Nstevens's questions

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual filesystem they are on (/var is a 6G partition).

-rw-r--r--  3 root       root             65G Feb 11 08:33 faillog
-rw-------  3 root       root            129G Feb 11 08:33 tallylog
-rw-rw-r--  2 root       utmp            585G Feb 11 08:57 lastlog

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

How can I get Ansible to populate the correct file when my /etc/ssh/sshd_config has AuthorizedKeysFile set to /etc/ssh/authorized_keys/%u? Ansible seems to ignore the setting and places keys in $HOME/.ssh/authorized_keys

playbook:

---
- hosts: all
  vars:
  vars_files:
    - ../group_vars/ssh_root_authorized_keys.yml
  gather_facts: false

  tasks:
    - name: Set up multiple authorized keys
      authorized_key:
        user: root
        state: present
        key: '{{ item.key }}'
      with_items: "{{ root_auth_keys }}"

ssh_root_authorized_keys.yml

root_auth_keys:
  - name: backup@host
    key : "{{ lookup('file', '../group_vars/pubkeys/[email protected]') }}"

  - name: nagios@host
    key : "{{ lookup('file', '../group_vars/pubkeys/[email protected]') }}"

I have a Wordpress site getting hit with over 100k requests per day with the same request below. All these GETs are coming from about 200 different IPs within the same Google netrange (66.249.x.x). There is no /search/ route on the site, but something in Wordpress (Relevanssi?) must be processing this request because there are UTF-8 collation errors in the DB, probably due to the emojis or cyrillic characters:

WordPress database error Illegal mix of collations (utf8_general_ci,IMPLICIT) and (utf8mb4_unicode_ci,COERCIBLE) for operation 'like' for query \n\t\t\tSELECT COUNT(DISTINCT(relevanssi.doc))\n\t\t\t\tFROM 49qi0c_relevanssi AS relevanssi\n\t\t\t\t WHERE (relevanssi.term LIKE 'berbat\xf0\x9f\xaa\x80\xe2\x9d\xa4\xef\xb8\x8f\xef\xb8\x8fwww%' OR relevanssi.term_reverse LIKE CONCAT(REVERSE('berbat\xf0\x9f\xaa\x80\xe2\x9d\xa4\xef\xb8\x8f\xef\xb8\x8fwww'), '%')) made by require('wp-blog-header.php'), wp, WP->main, WP->query_posts, WP_Query->query, WP_Query->get_posts, apply_filters_ref_array('posts_pre_query'), WP_Hook->apply_filters, relevanssi_query, relevanssi_do_query, relevanssi_search, relevanssi_search, relevanssi_generate_df_counts, QM_DB->query

I checked the Relevanssi forum and found someone posting almost the same issue. It was said to be 'harmless' and didn't appear to concern anyone so the thread was closed. Thing is though, the sheer load of these requests are starting to lag the site and the errors being generated are filling up the logs under the /var/ partition. I've got the /19 from Google blocked right now but probably not the right answer since it's Google (page ranking and all that). Anyone ever see this kind of stuff from Google before?

GET /search/%F0%9F%AA%80BEST+DATING+SITE%E2%9D%A4%EF%B8%8F%EF%B8%8F%C4%B0ngiliz+kad%C4%B1n+i%C3%A7+%C3%A7ama%C5%9F%C4%B1r%C4%B1+gal+r%C3%B6ntgenci+%C3%B6n%C3%BCnde+berbat%F0%9F%AA%80%E2%9D%A4%EF%B8%8F%EF%B8%8FWww.MtSp.XyZ%F0%9F%AA%80%E2%9D%A4%EF%B8%8F%EF%B8%8F%C4%B0ngiliz+kad%C4%B1n+i%C3%A7+%C3%A7ama%C5%9F%C4%B1r%C4%B1+gal+r%C3%B6ntgenci+%C3%B6n%C3%BCnde+berbat+%C4%B0ngiliz+kad%C4%B1n+i%C3%A7+%C3%A7ama%C5%9F%C4%B1r%C4%B1+gal+r%C3%B6ntgenci+%C3%B6n%C3%BCnde+berbat+%C4%B0ngiliz+kad%C4%B1n+i%C3%A7+%C3%A7ama%C5%9F%C4%B1r%C4%B1+gal+r%C3%B6ntgenci+%C3%B6n%C3%BCnde+berbat/feed/rss2/?page_number_9=1&page_number_15=7&page_number_14=3&page_number_16=3&page_number_10=1&page_number_12=33&page_number_17=3&page_number_13=3&page_number_11=17 HTTP/1.1" 200 718084 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

I have Nginx in front of apache to terminate SSL and filter things. I'm trying to get rate limiting working using these docs.

