Alexander Farber's questions

I run a web game embedded in Wordpress/Jetty behind HAProxy 1.5 on CentOS 7 Linux.

The website can be accessed both as http and https.

I have modified Wordpress to display player profile pages at the URLs like:

https://slova.de/player-12345

where 12345 is a numeric player id in my web game.

This works well, but I would like to simplify the above URLs to

https://slova.de/12345

and then use HAProxy to prepend the "player-" part to numeric-only paths.

So I have added to /etc/haproxy/haproxy.cfg file the line:

http-request redirect code 301 prefix /player- if { path_end /5 }

This results however in the broken URL for some reason:

https://slova.de/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/player-/5

Below is my complete haproxy.cfg file to provide more context:

global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon

    stats socket /var/lib/haproxy/stats

    tune.ssl.default-dh-param 2048

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000

    # for WebSocket connections
    timeout tunnel          1h
    timeout client-fin      1m

frontend public
    bind 144.76.184.151:80
    bind 144.76.184.151:443 ssl crt /etc/pki/tls/certs/slova.de.pem no-sslv3
    http-request deny if { path_beg /xmlrpc.php }

    http-request redirect code 301 prefix /player- if { path_end /5 }

    default_backend jetty

backend jetty
    server domain 127.0.0.1:8080 send-proxy

On CentOS 7 Linux I run Drupal, which requires users to confirm their mail addresses.

I have modified the postfix config files in the following way:

/etc/postfix/generic:

@www.localdomain [email protected]

/etc/postfix/main.cf:

smtp_generic_maps = hash:/etc/postfix/generic

This results in Drupal sending registration mails to new users which contains the headers:

From: [email protected]     <--- non-existing address at my domain
Reply-To: [email protected] <--- my private mail address

This works well (better than earlier, when I set From: to my Gmail address and Gmail was thinking my website was spamming others), but I have a problem:

I do not want to accept any mail addressed to anyone @preferans.de anymore (too much SPAM was pouring in), so I have deleted the MX records in the DNS entry of my server and closed the port 25 by iptables.

Now when a new Drupal user enters a fake address, the registration mail bounces back to [email protected] but my postfix installation can not deliver it:

/var/log/maillog:

Aug 16 18:20:44 www postfix/master[1006]: daemon started -- version 2.10.1, configuration /etc/postfix
Aug 16 22:29:20 pref postfix/cleanup[9031]: 785952C03A8: message-id=<[email protected]>
Aug 16 22:29:20 pref postfix/bounce[9033]: 5B56F2C03A7: sender non-delivery notification: 785952C03A8
Aug 16 22:29:20 pref postfix/qmgr[24449]: 785952C03A8: from=<>, size=3262, nrcpt=1 (queue active)
Aug 16 22:29:20 pref postfix/qmgr[24449]: 5B56F2C03A7: removed
Aug 16 22:29:22 pref postfix/smtp[9009]: connect to preferans.de[88.99.244.39]:25: Connection refused
Aug 16 22:29:22 pref postfix/smtp[9009]: 785952C03A8: to=<[email protected]>, relay=none, delay=1.5, delays=0/0/1.5/0, dsn=4.4.1, status=deferred (connect to preferans.de[88.99.244.39]:25: Connection refused)
Aug 16 22:38:51 pref postfix/qmgr[24449]: 785952C03A8: from=<>, size=3262, nrcpt=1 (queue active)
Aug 16 22:38:51 pref postfix/smtp[9208]: connect to preferans.de[88.99.244.39]:25: Connection refused
Aug 16 22:38:51 www postfix/smtp[9208]: 785952C03A8: to=<[email protected]>, relay=none, delay=571, delays=571/0.01/0.01/0, dsn=4.4.1, status=deferred (connect to preferans.de[88.99.244.39]:25: Connection refused)
Aug 16 22:48:51 www postfix/qmgr[24449]: 785952C03A8: from=<>, size=3262, nrcpt=1 (queue active)
Aug 16 22:48:51 www postfix/smtp[9393]: connect to preferans.de[88.99.244.39]:25: Connection refused
Aug 16 22:48:51 www postfix/smtp[9393]: 785952C03A8: to=<[email protected]>, relay=none, delay=1171, delays=1171/0.01/0.01/0, dsn=4.4.1, status=deferred (connect to preferans.de[88.99.244.39]:25: Connection refused)
Aug 16 23:08:51 www postfix/qmgr[24449]: CF37F2C039F: from=<[email protected]>, size=1234, nrcpt=1 (queue active)
Aug 16 23:08:51 www postfix/qmgr[24449]: 785952C03A8: from=<>, size=3262, nrcpt=1 (queue active)
Aug 16 23:08:51 www postfix/smtp[9797]: connect to preferans.de[88.99.244.39]:25: Connection refused
Aug 16 23:08:51 www postfix/smtp[9797]: 785952C03A8: to=<[email protected]>, relay=none, delay=2371, delays=2371/0.01/0.01/0, dsn=4.4.1, status=deferred (connect to preferans.de[88.99.244.39]:25: Connection refused)
Aug 16 23:08:51 www postfix/smtp[9796]: connect to gamai.com[67.227.226.241]:25: Connection refused
Aug 16 23:08:51 www postfix/smtp[9796]: CF37F2C039F: to=<[email protected]>, relay=none, delay=4588, delays=4588/0.01/0.13/0, dsn=4.4.1, status=deferred (connect to gamai.com[67.227.226.241]:25: Connection refused)
Aug 16 23:48:52 www postfix/qmgr[24449]: 785952C03A8: from=<>, size=3262, nrcpt=1 (queue active)
Aug 16 23:48:52 www postfix/smtp[10420]: connect to preferans.de[88.99.244.39]:25: Connection refused
Aug 16 23:48:52 www postfix/smtp[10420]: 785952C03A8: to=<[email protected]>, relay=none, delay=4772, delays=4772/0.01/0.01/0, dsn=4.4.1, status=deferred (connect to preferans.de[88.99.244.39]:25: Connection refused)

And the queue fills up:

# sudo mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
CF37F2C039F     1234 Wed Aug 16 21:52:22  [email protected]
                 (connect to gamai.com[67.227.226.241]:25: Connection refused)
                                         [email protected]

785952C03A8     3262 Wed Aug 16 22:29:20  MAILER-DAEMON
                (connect to preferans.de[88.99.244.39]:25: Connection refused)
                                         [email protected]

BD4222C03B6     1219 Thu Aug 17 07:48:48  [email protected]
(host mx.yandex.ru[87.250.250.89] said: 451 4.5.1 The recipient <[email protected]> has exceeded their message rate limit. Try again later. 1502957639-8f63s3727h-Dw8G1QLj (in reply to end of DATA command))
                                         [email protected]

-- 6 Kbytes in 3 Requests.

