Calvin Froedge's questions

I'm combining log files from several docker containers on my host and sending them a remote logging service. I'm just redirecting the output to logger and tagging it:

docker-compose logs 2>&1 | logger -t deviant

This is easily configurable via:

*.*  @remote_service:remote_port

However, *.* matches every kind of logs from my host machine, when I only want to send the redirected logs to the remote service.

Here's an example of a log I want to capture:

Apr 08 08:55:04 calvin.local deviant:  proxy_1 | 192.168.59.3 - - [08/Apr/2015:15:55:04 +0000] "stuff here"

Notice it contains calvin.local deviant

The ones containing deviant are the only ones I want. I've tried to specify which log entries like this:

*deviant*

...and restarted logging...but I still see all entries (not just ones tagged deviant) in my remote logs. Why?

Is there a way to show all of the jobs which were completed using the at command? I'm trying to debug a problem related to a command scheduled with at and I don't think it's my application, so I'm wondering if it might be the OS. Thanks!

I've set up an app which builds new websites. I am creating virtual host files automatically when a user signs up.

Is there a "right" way to enable the virtual host and reload apache from the web app or should I delegate that task to a cron job with root privileges? I added www-data to the sudoers folder but I still have a permission denied in my error log.

Ubuntu 11.10 running Apache/Mod_PHP

I've deployed Radius and have no problems connecting with TTLS, PEAP, or MD5 using linux, mac, and windows xp. For Windows 7 and Vista, I'm never prompted with the dialog box to enter username & password after configuring 802.1x support on the client.

Steps taken:

1. Enabled Wired Autoconfig in services.msc
2. Set to use PEAP
3. Set to require user authentication

When I enable the network connection it says "Trying to authenticate" then fails with no error log / message given. The radius server gives no indication that there was ever a request (no Access-Reject - the client simply never tries to authenticate).

On the windows 7 client, I can see that the DHCP server does not assign an IP to the client when 802.1x is enabled on the client (though it does when it isn't).

How can I debug this further? Has anyone else run into a similar situation?

My radius server is freeradius on Ubuntu 11.10.

I have a ZyXel GS2200-24 managed switch, and a free-radius server running on Ubuntu 11.10. Radius is configured and when I log into the switch the authentication goes through Radius.

Now, I'm trying to ensure that access to web resources (as an example, I set up a web server on the ip 192.168.1.2) requires first authenticating with radius, before the switch will allow the connection.

Am I correct that this should be handled at the switch level? What are these rules usually called / how are they usually defined?

I have a radius server set up on a server running Ubuntu 11.04. I have configured my switch to use the authentication server's IP (192.168.1.2) for RADIUS / 802.1x authentication, and I created a connection to test connecting from my Mac OSX client.

Here is my radius configuration for the client:

client 192.168.1.0/16 {
  secret = testing123
}

I can successfully authenticate using both 127.0.0.1 (localhost) and 192.168.1.2 (ip of eth1), so I know radius is getting those requests.

I set up a connection to test from my macbook, and my requests are timing out.

http://screencast.com/t/tMhRLS3H7

Is there a better way to test the radius connection from my macbook? Thanks!

UPDATE: I was able to successfully test on Mac OSX client using RadPerf. This is available as a cross-platform command line tool.

I am attempting to create an authentication system for my network via Radius. Eventually, I want all machines on the network to authenticate with Radius before gaining access to any other network resources, and I want to be able to log the activity of each machine.

For now, baby steps. I have a Linux server running Ubuntu which is connected to a TP-LINK unmanaged switch. Connected to a TP-LINK unmanaged switch (could this be a problem for me later?), I have a server running Ubuntu with RADIUS successfully installed and radtest working on localhost, a windows laptop running vista, and a Macbook pro.

The switch assigns each machine an IP like this: 169.254.108.110. At least between the Macbook pro and the Ubuntu server, they can ping each other. Now, how would I authenticate with Radius on my Ubuntu server from my Macbook pro?

This is going to be a somewhat loaded question. I am programming in a company that has been around since 1962. A lot of things, especially computer / network stuff, is very dated. Let me give a bit more background.

The company already operates a Windows server. On the server, many computers have files in shared network drives, and there are some programs too. This is how company wide access to things like accounting and inventory is granted, and how files are shared. Unfortunately, there has never been a strong sysadmin play a part in any of the design. The accounting system is running on Foxpro. Files are totally chaotic. The employees seem to know their way around in general, but in order to grow and scale, we need to quickly get a handle on this network. Some of the things I see a need for:

• A relational database, accessible via all computers on the network which will store:
  • Files (ie drawings, quotes, pictures of completed projects, etc.)
  • Employees (then we can start doing things like computerized time card entry)
  • Invoices, Payments Receivable and Inventory
  • Password management
  • Job tracking

I'd like to build custom applications on top of this database to power everything, and build APIs that allow our websites to interact with our in-house stuff. Obviously I must leave existing systems intact as I build new ones. I'm coming from a web background...and am very comfortable with Unix (I've administered dozens of servers that serve websites), PHP, and front end development. I'd like to stick with those open source technologies I already know well.

The biggest question in my mind is where to start. Do I buy a server rack and just start building a totally new network? Do I push everyone to the new network once ready, or try to use both at the same time somehow and slowly migrate away from the old?

I realize this could be a project that takes a year or more. I'd really appreciate some guidance - any resources on system design, how I get started, whatever. I'm willing to put in the work - I just need help creating a vision.

I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background...

Our organization has several ecommerce sites. All of these sites are running on the same IP, using SNI for name based virtual hosts. In most cases, this is working great. However, in some browsers (ie7 / ie8, but only on select machines for some reason), we got reports that users were seeing a domain mismatch with the SSL certificate. It turned out that they were seeing the SSL certificate for the first SSL host in alphabetic order, since Apache resolves the IP address first, THEN grabs what it thinks is the right virtual host file.

I did some experimenting with the SSL protocol and found that if I set it thusly (ssl.conf):

SSLProtocol TLSv1

Then I'd simply get a not found for any of the https domains in IE.

If I set SSLStrictSNIVHostCheck on in ports.conf

SSLStrictSNIVHostCheck on

Then I'd get a permission denied in the problematic browsers.

The problem is obviously that IE is not supporting, or not using, the TLSv1 protocol, or SNI, both of which are needed. So my question is...

Is there a configuration change I can make to support IE, perhaps under a different protocol, or is my only option using a separate IP for each virtual host which requires SSL?

Thanks in advance = )

Prompted from a question about MySQL server security best practices, I've been running through this list (with a few minor alterations) to properly secure my server database server:

http://www.greensql.net/publications/mysql-security-best-practices

On step 10, I'm told to change the root directory for the mysql user using chroot, but very few specifics are provided and I'm not sure where to start. Does anyone know of a good resource for walking me through the steps to properly create a chrooted environment for Ubuntu 10.10?

Here's the use case:

I have a SaaS system that was built (dev environment) on a single box. I've moved everything to a cloud environment running Ubuntu 10.10. One server runs the application, the other runs the database. The basic idea is that the server that runs the database should only be accessible by the application and the administrator's machine, who both have correct RSA keys.

My question:

Would it be better practice to use a firewall to block access to ALL ports except MySQL, or skip firewall / iptables and just disable all other services / ports completely? Furthermore, should I run MySQL on a non-standard port? This database will hold quite sensitive information and I want to make sure I'm doing everything possible to properly safeguard it.

Thanks in advance. I've been reading here for a while but this is the first question that I've asked. I'll try to answer some as well = )