myNewAccount's questions

Question: Are there some error events / codes that NGINX handles by default?

Background: The following portion of my config stops hotlinking and returns a 403 error.

    location ~* \.(jpg|png|svg|webp|ico)$ {
        valid_referers none blocked server_names ~\.bing\. ~\.duckduckgo\. ~\.facebook\. ~\.google\. ~\.instagram\. ~\.twitter\. ~\.yahoo\.;
        if ($invalid_referer) {
            return 403;
        }
    }

This section blocks unwanted HTTP methods and returns a 405 error.

if ($request_method !~ ^(GET|HEAD|POST)$) {
    return 405;
}

This got me thinking, are there any errors that I don't have to set up in NGINX?

For example, a 400 Bad Request error. Does NGINX know what a bad request is without adding an if statement and some logic to the config?

Alternately do I need to set up every error in the config that I plan to use and if I don't it can't be triggered? I always assumed this was the case but when I see how many different 400 and 500 errors there are I wonder if I'm not fully understanding this concept.

I'm having trouble understanding how communication occurs on a linux box if a front facing server like NGINX has been installed.

For example this is my setup.

AWS / EC2 linux based instance

NGINX - front facing server

Node.js / Express - upstream server

In this setup I have no problem communicating past NGINX with ping, curl, Node Package Manager and other tools even without setting an http_proxy environment variable. By default, without any added configuration these tools know how to get past NGINX and onto the internet.

In this common setup why don't I have to set up http_proxy or something similar to allow outside communication? Once NGINX is installed doesn't all traffic go through it?

My proxy values suggest that localhost:3128 is being used as a proxy. I should add that I personally added these environmental variables in an .sh file in my profile.d folder. A tutorial indicated I needed to do this to enable a particular Google service.

$ env

HTTP_PROXY=http://localhost:3128
HTTPS_PROXY=http://localhost:3128
http_proxy=http://localhost:3128
https_proxy=http://localhost:3128

However when I netstat the output doesn't indicate that the port is in use. So I assume that setting the environment variables didn't necessarily turn on a proxy although I'm not certain of that.

$ netstat -tuplen

tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      988        25226      -
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      0          20028      -
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      0          26841      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          26819      -
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      0          26843      -
tcp6       0      0 :::111                  :::*                    LISTEN      0          20030      -
tcp6       0      0 :::8080                 :::*                    LISTEN      0          32013      -
tcp6       0      0 :::80                   :::*                    LISTEN      0          26842      -
tcp6       0      0 :::22                   :::*                    LISTEN      0          26827      -
tcp6       0      0 :::443                  :::*                    LISTEN      0          26844      -
tcp6       0      0 :::9090                 :::*                    LISTEN      0          21892      -
udp        0      0 0.0.0.0:111             0.0.0.0:*                           0          20029      -
udp        0      0 127.0.0.1:323           0.0.0.0:*                           0          22534      -
udp6       0      0 fe80::c37:2dff:fe7d:546 :::*                                0          28138      -
udp6       0      0 :::111                  :::*                                0          20031      -
udp6       0      0 ::1:323                 :::*                                0          22535      -

A second piece of data indicates that something is not right. I'm having trouble with AWS SES.

When I test my connection I get an error.

$ aws ses verify-email-identity --email-address [email protected]

Failed to connect to proxy URL: "http://localhost:3128"

However when I comment out my .sh file and reboot the server the http_proxy environmental variables are gone and AWS SES works as expected.

So does the output mismatch between env and netstat indicate anything? I'm not sure how to approach this problem.

I need to add environmental variables related to proxy servers to allow my node.js app to communicate with reCAPTCHA Enterprise on Google Cloud.

