Home / user-84332

merlin's questions

Martin Hope
merlin
Asked: 2022-03-07 12:31:00 +0800 CST
  • 2

In an attempt to improve security on Ubuntu 20.04 server I disabled pw login follwing this article: https://www.cyberciti.biz/faq/how-to-disable-ssh-password-login-on-linux/

It works, but the sysinfo does not show up anymore on SSH login:

% ssh server
Last login: Sun Mar  6 21:07:05 2022 from 77.2.170.244

The steps included:

$ sudo vi /etc/ssh/sshd_config

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
PermitRootLogin no
PermitRootLogin prohibit-password

How can I reenable landscape-sysinfo ?

ubuntu
Martin Hope
merlin
Asked: 2021-07-05 04:56:48 +0800 CST
  • 2

I am trying to backup/restore an LVM volume on a local Ubuntu 20.04 (Focal Fossa) server. The production server has an LV of 500 GB, however there are only 19 GB used so far.

The local development server has 24 GB free space where I intend to restore the 19 GB from production. I do use -L 24G as a parameter while doing the LVM snapshot. The process fails to restore with the message: "no space left on device":

Production Server:

sudo lvcreate -s /dev/vg0/test -n backup_test -L 24G
sudo dd if=/dev/vg0/backup_test  | lz4 > test_lvm.ddimg.lz4

1048576000+0 records in
1048576000+0 records out
536870912000 bytes (537 GB, 500 GiB) copied, 967.79 s, 555 MB/s

sudo lvdisplay /dev/vg0/backup_test
  --- Logical volume ---
  LV Path                /dev/vg0/backup_test
  LV Name                backup_test
  VG Name                vg0
  LV UUID                IsGBmM-VM7C-2sO4-VrC1-kHKg-EzcR-4Hej44
  LV Write Access        read/write
  LV Creation host, time leo, 2021-07-04 12:45:45 +0200
  LV snapshot status     active destination for m360
  LV Status              available
  # open                 0
  LV Size                500.00 GiB
  Current LE             128000
  COW-table size         24.00 GiB
  COW-table LE           6144
  Allocated to snapshot  0.01%
  Snapshot chunk size    4.00 KiB
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:10

Local Test Server:

sudo lvcreate -n restore -L 24.5G data
sudo mkfs.ext4 /dev/data/restore
sudo lz4 -d test_lvm.ddimg.lz4 | sudo dd of=/dev/data/restore

Warning : using stdout as default output. Do not rely on this behavior: use explicit `-c` instead !
dd: writing to '/dev/data/restore': No space left on device
51380225+0 records in
51380224+0 records out
26306674688 bytes (26 GB, 24 GiB) copied, 1181.48 s, 22.3 MB/s

Is there a way to restore the 500 GB volume containing only 19 GB on a smaller disk than 500 GB?

backup ubuntu lvm restore
Martin Hope
merlin
Asked: 2020-05-26 12:50:28 +0800 CST
  • 3

I am new to grafana and have just setup my first dashboard with node_eporter_full template downloaded from the official grafana site.

Now I have set up messenger and want to set the first alarm. Unfortunatelly this does not work on any chart. The message I get is "Template variables are not supported in alert queries"

How can I setup an alert. E.g. if CPU is > 90%?

enter image description here

grafana
Martin Hope
merlin
Asked: 2019-03-08 04:34:11 +0800 CST
  • 3

I am running apache 2.4.18 on ubuntu. Serving about 500.000 PI per month. No big deal without peaks. Somehow it started now to take a long time for the initial connection, after restarting apache it is back to normal.

Chrome tells me, that the initial connection takes so long:

enter image description here

After a few minutes I can come back with a new browser session and it looks OK:

MySQL, PHP and the rest seem not to be the problem as restarting apache will fix it and all query logs show high performance.

My guess is that the apache configuration is not made for 2.4 but 2.2 as there seem to be some naming changes on concurrent connetions.

This is a part of my config:

# 
# Timeout: The number of seconds before receives and sends time out.
# 
Timeout 300

#       
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#       
KeepAlive On

#       
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#   
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
# 
KeepAliveTimeout 5

What could be the issue here?

apache-2.2
Martin Hope
merlin
Asked: 2017-02-08 07:09:26 +0800 CST
  • 2

I am about to install OpenEMM on Ubuntu 16.04 and have installed previously successfully on Ubuntu 14.04. Now I am facing the problem, that somehow OpenEMM can not see tomcat running. I followed the provided docu.

