I am busy setting up new k8s cluster.
I am using rke with the --max-pods: 200
kubelet: # https://rancher.com/docs/rke/latest/en/config-options/services/services-extras/#extra-args
extra_args:
- max-pods: 200 # https://forums.rancher.com/t/solved-setting-max-pods/11866/5
How do I check if the running node has been created with the correct settings.
We are looking for a way to use http2, one proxy with SSL termination and multiple different backends for different subdomains.
I found this explanation of the problem and I am looking for solutions that would work for haproxy. Which would probably work for other proxies as well.
The problem you ran into is caused by "Connection coalescing".
For example, if a browser (Chrome/Firefox) connects to an http2 server "a.example.org" which resolves to 192.168.2.1 and later connects to "b.example.org", it checks 2 things:
1. Do DNS entries match? This will always be the case since our proxy only has one IP.
2. Has a.example.org provided a certificate that also matches b.example.org. (e.g. wildcard or multidomain cert).
If both are the case it will not initiate a second connection but instead reuse the existing connection to host a.example.org.
This is fine in theory but due to the use of sniproxy a.example.org is unable to handle b.example.org because they are in reality, two different hosts.
One way the solve this should be the use of different certs that only cover a single domain (e.g. no wildcard).
I have not tested it but I think it might work.
Is there a way to force our proxy 'haproxy' to check existing connections and confirm that domain, subdomain are correct for the backend that the connection is actually being sent to.
We have tried changing timeout values, using force
option http-server-close
option forceclose
Nothing works the way we would like. Connection to subA.domain.com and then connecting to subB.domain.com fails as they are set up on two different backends. The browser resues the same connection and for two different backends.
I am trying to connect to local mysql server I use for development
The server starts fine, but I can not connect to it as a non-root user.
[root@somepc ]# mysql -u [someuser] -p[somepass]
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13 "Permission denied")
As root, this works as expected. So that user does have permissions to access mysql.
mysql -u [user] -p[password]
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 10.1.30-MariaDB MariaDB Server
Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
When I check the permission of as my user
stat /var/lib/mysql/mysql.sock
stat: cannot stat '/var/lib/mysql/mysql.sock': Permission denied
What should these permission be for a non-root user?
When I try the following in my manifest.
$profile = hiera('duplicity::profile', 'test123')
file { [ "/tmp/${profile}" ]:
ensure => directory,
owner => root,
group => root,
}
I have the following defined in the heira for that node
duplicity::profile:
- 'testfails'
Which creates folders like this
find /tmp/\[testfails\]
/tmp/[testfails]
Why is it adding the brackets into the folder name?
After upgrading some of the php libraries on our server phpmyadmin failed to load.
I see the following error on my web browser when trying to access browser
phpMyAdmin - Error
Cannot start session without errors, please check errors given in your PHP and/or webserver log file and configure your PHP installation properly.
This is the error I see in the log files.
tail -f /var/log/nginx/phpmyadmin/error.log
2015/09/16 12:54:13 [error] 9103#0: *21314 FastCGI sent in stderr: "PHP message: PHP Notice: Undefined property: PMA_Error::$_hash in /usr/share/phpMyAdmin/libraries/Error.class.php on line 164
PHP message: PHP Notice: Undefined property: PMA_Error::$_params in /usr/share/phpMyAdmin/libraries/Message.class.php on line 495
PHP message: PHP Fatal error: Class 'PMA_Message' not found in /usr/share/phpMyAdmin/libraries/Message.class.php on line 601" while reading upstream, client: 123.456.789.123, server: server12-admin.smokeccs.com, request: "GET /index.php?token=b07fa5dd143c2c9ec26042ee527121ba HTTP/1.1", upstream: "fastcgi://unix:/tmp/php5-fpm.sock:", host: "server12-admin.smokeccs.com", referrer: "http://server12-admin.smokeccs.com/index.php?token=96f06e54e731f866b4b22f8abd46b7c2"
Our server details
Server: Localhost via UNIX socket
Server type: Percona Server
Server version: 5.6.22-71.0 - Percona Server (GPL), Release 71.0, Revision 726
Protocol version: 10
User: root@localhost
Server charset: UTF-8 Unicode (utf8)
nginx/1.6.2
Database client version: libmysql - 5.1.73
PHP extension: mysqli Documentation
Phpmyadmin version
Version information: 4.0.10.8, latest stable version: 4.4.14.1
When setting up vsftpd we have problems with it not providing a trusted connection us a basic pem certificate container using just our private key and certificate.
We created our pem file with the following commands.
cat somecert.com.crt >> somepem.pem
cat somecertkey.com.key >> somepem.pem
/etc/vsftpd/vsftpd.conf
ssl_enable=YES
ssl_tlsv1=YES
rsa_cert_file=/etc/httpd/ssl/somepem.pem
When connecting using lftp in debug mode I saw that we giving a certificate with out enough info to be establish the full chain of authority. To ensure it was trusted.
lftp -d -u user:pass myserver.com
....