When I test a loop of 10 requests with curl, all the requests for /mytest/ are still being forwarded back to Apache - 8 of them show the same timestamp down to the second. I'm expecting only one request/second should reach Apache. What have I overlooked?

My curl command:

for i in $(seq 1 10); do curl --verbose  --request "GET /mytest" https://myhost.com; done

nginx.conf:

http {
   ...
   include /etc/nginx/conf.d/*.conf;
   ...
}

/etc/nginx/conf.d/rate-limit.conf:

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

server {
   location /mytest/ {
      limit_req zone=one;    #:: removed burst=5 for testing - made no diff
   }
}

I have a playbook similar to the one below which uses the base_acl variable. Let's pretend base_acl: "default_acl.j2. I have a host that I want to use a different base_acl value for. I've looked over the ansible precedence docs and don't see a way to do this other than using --extra-vars on the command line which I don't want to do.

I've tried defining base_acl in a host_vars file (should have higher precedence according to link above?) for the host in question, however the play still prints "playbook" for the variable value when run.

Is there a way to tell ansible to give host_vars precedence over playbook variables?

---
- hosts: all
  gather_facts: no
  vars:
    base_acl   : "playbook"
    
  tasks:
  - debug: msg="variable is {{ base_acl }}"

Why would these two commands report free space so differently? This started happening last year on several Ubuntu 18.04 VMs from time to time.

df reports 100% used while du -smh shows only 2.3G of the 4.0G (total) in use.

This is often followed by rsyslog or syslog-ng filling up /var with error messages when the syslog server is down for maintenance.

# df -mh /var
Filesystem              Size  Used Avail Use% Mounted on
/dev/mapper/new_vg-var  4.0G  3.9G     0 100% /var

# du -smh /var
2.3G    /var

# fuser /var

I'm upgrading some Ubuntu 18.04 hosts to Nginx v1.20. The available version in the official repos for Ubuntu 18.04 is 1.14, which has some advisories out for it, so I'm adding the "official" Nginx repo to my 18.04 hosts.

The libnginx-* mods seem to be a Ubuntu thing only. Are these modules automatically compiled into the nginx.org package somehow? For instance, apt shows the libnginx-mod-http-geoip is coming from the official repos, but nothing for the nginx.org repo.

Nginx shows both official repos, and nginx.org

# apt policy nginx
nginx:
  Installed: 1.20.1-1~bionic
  Candidate: 1.20.1-1~bionic
  Version table:
 *** 1.20.1-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
        100 /var/lib/dpkg/status
     1.20.0-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.18.0-2~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.18.0-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.16.1-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.16.0-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.14.2-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.14.1-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.14.0-1~bionic 500
        500 https://nginx.org/packages/ubuntu bionic/nginx amd64 Packages
     1.14.0-0ubuntu1.9 500
        500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main i386 Packages
        500 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu bionic-security/main i386 Packages
     1.14.0-0ubuntu1 500
        500 http://us.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
        500 http://us.archive.ubuntu.com/ubuntu bionic/main i386 Packages

Nginx mods show only for the official repo

# apt policy libnginx-mod-http-geoip
libnginx-mod-http-geoip:
  Installed: (none)
  Candidate: 1.14.0-0ubuntu1.9
  Version table:
     1.14.0-0ubuntu1.9 500
        500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status
     1.14.0-0ubuntu1 500
        500 http://us.archive.ubuntu.com/ubuntu bionic/main amd64 Packages

These are the mods which are installed for 1.14 (official). I'm assuming these need to be installed so the configured Nginx options continue to work with v1.20:

libnginx-mod-http-geoip
libnginx-mod-http-image-filter
libnginx-mod-http-xslt-filter
libnginx-mod-mail
libnginx-mod-stream

I'm trying to write an ansible playbook which only upgrades the linux-generic package but cannot find the magic incantation to get it to actually work. With this play, I get the error parameters are mutually exclusive: deb|package|upgrade which google suggests is due to upgrade: full is not meant for a single package:

  - name: Check if linux-generic is installed
    command: dpkg -l linux-generic
    register: pkg_chk

  - name: update kernel if installed
    when: pkg_chk.rc == 0
    apt:
      update_cache: yes
      autoremove  : yes
      autoclean   : no
      upgrade     : full
      dpkg_options: 'force-confold,force-confdef'
      name        : linux-generic

Removing upgrade: full runs the play...