Upon version check I do get the following:

openemm@rex:~/bin$ ./openemm.sh version
openemm.sh: 1.0.2
Username:   openemm
Hostname:   rex
Error: Could not find or load main class org.apache.catalina.util.ServerInfo

Tomcat can be started manualy and reached via :8080. However if I start tomcat manualy, it will run as root user not as openemm user.

The startup script provides the following:

openemm@rex:~/bin$ ./openemm.sh start
Start /home/openemm/bin/scripts/bav-update.py .. done.
Start /home/openemm/bin/scripts/bav-trigger.py .. done.
Start /home/openemm/bin/scripts/bavd.py .. done.
Start /home/openemm/bin/bav -L INFO .. done.
Start python /home/openemm/bin/scripts/recovery.py .. done.
Start /home/openemm/bin/scripts/update.py account bounce .. done.
Start /home/openemm/bin/scripts/pickdist.py .. done.
Stopping obsolete sendmail processes:   -15:4634 -15:4678 -9:4634 done.
[ ok ing sendmails:   listener [....] Starting sendmail (via systemctl): sendmail.service.
 mail queues  ADMIN  QUEUE  MIDQUEUE  SLOWQUEUE  done.
Start /home/openemm/bin/scripts/slrtscn.py .. done.
Starting up Tomcat ......
Check Java installation          :OK
Check Tomcat installation        :FAILED

Tomcat lives here:

rex:~$ ll /opt/openemm/tomcat
lrwxrwxrwx 1 root root 20 Feb  7 14:18 /opt/openemm/tomcat -> apache-tomcat-8.5.11/

What might be the problem here?

tomcat java
Martin Hope
merlin
Asked: 2017-01-27 00:59:55 +0800 CST
  • 2

I have installed solr 6.4.0 on ubuntu 16.04 LTS and want to use a configuration previously used on solr CLOUD 5.2.1

After creating a new core and linking the config files I can now see the core on the web interface and the files correctly under the core's administration interface.

The update link is greyed out and upon clicking on it it displays the error message:

Sorry, no dataimport-handler defined!

The things I checked:

  1. Solrconfig loads jar:

<lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-dataimporthandler-.*\.jar" /> <lib dir="/usr/share/java/" regex="mysql-connector-java-.*\.jar" />

Seems to work, as it displays an error message upon changing the filename. I therefore assume the mysql connector is loaded

  1. Defined dataimport handler:

in solrconfig:

<requestHandler name="/dataimport" class="org.apache.solr.handler.dataimport.DataImportHandler"> <lst name="defaults"> <str name="config">dataimport.xml</str> </lst> </requestHandler>

  1. Dataimporthandler itself

the file dataimport.xml is present and shows:

<dataConfig>
<dataSource type="JdbcDataSource"
            driver="com.mysql.jdbc.Driver"
            url="jdbc:mysql://localhost:3306/test"
            user="solr"
            password="secret" 
            convertType="true"
            batchSize="-1"
            encoding="UTF-8" />
 ...

The logfile inside the webadmin does not show any errors. I assume that logging is not configured to display this kind of error.

When I change the password inside dataimport.xml or the db name, nothing different happens. Same error message.

Any ideas on how to narrow down the problem?

solr
Martin Hope
merlin
Asked: 2017-01-06 01:19:03 +0800 CST
  • 2

According to OpenSSL, the version 1.0.1 has reached EOL: https://www.openssl.org/policies/releasestrat.html

Which means:

Support for version 1.0.1 will cease on 2016-12-31. No further releases of 1.0.1 will be made after that date. Security fixes only will be applied to 1.0.1 until then.

Unfortunatelly Ubunut 14.04 LTS still has not upgraded to 1.0.2: https://launchpad.net/ubuntu/trusty/+source/openssl

How is this handeled in the future? I need a feature of 1.0.2 and hope for Canonnical upgrading to this version due to EOL. What would you recommend? Waiting for an official upgrade or compiling from source to a different directory?

ubuntu openssl ubuntu-14.04
Martin Hope
merlin
Asked: 2016-12-31 08:04:40 +0800 CST
  • 3

I need to upgrade Openssl to 1.0.2 to get a certain feature. This worked following this tutorial http://www.miguelvallejo.com/updating-to-openssl-1-0-2g-on-ubuntu-server-12-04-14-04-lts-to-stop-cve-2016-0800-drown-attack/ However, HAProxy for example is still built with the old openssl version and thus does not support the ssl feature I need

