Kornel's questions

I have a virtual server (Debian 8.5, OpenVZ) that seems to run out of memory* when tmpfs-based /tmp is about 60% full.

(* while the system reports 2GB of memory still free, processes start to behave erratically, /tmp writes fail with ENOSPC, forking fails with ENOMEM, some connections drop with ENOBUFS, and eventually sshd starts closing connections during handshake).

Is this normal for tmpfs, or is my system somehow horribly misconfigured?

Can it be fixed by shrinking size of /tmp?

How can I resize /tmp if it's not in /etc/fstab?

Filesystem         Size  Used Avail Use% Mounted on
/dev/ploop25777p1  150G   19G  126G  13% /
devtmpfs           2.0G     0  2.0G   0% /dev
tmpfs              2.0G     0  2.0G   0% /dev/shm
tmpfs              2.0G   17M  2.0G   1% /run
tmpfs              5.0M     0  5.0M   0% /run/lock
tmpfs              2.0G     0  2.0G   0% /sys/fs/cgroup
tmpfs              2.0G   68K  2.0G   1% /tmp
none               2.0G     0  2.0G   0% /run/shm

proc  /proc       proc    defaults    0    0
none  /dev/pts    devpts  rw,gid=5,mode=620    0    0
none  /run/shm    tmpfs   defaults    0    0

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust".

The GTE CyberTrust cert has been removed from Debian, but the second one is still present in /etc/ssl/certs/Baltimore_CyberTrust_Root.pem.

$ curl https://us12.api.mailchimp.com
curl: (60) SSL certificate problem: unable to get local issuer certificate

What do I need to configure to be able to securely connect to these hosts system-wide?

(i.e. not just by overriding CAs for that one curl command, but to make it work by default for everything that uses openssl).

Dump from openssl client:

# openssl s_client -showcerts -connect us12.api.mailchimp.com:443
CONNECTED(00000003)
depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=GA/L=Atlanta/O=ROCKET SCIENCE GROUP/OU=Rocket Science Group/CN=*.api.mailchimp.com
   i:/C=NL/L=Amsterdam/O=Verizon Enterprise Solutions/OU=Cybertrust/CN=Verizon Akamai SureServer CA G14-SHA2
-----BEGIN CERTIFICATE-----
MIIFiDCCBHCgAwIBAgIURuinjSOLVC8VmOwDrapM4UemZC4wDQYJKoZIhvcNAQEL
…
ThF6LGDwvnUlPM6iio2H+pgS50ji0zgr317n0w==
-----END CERTIFICATE-----
 1 s:/C=NL/L=Amsterdam/O=Verizon Enterprise Solutions/OU=Cybertrust/CN=Verizon Akamai SureServer CA G14-SHA2
   i:/C=IE/O=Baltimore/OU=CyberTrust/CN=Baltimore CyberTrust Root
-----BEGIN CERTIFICATE-----
MIIFHzCCBAegAwIBAgIEByekazANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJ
…
t8SjWfUWbF8+aVWAOfZ1UBQ+Mg==
-----END CERTIFICATE-----
 2 s:/C=IE/O=Baltimore/OU=CyberTrust/CN=Baltimore CyberTrust Root
   i:/C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root
-----BEGIN CERTIFICATE-----
MIIEFTCCA36gAwIBAgIEByeO7TANBgkqhkiG9w0BAQUFADB1MQswCQYDVQQGEwJV
…
pN19+kSElK7XCQQidg9kUTWpJA/5C9sy2sL+wbkqXHonE8qxSDpx0EM=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=GA/L=Atlanta/O=ROCKET SCIENCE GROUP/OU=Rocket Science Group/CN=*.api.mailchimp.com
issuer=/C=NL/L=Amsterdam/O=Verizon Enterprise Solutions/OU=Cybertrust/CN=Verizon Akamai SureServer CA G14-SHA2
---
No client certificate CA names sent
---
SSL handshake has read 4444 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: CF5113EEB4AB191102C390311AAB919079CEDADD0E752BA60912317744FA12D4
    Session-ID-ctx:
    Master-Key: 89CE1A43C195D0175818D739E20E7484132F971C642BBB5AC11D0685E8494658BB8D574BCFBFFC26486EFF10DCE4E258
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 61 b6 3d 3e 95 8a de 3c-18 e9 c0 47 3b 0a 53 ea   a.=>...<...G;.S.
    0010 - a5 8c fb dc 66 6c 87 b1-2e 2b ca 93 20 2f 1e 77   ....fl...+.. /.w
    0020 - 81 e9 1c 45 ca d2 dd 8e-2d cb aa 86 00 c7 26 4a   ...E....-.....&J
    0030 - 2d 77 af 24 2f ea 33 64-f2 92 c0 da c1 49 72 47   -w.$/.3d.....IrG
    0040 - 44 b3 fe 4c 74 4d e7 7b-61 69 4e 16 69 5c 11 d1   D..LtM.{aiN.i\..
    0050 - a0 7c eb a3 04 71 8e 54-b8 00 7b e0 92 61 7c e1   .|...q.T..{..a|.
    0060 - 28 ee 73 f3 ac 04 54 5c-60 d0 95 fe 4a 79 fc 39   (.s...T\`...Jy.9
    0070 - 58 bd e9 3a 10 7f 18 58-50 9f 13 1b 56 20 70 91   X..:...XP...V p.
    0080 - 68 fa 3e 21 52 e4 5c 4f-03 8f 15 ec 7f be b0 ad   h.>!R.\O........
    0090 - 3c fe 35 2d 32 ef 9f dd-cd 06 8e 8a a7 8f af 59   <.5-2..........Y

