bMon's questions

I have root ssh logins disabled on my server, but I currently want to back up some files owned by root onto my my local box.

I am trying to figure out a way to use SCP to retrieve files while logged in via SSH without running a ssh daemon on my local box - and without installing any additional tools.

Just wondering if this is possible? I don't think it is..

The only method I can think of is to run a script that logs in via a user account then su's to root, then copies -- but I am trying to avoid this because I don't wish to hardcode my root pw into a script file on my local machine.

My goal: have a server (debian) on a private lan that provides tftp booting to any client machines plugged into the switch that the server is connected to - the server doesn't need outside Internet access, it will only be used for serving up different iso's to the connecting client machine (for os loads). The server is the router, dhcp server, and tftp server (not using a physical router).

Currently I have isc-dhcp-server, tftpd-hpa, nfs-kernel-server all installed and configured on my debian server.

I have it working when I have the mac address of the client machine hardcoded into the dhcpd.conf:

group {
  next-server 10.10.10.1;
  host tftpclient {
     hardware ethernet [client mac here]
     filename "pxelinux.0"
  }
}

But without the hardware ethernet line my clients won't properly pxe boot, I get the error:

PXE-E53: no boot filename received.

I am wondering how to configure this to not require hardcoding the mac addresses. I can provide any other config files upon request if need for problem solving.

My LAMP webserver started lagging while serving up pages. After poking around I noticed iptables -L was taking a good 2-5 seconds to complete - I'm used to this happening a lot quicker.

So I restarted iptables and it fixed my lag problem.

Question: is it bad practice to restart iptables on a regular basis?

I know it disables the firewall so I'm unprotected for a matter of seconds, but it seems that after about a week of running time the iptables -L command tends to take longer and longer to execute. So I figured a weekly cron would suffice, but wanted to know if this was a bad idea. Instead there may be a iptables specific conf option I should be setting instead?

I have a web server that also is my mail server - running dovecot and exim4. I currently have 5 open ports that have to do with serving mail, it seems very excessive to me. Its a dedicated box, I have root access - and most importantly I have control over everyone who receives mail from the box - so I can tell them to configure their mail clients any which way I prefer.

25/tcp    open     smtp
110/tcp   open     pop3
143/tcp   open     imap
993/tcp   open     imaps
995/tcp   open     pop3s

Questions:

What is the most secure way to serve mail?

Can I close ports 110 and 143, and just tell everyone to set their clients to receive on 993 and 995?

Is the mail served out of 993/995 fully encrypted, ie: not able to be eaves-dropped?

I have a web server, port 53 is open for DNS. I am getting thousands of lines in my /var/log/messages that look like:

Jan 27 08:34:21 server named[14051]: client 77.88.26.1#5335: query (cache) 'www.bpharma.in/A/IN' denied

Jan 27 08:34:23 server named[14051]: client 77.88.16.112#52035: query (cache) 'www.bpharma.in/A/IN' denied

Jan 27 08:34:24 server named[14051]: client 77.88.16.112#63885: query (cache) 'bpharma.in/A/IN' denied

Jan 27 08:59:17 server named[14051]: client 66.249.71.24#52367: query (cache) 'maheshwar.in/A/IN' denied

Jan 27 08:59:25 server named[14051]: client 66.249.71.27#47186: query (cache) 'maheshwar.in/A/IN' denied

I am just wondering if this is normal, and if not what should I do about it?

I have a single SBS 2003 that is a domain controller, and file server, MSSQL db's, and some other things. I am looking for a back up solution (local to external HDD) in the situation where the server crashes.

Is there a build in full system back up tool that can be scheduled? If so is it any good? Is restoring from it painless? Are there any other things to consider? Thanks.

I have a clean install of MS SBS 2003 Premium. I installed MSSQL 2000 with SP4. Now I am trying to install CRM 3.0 that requires SQL Reporting Services - but it says its not there.

When I go to Add/Remove programs "Microsoft SQL Server 2000 Reporting Services Standard Edition" is listed.

I read somewhere that if reporting services was installed / set up then there would be a site under IIS names "ReportingServices" (or something along those lines). I do not have those - the only two I don't know are Microsoft SharePoint Administration and SharePoint Central Administration.

Questions: 1. how do I set up reporting services and get it running? 2. are ms sharpoint admin and sharepoint central sites under the IIS related to reporting services?

I have a server running Microsoft SBS 2003 (no exchange). I have IIS installed, and need to get the server address to open a different address opposed to the standard companyweb.