My question is please:

How to configure my postfix installation, so that it drops not delivered mails immediately (but still comes through grey-listing)?

Finally here is the current postconf -n output:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = localhost
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_generic_maps = hash:/etc/postfix/generic
unknown_local_recipient_reject_code = 550

On CentOS 7 Linux I successfully use HAProxy 1.5.14 in front of Jetty 9 serving a Wordpress site via FastCGI.

It works really well, but for a HTML5/WebSocket game at the same website much higher client and server timeouts for WebSocket connections to the /ws/ URL are needed.

So I have modifed /etc/haproxy/haproxy.cfg file to the following:

global
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon
    tune.ssl.default-dh-param 2048

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m    # HOW TO INCREASE FOR /ws/ ?
    timeout server          1m    # HOW TO INCREASE FOR /ws/ ?
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000

frontend public
    bind 144.76.184.151:80
    bind 144.76.184.151:443 ssl crt /etc/pki/tls/certs/slova.de.pem

    acl websocket_url path_end /ws/
    #timeout client 60m if websocket_url   # SYNTAX ERROR
    use_backend ws-jetty if websocket_url
    default_backend jetty

backend jetty
    server domain 127.0.0.1:8080 send-proxy

backend ws-jetty
    timeout client 60m    # IS IGNORED HERE
    timeout server 60m
    server domain 127.0.0.1:8080 send-proxy

When I set

    timeout client 60m
    timeout server 60m

in defaults section, my WebSocket game works as needed, but I don't want to have 1 hour timeouts for the usual HTTP connections.

When I put that section into backend ws-jetty then the warning is printed, that timeout client is not a backend option and thus is ignored.

When I try the line timeout client 60m if websocket_url then a syntax error is reported.

On CentOS 7 Linux (acting as LAMP - and not "firewall/gateway") I have created a custom systemd service for running embedded Jetty at port 8080 as user nobody:

[Unit]
Description=WebSocket Handler Service
After=network-online.target

[Service]
Type=simple
User=nobody
Group=nobody
ExecStart=/usr/bin/java -classpath '/usr/share/java/jetty/*' de.afarber.MyHandler 123.123.123.123:8080
ExecStop=/bin/kill ${MAINPID}
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

However I actually need the server to listen at the port 80 - so that WebSocket connections to it work even through corporate firewalls.

The Jetty document on Setting Port 80 Access for a Non-Root User suggests to run the following command:

# iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Luckily I already use iptables-services package at my dedicated server and the current /etc/sysconfig/iptables file contains:

*filter
:INPUT DROP
:FORWARD DROP
:OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp -m multiport --dports 25,80,443,8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 2/min --limit-burst 1 -j ACCEPT
COMMIT

My problem is that I don't know the proper PREROUTING-syntax for the above file.

I have tried running the command above and then iptables -S in the hope that iptables will list the needed line for me - but that didn't happen.

UPDATE:

Unfortunately the following /etc/sysconfig/iptables file does not work:

*nat
:INPUT ACCEPT
:OUTPUT ACCEPT
:PREROUTING ACCEPT
:POSTROUTING ACCEPT
-A PREROUTING -p tcp -m tcp --dst 123.123.123.123 --dport 80 -j REDIRECT --to-ports 8080
COMMIT

*filter
:INPUT ACCEPT
:OUTPUT ACCEPT
:FORWARD ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p tcp -m tcp -m state --state NEW -m multiport --dports 25,80,443,8080 -j ACCEPT
-A INPUT -p tcp -m tcp -m state --state NEW --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 2/min --limit-burst 1 -j ACCEPT
-A FORWARD -p tcp -m tcp --dst 123.123.123.123 --dport 8080 -j ACCEPT
COMMIT

I need incoming HTTP-connections to 123.123.123.123:80 to be redirected to 123.123.123.123:8080 (where Jetty is listening as user "nobody"), but for some reason this does not happen.

When I browse to http://123.123.123.123:8080 then I see Jetty response.

But when I browse to http://123.123.123.123 connection is refused.

Can anybody please spot the error for me?

Here is my current nat table:

# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             afarber.de           tcp dpt:http redir ports 8080

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Here is my current filter table:

# iptables -t filter -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere             icmp any
ACCEPT     tcp  --  anywhere             anywhere             tcp state NEW multiport dports smtp,http,https,webcache
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN state NEW limit: avg 2/min burst 1

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             afarber.de           tcp dpt:webcache

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Here my /etc/sysctl.conf file:

net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

Problem: requests to -d 123.123.123.123 --dport 80 are not redirected to 8080

UPDATE 2:

The line does not help either:

-A PREROUTING -p tcp -m tcp -i eth0:1 --dst 123.123.123.123 --dport 80 -j DNAT --to-destination :8080

the connection to 123.123.123.123:80 is still dropped

I host 2 web domains (domain1.com and domain2.com) on a CentOS 6.6 Linux server with 4 IP addresses.

Postfix 2.6.6 accepts mails to [email protected] and [email protected] and forwards them to [email protected] and [email protected]. Here excerpts of the config files:

/etc/postfix/main.cf

inet_interfaces = all
inet_protocols = ipv4

virtual_alias_domains = domain1.com domain2.com
virtual_alias_maps = hash:/etc/postfix/virtual
smtp_generic_maps = hash:/etc/postfix/generic

/etc/postfix/virtual

[email protected]        [email protected]
[email protected]        [email protected]

My problem is that the first person (my father, whose business is since 1990 at the internet) becomes a lot of SPAM mails. I use Spamassassin to reject those mails, but some still come through and when forwarded to [email protected] they cause Google to throttle my server:

DFC32800849 3412 Fri Jan 30 11:40:38 [email protected] (host alt1.gmail-smtp-in.l.google.com[74.125.130.26] said: 421-4.7.0 [144.76.123.123 15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. fl14si17784804pdb.81 - gsmtp (in reply to end of DATA command)) [email protected]

This affects the second person, who gets mails to [email protected] after long delays.

My question is if it is please possible to configure Postfix so that it uses different IP addresses (since my server has 4 of them) for forwarding the mails?

Thank you and below is the current "postconf -n" output:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
header_checks = pcre:/etc/postfix/header_checks
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = www.domain1.com
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_destination_concurrency_limit = 2
smtp_destination_rate_delay = 40s
smtp_generic_maps = hash:/etc/postfix/generic
unknown_local_recipient_reject_code = 550
virtual_alias_domains = domain1.com domain2.com
virtual_alias_maps = hash:/etc/postfix/virtual

UPDATE:

I have modified my config files as suggested by undefined (thank you!) and then run postmap /etc/postfix/transport and service postfix restart -

/etc/mail/master.cf:

smtp      unix  -       -       n       -       -       smtp
smtp-1    unix  -       -       n       -       -       smtp -o smtp_bind_address=my_ip_3
smtp-2    unix  -       -       n       -       -       smtp -o smtp_bind_address=my_ip_4

/etc/mail/transport:

[email protected] smtp-1:
[email protected] smtp-2:

Unfortunately, I still see the old problematic my_ip_2 in the delivered mail headers.