When I run the scripts from Accessing Google Cloud APIs though a Proxy communication with Google Cloud is successfully enabled. However going forward I need proxy support at startup.

export GRPC_VERBOSITY=DEBUG  
export GRPC_TRACE=handshaker

export HTTP_PROXY=http://localhost:3128
export http_proxy=http://localhost:3128
export https_proxy=http://localhost:3128
export HTTPS_PROXY=http://localhost:3128

When I checked my profile.d directory I noticed it had both .sh and .csh files. For example,

colorgrep.csh
colorgrep.sh
colorls.csh
colorls.sh
colorxzgrep.csh
colorxzgrep.sh
colorzgrep.csh
colorzgrep.sh
csh.local
gawk.csh
gawk.sh
lang.csh
lang.sh
less.csh
less.sh
nano.sh
sh.local
which2.csh
which2.sh

Do I need to copy and paste my proxy related scripts into a single .sh file or should I also add them to a .csh file? Also will a simple copy and paste work or does the format need to change?

I just moved from Digital Ocean to AWS. My usual setup procedures for the web server I use for experimentation are not working.

I can reach the site through IPv4 but all domains error out and my SSL certificate doesn't show up when tested on SSL Shopper. DNS appears to be working fine, my firewall is open, SSL certificate installed and NGINX running fine. When all the obvious things are working what do I need to check? Or alternately am I missing something really obvious?

This is my setup.

The IPv4 address brings up the default NGINX welcome screen.

Unfortunately all domains error out,

http://example.com

https://example.com

http://www.example.com

https://www.example.com

SSL Labs test

IPs detected correctly on https://www.ssllabs.com/ but in both cases unable to connect to server.

SSL Shopper test

No SSL certificates found on https://www.sslshopper.com/.

In Linux

Both ports open.

firewall-cmd --list-ports

80/tcp 443/tcp

Nginx installed.

Nginx status: Active: active (running) since Fri 2021-03-05 13:48:16 MST; 2h 33min ago

curl localhost:80 returns 301 redirect which is correct.

Lets Encrypt SSL certificate installed.

Expiry Date: 2021-06-03 18:11:03+00:00 (VALID: 89 days)

In AWS console:

VPC > Your VPCs >

DNS hostnames: Enabled

DNS resolution: Enabled

IPv6 pool: Amazon ✓ Associated

EC2 > Instances >

Instance state: Running

Status check: 2/2 checks passed

Public IPv4 address: 1.1.1.1 (example.com)

Elastic IP addresses: 1.1.1.1 (example.com) [Public IP]

EC2 > Security Groups >

Inbound rules

HTTP TCP 80 0.0.0.0/0

HTTPS TCP 443 ::/0

Route 53 > Hosted zones >

Records

example.com A Simple 1.1.1.1

example.com AAAA Simple 2001:0db8:85a3:0000:0000:8a2e:0370:7334

www.example.com A Simple 1.1.1.1

www.example.com AAAA Simple 2001:0db8:85a3:0000:0000:8a2e:0370:7334

== UPDATE==

This is what my security console looks like. VPC > Security Groups > [my id]

Environment: AWS, DNSSEC

When I attempt to create a DS record to establish a chain of trust I get an error that I don't understand.

My full error.

Error occurred
Bad request.
(InvalidChangeBatch 400: RRSet of type DS with DNS name example.com. is not permitted in zone example.com.)

Oddly enough when I attempt to add the key to a subdomain like www.example.com it works. But that's not what I need. I need it to work for the entire domain.

Environment: Centos 8, Certbot, Lets Encrypt

On CentOS distributions certbot / Lets Encrypt uses snap to keep SSL certificates up to date. Below are the instructions.

certbot instructions: Nginx on CentOS/RHEL 8

$ sudo snap install core; sudo snap refresh core

$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

$ sudo certbot --nginx

However in a comment to this question Michael Hampton indicated that snap is not commonly used for Centos distributions and not necessarily needed for this job.

This isn't really an issue on CentOS where the packages are kept up to date. You could try to use the snap, but snap is largely yet another technologically questionable Canonical thing and most everyone else in the world ignores it.

How might certbot / Lets Encrypt be set up on CentOS / NGINX so that a certificate is downloaded and kept up to date without snap? I'm beginning to realize that the fewer technologies I use the less chance something might go wrong in the future.

