Tom's questions

Currently I've got server A and server B running with the following mongod instances:

Server A

1. mongod server (usually PRIMARY)
2. mongod arbiter

Server B

1. mongod server (usually SECONDARY)

When server A goes down, server B fails to elect itself as primary to take everything over. As such, my entire application goes offline as the database is unavailable.

My question is, without increasing the amount of physical servers, how can I make sure that server B takes over properly when server A goes down?

Would the following be a good idea?

Server A

1. mongod server 1A
2. mongod server 2A
3. mongod arbiterA

Server B

1. mongod server 1B
2. mongod server 2B
3. mongod arbiterB

Where I have not added an arbiter to B because that would make the total number of servers even. The question is: is this the most efficient way to let server B take over when server A powers off? Or can I remove some servers to save RAM/CPU/HDD?

I have got my webserver application starting on boot using upstart. This is the upstart script:

# web app node upstart file at /etc/init/webapp.conf

description "web application"

start on started mongodb
stop on runlevel [06]

respawn
respawn limit 10 100

env NODE_ENV=production

pre-start script
    ulimit -n 2048
end script

exec start-stop-daemon --start -c mainuser --exec /usr/bin/make -- -C /home/mainuser/app start-prod

This works flawlessly on Ubuntu server 10.04 LTS and I'm very happy about it.

However, I have a deployment shell script which logs in using SSH as mainuser (this is not a sudoer) and will then update the working directory to the latest deployment version.

The issue here is that the service needs to be restarted so that the applications loads the new source files. However, mainuser gets a...

mainuser@Saturn101:~$ stop webapp
-bash: stop: command not found

...when trying to stop it. I have to run sudo stop webapp, but this user cannot do this as he is not a sudoer. For security reasons I don't want him to be a sudoer either, plus I do not want to insert the sudo password.

So how do I allow mainuser to run stop webapp and start webapp?

This is how I setup my iptables with UFW:

1. sudo ufw default deny incoming (deny all incoming)
2. sudo ufw default deny outgoing (deny all outgoing)
3. sudo ufw allow out 53 (accept outgoing DNS traffic, both tcp and udp)
4. sudo ufw allow in 80/tcp (accept all incoming tcp from port 80)
5. sudo ufw allow out 80/tcp (accept all outgoing tcp to port 80)
6. sudo ufw allow proto tcp from <admin_ip_addr> to <server_ip_addr> port 22 (accept incoming tcp port 22 from administrator's office IP for ssh)
7. sudo ufw allow out 9418/tcp (accept outgoing git connections)
8. sudo ufw allow proto tcp from <server_ip_addr> to any port 22 (accept outgoing ssh connections to connect with GitHub)

In English: block all, except for HTTP, DNS, incoming SSH from admin IPs, outgoing GIT and outgoing SSH.

Unfortunately, when I then do git clone [email protected]:username/project.git it gets stuck at Initialized empty Git repository in /home/adminuser/exper/project/.git/

When I then enable all outgoing traffic with sudo ufw default allow outgoing, and repeat the git clone command, it does work.

So, apparently there is something outgoing that is still being blocked.

Can anyone tell me what this may be, and what rule I should add to allow it?

I have also tried the following rules, without success:

1. sudo ufw allow out 1024:65535/udp

With UFW, I disabled all outgoing and ingoing traffic by default. However, I do allow port 80 in and out:

1. sudo ufw default deny incoming (deny all incoming)
2. sudo ufw default deny outgoing (deny all outgoing)
3. sudo ufw allow in 80/tcp (accept all incoming tcp from port 80)
4. sudo ufw allow out 80/tcp (accept all outgoing tcp to port 80)

Yet, the following commands don't seem to work. Could anyone tell me why?

mainuser@saturn101:~/apps/mongodb$ curl http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.0.4-rc1.tgz > mongodb-2.0.4-rc1.tgz

curl: (6) Couldn't resolve host 'fastdl.mongodb.org'

And,

ping google.com
ping: unknown host google.com

And,

sudo apt-get update

UFW's man page mentions that it can setup iptables rate limiting for me:

ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw will deny connections if an IP address has attempted to initiate 6 or more connections in the last 30 seconds. See http://www.debian-administration.org/articles/187 for details. Typical usage is:

     ufw limit ssh/tcp

Unfortunately this is all the documentation that I could find. I would like to stick with UFW, and not use more complicated iptables commands (to keep things "uncomplicated").

How would I use ufw to limit all incoming (so not outgoing) traffic on port 80 to 20 connections per 30 seconds? How would I disable rate limiting for ports 30000 to 30005? Is rate limiting enabled by default for all ports?

I've created two user accounts for two applications: mongod and node.js. Both of these store their data in their home folder. This keeps data "sandboxed" and prevents them from needing to be in the sudoers / admin file.

However, I have read that the home folder is not mounted when upstart runs my applications.

How do I ensure that it is mounted before upstart attempts to run my application, in a proper way?

I'm thinking about signing up to the Amazon S3 storage service.

What I want to do is create a service where other people can register their own bucket with a certain amount of storage.

These users will install my software, which then uploads their files. Of course, the users may only upload what they have paid for.

For this to work I would like to create a separate bucket for each customer, each with its own properties. Question 1: is this possible with the API? How?

This means that the installed software must have the rights needed to upload to my Amazon S3 account. Question 2: can I create individual authentication IDs for each bucket or customer, so that they can only upload with restrictions I have set?

Important info: I am a European resident and cannot do business in the United States, this means that I cannot use Amazon's DevPay service.

Update: looks like Amazon has a 100 buckets limit. This is not my service it seems. http://seocracy.com/2009/08/amazon-s3-bucket-limit/

Thanks in advance.