amateur barista's questions

While attempting to clone a remote Git repo using SSH I got the following error:

git clone user@remote-repo:project.git .
remote: Counting objects: 187444, done.
remote: Compressing objects: 100% (73430/73430), done.
client_loop: send disconnect: Broken pipe.06 MiB | 4.04 MiB/s
fetch-pack: unexpected disconnect while reading sideband packet
fatal: early EOF
fatal: index-pack failed

My environment has the following Specs:

• WSL2 (Windows Subsystem 4 Linux)
• git --version git version 2.30.1

The git package can be found here https://pkgs.alpinelinux.org/package/edge/main/x86_64/git

uname -a
Linux 4.19.128-microsoft-standard #1 SMP Tue Jun 23 12:58:10 UTC 2020 x86_64 Linux

2021-03-09-07:11AM wsl@Alpine:~$ more /etc/issue
Welcome to Alpine Linux 3.10
Kernel \r on an \m (\l)

I've got no clue why is this happening. Is it a bursting or kernel configuration issue on Alpine? WSL? I doubt it's the remote host. The remote host works fine for SSH, as well as cloning for every non-WSL user.

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while tailing the auth.log (log sample below). As you can see, there is no IP information for this incoming SSH connections. What is the best way to trace the IP address for incoming SSH connections?

Aug 10 14:30:04 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:04 ps2000 suexec: (pam_unix) session closed for user root_bar
Aug 10 14:30:06 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:06 ps2000 suexec: (pam_unix) session closed for user root_bar
Aug 10 14:30:08 ps2000 CRON[16879]: (pam_unix) session closed for user root_bar
Aug 10 14:30:14 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:14 ps2000 suexec: (pam_unix) session closed for user root_bar
Aug 10 14:30:16 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:16 ps2000 suexec: (pam_unix) session closed for user root_bar
Aug 10 14:30:27 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:27 ps2000 suexec: (pam_unix) session closed for user root_bar
Aug 10 14:30:39 ps2000 suexec: (pam_unix) session opened for user root_bar by (uid=999)
Aug 10 14:30:39 ps2000 suexec: (pam_unix) session closed for user root_bar

Disclaimer: servername, and all user information has been changed for security reasons.

Correction: The question "Tracing incoming SSH connections" has been properly answered by the posters below. The message suexec (pam_unix) session does not necessarily indicate any sshd activity as clarified by @aseq, and I posted this as a sshd question due to my ignorance. Since the original question, and it's answers are helpful, I'm accepting the most helpful answer. I think tracing suexec: (pam_unix) session is the candidate for a separate question.

Final update: I discovered that the messages above did have to do with sshd. After doing some tweaks in /etc/pam.d/common-auth I started seeing lines such as

Aug 10 16:45:23 candy_bass sshd[427]: (pam_unix) session opened for user summer_flag by (uid=0)
Aug 10 16:45:23 candy_bass sshd[427]: PAM pam_parse: expecting return value; [...sucess=1 default=ignore]
Aug 10 16:45:23 candy_bass sshd[427]: PAM pam_parse: expecting return value; [...sucess=1 default=ignore]
Aug 10 16:45:23 candy_bass sshd[427]: Accepted publickey for summer_flag from xxx.zzz.yyy.abc port 35964 ssh2
Aug 10 16:45:23 candy_bass sshd[427]: (pam_unix) session opened for user summer_flag by (uid=0)
Aug 10 16:45:23 candy_bass pam_limits[427]: setrlimit limit #11 to soft=-1, hard=-1 failed: Operation not permitted; uid=0 euid=0
Aug 10 16:45:23 candy_bass pam_limits[427]: setrlimit limit #12 to soft=-1, hard=-1 failed: Operation not permitted; uid=0 euid=0
Aug 10 16:45:23 candy_bass sshd[427]: (pam_unix) session closed for user summer_flag

So this is related to sshd, however, since this is so specific to a token-auth vendor (whose name I am not disclosing for privacy), I think this might be better solved by the vendor.

Background: I added OTP token authentication to my web server. I modified the /etc/ssh/sshd_config file with the ForceCommand /token/script command.

Problem: I have a local Jenkins instance connecting to the web server for doing deployments; Jenkins can't enter token info or respond to phone calls (although who knows, I bet there's even a plugin for that!).