How can I please verify that the new "transports" are being used?

Here is the log excerpt after the change:

Feb  7 14:56:50 www postfix/postsuper[14206]: Deleted: 92 messages
Feb  7 14:57:06 www postfix/anvil[14172]: statistics: max connection rate 1/60s for (smtp:37.233.142.116) at Feb  7 14:53:45
Feb  7 14:57:06 www postfix/anvil[14172]: statistics: max connection count 1 for (smtp:37.233.142.116) at Feb  7 14:53:45
Feb  7 14:57:06 www postfix/anvil[14172]: statistics: max cache size 1 at Feb  7 14:53:45
Feb  7 14:57:07 www postfix/smtp[14008]: warning: open active 6870A8007E8: No such file or directory
Feb  7 14:57:14 www postfix/smtpd[14213]: connect from mail-ie0-f171.google.com[209.85.223.171]
Feb  7 14:57:14 www postfix/smtpd[14216]: connect from unknown[213.179.214.207]
Feb  7 14:57:14 www postfix/smtpd[14213]: 3EBA0800187: client=mail-ie0-f171.google.com[209.85.223.171]
Feb  7 14:57:14 www postfix/cleanup[14218]: 3EBA0800187: message-id=<CAADeyWgtCh21w-_AbKaPrq_kj2A=YjRi7OXHyjjruL01MR6sqw@mail.gmail.com>
Feb  7 14:57:14 www postfix/qmgr[12668]: 3EBA0800187: from=<[email protected]>, size=1707, nrcpt=1 (queue active)
Feb  7 14:57:14 www spamd[1856]: spamd: connection from localhost [127.0.0.1] at port 34152
Feb  7 14:57:14 www spamd[1856]: spamd: setuid to spam succeeded
Feb  7 14:57:14 www spamd[1856]: spamd: processing message <CAADeyWgtCh21w-_AbKaPrq_kj2A=YjRi7OXHyjjruL01MR6sqw@mail.gmail.com> for spam:502
Feb  7 14:57:14 www spamd[1856]: spamd: clean message (-1.9/5.0) for spam:502 in 0.0 seconds, 1670 bytes.
Feb  7 14:57:14 www spamd[1856]: spamd: result: . -1 - BAYES_00,FREEMAIL_FROM,HTML_MESSAGE,T_DKIM_INVALID scantime=0.0,size=1670,user=spam,uid=502,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=34152,mid=<CAADeyWgtCh21w-_AbKaPrq_kj2A=YjRi7OXHyjjruL01MR6sqw@mail.gmail.com>,bayes=0.000000,autolearn=ham
Feb  7 14:57:14 www postfix/smtpd[14216]: 68890800246: client=unknown[213.179.214.207]
Feb  7 14:57:14 www postfix/pipe[14219]: 3EBA0800187: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.18, delays=0.13/0/0/0.05, dsn=2.0.0, status=sent (delivered via spamassassin service)
Feb  7 14:57:14 www postfix/qmgr[12668]: 3EBA0800187: removed
Feb  7 14:57:14 www postfix/pickup[14119]: 69FD7800187: uid=502 from=<[email protected]>
Feb  7 14:57:14 www postfix/cleanup[14223]: 69FD7800187: message-id=<CAADeyWgtCh21w-_AbKaPrq_kj2A=YjRi7OXHyjjruL01MR6sqw@mail.gmail.com>
Feb  7 14:57:14 www postfix/qmgr[12668]: 69FD7800187: from=<[email protected]>, size=2042, nrcpt=1 (queue active)
Feb  7 14:57:14 www spamd[1762]: prefork: child states: II
Feb  7 14:57:14 www postfix/smtpd[14213]: disconnect from mail-ie0-f171.google.com[209.85.223.171]
Feb  7 14:57:14 www postfix/cleanup[14218]: 68890800246: message-id=<[email protected]>
Feb  7 14:57:14 www postfix/qmgr[12668]: 68890800246: from=<[email protected]>, size=13993, nrcpt=1 (queue active)
Feb  7 14:57:14 www spamd[1856]: spamd: connection from localhost [127.0.0.1] at port 34153
Feb  7 14:57:14 www spamd[1856]: spamd: setuid to spam succeeded
Feb  7 14:57:14 www spamd[1856]: spamd: processing message <[email protected]> for spam:502
Feb  7 14:57:14 www postfix/smtpd[14216]: disconnect from unknown[213.179.214.207]
Feb  7 14:57:14 www spamd[1856]: spamd: clean message (1.6/5.0) for spam:502 in 0.2 seconds, 13741 bytes.
Feb  7 14:57:14 www spamd[1856]: spamd: result: . 1 - BAYES_50,HTML_MESSAGE,RDNS_NONE,T_REMOTE_IMAGE,UNPARSEABLE_RELAY scantime=0.2,size=13741,user=spam,uid=502,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=34153,mid=<[email protected]>,bayes=0.484741,autolearn=no
Feb  7 14:57:15 www postfix/pickup[14119]: 00CD6800247: uid=502 from=<[email protected]>
Feb  7 14:57:15 www postfix/cleanup[14223]: 00CD6800247: message-id=<[email protected]>
Feb  7 14:57:15 www postfix/pipe[14219]: 68890800246: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.68, delays=0.43/0/0/0.25, dsn=2.0.0, status=sent (delivered via spamassassin service)
Feb  7 14:57:15 www postfix/qmgr[12668]: 68890800246: removed
Feb  7 14:57:15 www postfix/qmgr[12668]: 00CD6800247: from=<[email protected]>, size=14341, nrcpt=1 (queue active)
Feb  7 14:57:15 www spamd[1762]: prefork: child states: II
Feb  7 14:57:47 www postfix/smtp[14008]: warning: open active A6F92801560: No such file or directory

Unfortunately, still the same IP (which is throttled by Google) 144.76.184.154 is seen in the delivered test mail:

Delivered-To: [email protected]
Received: by 10.170.190.67 with SMTP id h64csp2513657yke;
        Sat, 7 Feb 2015 05:59:08 -0800 (PST)
X-Received: by 10.180.89.210 with SMTP id bq18mr14321108wib.45.1423317548028;
        Sat, 07 Feb 2015 05:59:08 -0800 (PST)
Return-Path: <[email protected]>
Received: from www.afarber.de ([144.76.184.154])
        by mx.google.com with ESMTP id k10si7979060wif.41.2015.02.07.05.59.07
        for <[email protected]>;
        Sat, 07 Feb 2015 05:59:08 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 144.76.184.154 as permitted sender) client-ip=144.76.184.154;
Authentication-Results: mx.google.com;
       spf=softfail (google.com: domain of transitioning [email protected] does not designate 144.76.184.154 as permitted sender) [email protected];
       dkim=pass [email protected];
       dmarc=pass (p=NONE dis=NONE) header.from=gmail.com
Received: by www.afarber.de (Postfix, from userid 502)
    id 69FD7800187; Sat,  7 Feb 2015 14:57:14 +0100 (CET)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on www.afarber.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
    HTML_MESSAGE,T_DKIM_INVALID autolearn=ham version=3.3.1
Received: from mail-ie0-f171.google.com (mail-ie0-f171.google.com [209.85.223.171])
    by www.afarber.de (Postfix) with ESMTP id 3EBA0800187
    for <[email protected]>; Sat,  7 Feb 2015 14:57:14 +0100 (CET)

It is not the IP that I have specified for smtp-1 or smtp-2.