How do I upgrade without compiling? I tried apt-get update and upgrade and also dist-upgrade. All that did not bring me to version 1.0.2

ubuntu openssl
Martin Hope
merlin
Asked: 2016-01-16 07:27:37 +0800 CST
  • 3

I am running a zookeeper ensemble of 3 on three different ubuntu 14.04 nodes. The setup used to work OK, but now I noticed the zk1 is not operational. It does also not restart:

:/home/www$ sudo /etc/init.d/zookeeper status
 * zookeeper is not running
:/home/www$ ps -ef | grep zoo
zookeep+ 11465     1  0 16:15 ?        00:00:00 /usr/bin/java -cp /etc/zookeeper/conf:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=false -Dzookeeper.log.dir=/var/log/zookeeper -Dzookeeper.root.logger=INFO,ROLLINGFILE org.apache.zookeeper.server.quorum.QuorumPeerMain /etc/zokeeper/conf/zoo.cfg
merlin     11492 25021  0 16:15 pts/1    00:00:00 grep --color=auto zoo
:/home/www$ echo stat | nc zk1 2181
:/home/www$ echo stat | nc zk2 2181
Zookeeper version: 3.4.5--1, built on 06/10/2013 17:26 GMT
Clients:
 /10.0.0.103:42841[1](queued=0,recved=33936,sent=33950)
 /10.0.0.101:38370[0](queued=0,recved=1,sent=0)

Latency min/avg/max: 0/0/14
Received: 37987
Sent: 38069
Connections: 2
Outstanding: 0
Zxid: 0x1600000983
Mode: follower
Node count: 202

The startup script is not restarting zookeper nor is it stoping it. Status claims that it is not running. However, zk2 and zk3 are running but their startup script claims also that zookeeper is not running but it is.

This is a production server and so far solr is operational but I woule like to fix this a.s.a.p. Any help is greatly appreciated.

Here is the logfile, running a crazy amount of permanent errors. Something seems to be wrong with the dabase. I had to remove the log entries of solr the other day which might be the cause of it.

Zookeeper logfile:

2016-01-15 16:30:02,618 - INFO  [main:QuorumPeerConfig@101] - Reading configuration from: /etc/zookeeper/conf/zoo.cfg
2016-01-15 16:30:02,620 - INFO  [main:QuorumPeerConfig@334] - Defaulting to majority quorums
2016-01-15 16:30:02,622 - INFO  [main:DatadirCleanupManager@78] - autopurge.snapRetainCount set to 3
2016-01-15 16:30:02,622 - INFO  [main:DatadirCleanupManager@79] - autopurge.purgeInterval set to 0
2016-01-15 16:30:02,623 - INFO  [main:DatadirCleanupManager@101] - Purge task is not scheduled.
2016-01-15 16:30:02,628 - INFO  [main:QuorumPeerMain@127] - Starting quorum peer
2016-01-15 16:30:02,635 - INFO  [main:NIOServerCnxnFactory@94] - binding to port 0.0.0.0/0.0.0.0:2181
2016-01-15 16:30:02,644 - INFO  [main:QuorumPeer@913] - tickTime set to 2000
2016-01-15 16:30:02,644 - INFO  [main:QuorumPeer@933] - minSessionTimeout set to -1
2016-01-15 16:30:02,644 - INFO  [main:QuorumPeer@944] - maxSessionTimeout set to -1
2016-01-15 16:30:02,644 - INFO  [main:QuorumPeer@959] - initLimit set to 10
2016-01-15 16:30:02,663 - INFO  [main:FileSnap@83] - Reading snapshot /var/lib/zookeeper/version-2/snapshot.1400009ce6
2016-01-15 16:30:02,677 - ERROR [main:Util@239] - Last transaction was partial.
2016-01-15 16:30:02,677 - ERROR [main:QuorumPeer@453] - Unable to load database on disk
java.io.EOFException
    at java.io.DataInputStream.readInt(DataInputStream.java:392)
    at org.apache.jute.BinaryInputArchive.readInt(BinaryInputArchive.java:63)
    at org.apache.zookeeper.server.persistence.FileHeader.deserialize(FileHeader.java:64)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.inStreamCreated(FileTxnLog.java:558)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.createInputArchive(FileTxnLog.java:577)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.goToNextLog(FileTxnLog.java:543)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.next(FileTxnLog.java:625)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.init(FileTxnLog.java:529)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.<init>(FileTxnLog.java:504)
    at org.apache.zookeeper.server.persistence.FileTxnLog.read(FileTxnLog.java:341)
    at org.apache.zookeeper.server.persistence.FileTxnSnapLog.restore(FileTxnSnapLog.java:132)
    at org.apache.zookeeper.server.ZKDatabase.loadDataBase(ZKDatabase.java:223)
    at org.apache.zookeeper.server.quorum.QuorumPeer.loadDataBase(QuorumPeer.java:417)
    at org.apache.zookeeper.server.quorum.QuorumPeer.start(QuorumPeer.java:409)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.runFromConfig(QuorumPeerMain.java:151)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:111)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:78)
2016-01-15 16:30:02,678 - ERROR [main:QuorumPeerMain@89] - Unexpected exception, exiting abnormally
java.lang.RuntimeException: Unable to run quorum server 
    at org.apache.zookeeper.server.quorum.QuorumPeer.loadDataBase(QuorumPeer.java:454)
    at org.apache.zookeeper.server.quorum.QuorumPeer.start(QuorumPeer.java:409)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.runFromConfig(QuorumPeerMain.java:151)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:111)
    at org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:78)
Caused by: java.io.EOFException
    at java.io.DataInputStream.readInt(DataInputStream.java:392)
    at org.apache.jute.BinaryInputArchive.readInt(BinaryInputArchive.java:63)
    at org.apache.zookeeper.server.persistence.FileHeader.deserialize(FileHeader.java:64)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.inStreamCreated(FileTxnLog.java:558)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.createInputArchive(FileTxnLog.java:577)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.goToNextLog(FileTxnLog.java:543)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.next(FileTxnLog.java:625)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.init(FileTxnLog.java:529)
    at org.apache.zookeeper.server.persistence.FileTxnLog$FileTxnIterator.<init>(FileTxnLog.java:504)
    at org.apache.zookeeper.server.persistence.FileTxnLog.read(FileTxnLog.java:341)
    at org.apache.zookeeper.server.persistence.FileTxnSnapLog.restore(FileTxnSnapLog.java:132)
    at org.apache.zookeeper.server.ZKDatabase.loadDataBase(ZKDatabase.java:223)
    at org.apache.zookeeper.server.quorum.QuorumPeer.loadDataBase(QuorumPeer.java:417)
    ... 4 more

I removed now the snapshots and could restart zookeeper on this node, however it will not connect to the ensemble but show only one node up:

echo stat | nc zk1 2181
Zookeeper version: 3.4.5--1, built on 06/10/2013 17:26 GMT
Clients:
 /10.0.0.101:57508[0](queued=0,recved=1,sent=0)

Latency min/avg/max: 0/0/0
Received: 1
Sent: 0
Connections: 1
Outstanding: 0
Zxid: 0x16000009a4
Mode: follower
Node count: 202
solr
Martin Hope
merlin
Asked: 2016-01-08 01:38:48 +0800 CST
  • 5

I am having trouble with one of my sendmail servers. Users are informing me about that registration emails do not arrive. The logfile claims that the message has been queued, but the queue is empty:

sudo cat /var/log/mail.log | grep email

(with obfuscated e-mail and server adresses in this example):

Jan 6 23:33:57 fx1 sendmail[9292]: u06MXvuk009292: to=email, ctladdr=sender-email (1001/100), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=38128, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (u06MXv7o009293 Message accepted for delivery)

Jan 6 23:34:00 fx1 sm-mta[9295]: u06MXv7o009293: to=, delay=00:00:03, xdelay=00:00:03, mailer=esmtp, pri=128308, relay=mx3.hotmail.com. [65.55.37.120], dsn=2.0.0, stat=Sent ( <70001a6bb8ff80254895632a2c4367fb@myhost> Queued mail for delivery)

$ mailq
> MSP Queue status...
/var/spool/mqueue-client is empty
        Total requests: 0
MTA Queue status...
        /var/spool/mqueue (1 request)
-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------
u04ALref018750*     184 Mon Jan  4 11:21 <[email protected]>
                 (Deferred: Connection timed out with mail.vtmail.com.)
                     <[email protected]>
        Total requests: 1

The mail.err logfile is empty.

