Nuno's questions

Consider I have docker-subdomain.mydomain.com pointing to a website in a Docker container, and host-subdomain.mydomain.com pointing to a website in the Host itself. Both these websites are in the same Host and IP address.

When the PHP code of the docker-subdomain.mydomain.com inside Docker makes a curl call to host-subdomain.mydomain.com, and that host-subdomain.mydomain.com logs the IP address of the caller, it appears to be an IP address starting with "172.", which means it's the private IP address of the docker container.

I'm wondering how is the private IP address used, if the DNS of host-subdomain.mydomain.com is the public IP, so I'd think it would use the external interface to connect? (like it happens when a PHP script executes curl in the host itself, outside Docker)

How does Docker know that host-subdomain.mydomain.com points to the same host?

--

Note: I'm not asking how to bypass/change this behavior - I'm just curious, as it's doing exactly what I wanted it to do, but I don't understand why.

On the servers I have, with HDD or SSD, I have a cron that periodically runs:

/usr/sbin/smartctl --test=short/long /dev/sd1

(for each disk)

While it runs, it just looks at the output of /usr/sbin/smartctl -c /dev/sd1, looping until it no longer contains:

[0-9]+% of test remaining.

And then checks if it completed without errors:

(   0)  The previous self-test routine completed

However, it appears that smartctl doesn't yet support testing of NVMe, as of version 7.0, and as per: https://www.smartmontools.org/wiki/NVMe_Support

It does say that

The smartd daemon tracks health (-H), error count (-l error) and temperature (-W DIFF,INFO,CRIT)

but what does actually run the tests? I'm not sure if the output of -H and -l update unless we run short/long tests?

I also read about nvme-cli, but I don't seem to find ways of running health tests on disks with it.

Any ideas?

Using CentOS 7 here.

ServerA needs to have a directory of ServerB mounted in a location, with write permissions.

I've been using SSHFS for this. I find SSHFS being very stable (100% reliable), while NFS was not so stable, besides being really hard to configure, and by default exposing to public, etc...

With SSHFS, I had to create a local user on ServerB, and put its private key on ServerA, to setup the mounts.

However, if someone ever hacks into ServerA, the hacker will be able to access any directory/file that may have 'other' read permissions anywhere on ServerB, by logging into ServerB with that user and its private key.

Is there any way to prevent this, so that the ONLY directory that this user can access is the directory that needs to be mounted on ServerA?

I have a CentOS 7 server on AWS.

When logged in with the centos user, how can I prevent sudo -s logging in to root without requiring root's password?

[root@server ~]# cat /etc/sudoers | grep rootpw
Defaults rootpw
[root@server ~]# getent group wheel
wheel:x:10:centos
[root@server ~]# gpasswd -d centos wheel
Removing user centos from group wheel
[root@server ~]# getent group wheel
wheel:x:10:
[root@server ~]# su centos
[centos@server root]$ sudo -s
[root@server ~]# !!!!!!!!!!!!!!!!

I realize that processes that run inside Docker containers appear on the hosts' process list:

# ps aux | grep mariadb
root     12486  0.0  0.0 112812   976 pts/0    S+   14:47   0:00 grep --color=auto mariadb

Is there a way to identify whether a process is running on the Host or on a Docker container, or a way to filter the Docker processes out?

On CentOS 7, I am trying to upgrade awscli:

/usr/bin/python3 -m pip install awscli --upgrade --user

Why is this downloading every single previous version, until there is finally no space left on device?

