I am trying to make a MariaDB slave instance read only. From what I understand, read_only option is not truly readonly as users with super privilege can still write to the database.
super_read_only is not yet supported by MariaDB, but there is an open feature request for it.
I also came across innodb_read_only. But innodb_read_only is set to OFF, even when I add -innodb-read-only=1 to mysqld arguments.
Is innodb_read_only allowed on a slave server?
Is it possible to whitelist a wildcard domain in dnsmasq with rebind-domain-ok?
I tried the following, but it did not work
rebind-domain-ok=/.example.com/
I am using php-fpm with PrivateTmp enabled. I have to read a file from PHP, which is copied by a remote deployment agent to the /tmp directory. Since PrivateTmp is enabled, I am unable to directly access /tmp directory.
Is it possible to read a file from the system /tmp folder when PrivateTmp is enabled? I tried creating a symbolic link to /tmp at /var/temp and accessing the file through /var/temp, but it did not work. /var/tmp is currently bind mounted from /tmp, and I also tried accessing the file through /var/tmp without any success.
I have StatsD daemon running on a remote server (x.x.x.x) at 8125. I would like to forward 127.0.0.1:8125 to x.x.x.x:8125.
I have already tried running the following on localhost
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p udp --dport 8125 -j DNAT --to x.x.x.x:8125
iptables -t nat -A OUTPUT -p udp --dport 8125 -j DNAT --to-destination x.x.x.x:8125
iptables -t nat -A POSTROUTING -d x.x.x.x -j MASQUERADE
But it is not forwarding correctly.
echo "test.test.test:1|c" | nc -w 1 -u localhost 8125
Fails with error nc: Write error: Connection refused
echo "test.test.test:1|c" | nc -w 1 -u 127.0.0.1 8125
Fails without any error
echo "test.test.test:1|c" | nc -w 1 -u x.x.x.x 8125
Works correctly
Also, will such a port forwarding cause any security issues?
I am seeing a huge number of connections from a single IP.
# netstat -alpn | grep :80 | grep 92.98.64.103
tcp 0 0 my.ip.address.x:80 92.98.64.103:45629 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:44288 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:48783 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:40531 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:54094 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:47394 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:43495 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:55429 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:42993 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:49542 TIME_WAIT -
tcp 0 0 my.ip.address.x:80 92.98.64.103:54812 TIME_WAIT -
There are 419 such lines. But I see only 1 request from 92.98.64.103 in my access log. Is this DoS attack?
UPDATE - 419 Connections are from a single IP. There are several such IPs with over 100 connections.
The normal RAM usage of my server is around 2-3 GB. But at that time it was using 15GB RAM.
root@mars [~]# netstat -alpn | grep ':80 .*TIME_WAIT' | wc -l
6728
UPDATE 2 - TIME_WAIT increased to over 10000 in a few seconds
root@mars [~]# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
1 established)
1 Foreign
4 CLOSE_WAIT
9 FIN_WAIT2
34 LAST_ACK
39 SYN_RECV
44 LISTEN
45 CLOSING
68 FIN_WAIT1
128 ESTABLISHED
10261 TIME_WAIT
But the web server is loading fine without any problem.
What effect can a latency of 100 ms have on a page load time? If a 100 KB file is served from two locations with latencies of 100ms and 200ms respectively, will the difference in load time be just 100ms, or will the second request take double the time to load (assuming that the networks are equally optimized, and all other network parameters are the same)?
Apache on a production server of mine is seg faulting intermittently. I have enabled core dump option in apache configuration and have several dumped core files. Unfortunately, since it is a production server, apache or the loaded modules are not compiled with debug symbols. From what I understand, gdb cannot do much without debug symbols.
Can I at least find out which module is causing the seg fault, without debug symbols? If so, how?
Following is the output from a gdb backtrace
(gdb) bt full
#0 0xb7f1f832 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
No symbol table info available.
#1 0xb7be82bc in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
No symbol table info available.
#2 0xb771652a in ?? () from /usr/local/apache/modules/mod_pagespeed.so
No symbol table info available.
#3 0xb75df576 in ?? () from /usr/local/apache/modules/mod_pagespeed.so
No symbol table info available.
#4 0xb7715c20 in ?? () from /usr/local/apache/modules/mod_pagespeed.so
No symbol table info available.
#5 0xb7be4a49 in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#6 0xb7b2a63e in clone () from /lib/libc.so.6
No symbol table info available.
Does this mean that /lib/ld-linux.so.2 is causing the seg fault?
I have installed varnish on my server and would like to test the configuration without affecting normal usage. I have apache listening on port 80 and varnish on port 8080. So, I want all requests from my IP a.b.c.d to pass through varnish and all the other IPs should be allowed to access apache normally.
I read somewhere that it is possible to use PREROUTING in Iptables to achieve this. Can some one please tell me how to do it? I have 2 sites hosted on the server, is it possible to configure this for just one domain?
Update
I tried the command, but it did not work
root@git:~# iptables -A PREROUTING -t nat -i venet0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@git:~# iptables -A PREROUTING -t nat -i venet0:0 -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
Warning: weird character in interface `venet0:0' (No aliases, :, ! or *).
root@git:~# iptables -A PREROUTING -t nat -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
root@git:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I am on a VPS and do not have an interface named eth0. /sbin/ifconfig lists lo, venet0, venet0:0, venet0:1 and venet0:2 only.
Update 2 - Inserting the rule at the beginning worked
iptables -t nat -I PREROUTING -p tcp -s 117.201.192.67 --dport 80 -j REDIRECT --to-port 8000
Is it possible to check the requested hostname too? I would like to redirect only requests for mydomainname.com