How could I track down the problem? This is happening quite frequently.

sendmail
Martin Hope
merlin
Asked: 2015-12-07 10:40:51 +0800 CST
  • 3

I am operating a cluster of 3 dedicated machines for a webapp, each of those uses sendmail as MTA. Hostnames are node1.domain.com node2.domain.com node3.domain.com

Unfortunatelly outlook.com rejects to deliver mails to its users from my servers telling me the following:

X-Authentication-Warning: node1.domain.com: www set sender to [email protected] using -f

AND

Action: failed Status: 5.0.0 Diagnostic-Code: SMTP; 550 SC-001 (BAY004-MC5F13) Unfortunately, messages from 136.243.73.202 weren't sent. Please contact your Internet service provider since part of their network is on our block list.

This last message is strange as the ip does not apear to be on any blacklist I checked.

How could I fix the config regarding the authentication warning? I guess this is the main reason for the rejection. Thank you in advance for any help.

email
Martin Hope
merlin
Asked: 2015-11-16 09:28:52 +0800 CST
  • 3

I somehow messed up some thinly provisioned lvm volumes on ubuntu 14.04 and now I want to start fresh by deleting the thinpool with all its volumes and data inside. Unfortunatelly this failes and I can't find a solution.

The logical volumes look like this:

user@server1:~$ sudo lvs
  dm_report_object: report function failed for field data_percent
  LV             VG   Attr      LSize   Pool       Origin Data%  Move Log Copy%  Convert
  project2       vg0  Vwi-i-tz-  22.00g mythinpool       
  project1       vg0  Vwi---tz-  20.00g mythinpool                                      
  project3       vg0  Vwi---tz-  21.00g mythinpool                                      
  home           vg0  -wi-ao--- 140.00g                                                 
  mythinpool     vg0  twi-i-tz-  78.82g                    52.15                        
  root           vg0  -wi-ao---  10.00g                                                 
  swap           vg0  -wi-ao---   4.00g                                                 
  tmp            vg0  -wi-ao---   5.00g

Now I want to remove the thinpool with the three lvms inside:

sudo lvremove /dev/vg0/mythinpool

Removing pool mythinpool will also remove 3 thin volume(s). OK? [y/n]: y
Do you really want to remove and DISCARD logical volume project1? [y/n]: y
  device-mapper: message ioctl on  failed: Invalid argument
  Unable to deactivate open vg0-mythinpool_tdata (252:5)
  Unable to deactivate open vg0-mythinpool_tmeta (252:4)
  Failed to deactivate vg0-mythinpool-tpool
  Failed to resume mythinpool.
  Failed to update thin pool mythinpool.

I don't care about the data inside mythinpool, but the rest of the volume group vg0 MUST stay intact. How could I solve this problem? Thank you for any help on this.

EDIT 1: After following the answer from shodanshok I was able to remove one LVM-Image by booting into CentOS7, but unfortunatelly the other two volumes including thin pool return another error message - transaction_id mismatch:

enter image description here

There is also no space available for lvconvert --repair

ubuntu
Martin Hope
merlin
Asked: 2015-10-29 02:30:04 +0800 CST
  • 39

I am having trouble in delivering mail to google from a fresh sendmail install on ubuntu 14.04. The DNS-records seem to be fine for the ip. Something else must be wrong.

Sending mail from command line: 

sudo sendmail -v -Am -i [email protected];

Verbose output:

myname@fx1:/etc/mail$ sudo sendmail -v -Am -i [email protected];
[email protected]... Connecting to aspmx.l.google.com. via esmtp...
220 mx.google.com ESMTP v1si55415385wja.21 - gsmtp
>>> EHLO staging.mydomain.com
250-mx.google.com at your service, [2a01:4f8:212:27c8::2]
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-CHUNKING
250 SMTPUTF8
>>> STARTTLS
220 2.0.0 Ready to start TLS
>>> EHLO staging.mydomain.com
250-mx.google.com at your service, [2a01:4f8:212:27c8::2]
250-SIZE 35882577
250-8BITMIME
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-CHUNKING
250 SMTPUTF8
>>> MAIL From:<[email protected]>
250 2.1.0 OK v1si55415385wja.21 - gsmtp
>>> RCPT To:<[email protected]>
>>> DATA
250 2.1.5 OK v1si55415385wja.21 - gsmtp
354  Go ahead v1si55415385wja.21 - gsmtp
>>> .
550-5.7.1 [2a01:4f8:212:27c8::2] Our system has detected that this message does
550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and
550-5.7.1 authentication. Please review
550-5.7.1  https://support.google.com/mail/?p=ipv6_authentication_error for more
550 5.7.1 information. v1si55415385wja.21 - gsmtp
myname... Connecting to local...
myname... Sent