    Start Time: 1461151140
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)

I accidentally installed zabbix-frontend-php that pulled apache2 as a dependency.

I don't want to use either, and I want to completely delete both packages.

Unfortunately, it seems that apt-get won't let me remove zabbix until I make apache2 work properly for zabbix. I really don't want to spend time fixing broken packages I'm about to delete.

How can I override apt-get and proceed with deletion?

$ apt-get remove apache2 zabbix-frontend-php
Package 'apache2' is not installed, so not removed
The following packages were automatically installed and are no longer required:
  apache2-bin apache2-data
Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:
  zabbix-frontend-php
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 28.2 MB disk space will be freed.
Do you want to continue? [Y/n]
(Reading database ... 28117 files and directories currently installed.)
Removing zabbix-frontend-php (1:2.4.7-1+jessie) ...
Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.
invoke-rc.d: initscript apache2, action "restart" failed.
dpkg: error processing package zabbix-frontend-php (--remove):
 subprocess installed post-removal script returned error exit status 1
Errors were encountered while processing:
 zabbix-frontend-php
E: Sub-process /usr/bin/dpkg returned an error code (1)

Is it possible to make xargs use only newline as separator? (in bash on Linux and OS X if that matters)

I know -0 can be used, but it's PITA as not every command supports NUL-delimited output.

I hate when bash gives me "duh!" kind of error:

foo$ ./bar
-bash: ./bar: is a directory

I used to love AmigaOS shell in which "execution" of a directory simply meant setting it as the current directory:

foo$ ./bar
bar$ 

Is it possible in bash? (without infinite number of aliases of course.)

I'd like to redirect all spams (that weren't rejected outright) to mailbox of local user spam (i.e. deliver mail to spam user rather than to original local recipient).

I'm using sa-exim (exim 4 + spamassasin 3.2) on Debian (it's got its own exim4.conf.template convoluted config).

I've tried adding the following router (before exim's real_local):

 spams:
  debug_print = "R: spams $local_part@$domain"
  driver = redirect
  condition = ${if def:h_X-Spam-Flag {1}{0}}
  allow_fail
  allow_defer
  check_local_user
  domains = +local_domains
  data = spam@localhost

but it doesn't seem to be triggered at all.

Is there efficient and easy way to use IP blacklist (like this one, but perhaps 2-3 times larger, which can't be simplified to CIDRs much) to deny access to a web server (either lighttpd or Apache) using standard/userspace software (no kernel recompilation) on Linux?

AFAIK Deny rules in Apache config and iptables have linear lookup time. There are kernel modules that efficiently handle large lists of IPs, but installation of those requires patching of the kernel.