UPDATE 2:

I have added "-v" to /etc/postfix/master.cf:

smtp      inet  n - n - - smtpd -o content_filter=spamassassin
....
smtp      unix  - - n - - smtp
smtp-1    unix  - - n - - smtp -o smtp_bind_address=144.76.184.155 -v
smtp-2    unix  - - n - - smtp -o smtp_bind_address=144.76.184.156 -v
....
spamassassin unix - n n - - pipe user=spam argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

And see now more Spamassassin messages in the /var/log/maillog.

Here is the updated "postconf -n" output (which is unchagned from above):

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
header_checks = pcre:/etc/postfix/header_checks
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = www.afarber.de
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_destination_concurrency_limit = 2
smtp_destination_rate_delay = 40s
smtp_generic_maps = hash:/etc/postfix/generic
unknown_local_recipient_reject_code = 550
virtual_alias_domains = videoskat.de balkan-preferans.de simplex.ru larissa-farber.de bukvy.de slova.de
virtual_alias_maps = hash:/etc/postfix/virtual

With postfix-2.6.6-2.2.el6_1.x86_64 on CentOS 6.4 is there please a way to inspect OUTGOING mails and silently drop them (i.e. do not send them) if the recipient looks like [email protected] (i.e. gmail.com domain and more than 3 dots in the username part of the address)?

Can header_checks be used for that or is it for INCOMING mail only?

Below is the current configuration (the postconf -n output) of Postfix at my server (I use virtual_alias_domains to accept mail for several Drupal sites hosted as Apache vhosts at my dedicated server and I want to stop sending the registration mail for fake users):

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_generic_maps = hash:/etc/postfix/generic
unknown_local_recipient_reject_code = 550
virtual_alias_domains = videoskat.de balkan-preferans.de simplex.ru preferans.de larissa-farber.de bukvy.de
virtual_alias_maps = hash:/etc/postfix/virtual

UPDATE:

Thanks to Jenny D, the following seems to work

/etc/postfix/header_checks:

/^To: \S+\.\S+\.\S+\.\[email protected]$/i DISCARD

/etc/postfix/main.cf:

header_checks = pcre:/etc/postfix/header_checks

A question about DNS zone files syntax (not sure if it's correct term here).

For my dedicated server I have the following zone file right now:

$TTL 86400
@   IN SOA ns1.first-ns.de. postmaster.robot.first-ns.de. (
    2013111400   ; serial
    14400        ; refresh
    1800         ; retry
    604800       ; expire
    86400 )      ; minimum

@                        IN NS      ns1.first-ns.de.
@                        IN NS      robotns2.second-ns.de.
@                        IN NS      robotns3.second-ns.com.

@                        IN A       144.76.184.151
localhost                IN A       127.0.0.1
www                      IN A       144.76.184.151
@                        IN MX 100  afarber.de.

And I wonder if the 2 lines (which use the same IP-address on the right side) could be written in a shorter form?

@                        IN A       144.76.184.151
www                      IN A       144.76.184.151

Trying to install MySQL (for WordPress) on a CentOS 6.4 /64 bit server.

I have installed the mysql-server-5.1.69-1.el6_4.x86_64 package and executed the following commands:

# chkconfig mysqld on
# service mysqld start
# /usr/bin/mysqladmin -u root password 'xxxxx'
# /usr/bin/mysql_secure_installation

Then I've noticed that mysqld_safe process is listening at 0.0.0.0 and decided to change that - so that my WordPress installation only uses domain sockets (or unix pipes? not sure about the correct term).

So I've modified the /etc/my.cnf to:

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
user=mysql
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links=0
bind-address = localhost
skip-networking
enable-named-pipe

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

But now MySQL refuses to start:

# service mysqld restart
Stopping mysqld:                                           [  OK  ]
MySQL Daemon failed to start.
Starting mysqld:                                           [FAILED]

The /var/log/mysqld.log contains:

 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
  InnoDB: Initializing buffer pool, size = 8.0M
  InnoDB: Completed initialization of buffer pool
  InnoDB: Started; log sequence number 0 44233
 [ERROR] /usr/libexec/mysqld: unknown option '--enable-named-pipe'
 [ERROR] Aborting
  InnoDB: Starting shutdown...
  InnoDB: Shutdown completed; log sequence number 0 44233
 [Note] /usr/libexec/mysqld: Shutdown complete
 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended

I've searched Google and grepped /usr/share/mysql/*.cnf for that directive, but haven't found any hints there.

I rent a dedicated server (with Intel Haswell CPU and custom hardware) at a lowcost hosting service and use it with CentOS 6.4 / 64 bit Linux (with stock kernel: 2.6.32-358.14.1.el6.x86_64).

Every few weeks it hangs and the other customers seem to have similar problems.

In the dmesg output I see (here is the full dmesg output):

CPU0: Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz stepping 03
....
NMI watchdog enabled, takes one hw-pmu counter.
....
iTCO_wdt: Intel TCO WatchDog Timer Driver v1.07rh
iTCO_wdt: Found a Lynx Point TCO device (Version=2, TCOBASE=0x1860)
iTCO_wdt: initialized. heartbeat=30 sec (nowayout=0)

and in the process list I see:

#  ps uawwwx|grep [w]atchdog
root         6  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/0]
root        10  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/1]
root        14  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/2]
root        18  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/3]
root        22  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/4]
root        26  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/5]
root        30  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/6]
root        34  0.0  0.0      0     0 ?        S    Aug22   0:00 [watchdog/7]

Does this mean, a hardware watchdog is already active at my server and will reboot my machine in under 30 seconds of being frozen?

(In the /etc/sysctl.conf I have put kernel.panic=10, so that it doesn't stuck in kdb console anymore).

Or do I have to install and start the CentOS package watchdog?

On CentOS 6.4 / 64 bit - how to find the limits of the user "nobody"?

