which is configured as an openvpn server. My webserver is successfully connecting/tunneling to my OpenVPN Ubuntu server Instance, and serving web requests on ports 80 (http) and ports 443 (Https). My openvpn client (the web server) is connecting to my openvpn server instance on port 1194/UDP. Without UFW or any firewall whatsoever, my webserver is properly serving traffic through my openvpn instance on EC2. However, on the EC2 instance, when I apply UFW rules to allow for ssh, and allow incoming traffic on ports 443 and 80 for the webserver, my webserver is no longer accessible from the outside. My default incoming rules are deny, and default outgoing rules are allow. Below is my UFW configuration on my openvpn EC2 instance:

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
43219                      ALLOW IN    Anywhere
1194                       ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
Anywhere                   ALLOW IN    123.124.1my.1ip
443/tcp                    ALLOW IN    Anywhere
22                         ALLOW IN    123.224.1my.2ip
Anywhere                   ALLOW IN    10.8.0.0/24
22/tcp (v6)                ALLOW IN    Anywhere (v6)
43219 (v6)                 ALLOW IN    Anywhere (v6)
1194 (v6)                  ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

This configuration is somehow blocking traffic to my webserver through the vpn. So my question is what am i doing wrong? What exactly do I need to unblock in order to get my webserver to pass through the vpn tunnel, out to the rest of the world?

I am running a LEMP server locally behind my router. Everything is working as it should. Because I would prefer that my ip address isn't exposed to the world, I am attempting to tunnel the web server through an AWS Instance running Ubuntu 18.04. I "thought", that It would be as easy as building the AWS Ubuntu OpenVPN cloud server, connecting my local webserver to that server via openvpn in the terminal, and then changing my dns A records to point towards the Amazon VPN server's IP address.

Apparantly, there is something I am missing, as I have done all of the above assumptions, yet, I still cannot get my webserver to serve traffic on my AWS IP address.

My setup: My Local web server is successfully connected to my ubuntu aws instance via openvpn. My local web server is recieving my aws instance's IP address properly. The Openvpn server seems to be working properly. My DNS configuration has it's A records pointing towards my AWS instance's ip address. I can browser the internet via the tunnel and whatsmyip.org is showing the proper aws ip address.

On the EC2 instance, the output of ip addr show is

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc fq_codel state UP group default qlen 1000
    link/ether 0e:86:bb:81:3b:dd brd ff:ff:ff:ff:ff:ff
    inet 172.31.47.112/20 brd 172.31.47.255 scope global dynamic eth0
       valid_lft 3208sec preferred_lft 3208sec
    inet6 fe80::c86:bbff:fe81:3bdd/64 scope link
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::2405:76a5:410a:17a7/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

On the local webserver the output of ip addr show is

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:14:6d:e1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.30.32/24 brd 192.168.30.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::815e:ba7:5be8:1fb5/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether dc:a6:32:14:6d:e2 brd ff:ff:ff:ff:ff:ff
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.3/24 brd 10.8.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::292b:b09f:9ac9:2cc7/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

On my EC2 Instance, the output of sudo iptables -t nat -vnL is:

Chain PREROUTING (policy ACCEPT 396 packets, 22897 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 173 packets, 8430 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 361 packets, 44271 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 361 packets, 44271 bytes)
 pkts bytes target     prot opt in     out     source               destination
  223 14467 SNAT       all  --  *      *       10.8.0.0/24         !10.8.0.0/24          to:172.31.47.112

On my local server the output of sudo iptables -t nat -vnL is:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

As Far as I can tell, my Ip address is not changing upon reboot or restart of the vpn server. Lastly, in oder to set up the vpn server on the EC2 side, is followed the following guide incase you want to check it out:

https://linuxhint.com/vpn_amazon_ec2_setup/

Aftere this setup, my webserver, is not serving traffic on the amazon ip address.

Could anyone tell me what exactly I might be missing here and how to remedy it?

I trying to get an email server up and running on a raspberry pi running Raspbian Buster.

In my postfix checks I am getting a strange notification about a symlink that I definitely did not create myself. The warning is postfix/postfix-script: warning: symlink leaves directory: /etc/postfix/./makedefs.out I have done two clean installs thinking it might be malicious, and every time it comes back, so I am assuming it is somehow part of the configuration or has something specifically to do wiht the postfix version on raspberry pi.

In any event, the following message appears when running my postfix check:

sudo postfix check
postfix: Postfix is running with backwards-compatible default settings
postfix: See http://www.postfix.org/COMPATIBILITY_README.html for details
postfix: To disable backwards compatibility use "postconf compatibility_level=2" and "postfix reload"
postfix/postfix-script: warning: symlink leaves directory: /etc/postfix/./makedefs.out

1. Does anyone have any idea what exactly this symlink is doing and who/what is creating it?
2. Is it something to worry about and
3. How do I get rid of this error message in my postfix check?

I am running a LEMP webserver on my Raspberry pi using Rasbpian. The name of my my pi's hostname is raspi-host123.

My local hosts file on my server looks like this:

127.0.0.1       localhost loopback
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
127.0.1.1       raspi-host123 mysite.com www.mysite.com mail.mysite.com

I am wondering if the address of the Raspberry Pi should be integrated into my public resolvers so my hosts file instead looks like this:

My local hosts file on my server looks like this:

127.0.0.1       localhost loopback
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
127.0.1.1       raspi-host123.mysite.com raspi-host123.www.mysite.com raspi-host123.mail.mysite.com

Does the local hostname in my /etc/hosts file have anything to do with my domain names from my web server?

I am attempting to setup postfix and dovecot on a LEMP server. I am using letsencrypt certificates. I suspect I am having a permissions problem because I cannot access the /etc/letsencrypt/live folder using cd unless I preface it with the sudo su command.

This seems to be affecting my dovecot configuration because dovecot is giving me the following fatal error:

doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 13: ssl_key: Can't open file /etc/letsencrpyt/

I have checked my letsencrypt certificate and pemchain path in dovecot settings multiple times and they are correct. So it appears that something else is blocking dovecot from accessing my certificate chain. I'm assuming it is the same thing that won't let me access my chain with out being root.

The Top of my /etc/dovecot/conf.d/10-ssl.conf page looks like this:

##
## SSL settings
##

# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
ssl = required

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
ssl_cert = </etc/letsencrypt/live/mail.mysite.com/fullchain.pem
ssl_key = </etc/letsencrpyt/live/mail.mysite.com/privkey.pem

My /etc/dovecot/conf.d/10-ssl.conf has the following lines uncommented and edited. I am not actually using mail.mysite.com :

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.mysite.com/fullchain.pem
ssl_key = </etc/letsencrpyt/live/mail.mysite.com/privkey.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = </usr/share/dovecot/dh.pem

The Results of:

ls -l /etc | grep letsencrypt
drwxr-xr-x  9 root  root     4096 Feb 20 12:44 letsencrypt

My question is, how can I fix the above error and allow dovecot to access my letsencrypt certificate path correctly?