Environment: Centos 8, Digital Ocean Droplet

I've recently found 2 strange, seemingly unconnected errors in my OS.

SELinux setting httpd_can_network_relay to on throws error, “could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid”. How is this fixed?

Michael Hampton suggested this may be the result of a corrupt SELinux policy. I followed his instructions and reinstalled selinux but the error persisted.

Tonight I got a warning that my servers SSL certificate was not renewing even though it was set up to automatically renew with snap.

I checked and certbot.renew was disabled and inactive.

$ snap services
Service        Startup   Current   Notes
certbot.renew  disabled  inactive  -

When I attempted to force renewal with a refresh I got this error.

$ snap refresh
error: system does not fully support snapd: cannot mount squashfs image using "squashfs": mount:
       /tmp/sanity-mountpoint-019949784: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error.

Then I tested cerbot without snap and got an error.

$ sudo certbot renew --dry-run
internal error, please report: running "certbot" failed: cannot find installed snap "certbot" at revision 952: missing file /var/lib/snapd/snap/certbot/952/meta/snap.yaml

Question: Am I right to suspect that my OS may be corrupt? If so is there a tool or method I can use to restore Centos back to its original, healthy state?

Environment: Digital Ocean Droplet, CentOS 8

The State of httpd_can_network_relay is set to on. However the Default is set to off.

$ sudo semanage boolean -l | grep httpd_can_network_relay

httpd_can_network_relay        (on   ,  off)  Allow httpd to can network relay

However when I attempt to set the default to on I get an error. I'm not sure how to approach this.

$ sudo setsebool httpd_can_network_relay 1 -P

libsepol.context_from_record: type systemd_sleep_exec_t is not defined

libsepol.context_from_record: could not create context structure

libsepol.context_from_string: could not create context structure

libsepol.sepol_context_to_sid: could not convert system_u:object_r:systemd_sleep_exec_t:s0 to sid

invalid context system_u:object_r:systemd_sleep_exec_t:s0

Note: All repos are up to date with dnf.

$ dnf repolist
appstream                                               CentOS Linux 8 - AppStream
baseos                                                  CentOS Linux 8 - BaseOS
epel                                                    Extra Packages for Enterprise Linux 8 - x86_64
epel-modular                                            Extra Packages for Enterprise Linux Modular 8 - x86_64
extras                                                  CentOS Linux 8 - Extras
nginx-stable                                            nginx stable repo
nodesource                                              Node.js Packages for Enterprise Linux 8 - x86_64

OS: centos-release-8.2-2.2004.0.1.el8.x86_64

Host: Digital Ocean

Recently when I login to my account I get a long list of updates and activity. I believe these updates have already been installed and when I attempt to install them I get this output.

$ sudo dnf update -y

Last metadata expiration check: 0:22:54 ago on Fri 14 Aug 2020 07:37:47 PM MST.
Dependencies resolved.
Nothing to do.
Complete!

However the next time I login I once again get the output below. (I abbreviated this output considerably).

Question) Once these updates have been installed shouldn't they go away and not pop up the next time I login? Is there a way to clear this out? Do I not understand this properly?

The following updates were downloaded on 'server.example.com':

================================================================================

 Package                        ArchVersion                                    Repository Size  
                                                                                                                                                    
================================================================================

Installing:

 kernel                         x86_644.18.0-193.14.2.el8_2  
                                                                                                                                                                               BaseOS     2.8 M

 kernel-core                    x86_644.18.0-193.14.2.el8_2 
                                                                                                                                                                                  BaseOS     28 M

 kernel-devel                   x86_644.18.0-193.14.2.el8_2 
                                                                                                                                                                                  BaseOS     15 M

 kernel-modules                 x86_644.18.0-193.14.2.el8_2
                                                                                                                                                                                   BaseOS     23 M