ERROR: Certificate verification: Not trusted
**** Certificate verification: Not trusted
---- Closing control socket
I am trying to connect to my oracle database. I can't get the listener started. Here is what I have tried.
$ lsnrctl start
LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 20-JAN-2012 08:19:58 Copyright (c) 1991, 2007, Oracle. All rights reserved. Starting /u01/app/oracle/product/10.2.0/db_1/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 10.2.0.4.0 - Production Log messages written to /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log Error listening on: (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)) TNS-12545: Connect failed because target host or object does not exist TNS-12560: TNS:protocol adapter error TNS-00515: Connect failed because target host or object does not exist
$ cat ./admin/tnsnames.ora
# TNSNAMES.ORA Network Configuration File:
# /u01/app/oracle/product/10.2.0/db_1/network/admin/tnsnames.ora
#
EXTPROC_CONNECTION_DATA.test =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC))
)
(CONNECT_DATA =
(SID = DEVDB)
(PRESENTATION = RO)
)
)
DEVDB =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
)
(CONNECT_DATA =
(SERVICE_NAME = DEVDB.test)
)
)
DEBDB.test =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = DEVDB.test)(PORT = 1521))
)
(CONNECT_DATA =
(SERVICE_NAME = DEVDB.test)
)
)
$ hostname
test
Here is an example of a successful start on an other machine with similar set up. No listner.ora file just tnsnames.ora.
$ lsnrctl start LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 20-JAN-2012 11:38:51 Copyright (c) 1991, 2007, Oracle. All rights reserved. Starting /u01/app/oracle/product/10.2.0/db_1/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 10.2.0.4.0 - Production Log messages written to /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracletest)(PORT=1521))) Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521)) STATUS of the LISTENER ------------------------ Alias LISTENER Version TNSLSNR for Linux: Version 10.2.0.4.0 - Production Start Date 20-JAN-2012 11:38:51 Uptime 0 days 0 hr. 0 min. 0 sec Trace Level off Security ON: Local OS Authentication SNMP OFF Listener Log File /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log Listening Endpoints Summary... (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracletest)(PORT=1521))) The listener supports no services The command completed successfully
On centos 5.7 the default Apache / httpd install has a number of modules enabled by default. Should I disable all the modules and only enable the bare minimum of modules that we need.
Will that improve performance and security.
We are running this server as a production server serving a blog / forum / etc as virtual hosts.
Here is the list of modules enabled by default.
LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule auth_digest_module modules/mod_auth_digest.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_alias_module modules/mod_authn_alias.so LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_default_module modules/mod_authn_default.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_dbm_module modules/mod_authz_dbm.so LoadModule authz_default_module modules/mod_authz_default.so LoadModule ldap_module modules/mod_ldap.so LoadModule authnz_ldap_module modules/mod_authnz_ldap.so LoadModule include_module modules/mod_include.so LoadModule log_config_module modules/mod_log_config.so LoadModule logio_module modules/mod_logio.so LoadModule env_module modules/mod_env.so LoadModule ext_filter_module modules/mod_ext_filter.so LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule expires_module modules/mod_expires.so LoadModule deflate_module modules/mod_deflate.so LoadModule headers_module modules/mod_headers.so LoadModule usertrack_module modules/mod_usertrack.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule mime_module modules/mod_mime.so LoadModule dav_module modules/mod_dav.so LoadModule status_module modules/mod_status.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule info_module modules/mod_info.so LoadModule dav_fs_module modules/mod_dav_fs.so LoadModule vhost_alias_module modules/mod_vhost_alias.so LoadModule negotiation_module modules/mod_negotiation.so LoadModule dir_module modules/mod_dir.so LoadModule actions_module modules/mod_actions.so LoadModule speling_module modules/mod_speling.so LoadModule userdir_module modules/mod_userdir.so LoadModule alias_module modules/mod_alias.so LoadModule rewrite_module modules/mod_rewrite.so LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_connect_module modules/mod_proxy_connect.so LoadModule cache_module modules/mod_cache.so LoadModule suexec_module modules/mod_suexec.so LoadModule disk_cache_module modules/mod_disk_cache.so LoadModule file_cache_module modules/mod_file_cache.so LoadModule mem_cache_module modules/mod_mem_cache.so LoadModule cgi_module modules/mod_cgi.so LoadModule version_module modules/mod_version.so
why do files need to be world readable for Apache to server them?
I would think that if they are owned buy the Apache user or group. And the files are readable and executable that would allow Apache to server the files.
How are request to Apache handled. Are they assigned user guest or nobody, or does Apache own the requests.
Any documentation, other then the basic how to change user groups and permission would be nice. My problem is not changing permission but understanding how requests are handled and why the files need to be world readable.