Because I can not just su - nobody and call ulimit -a:

# id nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)

# su - nobody
This account is currently not available.

UPDATE:

I am asking: how to call ulimit -a for the CentOS user nobody, so that I can adjust /etc/security/limits.conf in regard to the max number of open files for that user.

EVEN MORE DETAILS:

I have a perl script (a non-forking TCP-sockets based card game daemon) which is being started by init (I've created a file for it: /etc/init/my_card_game.conf), but then drops super user privilleges and runs as nobody:

sub drop_privs {
        my ($uid, $gid) = (getpwnam('nobody'))[2, 3];
        die "User nobody not found\n" unless $uid && $gid;

        umask(0);
        chdir('/tmp') or die "Can not chdir to /tmp: $!\n";
        #chroot('/tmp') or die "Can not chroot to /tmp: $!\n";

        # try to set the real, effective and save uid
        setgid($gid) or die "Can not set gid to $gid: $!\n";
        setuid($uid) or die "Can not set uid to $uid: $!\n";
        # try to regain privileges - this should fail
        die "Not able to drop privileges\n" if setuid(0) || setgid(0);
}

I want to make sure it has a big enough max number of nofiles - so that it can serve all connected clients.

I'm currently using Google Apps to forward mails addressed to recipients at my domain balkan-preferans.de (176.9.40.169) to my address [email protected] - this is done by the following DNS-zone served by my hoster:

$TTL 86400
@   IN SOA ns1.first-ns.de. postmaster.robot.first-ns.de. (
    2012100402   ; serial
    14400        ; refresh
    1800         ; retry
    604800       ; expire
    86400 )      ; minimum

@                        IN NS      robotns3.second-ns.com.
@                        IN NS      robotns2.second-ns.de.
@                        IN NS      ns1.first-ns.de.

@                        IN A       176.9.40.169
localhost                IN A       127.0.0.1
www                      IN A       176.9.40.169
@                        IN MX 1    ASPMX.L.GOOGLE.COM.
@                        IN MX 5    ALT1.ASPMX.L.GOOGLE.COM.
@                        IN MX 5    ALT2.ASPMX.L.GOOGLE.COM.
@                        IN MX 10   ASPMX3.GOOGLEMAIL.COM.
@                        IN MX 10   ASPMX2.GOOGLEMAIL.COM.

This has worked well for the past year, but I'd like to get rid of Google Apps, because they aren't free of cost anymore and I don't use any other features of that product.

So I'd like to change the MX-records above to point to my 2 web servers - which run 24/7 anyway.

On the servers with CentOS 6 Linux I currently run sendmail (for sending logwatch mails mainly).

Could anybody please provide some hints on which macros to add to /etc/mail/sendmail.mc so that all mail for the balkan-preferans.de is accepted and then relayed to my address [email protected]?

Do I have to open an incoming port in iptables firewall too?

I run a small Facebook game at a CentOS 6.3 quad core machine with PostgreSQL 8.4.3 + few PHP scripts (doing mostly select queries) + 1 Perl daemon and even though the server worked ok, I've suggested my users to double up the RAM to 32 GB and they have collected money for that.

Now my problem is that I don't know, which knob to turn and how to really use the additional memory to speed up the server.

Below is my top output at the peak time (evenings) - as you see, 27 GB of RAM aren't used:

# top - 18:47:55 up 23:12,  2 users,  load average: 2.17, 2.31, 2.56
Tasks: 246 total,   2 running, 244 sleeping,   0 stopped,   0 zombie
Cpu(s): 12.1%us,  0.2%sy,  0.0%ni, 87.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:  32790380k total,  5296664k used, 27493716k free,   197132k buffers
Swap:  2096056k total,        0k used,  2096056k free,  3815840k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
12363 postgres  20   0 4376m 717m 710m S 40.6  2.2   2:03.48 postmaster
 3842 nobody    20   0  118m  23m 3920 S 12.0  0.1  46:24.68 pref.pl
 9178 postgres  20   0 4375m 518m 514m S 11.3  1.6  53:50.63 postmaster
12380 postgres  20   0 4377m 668m 660m S 11.3  2.1   2:33.26 postmaster
12243 postgres  20   0 4377m 668m 662m S  9.3  2.1   2:20.49 postmaster
12438 postgres  20   0 4374m 502m 498m S  6.3  1.6   1:03.34 postmaster
12249 postgres  20   0 4384m 852m 839m S  3.0  2.7   3:59.11 postmaster
12241 postgres  20   0 4378m 632m 625m S  1.7  2.0   2:48.62 postmaster
12156 apache    20   0  366m  27m  17m S  1.0  0.1   0:05.12 httpd
   36 root      20   0     0    0    0 S  0.3  0.0   0:01.32 events/1
  100 root      39  19     0    0    0 S  0.3  0.0   0:06.04 khugepaged
 9217 postgres  20   0 21976 1036  516 S  0.3  0.0   1:01.07 pgbouncer
12010 apache    20   0  376m  37m  17m S  0.3  0.1   0:07.58 httpd
12280 apache    20   0  370m  30m  16m S  0.3  0.1   0:03.17 httpd
12362 apache    20   0  365m  15m 6816 R  0.3  0.0   0:01.90 httpd
12457 apache    20   0  360m 9.8m 3456 S  0.3  0.0   0:00.14 httpd
    1 root      20   0 19352 1584 1284 S  0.0  0.0   0:01.03 init
    2 root      20   0     0    0    0 S  0.0  0.0   0:00.00 kthreadd

# vmstat 10
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 6  2      0 27323416 196988 3852536    0    0     3   165   15    9 14  0 84  2  0
 1  0      0 27422148 197012 3814860    0    0     0  5284 4784 2104 46  1 51  2  0
 1  0      0 27454748 197020 3826656    0    0     4  1734 2021 1200 16  0 83  1  0
 0  2      0 27514008 197028 3813464    0    0     0   702 1475 1208  8  0 90  2  0
 0  0      0 27465612 197040 3813968    0    0     0  1435 1764 1725 10  0 85  5  0
 1  0      0 27459260 197060 3814248    0    0     0  2032 2667 1304 22  0 76  1  0
 1  0      0 27440076 197064 3827064    0    0     0  1604 3146 2109 27  0 72  1  0
 1  0      0 27466796 197068 3814868    0    0     2  1241 2014 1637 13  0 83  3  0
 4  0      0 27380104 197072 3848256    0    0     0  1064 2375  894 20  0 79  1  0
 1  0      0 27488168 197096 3815296    0    0     0  2075 2697 2220 23  0 75  1  0
 1  0      0 27462168 197116 3821380    0    0     0   871 1750  943 13  0 86  1  0
 4  0      0 27432100 197128 3822320    0    0     0  3980 4767 2340 46  1 53  1  0
 0  0      0 27493716 197132 3815844    0    0     0  1871 3209 2078 27  0 72  1  0
 3  0      0 27424284 197132 3827036    0    0     0  1452 2551 1487 18  0 78  3  0
 3  0      0 27435428 197160 3824116    0    0     0  2066 3430 2082 29  0 70  1  0
 2  0      0 27452004 197172 3817440    0    0     0  1356 2722 1895 23  0 76  1  0
 2  0      0 27436668 197176 3826648    0    0     0  1633 3629 2162 30  0 69  1  0
 1  0      0 27439924 197204 3823124    0    0     0  1502 1786 1293 14  0 86  0  0
 0  0      0 27466696 197212 3816780    0    0     0  1200 1701 1164 13  0 86  0  0
 3  0      0 27432204 197212 3818344    0    0     0  2587 2098 2154 16  0 83  1  0
 2  0      0 27421088 197224 3827224    0    0     0  1229 2635 1421 21  0 75  3  0
 3  0      0 27319136 197232 3832088    0    0    13  2965 4220 1951 40  0 59  1  0