Upgrading:

 annobin                        x86_648.90-1.el8.0.1 
                                                                                                                                                                                         AppStream  201 k

 boost-atomic                   x86_641.66.0-7.el8   
                                                                                                                                                                                         AppStream  13 k

 boost-chrono                   x86_641.66.0-7.el8  
                                                                                                                                                                                          AppStream  22 k

 boost-date-time                x86_641.66.0-7.el8 
                                                                                                                                                                                           AppStream  29 k

 boost-filesystem               x86_641.66.0-7.el8
                                                                                                                                                                                            AppStream  48 k

 boost-regex                    x86_641.66.0-7.el8  
                                                                                                                                                                                          AppStream  281 k

 boost-system                   x86_641.66.0-7.el8  
                                                                                                                                                                                          AppStream  18 k

 boost-thread                   x86_641.66.0-7.el8  
                                                                                                                                                                                          AppStream  58 k

 boost-timer                    x86_641.66.0-7.el8  
                                                                                                                                                                                          AppStream  20 k

 cloud-init                     noarch19.4-1.el8.7 
                                                                                                                   
Installing weak dependencies:

 PackageKit                     x86_641.1.12-4.el8   
                                                                                                                                                                                         AppStream  601 k

 elfutils-debuginfod-client     x86_640.178-7.el8  
                                                                                                                                                                                           AppStream  62 k

Transaction Summary
================================================================================
Install   13 Packages

Upgrade  295 Packages

Web console: https://server.example.com:9090/ or https://555.55.555.55:9090/

Environment: Fresh install of CentOS 8, Digital Ocean Droplet

Question: Why would hostname -I report 3 IP addresses? Shouldn't it show 1 IPv4 and 1 IPv6 address?

My Output: (IP addresses changed)

149.50.50.1 10.10.10.1 2500:1111:1111:1111:1111:1111:1111

149.50.50.1 and 2500:1111:1111:1111:1111:1111:1111 are displayed in my DO control panel. I have no idea where 10.10.10.1 comes from.

Environment: Digital Ocean, Centos 8, Postfix/Dovecot

Background: For my droplet I used a FQDN, server.example.com. Digital Ocean configures the PTR record (reverse DNS entry) on their end based on the droplet name.

This works fine with my web server. Unfortunately I'm getting a reverse DNS lookup error for my Postfix email server. In Postfix main.cf I used mail.server.com as the value for the myhostname parameter. Below are some relevant entries from my DNS records.

Type: A
Name: example.com
Value: 100.100.100.100

Type: A
Name: mail.example.com
Value: 100.100.100.100

Type: MX
Name: example.com
Value: mail.example.com

The error I get on MXToolbox is,

Reverse DNS does not match SMTP Banner.

I tried adding an additional DNS record to fix the problem but the error didn't go away.

Type: A
Name: server.example.com
Value: 100.100.100.100

Question: Is there a DNS record I can add to fix this problem? I'm not sure how to fix a reverse DNS lookup problem.

Addendum The answer to this question is in the comments. The correct way to solve this is to rename the mail server server.example.com. Otherwise I would need 2 different Droplets or servers. Email always comes from [email protected] so to end users their world looks the same regardless of what the mail server is named.

When using Postfix Port 587 is turned on by uncommenting a line in master.cf.

submission inet  n       -       n       -       -       smtpd

I found this out by reading posts and comments on various websites. However I see no reference to this on the official Postfix Configuration Parameters page. That is very frustrating.

Where in the official docs does it say to uncomment the submission parameter in master.cf? I feel like I'm missing out on a lot of important information.

Environment: Postfix 3.3

In my main.cf file I see references to both smtp and smtpd.

For example:

smtpd security is set here.

smtpd_tls_security_level = may

And just a few lines below smtp security is set in an otherwise identical parameter.

smtp_tls_security_level = may

Other examples are these smtpd parameters:

smtpd_tls_cert_file
smtpd_tls_key_file

Although these aren't exactly the same just a few lines below smtp is used.

smtp_tls_CApath
smtp_tls_CAfile

Question: As far as Postfix is concerned what is the difference between smtp and smtpd?

Environment: CentOS, Postfix, Dovecot, Digital Ocean Droplet

Background: The mail server I just installed appears to send and receive normally. I tested my website on MXtoolbox and received 1 error that was related to SMTP. It was the only error that I received.