Requirement already satisfied: awscli in
/root/.local/lib/python3.6/site-packages (1.18.196) Collecting awscli
Downloading awscli-1.18.197-py2.py3-none-any.whl (3.5 MB)
Downloading awscli-1.18.197.tar.gz (1.4 MB) Using cached
awscli-1.18.196-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.196.tar.gz (1.4 MB) Using cached
awscli-1.18.195-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.195.tar.gz (1.4 MB) Using cached
awscli-1.18.194-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.194.tar.gz (1.4 MB) Using cached
awscli-1.18.193-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.193.tar.gz (1.4 MB) Using cached
awscli-1.18.192-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.192.tar.gz (1.4 MB) Using cached
awscli-1.18.191-py2.py3-none-any.whl (3.5 MB) Downloading
awscli-1.18.191.tar.gz (1.4 MB) Using cached
awscli-1.18.190-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.190.tar.gz (1.4 MB) Downloading
awscli-1.18.189-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.189.tar.gz (1.4 MB) Downloading
awscli-1.18.188-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.188.tar.gz (1.4 MB) Downloading
awscli-1.18.187-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.187.tar.gz (1.4 MB) Downloading
awscli-1.18.186-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.186.tar.gz (1.4 MB) Using cached
awscli-1.18.185-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.185.tar.gz (1.4 MB) Downloading
awscli-1.18.184-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.184.tar.gz (1.4 MB) Using cached
awscli-1.18.183-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.183.tar.gz (1.4 MB) Using cached
awscli-1.18.182-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.182.tar.gz (1.4 MB) Using cached
awscli-1.18.181-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.181.tar.gz (1.4 MB) Using cached
awscli-1.18.180-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.180.tar.gz (1.4 MB) Using cached
awscli-1.18.179-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.179.tar.gz (1.4 MB) Using cached
awscli-1.18.178-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.178.tar.gz (1.4 MB) Using cached
awscli-1.18.177-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.177.tar.gz (1.3 MB) Using cached
awscli-1.18.176-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.176.tar.gz (1.3 MB) Downloading
awscli-1.18.175-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.175.tar.gz (1.3 MB) Using cached
awscli-1.18.174-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.174.tar.gz (1.3 MB) Using cached
awscli-1.18.173-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.173.tar.gz (1.3 MB) Using cached
awscli-1.18.172-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.172.tar.gz (1.3 MB) Using cached
awscli-1.18.171-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.171.tar.gz (1.3 MB) Downloading
awscli-1.18.170-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.170.tar.gz (1.3 MB) Downloading
awscli-1.18.169-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.169.tar.gz (1.3 MB) Downloading
awscli-1.18.168-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.168.tar.gz (1.3 MB) Using cached
awscli-1.18.167-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.167.tar.gz (1.3 MB) Using cached
awscli-1.18.166-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.166.tar.gz (1.3 MB) Using cached
awscli-1.18.165-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.165.tar.gz (1.3 MB) Using cached
awscli-1.18.164-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.164.tar.gz (1.3 MB) Using cached
awscli-1.18.163-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.163.tar.gz (1.3 MB) Using cached
awscli-1.18.162-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.162.tar.gz (1.3 MB) Using cached
awscli-1.18.161-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.161.tar.gz (1.3 MB) Using cached
awscli-1.18.160-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.160.tar.gz (1.3 MB) Using cached
awscli-1.18.159-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.159.tar.gz (1.3 MB) Using cached
awscli-1.18.158-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.158.tar.gz (1.3 MB) Using cached
awscli-1.18.157-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.157.tar.gz (1.3 MB) Using cached
awscli-1.18.156-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.156.tar.gz (1.3 MB) Using cached
awscli-1.18.155-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.155.tar.gz (1.3 MB) Using cached
awscli-1.18.154-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.154.tar.gz (1.3 MB) Downloading
awscli-1.18.153-py2.py3-none-any.whl (3.4 MB) Using cached
awscli-1.18.153.tar.gz (1.3 MB) Using cached
awscli-1.18.152-py2.py3-none-any.whl (3.4 MB) Downloading
awscli-1.18.152.tar.gz (1.3 MB) Using cached
awscli-1.18.151-py2.py3-none-any.whl (3.3 MB) Downloading
awscli-1.18.151.tar.gz (1.3 MB) Using cached
awscli-1.18.150-py2.py3-none-any.whl (3.3 MB) Downloading
awscli-1.18.150.tar.gz (1.3 MB) Using cached
awscli-1.18.149-py2.py3-none-any.whl (3.3 MB) Downloading
awscli-1.18.149.tar.gz (1.3 MB) Using cached
awscli-1.18.148-py2.py3-none-any.whl (3.3 MB) Downloading
awscli-1.18.148.tar.gz (1.3 MB) Using cached
awscli-1.18.147-py2.py3-none-any.whl (3.3 MB) Downloading
awscli-1.18.147.tar.gz (1.3 MB) Using cached
(...)
awscli-1.16.41-py2.py3-none-any.whl (1.4 MB) Downloading
awscli-1.16.41.tar.gz (636 kB) Downloading
awscli-1.16.40-py2.py3-none-any.whl (1.4 MB) Downloading
awscli-1.16.40.tar.gz (636 kB) Downloading
awscli-1.16.39-py2.py3-none-any.whl (1.4 MB) Downloading
awscli-1.16.39.tar.gz (636 kB) Downloading
awscli-1.16.38-py2.py3-none-any.whl (1.4 MB) Downloading
awscli-1.16.38.tar.gz (636 kB) ERROR: Could not install packages due
to an EnvironmentError: [Errno 28] No space left on device:
'/tmp/pip-install-d05v14o4/awscli_799b59c34d714e6abf8745c33231bad6/awscli/examples/ec2/create-vpc-endpoint-connection-notification.rst'

I have uninstalled and re-installed it. Works well when I do that way.
But I don't understand why upgrading causes it to download every other version.

