I am running server-side software on Digital Ocean servers. These include Docker, NPM, Node.js, and others. The server is running Ubuntu 22.04.
Sometimes, the server hangs randomly for several minutes. There is no pattern in hangs. You cannot even SSH into the server. After a few minutes, the server resumes operations normally.
Here are the server performance metrics extracted from Digital Ocean dashboard during the hang:
I am temporarily exposing some HTTP services to the Internet and I would like to password-protect them. Because the exposure is just a few hours, setting up Nginx, Traefik or other heavy-weight solution might not be worth the time.
Running on Ubuntu Linux. I would like to avoid any configuration files and just run the proxy directly from the command line, so I can easily modify and copy-paste the command around.
What would be ideally a single command line reverse proxy, where you just give the upstream localhost port, username and password, to expose an HTTP port to the Internet in the HTTP Basic Authentication realm?
Anything from Ubuntu apt repositories goes. Also I consider any Docker-based solution if there is something I could grab from Docker Hub that offers setting up the proxy parameters directly from the command line, without configuration files.
I have the following set up
Zabbix server 2.2.2
Zabbix agent 2.2.2
I have the agent running on several Ubuntu 14.04 servers which have Template Linux OS applied on them. For some reason, the file system autodiscovery (free space on partition, etc.) items do not appear in the host item list. There is no indication in log files, both agent and server, what could go wrong. The file systems still appear on some older hosts I added to Zabbix earlier, long time ago.
Do I need to take some actions in Zabbix server GUI in order to make file-system discovery happen (I thought this was automatic)? Is there something else that could be wrong?
I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP.
However when the world completes the migration to IPv6, banning single addresses probably won't work anymore, since a "normal" botnet computer or attacker posses quite many IPv6 addresses?
If I want to block IPv6 users what would be the best way to accomplish this? Use a certain IP mask or something else?
How about doing "upscaling heuristics" when you get multiple individual hits inside IPv6 then ban the whole block?
For me it is more important to mitigate the threat. If some poor genuine users to belong to the same block with blocked IPs then it is an issue between those people and their ISP to get that netblock cleared.
Let's say that I want to set load alert if load > 20 with Munin. However, Munin will immediately alert when the load spikes up to 20. Is it possible to adjust the alert integration time (time window), so that alert only triggers if load has stayed above 20 for 30 minutes?
I am running Apache 2.2 with mod_wsgi, Python 2.7 and mpm_worker. Occassionally, one of the worker processes gets stuck and all of it threads stop in writing state (as demostrated in the screenshot below).
This happens ~once in a day for one worker process.
I assume this is either because
Some internal problem in Apache
All of my Python threads inside the mod_wsgi worker process deadlock somehow
Thus far, the only remedy I have found is Apache full restart (not graceful).
I'd hope to find some pointers how to diagnose the issue what is causing it
Why Apace Timeout does not kill the worker threads / processes. Time timeout is one minute, but looks like those threads and workers have been running happily several hours on one request.
Is it possible to obtain thread dump from inside mod_wsgiand see if the Python thread themselves are somehow deadlocked
Any idea what could be causing this and how to remedy the situation?
Below is an screenshot showing Apache server-status where one of the worker processes (1-0) is stuck.
I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ IPs.
I was looking into ModSecurity to do this, but it looks too complex with very arcane and brittle configuration language just for doing IP blocking. What other alternatives there are?
Also, it is viable to generate Nginx rules configuration (ip-blocklist.conf) for the inclusion in the main Nginx config e.g. for every 5 minutes and then gracefully restart Nginx? How scaleable are Nginx rules e.g. up to 10k entries?
I am planning to do some performance related logging with Apache. The plan is to have special diagnostics information logged for every nth request on the live system. However, as this is live system, I am more interested in statistical sample than deterministic logs of logging every request.
Apache itself provides robust logging options for performance metrics (milliseconds per request, etc.) and one can add custom measurements using response headers.
Is there an easy way to do logging in Apache which would not concern all requests, but a statistical subset of them? This would 1) decrease the created log file size 2) have less performance impact on the diagnosed system.