Unable to Connect to SMTP Host

Description: We attempted a connection to your mail server on port 25 but your server did not respond. More than likely there is no email server at this address or you have a misconfigured firewall or spam filtering system.

Question: Firewalld is blocking port 25. The only ports I have open are, 80/tcp 443/tcp 587/tcp 993/tcp. Do I need port 25 to be open for the mail server to function correctly and consistently or is this error unimportant?

Environment: CentOS 8

Question: When I enter sudo crontab -e it opens in Vim. However Nano is set as the default editor and for every other type of file it is used as expected. Why might this be? Is there a way around this?

Background: I followed these steps to make Nano the default editor.

# nano /root/.bashrc

I added these lines and saved the file.

export EDITOR='nano'
export VISUAL='nano'

This is what the entire file consists of.

# .bashrc

# User specific aliases and functions

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'

# Source global definitions
if [ -f /etc/bashrc ]; then
        . /etc/bashrc
fi

export EDITOR='nano'
export VISUAL='nano'

I used this command to make the change active.

# source /root/.bashrc

In the dnf-automatic config file automatic.conf I see the following lines under the email section.

[email]
# The address to send email messages from.
email_from = [email protected]

# List of addresses to send messages to.
email_to = [email protected]

# Name of the host to connect to to send email messages.
email_host = mail.mailServer.com

How does dnf-automatic send an email without knowing the password of the sender [email protected]?

I don't see a spot to put the password. I must be missing something but I don't know what.

Host: Digital Ocean

OS: CentOS

I have an existing SSL certificate that covers my domain.

$ certbot certificates produces this output.

Found the following certs:
   Certificate Name: example.com
     Domains: example.com www.example.com
     Expiry Date: 2020-04-12 21:20:31+00:00 (VALID: 86 days)
     Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
     Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem

I installed postfix and I believe I need to add mail.example.com to my certificate.

I tried to add mail.example.com to my certificate using this command,

$ sudo certbot certonly --standalone -d mail.example.com

Unfortunately it threw this error,

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mail.example.com
Waiting for verification…
Challenge failed for domain mail.example.com
http-01 challenge for mail.example.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: mail.example.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for mail.example.com

It appears that certbot is trying to install mail.example.com using an A record. On Digital Ocean in my Domain Records section mail.example.com was created as an MX record, not an A record.

Host: Digital Ocean

OS: CentOS 7

Mail Server: Postfix (new install)

SSL: certbot and letsencrypt.

I'm trying to track down an error I'm having with postfix and I think possibly my SSL certificate.

When I use the sendmail command to test postfix the mail doesn't send and I get an error.

Jan 16 19:57:15 centos-s-1vcpu-1gb-sfo2-01 postfix/smtp[1295]: warning: TLS library problem: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
Jan 16 19:57:15 centos-s-1vcpu-1gb-sfo2-01 postfix/smtp[1295]: A123530230A9: Cannot start TLS: handshake failure

So I think maybe I have a problem with my SSL certificate and postfix but I'm not sure.

When I enter, certbot certificates I get this output.

Found the following matching certs:
  Certificate Name: examplesite.io
    Domains: examplesite.io www.examplesite.io
    Expiry Date: 2020-04-12 21:20:31+00:00 (VALID: 87 days)
    Certificate Path: /etc/letsencrypt/live/examplesite.io/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/examplesite.io/privkey.pem

In the Domains section I don't see mail.examplesite.io. Do I need to add that to the certificate or is that not related to my error?

I should add that I do have an MX record in my DNS records at Digital Ocean.

TYPE: MX

Hostname: examplesite.io

Value: mail handled by mail.examplesite.io

I'm using an A DNS record to translate WWW for IPV4 traffic. It looks like this:

DNS records

TYPE: A

HOSTNAME: www.mywebsite.example

VALUE: directs to 192.168.0.1

Do I need to add an AAAA record for WWW to support IPv6 traffic?