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----

What I've already done:

/var/lib/pgsql/data/postgresql.conf (local connections only)

max_connections = 100
shared_buffers = 4096MB
work_mem = 16M

/etc/php.ini

memory_limit = 300M
[PostgresSQL]
pgsql.allow_persistent = Off    # because I use pgbouncer

/etc/pgbouncer.ini (local connections only too)

max_client_conn = 600
default_pool_size = 80

/etc/httpd/conf/httpd.conf (didn't modify yet):

<IfModule prefork.c>
StartServers      10
MinSpareServers    8
MaxSpareServers   30
ServerLimit      512
MaxClients       512
MaxRequestsPerChild  4000
</IfModule>

Any suggestions please on how to speed up my Linux Apache PostgreSQL PHP (aka "LAPP") server?

I was actually hoping that Linux would use the additional memory for caching disks, but this doesn't seem to happen?

UPDATE:

I've installed iotop and it show PostreSQL doing SELECT's and my Perl daemon (for the Facebook game):

Total DISK READ: 0.00 B/s | Total DISK WRITE: 101.72 K/s
  TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN     IO>    COMMAND
20555 be/4 postgres    0.00 B/s   78.25 K/s  0.00 %  0.28 % postgres: pref pref [local] SELECT
26397 be/4 postgres    0.00 B/s 1674.51 K/s  0.00 %  0.00 % postgres: pref pref [local] SELECT
26392 be/4 apache      0.00 B/s    3.91 K/s  0.00 %  0.00 % httpd
26402 be/4 postgres    0.00 B/s    3.22 M/s  0.00 %  0.00 % postgres: pref pref [local] SELECT
26448 be/4 apache      0.00 B/s   62.60 K/s  0.00 %  0.00 % httpd
26486 be/4 postgres    0.00 B/s    7.82 K/s  0.00 %  0.00 % postgres: pref pref [local] SELECT
26524 be/4 apache      0.00 B/s    3.91 K/s  0.00 %  0.00 % httpd
15392 be/4 nobody      0.00 B/s    3.91 K/s  0.00 %  0.00 % perl -w /usr/local/pref/pref.pl
    1 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % init
    2 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [kthreadd]
    3 rt/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [migration/0]
    4 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [ksoftirqd/0]
    5 rt/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [migration/0]
    6 rt/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [watchdog/0]
    7 rt/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [migration/1]
    8 rt/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [migration/1]
    9 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [ksoftirqd/1]

It seems that disk caching works ok, since the read is always 0 ?

In PostgreSQL 8.4.9 with pgbouncer 1.3.4 in pool_mode = session (but some users connect to the database directly) - when I login as "super user" with

   psql -U postgres -W postgres

What is the command please to disconnect all "normal users" and prevent them from connecting again while I perform maintenance (I'd like to rename some table columns for more consistent naming and correspondingly change some stored procedures).

I can't find it in the III. Server Administration doc.

Or should I edit pg_hba.conf and restart the service/process?

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections?

On CentOS 5 Linux I've tried putting these lines into /etc/sysconfig/iptables:

-A OUTPUT -m owner --uid-owner root -j DROP
-A OUTPUT -m owner --uid-owner apache -j DROP
-A OUTPUT -m owner --uid-owner nobody -j DROP

but unfortunately get the error:

# sudo service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: owner: Bad value for "--uid-owner" option: "apache"
Error occurred at line: 27
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]

I have a non-forking perl script running as a TCP-sockets daemon (this script is a backend for a multiplayer game) in CentOS 5.7. It is being started and respawned by /etc/inittab:

pref:3:respawn:/bin/su -c '/usr/local/pref/pref.pl >/tmp/pref-`date +%a`.txt 2>&1' afarber

It is being restarted every night by the cronjob:

33    1     *     *     *     kill `cat /tmp/pref.pid`

(where the /tmp/pref.pid file is created by the script itself).

This setup has worked well for me since many moons. Now I'm trying to upgrade to CentOS 6.x and have created a new /etc/init/pref.conf file after reading "man 5 init":

start on stopped rc RUNLEVEL=3
stop on starting rc RUNLEVEL=[!3]
console output
respawn
chdir /tmp
exec /bin/su -c '/usr/local/pref/pref.pl >/tmp/pref-`date +%a`.txt 2>&1' afarber

And can start it with

# sudo initctl start pref
pref start/running, process 2590

and also see the script running under user afarber with "ps uawx" and listening at port 8080 (as it should) with "netstat -an".

But my problem is that I can't stop or restart the script (and I need that for the nightly cronjob):

# sudo initctl restart pref
initctl: Unknown instance:

# sudo initctl stop pref
initctl: Unknown instance:

Any ideas please?

(And I don't want to install any 3rd party software, like daemontools/Tivoli/etc. - because I want to be my web server to be easily reinstallable and movable to other hosters).

UPDATE: here is what I see -

# initctl reload-configuration

# initctl list
rc stop/waiting
tty (/dev/tty3) start/running, process 1515
tty (/dev/tty2) start/running, process 1513
tty (/dev/tty1) start/running, process 1511
tty (/dev/tty6) start/running, process 1521
tty (/dev/tty5) start/running, process 1519
tty (/dev/tty4) start/running, process 1517
plymouth-shutdown stop/waiting
control-alt-delete stop/waiting
kexec-disable stop/waiting
quit-plymouth stop/waiting
rcS stop/waiting
prefdm stop/waiting
pref start/running, process 1507
init-system-dbus stop/waiting
splash-manager stop/waiting
start-ttys stop/waiting
rcS-sulogin stop/waiting
serial stop/waiting

# initctl status pref
pref start/running, process 1507

# initctl restart pref
pref start/running, process 2083

# initctl restart pref
initctl: Unknown instance:

# initctl restart pref
initctl: Unknown instance:

UPDATE2:

My script has 2 pecularities:

1) When it gets SIGTERM or SIGINT, it writes some data into PostgreSQL and this takes 10-15 seconds

2) When it is started numerous times, then the subsequent runs will fail immediately, because only the 1st instance will be able to listen at the TCP-port 8080

And in /var/log/messages I see:

...
17:44:25 static init: pref main process ended, respawning
17:44:26 static init: pref main process (2128) terminated with status 98
17:44:26 static init: pref main process ended, respawning
17:44:26 static init: pref main process (2133) terminated with status 98
17:44:26 static init: pref respawning too fast, stopped

is that all maybe the reason and is there something I could do? (maybe somehow delay the subsequent spawns?)