Possible solution: use the ~/user/authorized_keys command parameter to force the token script on all keys, except for the key being used by jenkins.

Question: How less secure than the global sshd_config approach the authorized_keys approach is? Would you consider it an acceptable trade-off? Is there a better solution (that allows Jenkins to do slave deployments, whilst keeping everyone else locked down with token auth?).

I've tried both approaches and both work like a charm. The second approach I find more practical in terms of deployments, but it raises some sort of internal red flags for me. I don't know if I'm chasing ghosts (with the red flags). Discuss!

I am trying to update my /etc/apt/sources.list on my VPS. As I run apt-get update I get all kinds of 404s not found, for example:

Failed to fetch http://debian.newdream.net/dists/etch/main/binary-amd64/Packages.gz  404 Not Found
Failed to fetch http://security.debian.org/dists/etch/updates/main/binary-amd64/Packages.gz  404 Not Found [IP: 149.20.20.6 80]
Failed to fetch http://www.ksplice.com/apt/dists/etch/ksplice/binary-amd64/Packages.gz  404 Not Found

As I look into http://www.debian.org/releases/etch/, I don't see any information regarding archives. I am inside archive.debian.org, but I am a little confused as to how to follow it's instructions/modify the sources list. Here's the contents of the current list:

deb http://debian.di.newdream.net/ etch ndn
deb http://www.ksplice.com/apt etch ksplice
deb http://debian.newdream.net etch main non-free contrib
deb http://www.backports.org/debian/ etch-backports main
deb http://archive.debian.org/debian-volatile etch/volatile main contrib non-free
deb http://security.debian.org/ etch/updates main
deb http://debian.dc-uoit.net/debian-multimedia/ etch main

From what I read on the archive README, I was thinking that the format would be something like this:

deb http://archive.debian.org/debian-security dists/etch/updates/ main

Also, after commenting out most, if not all of the lines in the sources file, I still get the same errors. Is there a command that needs to be run to clear the cache?

By default the example Solr application included with version 1.4.1 takes two minutes to process documents sent to the index. I've seen other servers configured to take 3+ minutes. Where can you change change this to zero or 15 seconds?

I have a stage and dev server. I periodically pull the database from stage to local, but not the images due to lack of write permissions on stage. I know that you can write rewrite conditions for pulling all images from a remote location, but is there any way to tell Apache to first look on local, and if not found, then grab the images from remote?

On my Mac OS X, Web Sharing is disabled in System Preferences -> Sharing -> Services -> "Personal Web Sharing". Still, when I type "localhost" in the browser, I get the "It works!" message, meaning that Apache is still running. How do I disable it?

Currently the bundled Apache port 80 is conflicting with my MAMP installation, since I want MAMP to run on 80.

Has anyone used Memcached with IPv6? Can you provide any configuration tips, gotchas, or mention any stability issues you've had?

Their specification draft says they should on section 3.2.1. Are we there yet? Has anyone used Varnish with IPv6?

Have you successfully installed Hudson on a Dreamhost VPS? If you have, what are the steps to make it run continuously, even if the server restarts? They run debian on the servers.

The following excerpt from this post led me to this question:

Cache contention

On a large site, if you are using MyISAM, contention occurs in the database tables when the cache is forced to clear after a node or a comment is added. With tens of thousands of filter text snippets needing to be deleted, the table will be locked for a long period, and any accesses to it will be queued pending the purge of the data in it. The same is true for the page cache as well.

This often causes a "site hang" for a minute or two. During that time new requests keep piling up, and if you do not have the MaxClients parameter in Apache setup correctly, the system can go into thrashing because of excessive swapping.

I have a drupal website with many modules (don't ask the number). For six months the website has been stable, but recently the servers began to seize. Generally MySQL reaches the maximum number of concurrent connections (1000) and the website crashes.

I want to find out what web pages within the site are being visited, or what cron or drush processes are running that are bringing the site down.

What is the best strategy for finding out this information?

Do I parse the apache logs, and see what web pages were visited, then proceed to benchmark the last 100 pages on the log and see how much memory they are consuming, for example?

Or is there a more accurate way of saying "this particular page or process brought down your site"?

I know that there's the PHP log, the Apache log, the MySQL log, and the top command, but it seems like too much inconclusive information.