Right now when you navigate to my server on the domain http://crm -- it comes up with the "Welcome to Windows Small Business Server 2003 To get started, click a link." page. But I need it to load a site from Programfiles > CRM > CRM web instead. And also have it accessible on port :5555.

Any help would be appreciated - thanks!

I am doing a fresh install of CRM 3.0.

During the check list of requirements before the set up will continue I am getting the following error:

One more more Microsoft CRM groups do not exist

I figured this installation would set up the groups automatically - guess I was wrong. So after reading the doc's CRM requires 4 groups (PriUserGroup, SQLAccessGroup, UserGroup, ReportingGroup).

So I opened the Active Directory and Added the four groups manually to the domain.local and tried the install again and got the same message.

Any ideas why? I guess I need to put the group in a specify dir under my domain.local (ie: in "MyBusiness" or "MyBusiness/SecurityGroups" etc) but I don't know where or if this is correct.

Thanks.

I have a typically configured dedicated LAMP server running CentOS 5.

I am creating a plan for worst case scenarios - "server dies" any which way.

As of now I have a good back up system going for all users that includes their files databases etc.

My question now is what system information should I capture about the server configuration in order to bring a new server into a matching configuration of the dead one quickly. Things like IP config / DNS setting etc.

I realize there are services that will be unique to my config, but any general static config points to capture would be helpful - as well as where to capture them.

I have a typically configured LAMP server with various web apps running on it.

A few of the web apps require user supplied image upload functionality (as well as a couple WP blogs that need to upload images).

I have tried to tighten my permission security, and I am finding that 767 is the best I can have on my /uploads/ directory.

I've read that 755 or 750 are the best for directories, but my uploads won't take when set with them.

So my question: is 767 safe? Or should I take the time to get under the hood and try to get 755 or 750 working somehow?

I have a LAMP server - on there I have multiple domains. Each domain has its own user, db's, public_htmls/, etc.

I need to access Domain A's database from a web app on Domain B in php.

Currently I just use localhost as my host for all DB connections in my web apps - but now I need to access a DB under a different domain so that obviously won't work.

Not sure if there is server (apache/php/dns) configuration required which would make this question better suited for server fault.

Any ideas?

About every two seconds I am getting:

[Sat Feb 19 19:00:01 2011] [error] [client 69.239.204.217] script '/var/www
/html/forum.php' not found or unable to stat
[Sat Feb 19 19:00:04 2011] [error] [client 69.239.204.217] File does not exist: /var/www/html/404.shtml

..in my /var/log/httpd/error_log file.

Sometimes the request will be for forum_asp.php.

I'm assuming its a bot trying to access insecure forum files, but I'm not so sure since it appears each is a unique IP and not just a few rouge IPs hitting it consecutively. And whois results of the ip's aren't all the classic ISP in Russia or China, they are more end user address (comcast, etc).

Any insight into whats going on here would be appreciated.

Also, any techniques people use to do a "live monitor" of web traffic would be appreciated. Right now I'm doing a:

tail -f error_log

Thanks.

In regards to a website that you want to keep private, in a situation where you can't restrict/allow to ip's for your users and password protection cannot be implemented. But you can have your users use a custom user-agent.

For a first line of defence I am thinking about denying all user-agents and allowing one ambiguous one.

The Apache documentation says:

Access control by User-Agent is an unreliable technique, since the User-Agent header can be set to anything at all, at the whim of the end user.

But I figure in the reverse fashion of denying all and only accepting one it could be quite effective.

My questions are 1.) giving the situation does this seem like a good solution 2.) is there a way for people to figure out which user-agents are allowed on a given server?

I was messing with one of my sites' .htaccess files and got it working as desired. Then I was finished working on it so I moved it to my encrypted container (TrueCrypt). Later on I wanted to change some things so was modifying the .htaccess directly from the encrypted container but couldn't get my .htaccess doing what I wanted - I kept getting the 403 Forbidden.

So finally after convincing myself there were no errors in my code, I created a blank .htaccess and uploaded it from my encrypted mount and was still getting the Forbidden. Then finally created an empty .htaccess from a non-encrypted location and boom, it worked and the site responded as expected.

One last thing I did was move the working/empty .htaccess from non-encrypted location to my TrueCrypt mount and after uploading it was breaking again.

My question is what am I missing? Is this expected behaviour? Perhaps a bug? Any insight would be appreciated, thanks.

EDIT: I just tested uploading a different type of file from the encrypted mount (index.html) and as expected it failed as well. So this is less of a .htaccess question and more of a truecrypt / webserver question.