TASK [update kernel if installed] **********************************************************
ok: [vivaldi.fammed.wisc.edu]

But, when I login to the machine and run aptitude full-upgrade it shows ansible didn't do anything:

# aptitude full-upgrade
The following NEW packages will be installed:
  linux-headers-4.4.0-203{a} linux-headers-4.4.0-203-generic{a}
  linux-image-4.4.0-203-generic{a} linux-modules-4.4.0-203-generic{a}
  linux-modules-extra-4.4.0-203-generic{a}

Ok, so I thought I'd just throw the command: module at it and use bare apt commands but there is some issue with the command string that I have not escaped properly.

  - name: upgrade linux-generic
    when: pkg_chk.rc == 0
      command: apt-get install -y --only-upgrade -o Dpkg::Options::='force-confdef' -o Dpkg::Options::='force-confold' linux-generic
      register: install_chk

  - name: autoremove linux-generic
    when: install_chk.rc == 0
      command: apt-get -y autoremove -o Dpkg::Options::='force-confdef' -o Dpkg::Options::='force-confold'
      register: auto_chk

which yields this error:

Syntax Error while loading YAML.
  mapping values are not allowed in this context
    The error appears to be in '/usr/src/ansible/tests/upgrade-kernel-only.yml': line 24, column 12, but may
    be elsewhere in the file depending on the exact syntax problem.
    
    The offending line appears to be:
    
        when: pkg_chk.rc == 0
          command: apt-get install -y --only-upgrade -o Dpkg::Options::='force-confdef' -o Dpkg::Options::='force-confold' linux-generic
               ^ here

I've tried escaping the : = characters, as well as replacing double-quotes and single quotes. Anyone know how to get this working?

I'm running Postfix on Debian as an MX for a small LAN and trying to get SMTPS working with mobile.charter.net over port 587. I followed a few links off google for setting this up along with a post on serverfault with a similar question. I've tried sending a few emails but getting this error about "initial server greeting" in the mail log:

 Nov 17 03:39:14 edgemx postfix/smtp[30355]: 9B39AA4: to=<[email protected]>, relay=mobile.charter.net[47.43.18.12]:587, delay=473, delays=173/0.03/300/0, dsn=4.4.2, status=deferred (conversation with mobile.charter.net[47.43.18.12] timed out while receiving the initial server greeting)

I ran a tcpdump on port 587 while sending and I don't see the certificate transfer happening between Postfix and Charter. There's like three SYN packets and that's it. If I use openssl in client mode to connect, the tcpdump traffic is much different and I can see a cert transfer happen.

openssl s_client -connect mobile.charter.net:587

Anyone know what's up? What is openssl doing that Postfix isnt? relevant SASL/SSL edits in main.cf are below.

main.cf

smtp_sasl_auth_enable         = yes
smtp_sasl_password_maps       = hash:/etc/postfix/relayhost_passwd
smtp_sasl_security_options    = noanonymous
smtp_use_tls                  = yes
smtp_tls_security_level       = encrypt
relayhost                     = [mobile.charter.net]:587
smtp_tls_mandatory_ciphers    = high

relayhost_passwd file (postmap'd already)

[mobile.charter.net]:587      [email protected]:sUp3rS3kr1t

I've invested in some SSD drives and want to run my Linux KVM guests from them (currently on a SATA array). The current location of the guests is /var/lib/libvirt/images. I have the SSD volume mounted on /mnt/ssd/. The VMs do some calendaring and mail stuff and would rather not power them off to just use a simple copy command while they're cold. How can I move my KVM guests to the /mnt/ssd/images/ directory and update the XML config for KVM? Found a similar question here (How to migrate a running KVM (with full disk copy) to another node?) but it involves moving a guest to another server - I just want to change the directory and move the image.