I'm trying to install yq on CentOS 9 on hetzner.
wget https://github.com/mikefarah/yq/releases/download/v4.27.5/yq_linux_arm64 && chmod +x yq_linux_arm64 && ./yq_linux_arm64
The error is:
bash: ./yq_linux_arm64: cannot execute binary file: Exec format error
Arch info:
[root@centos-2gb-nbg1-1 ~]# uname -a
Linux centos-2gb-nbg1-1 5.14.0-148.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 19 13:03:55 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
I'm trying to add authentication to squid installed on windows, here is the config:
auth_param basic program C:\Squid\lib\squid\basic_ncsa_auth.exe C:\Squid\etc\squid\.htpasswd
acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users
http_port 2001
http_access allow localnet
http_access deny all
In .htpasswd
admin:$apr1$kWA/DRFy$klaeXRe3S3jIPqc64HTMA0
This corresponds to username admin and password 1234
But once I try to use the proxy, got TCP_DENIED/407 in logs, and auth fails.
Update:
found the following error in log
C:/Squid/lib/squid/basic_ncsa_auth.exe: error while loading shared libraries: cygcrypt-2.dll: cannot open shared object file: No such file or directory
I have a windows machine with a squid server and VPN client connection(which is not the default gateway)
What I want is to redirect some traffic from squid to my default ethernet connection and some to VPN.
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.100.11
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
PPP adapter vpn_conn:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 172.16.3.33
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
squid conf
http_port 2003
acl user3_acl myport 2003
tcp_outgoing_address 172.16.3.33 user3_acl
http_port 2004
acl user4_acl myport 2004
2004 port works as expected through my Ethernet adapter, but redirect to vpn doesn't work,
the log contains
1638648992.630 75 33.33.333.333 NONE/503 0 CONNECT docs.microsoft.com:443 - HIER_NONE/- -
I want to extract files with tar so that the whole directory will be owerwritten.
I added --overwrite-dir but still old files in test dir remains.
For the test, I have /home/ubuntu/f1/test/first.log and /home/ubuntu/f2/test/second.log
Then I run in /home/ubuntu/f1
tar cvf - ./test | sudo tar -C /home/ubuntu/f2 --overwrite-dir -xvf -
And with ls /home/ubuntu/f2/test expect to see only second.log file. But instead I get both.
Is it possible to do just with tar?
There are two tests:
ioping -c 10 -S 4K -D .
9 requests completed in 2.49 ms, 36 KiB read, 3.61 k iops, 14.1 MiB/s
generated 10 requests in 9.00 s, 40 KiB, 1 iops, 4.44 KiB/s
min/avg/max/mdev = 259.5 us / 277.0 us / 325.0 us / 19.9 us
sudo fio --ioengine=libaio --direct=1 --rw=read --bs=4K --numjobs=1 --iodepth=1 --runtime=10 --time_based --name seq_read --filename=/fiotest --size=100m
read: IOPS=19.8k, BW=77.5MiB/s (81.2MB/s)(775MiB/10001msec)
clat (nsec): min=830, max=11311k, avg=44909.47, stdev=76899.23
Both use the same block size, but the results of latency and iops are completly different. Why so?
I wanted docker to respect ufw rules, so found this topic https://stackoverflow.com/questions/30383845/what-is-the-best-practice-of-docker-ufw-under-ubuntu
I did the following:
set "iptables": false for docker,
set sed -i -e 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/g' /etc/default/ufw
set iptables -t nat -A POSTROUTING ! -o docker0 -s 172.17.0.0/16 -j MASQUERADE
And it works, but I don't understand how traffic gets to the container?
Before sudo iptables-save | grep 8123 gave me:
-A POSTROUTING -s 172.21.0.5/32 -d 172.21.0.5/32 -p tcp -m tcp --dport 8123 -j MASQUERADE
-A DOCKER ! -i br-cf80e85bf468 -p tcp -m tcp --dport 8123 -j DNAT --to-destination 172.21.0.5:8123
-A DOCKER -d 172.21.0.5/32 ! -i br-cf80e85bf468 -o br-cf80e85bf468 -p tcp -m tcp --dport 8123 -j ACCEPT
But after I disable iptable there is no rules, how traffic comes to the docker 8123 then? Here 8123 docker published port 0.0.0.0:8123->8123/tcp
I want to make a staging development environment. So that it could be reachable only by vpn. Is it possible to do it only with vps? I use contabo vps, and by default, once I open a port on the server it opens for everyone. I tried to use ufw, but it doesn't work with docker, but mostly all my workloads are in docker(rancher Kubernetes). Is there another firewall that will close all ports on the server. How do I connect nodes together so they are reachable by each other but, not the outside world?
I know that I could buy a dedicated server, install hypervisor and pfsense. But is it possible to do a similar thing with only vps without nested virtualization?
I have enabled ufw. The is ufw status verbose output
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN Anywhere
22/tcp (v6) ALLOW IN Anywhere (v6)
But when I run nginx as
docker run --name nginx -p 80:80 -d nginx
I still can see nginx welcome page in the browser and nmap shows 80 port as open.
If my fs use 4k block size, mysql use 16k page size. But which block size to choose for fio test?
In disk benchmarking tool fio there is statistics for brandswitch
Run status group 0 (all jobs):
READ: bw=20.9MiB/s (21.9MB/s), 10.4MiB/s-10.8MiB/s (10.9MB/s-11.3MB/s), io=64.0MiB (67.1MB), run=2973-3069msec
According for docs:
Values outside of brackets are power-of-2 format and those within are the equivalent value in a power-of-10 format.
As far as I know 1 MB/s = 8MiB/s. But here 20.9MiB/s complies to 21.9MB/s.
I want to preserve colors of docker exec command. The only way I found is to use script command like so
docker exec <container_name> script -q -c "./spiral migrate:status" /dev/null
The problem is that my containers are alpine and there is no script command by default. How to install it?
One way I found is to install apk add util-linux. But it takes 350 Mb, just makes not sense of using alpine then.
How to install only one script command? Is there other workarounds to keep the colors?
Just realized that command is basically compiled executable. So the workaround would be to get it from once installed util-linux, and place in all my containers.
We have a stage server running in local network, that could be accessed from the internet. I want to test gdpr, and set proxy in browser, so ip checker sites shows my new ip. But when I access our stage server, it shows my local ip. Why does it happen? How to access it through proxy?
Kubernetes rolling updates will be creating new pods with updates and gradually change old pods by new, and as soon as new pod is ready it will get traffic by round-robin with the old ones.
But what to do in case that I have 2 services one is using another and I need to make updates in them simultaneously? I don't want the situation that old service 1 will make calls to new service 2.