I have: vm.swappiness = 1 as suggested here to prevent using Swap when there is plenty of available memory. (0 would completely disable swap, as far as I understand)

In frequent cases, I end up with, say, 5GB swap used (total 16GB),
while I have 9GB free available memory (total 32GB)
(only 1GB free if we count cached RAM).

As my application starts to get slow (since most of the Swap is from MariaDB), I run:

swapoff -a
swapon -a

And all the swap memory is moved to the main RAM.
I end up with 5.6GB available RAM, 4GB if we count cached.

There is no apparent reason to have so much Swap.
I've been researching about this, and I cannot find a way to prevent using Swap when it's not needed.
vm.swappiness = 1 is definitely "permanently saved", since it is on the sysctl.conf file, and there have been reboots, etc.

I don't want to disable swap, but the only workaround I can think of is:

1. disable swap
2. have a cron running every 1 minute to check how much free RAM there is
3. enable swap if available RAM is low

But, this is VERY risky to do, and I wish the OS was smart enough to manage this better!

Is there absolutely no way to only use swap when absolutely needed?

I send emails through AWS SES to increase the chances of my emails being delivered to users. It's been working quite well so far.

However, as I send emails through AWS SES, is the Reputation of my Domain improving overtime?

If one day I decide to leave AWS SES and send emails from my own SMTP server (with the same quality of emails), will I keep the Domain Reputation gained while I was sending through AWS SES, or would I be "stuck" with continuing to use AWS SES to keep the reputation gained?

I have a private self-hosted email server.

I'm aware that if I send emails to Hotmail/Yahoo/Gmail addresses, and the users Open the emails and Reply to the emails, my Domain & IP Reputation will increase (for that particular ISP), as their user is engaging with my emails.

However, if the addresses I send emails to are on domains ".gov" and ".mil", which I believe have self-hosted email servers too (not Hotmail/Gmail), does the Opening and Replying to email actions increase anything in my Domain & IP Reputation?

I had someone telling me:

1) We send emails to .GOV/.MIL address FROM our own IP.
2) They receive + Open + Respond to the Email
3) Our IP and email reputation goes up, at least from 2 factors:
- Open Email
- Respond Email (stronger)

I just want to confirm whether this is true or not.

To clarify, my emails are configured properly (SPF/DKIM/etc). I'm not having problems sending emails to .mil/.gov. My question is whether actions done by the recipients (.gov/.mil / any self-hosted recipient) affect anything in relation to my overall IP/Domain reputation.

I'm trying to find how to setup 2FA/MFA on users who login to Jenkins, with Google Authenticator.

Everything I'm finding is about logins to servers/git/etc, but not for the actual USERS in Jenkins.

Does anyone know how to do this?

I want to create an alias to the "static" folder:

location ~ ^/myapp/([a-zA-Z0-9_-]+)/ {
    alias /var/lib/myapp/$1/static/;
    autoindex on;
}

But, if I have the URL:

https://mydomain/myapp/section1/page.html

I'm being redirected to:

https://mydomain/myapp/section1/page.html/

which causes a 404.

If I access:

https://mydomain/myapp/section1/

I can correctly see the list of all the html files (because of "autoindex on").

However, if I have this config:

location /myapp/ {
    alias /var/lib/myapp/;
    autoindex on;
}

nginx does NOT add the trailing slash, and therefore I can correctly access the .html pages. The problem with this config is that "static/" has to be included in the URL, such as:

https://mydomain/myapp/section1/static/page.html

How can I make nginx NOT add a trailing slash in the first example above?

On my website, we log user IPs to ensure we're able to properly moderate and prevent abuse.

We are aware of Proxies, such as Opera VPN, Tor, and others.

However, I am not aware of Google itself having a Proxy, other than the "Data Saver" functionality.

Some users are coming to my website with IPs such as:

66.102.8.219
66.249.91.121

There are a lot more IPs. These IPs are owner by AS15169 Google LLC and have these hostnames:

rate-limited-proxy-66-249-91-121.google.com
google-proxy-66-102-8-219.google.com

As per this page, https://developers.chrome.com/multidevice/data-compression
The header X-Forwarded-For will be present with the user's real IP.
And we do look into this header.

However, when I dump the headers when users come with the IPs above, this header is not present, and there's no other header with the user's IP, at all.

Plus, as per this page, https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

The [Cache-Control] no-transform directive is redundant for content served over HTTPS, because proxies can not transform payloads over secure connections.