I'm using freshly installed CentOS 5.7 Linux 64 bit with PGDG packages:

# rpm -qa|grep -i PG
postgresql-libs-8.4.8-2PGDG.rhel5
pgdg-centos-8.4-2
postgresql-8.4.8-2PGDG.rhel5
pgbouncer-1.3.4-1.rhel5
postgresql-server-8.4.8-2PGDG.rhel5

and get the following Apache-errors in /var/log/audit/audit.log

type=AVC msg=audit(1316700316.235:41): avc:  denied  { write } for
pid=2748 comm="httpd" name=".s.PGSQL.6432" dev=sda1 ino=754350
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1316700316.235:41): arch=c000003e syscall=42
success=no exit=-13 a0=c a1=2b712748bee0 a2=6e a3=0 items=0 ppid=2721
pid=2748 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48
egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd"
exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

And here are the files in question (PostgreSQL at "port" 5432 and pgbouncer at "port" 6432):

# ls -aZ /tmp/
srwxrwxrwx  postgres postgres system_u:object_r:postgresql_tmp_t .s.PGSQL.5432
-rw-------  postgres postgres system_u:object_r:postgresql_tmp_t
.s.PGSQL.5432.lock
srwxrwxrwx  postgres postgres system_u:object_r:tmp_t          .s.PGSQL.6432

Does anybody please know, how to permanently make the file .s.PGSQL.6432 above of the same postgresql_tmp_t "type" as s.PGSQL.5432 (which probably will solve the problem)?

By looking at the processes I think, that somehow I must move pgbouncer process from initrc_t to postgresql_t:

# ps uawxZ
system_u:system_r:initrc_t      postgres  2610  0.0  0.0  17020   780 ?        S    15:47   0:00 pgbouncer -d /etc/pgbouncer.ini
system_u:system_r:postgresql_t  postgres  2666  0.1  2.4 1192464 25216 ?       S    15:48   0:02 /usr/bin/postmaster -p 5432 -D    /var/lib/pgsql/data
system_u:system_r:httpd_t       root      2721  0.0  1.0 260608 10564 ?        Ss   15:48   0:00 /usr/sbin/httpd
system_u:system_r:httpd_t       apache    2747  0.0  0.9 261632  9728 ?        S    15:48   0:00 /usr/sbin/httpd
system_u:system_r:httpd_t       apache    2748  0.0  0.9 261632  9728 ?        S    15:48   0:00 /usr/sbin/httpd

I have been trying to add 2 PHP extensions to a freshly installed CentOS 6.0 Linux server, but get the error messages in /var/log/httpd/error_log:

[notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/gdchart.so' - /usr/lib64/php/modules/gdchart.so: undefined symbol: php_gd_gdFontMediumBold in Unknown on line 0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/oci8.so' - libnnz11.so: cannot enable executable stack as shared object requires: Permission denied in Unknown on line 0
[notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.2 mod_ssl/2.2.15 OpenSSL/1.0.0-fips mod_wsgi/3.2 Python/2.6.5 mod_perl/2.0.4 Perl/v5.10.1 configured -- resuming normal operations

I did run

# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/oci8.so
# chcon system_u:object_r:lib_t:s0 /usr/lib64/php/modules/gdchart.so
# ls -alZ /usr/lib64/php/modules/

-rwxr-xr-x. root root system_u:object_r:lib_t:s0       curl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       dom.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       fileinfo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gdchart.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       gd.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       json.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       oci8.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pdo_sqlite.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       pgsql.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       phar.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       sqlite3.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       wddx.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlreader.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xmlwriter.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       xsl.so
-rwxr-xr-x. root root system_u:object_r:lib_t:s0       zip.so

Here is how I compiled both modules:

1) For oci8.so - setup /etc/tnsnames.ora and then:

# rpm -Uvh oracle-instantclient11.2-basic-11.2.0.2.0.x86_64.rpm
# rpm -Uvh oracle-instantclient11.2-devel-11.2.0.2.0.x86_64.rpm
# pecl install oci8 (entered: instantclient,/usr/lib/oracle/11.2/client64/lib there)

2) For gdchart.so:

# yum install gd-devel php-devel gcc
# wget http://pecl.php.net/get/gdchart-0.2.0.tgz
# tar xvfz $!
# cd $!
# ./phpize
# ./configure
# make && make install

Does anybody please have an idea, what am I missing?

Using both libs (Oracle instant clicent and GDChart) from commandline works ok.

UPDATE:

When I switch SELinux off by putting SELINUX=permissive into /etc/selinux/config and reboot, the oci8.so loads, but gdchart.so still has a bug.

So I guess my question is: how to enable SELinux back and still being able to use oci8.so? Please share your experience here - if you already struggle with Oracle + PHP + CentOS/RHEL 6.

UPDATE 2:

When starting Apache, I see in /var/log/audit/audit.log:

type=AVC msg=audit(1316698464.300:51213): avc:  denied  { execstack } for  pid=2833 comm="httpd" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:system_r:httpd_t:s0 tclass=process
type=SYSCALL msg=audit(1316698464.300:51213): arch=c000003e syscall=10 success=yes exit=0 a0=7fff95f4b000 a1=1000 a2=1000007 a3=7f5e22611000 items=0 ppid=1 pid=2833 auid=10116 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

I host 4 virtual hosts at a dedicated CentOS 5.6 server:

# rpm -qa|grep http
httpd-2.2.3-45.el5.centos.1

One of them is my Drupal 7.2 site and another was holding static texts and fotos belonging to my wife - here is the excerpt from httpd.conf:

<VirtualHost 85.214.19.116:80>
    DocumentRoot /var/www/html/preferans.de
    ServerName preferans.de
    ServerAlias preferans.de *.preferans.de
    ErrorLog logs/preferans.de/error_log
    CustomLog logs/preferans.de/access_log common
    <IfModule mod_rewrite.c>
        <Directory "/var/www/html/preferans.de">
            RewriteEngine on

            # needed by Drupal 7 for "clean URLs"
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteCond %{REQUEST_FILENAME} !-d
            RewriteCond %{REQUEST_URI} !=/favicon.ico
            RewriteRule ^ index.php [L]
        </Directory>
    </IfModule>
</VirtualHost>

<VirtualHost 85.214.19.116:80>
    DocumentRoot /var/www/html/larissa-farber.de
    ServerName larissa-farber.de
    ServerAlias larissa-farber.de *.larissa-farber.de
    ErrorLog logs/larissa-farber.de/error_log
    CustomLog logs/larissa-farber.de/access_log common
</VirtualHost>

Now my wife has decided to move her files to Tumblr blog service.