And if there isn't such options yet, what would be the easiest way to get started with a custom module for custom logging?
I am migrating over a server to new hardware. A part of the system will be rebuild. What files and directories are needed to copy so that usernames, passwords, groups, file ownership and file permissions stay in intact?
Ubuntu 12.04 LTS.
Do Ubuntu Linux cron (Vixie cron?) support setting timeout for its jobs?
Specifically, the process would be killed after X seconds unless it finishes successfully by then.
I have had some cases where tasks have been hanging due to network connectivity and various issues. The process are left to hanging forever unless you manually clean up and kill them.
I am setting up Apache to do smartcard authentication. The smartcard login is based on client-side SSL certificates handled by an OS driver.
I have currently just one smartcard provider, but in the future there are potentially several of them. I am not sure how Apache 2.2. handles client-side certifications per Location. I did some quick testing and it somehow seemed that only the last SSLCACertificateFile directive would have been effective and this doesn't sound right.
Is it possible to have different SSLCACertificateFile per Location in Apache (2.2, 2.4) as described below or is SSL protocol somehow limiting that you cannot have more than one SSLCACertificateFile per IP?
Example potential config below how I wish to handle several SSLCACertificateFile on the same server to allow users to log in with different smartcard provides.
<VirtualHost 127.0.0.1:443>
# Real men use mod_proxy
DocumentRoot "/nowhere"
ServerName local-apache
ServerAdmin [email protected]
SSLEngine on
SSLOptions +StdEnvVars +ExportCertData
# Server-side HTTPS configuration
SSLCertificateFile /etc/apache2/certificate-test/server.crt
SSLCertificateKeyFile /etc/apache2/certificate-test/server.key
# Normal SSL site traffic does not require verify client
SSLVerifyClient none
SSLVerifyDepth 999
# Provider 1
<Location /@@smartcard-login>
SSLVerifyClient require
SSLCACertificateFile /etc/apache2/certificate-test/ca.crt
# Apache does not natively pass forward headers
# created by SSLOptions +StdEnvVars,
# so we pass them forward to Python using RequestHeader
# from mod_headers
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
</Location>
# Provider 2
<Location /@@smartcard-login-provider-2>
# For real
SSLVerifyClient require
SSLCACertificateFile /etc/apache2/certificate-test/provider2.crt
# Apache does not natively pass forward headers
# created by SSLOptions +StdEnvVars,
# so we pass them forward to Python using RequestHeader
# from mod_headers
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
</Location>
# Connect to Plone ZEO client1 running on fg
ProxyPass / http://localhost:8080/VirtualHostBase/https/local-apache:443/folder_sits/sitsngta/VirtualHostRoot/
ProxyPassReverse / http://localhost:8080/VirtualHostBase/https/local-apache:443/folder_sits/sitsngta/VirtualHostRoot/
</VirtualHost>
How one could monitor and keep logs of daily, weekly and monthly bandwidth usage of Linux servers? This is important for cheap VPS solutions where they have monthly caps in bandwidth.
Preferable some lightweight command-line tool just for this purpose.
Even more preferably nothing which includes PHP or web code.
It's enough to count all inbound / outbound traffic per network interface. This is just for one VPS, nothing heavy weight needed.
What methods exist for backing up Xen virtual machine contents? I have some virtual servers running on LVM / Ext4 disks. Preferably a method which can be directly executed over SSH / network connection without the need of creating a local duplicate of virtual machine first.
As far as I am concerned I'd like to back-up the disk image only, not the running state. However, simple copy of the disk partition on-line will probably yield to Ext4 corruption?
We are thinking about launching some Linux server-side services which would greatly benefit of having real accelerated OpenGL available. Currently we are running normal server instances with Mesa library and software rendering on CPUs. Works, albeit very slowly.
Are there any "OpenGL clouds" available anywhere? We'd rather take a solution where the server has already has working headless X11 and OpenGL in place.