Therefore, I don't think the IPs above have to do with Data Saver functionality, because my website is fully SSLed.

-

What do you think these users are using in order to hide their real IP?

I am looking into setting up smartmontools.

I'd like to control when the tests run. I was thinking of running:

/usr/sbin/smartctl --test=short /dev/sdX (every week)
/usr/sbin/smartctl --test=long /dev/sdX (every month)

And send an email/alert if an error is found.

1) Am I right to say that if I have the above set up in a cron, I don't need to have "smartd" daemon running in background?

2) Is there any advantage in enabling Offline Data Collection, if I run the tests above and have "smartd" disabled?

3) And the last thing that's been bugging me is that I see in the documentation that the commands for enabling/disabling --smart, --offlineauto and --saveauto are listed as Obsolete in ATA specifications. Does this mean that all these features are obsolete/useless on ATA devices?

On every boot, my machine (CentOS 7) mounts all these:

# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        30G  2.6G   28G   9% /
devtmpfs        287M     0  287M   0% /dev
tmpfs           294M     0  294M   0% /dev/shm
tmpfs           294M   34M  261M  12% /run
tmpfs           294M     0  294M   0% /sys/fs/cgroup

But my /etc/fstab only contains these:

# cat /etc/fstab
UUID=823db525-82d9-467e-acdf-7379cbd85171 /    xfs     defaults        0 0

Where would all the mounts of "tmpfs" be defined?
Where can I configure their sizes?

If I add more entries in my /etc/fstab, such as something like:

tmpfs       /dev/shm     tmpfs   defaults,noatime      0 0

Would that cause a conflict with whatever setting is already mounting that on boot?

I have a busy server with a RAID 1 setup. The application (runs in PHP) is very read/write intensive to the database (MariaDB).

A cronjob runs smartctl short test every day and checks the output of smartctl -H and mdadm -D.

I would like to run a long test sometimes, but I am concerned about its performance impact. I read that it can take several hours to complete. If it causes server performance to degrade while it runs, my users will be affected for 5+ hours.

So, a few questions here:

1) Do long smart tests usually impact performance that can be significant to users?

2) Since I have RAID 1 and do short tests, are long tests still necessary?

3) Is there a way to stop a long test if I find it is causing trouble on server performance?

The tcp_rfc1337 setting seems to have a solution for TIME-WAIT Assassination.

The first problem is that old duplicate data may be accepted erroneously in new connections, leading to the sent data becoming corrupt.
The second problem is that connections may become desynchronized and get into an ACK loop because of old duplicate packets entering new connections, which will become desynchronized.
The third and last problem is that old duplicate packets may enter newly established connections erroneously and kill the new connection.

From what I read, to solve the problems, what the setting does is ignore the RST (reset) packets while the socket is in its TIME-WAIT state.

So, why isn't this setting enabled by default? What are the disadvantages of using this?

I actually learned about this variable when I was researching about stopping SYN flooding attacks. Do you think this setting helps with stopping them?

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file.

So, is it possible to trigger a script/command when the kernel alerts for "possible SYN flooding on port XXX" ?

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast.

However, the server appears to sometimes have "SYN flooding" attacks. I really believe/suspect these are intentional and not caused by our legit users. (as they appear to happen when there are some individuals that register new accounts and try to cause trouble)

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

Unfortunately, when that happens, my whole traffic is affected:

[Mon Jun 27 22:15:28.842067 2016] [mpm_event:error] [pid 12022:tid 132875292207712] AH00485: scoreboard is full, not at MaxRequestWorkers

My MaxRequestWorkers is 600. I have increased it a few times in the past.
Recently I also have increased net.ipv4.tcp_max_syn_backlog and ListenBackLog to 5000.
My server has 16GB RAM and 1 Gbps bandwidth.

I am not really happy that there appears to be someone that can easily control whether my website is alive or not.
What can one do to stop this?

Also, netstat seems to give me the IPs connected to the server right now.
Is it possible to get the top IPs at a given time in the past?

I use MyISAM tables in MySQL, and I would like to know which methods are used to avoid problems with file-size limits and row limits.
How do big sites (such as Facebook) deal with those limits?

I have a Unix server running with 2 disks with the same capacity, but 1 is being used only for backups storage.
I would like to temporarily use that secondary disk as a mirror of the first, and move the backups to the main disk (which will obviously then be mirrored to the secondary disk too).

Is this a good idea? If yes, I am just not sure on how to install the RAID 1 (as software) to start using the secondary disk as a mirror of the first. Could you please help me here?

Thank you!