As a quick measure I've put the following index.php into her dir:

# cat /var/www/html/larissa-farber.de/index.php
<?php
header('Location: http://larissa-farber.tumblr.com/');
?>

This works ok, but I'd rather use the mod_rewrite to do the redirect (that is - until I figure out how to transfer her web address to Tumblr completely, which should be possible too).

From reading the docs I understand, that I need something like:

RewriteRule ^(.*)$ http://larissa-farber.tumblr.com/$1 [R=301,L]

But where to put it and how to keep my other 3 virtual sites working?

Thank you! Alex

(This is not a promotion of any of the sites above, I'm just too lazy to use fake addresses here and don't see a reason for that).

I run a small multiplayer card game with around 500 users at peak times:

The client is in Flash and the server is in Perl.

The Perl server binds to port 8080, i.e. only 1 instance of it can be started (important detail).

The Perl server poll()s TCP-sockets and forks only once - at the startup by calling this method:

sub daemonize {
    die "Can not fork: $!\n" unless defined (my $child = fork());
    # the parent should die
    exit 0 if $child;

    setsid();
    open(STDIN, '</dev/null');
    open(STDOUT, '>/tmp/pref.txt');
    open(STDERR, '>&STDOUT');
    chdir('/');
    umask(0);
}
....
$tcpSocket = IO::Socket::INET->new(Proto     => 'tcp',
                                   LocalPort => 8080,
                                   Listen    => SOMAXCONN,
                                   ReuseAddr => 1,
                                   );
die "Can not create listening TCP socket: $!\n"
        unless defined $tcpSocket;

It runs on CentOS 5.6 Linux / 64 bit, PostgreSQL 8.4.8 and Perl 5.8.8.

Because my budget is small and I had enough troubles already, I want to use as little additional software as possible - so that I can change hosters or reinstall my cheapo server quickly. That is why I for example just log to /tmp/pref.txt instead of installing syslog-ng. And that is why I'd like to use /etc/inittab for restarting my Perl daemon.

My Perl daemon runs mostly stable, but approx. once a week it can crash with a

May 29 11:06:46 myhost kernel: pref.pl[3113]: segfault at 00007fffa21e6fd8 rip 0000003cce274460 rsp 00007fffa21e6fd0 error 6

Since I'm tired of restarting the server manually, I've tried to add it to the /etc/inittab:

pref:3:respawn:/bin/su -c '/usr/local/pref/pref.pl' nobody

(and I've added a nightly cronjob to "pkill pref.pl" in the hope to refresh perl this way).

Unfortunately this does not work as expected - in the /var/log/messages I see that the script is being started again and again:

Jun  2 18:55:56 myhost init: Id "pref" respawning too fast: disabled for 5 minutes
Jun  2 19:00:58 myhost init: Id "pref" respawning too fast: disabled for 5 minutes
Jun  2 19:06:02 myhost init: Id "pref" respawning too fast: disabled for 5 minutes

What am I doing wrong here? I was hoping to being able to use /etc/inittab here, because I remember using it for a similar situation at work few years ago (also with a Perl daemon) and it worked well then...

Thank you! Alex

UPDATE:

My game is not crashing, perl interpreter does (but not often, once a week).

My question is about how to run a Perl daemon (i.e. a Perl script that forks once in the beginning and then binds to a TCP port) from /etc/inittab?

I'm trying to setup a CentOS 5.5/64 bit VM to access a remote Oracle database with PHP and Perl scripts. (I have no experience with Oracle, have only programmed and administrated some PostgreSQl and MySQL before.)

I've installed the following Oracle Instant Client rpms:

oracle-instantclient11.2-basic-11.2.0.2.0.x86_64.rpm
oracle-instantclient11.2-devel-11.2.0.2.0.x86_64.rpm
oracle-instantclient11.2-sqlplus-11.2.0.2.0.x86_64.rpm

And have added the following variables to my .bash_profile:

export TNS_ADMIN=/etc
export ORACLE_HOME=/usr/lib/oracle/11.2
export LD_LIBRARY_PATH=$ORACLE_HOME/client64/lib
PATH=$PATH:$HOME/bin:/sbin:$ORACLE_HOME/client64/bin

Into the file /etc/tnsnames.ora I've written the infos received from the colleague at the remote site running the Oracle database:

some_string =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = my_address)(PORT = my_port))
    )
    (CONNECT_DATA =
      (SERVICE_NAME = PDTT)
    )
  )

The nice part is that I can connect from CLI now by running

sqlplus 'my_user/my_password@//my_address:my_port/PDTT'

and then can see some tables by issueing:

select table_name from user_tables;

And also I've run sudo pecl install oci8 successfully, added the file /etc/php.d/oci8.ini containing:

extension=oci8.so

and can see the following phpinfo() output

Now my questions and problems please:

1) How should I setup ORACLE_SID variable and how to call sqlplus once it is set? Can/should I use ORACLE_SID from PHP and Perl scripts?

2) I run sudo -E perl -MCPAN -e shell and it works well when installing other Perl modules, but for "install DBD::Oracle" it fails with:

  CPAN.pm: Going to build T/TI/TIMB/DBD-Oracle-1.26.tar.gz

Using DBI 1.52 (for perl 5.008008 on x86_64-linux-thread-multi) installed in /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/DBI/

Configuring DBD::Oracle for perl 5.008008 on linux (x86_64-linux-thread-multi)

Remember to actually *READ* the README file! Especially if you have any problems.

  The ORACLE_HOME environment variable value (/usr/lib/oracle/11.2) is not valid.
  It must be set to hold the path to an Oracle installation directory
  on this machine (or a machine with a compatible architecture).
  For an Instant Client install, the directory should include an sdk subdirectory.
  See the appropriate README file for your OS for more information.
  ABORTED!
Running make test
  Make had some problems, maybe interrupted? Won't test
Running make install
  Make had some problems, maybe interrupted? Won't install

It mentions "sdk" dir above, but the rpm didn't have that dir at all:

# rpm -ql oracle-instantclient11.2-devel | grep -i sdk
#

Thank your for any hints and also any useful tips for Oracle installation and usage. There is lot of Oracle information out there, but it often assumes that Oracle is installed at the same machine.