I am especially looking for OpenGL + Linux as a service, I am less interested in OpenCL, CUDA, scientific calculating or rendering clusteres. It's more like "OpenGL on demand",
What's the recommended method of doing Apache based PHP virtual hosting installations where each site would have one and just one user allocated for it?
www-data or all users)/srv/www installation folder (not /home, the user does not have a shell)As I believe this would add some security against the cases where one site get compromised on a shared host.
I'd be grateful for pointers to tools, tutorials, etc.
We havie Plone site coming through Varnish front end cache. We'd like to give two different subdomains www.site.com and editors.site.com for this site. The latter would always be serving non-cached versions of the pages and used by the site maintainers to update the content.
What would be the simplest way to accomplish this?
Varnish 2.x - based on the default Debian template
Config below:
backend default {
.host = "127.0.0.1";
.port = "8080";
}
sub vcl_recv {
if (req.http.host ~ "(www\.)?site\.com(:[0-9]+)?$") {
set req.url = "/VirtualHostBase/http/www.site.com:80/LS/VirtualHostRoot" req.url;
set req.backend = default;
}
else if (req.http.host ~ "editors.site.com(:[0-9]+)?$") {
set req.url = "/VirtualHostBase/http/editors.site.com:80/LS/VirtualHostRoot" req.url;
set req.backend = default;
}
}
# Below is a commented-out copy of the default VCL logic. If you
# redefine any of these subroutines, the built-in logic will be
# appended to your code.
#
sub vcl_recv {
if (req.http.x-forwarded-for) {
set req.http.X-Forwarded-For =
req.http.X-Forwarded-For ", " client.ip;
} else {
set req.http.X-Forwarded-For = client.ip;
}
if (req.request != "GET" &&
req.request != "HEAD" &&
req.request != "PUT" &&
req.request != "POST" &&
req.request != "TRACE" &&
req.request != "OPTIONS" &&
req.request != "DELETE") {
/* Non-RFC2616 or CONNECT which is weird. */
return (pipe);
}
if (req.request != "GET" && req.request != "HEAD") {
/* We only deal with GET and HEAD by default */
return (pass);
}
if (req.http.Authorization || req.http.Cookie) {
/* Not cacheable by default */
return (pass);
}
return (lookup);
}
sub vcl_pipe {
# Note that only the first request to the backend will have
# X-Forwarded-For set. If you use X-Forwarded-For and want to
# have it set for all requests, make sure to have:
# set req.http.connection = "close";
# here. It is not set by default as it might break some broken web
# applications, like IIS with NTLM authentication.
return (pipe);
}
#
sub vcl_pass {
return (pass);
}
#
sub vcl_hash {
set req.hash += req.url;
if (req.http.host) {
set req.hash += req.http.host;
} else {
set req.hash += server.ip;
}
return (hash);
}
#
sub vcl_hit {
if (!obj.cacheable) {
return (pass);
}
return (deliver);
}
#
sub vcl_miss {
return (fetch);
}
#
sub vcl_fetch {
if (!beresp.cacheable) {
return (pass);
}
if (beresp.http.Set-Cookie) {
return (pass);
}
return (deliver);
}
#
sub vcl_deliver {
return (deliver);
}
#
What's good "ghetto process monitor" without installing any additional software besides cron and some standard UNIX tools? I.e. check in a shell script if a certain process has died and been dead for a while to restart it? This would be to restart segfaulting Varnish process.
Does there exist a magical shell piping which would allow easily to grep through bunch of .gz log files without needing to extract them somewhere?
.gz files are Apache logs, result of log rotation. I'd like to quickly check how often certain URIs are accessed in the past.
Is it possible to access response object data in Apache
... so that one could manipulate headers based on content type and caching output?
From the documentation it seems that this is not possible. Is there any other module which could allow this kind of manipulation (setting environment variables based on response headers)?
Debian/Ubuntu seem to have very complex Exim4 configuration files:
Understanding exim configuration files
What would be the recommendation if I want to raise the value of smtp_accept_max value? Is it autogenerated somewhere or is it possible to put this to a conf template and run [some script]?