Any help is greatly apreciated. Thank you in advance.

sendmail
Martin Hope
merlin
Asked: 2015-09-11 22:16:50 +0800 CST
  • 9

I need to configure HAProxy with two different SSL-Certificates

  1. www.example.com
  2. api.example.com

Now I learned from a post on serverfault ( Configure multiple SSL certificates in Haproxy ) how to use 2 certificates, however the server continues to use the first certificate mentioned for both domains.

Config:

frontend apache-https
    bind 192.168.56.150:443 ssl crt /certs/crt1.pem crt /certs/cert2.pem
    reqadd X-Forwarded-Proto:\ https
    default_backend apache-http

backend apache-http
    redirect scheme https if { hdr(Host) -i www.example.com } !{ ssl_fc }
    redirect scheme https if { hdr(Host) -i api.example.com } !{ ssl_fc }
    ...

How to tell HAProxy which certificate to use depending on the URL?

Full config:

global
    log /dev/log    local0
    log /dev/log    local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3
    tune.ssl.default-dh-param 2048 // better with 2048 but more processor intensive

defaults
        log     global
        mode    http
        option tcplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000

frontend apache-http
        bind 0.0.0.0:80
        mode http
        option http-server-close                # needed for forwardfor
        option forwardfor                       # forward IP Address of client
        reqadd X-Forwarded-Proto:\ http
        default_backend apache-http
        stats enable

frontend apache-https
        bind 0.0.0.0:443 ssl crt cer1.pem cert2.pem
        reqadd X-Forwarded-Proto:\ https
        default_backend apache-http

backend apache-http
        redirect scheme https if { hdr(Host) -i db.example.com } !{ ssl_fc }
        redirect scheme https if { hdr(Host) -i api2.example.com } !{ ssl_fc }
        balance roundrobin
        cookie SERVERID insert indirect nocache
        server www-1 10.0.0.101:80 cookie S1 check
        server www-2 10.0.0.102:80 cookie S2 check
        server www-3 10.0.0.103:80 cookie S3 check
ssl
Martin Hope
merlin
Asked: 2015-09-10 00:44:18 +0800 CST
  • 3

I am running a 3 node MySQL 5.6 Galera Cluster. Everything is in sync and looks fine, but as I just found out the user table was not in sync.

One particular user was not present on the other nodes where I thought it might replicate it after issuing:

mysql -u root -p -e "INSERT INTO mysql.user (Host,User) values ('10.0.0.10','haproxy_check'); FLUSH PRIVILEGES;"

I double checked wsrep status and user tables on all nodes. After issuing the command on the other 2 nodes it is available and galera seems to be still in sync.

Am I missing something here? Why is galera not replicating the user table?

mysql
Martin Hope
merlin
Asked: 2015-08-24 11:12:35 +0800 CST
  • 5

Somehow I can not get glusterfs running again on ubuntu 14.04. I used to have it up and running a few days ago, including a configured volume. Then I removed the start script from autostart.

Now I get "failed" on starting the daemon. Then I purged the package and tried to reinstall. This is where I get following output:

Setting up glusterfs-server (3.7.3-ubuntu1~trusty1) ...
 * Starting glusterd service glusterd                                                                                                                                    [fail] 
invoke-rc.d: initscript glusterfs-server, action "start" failed.
dpkg: error processing package glusterfs-server (--configure):
 subprocess installed post-installation script returned error exit status 1
Processing triggers for ureadahead (0.100.0-16) ...
sh: 0: getcwd() failed: No such file or directory
sh: 0: getcwd() failed: No such file or directory
                                                                                                  Errors were encountered while processing:
 glusterfs-server
E: Sub-process /usr/bin/dpkg returned an error code (1)

This are the entries of the logfile:

[2015-08-23 19:10:33.979995] I [MSGID: 106478] [glusterd.c:1346:init] 0-management: Maximum allowed open file descriptors set to 65536
[2015-08-23 19:10:33.980021] I [MSGID: 106479] [glusterd.c:1395:init] 0-management: Using /var/lib/glusterd as working directory
[2015-08-23 19:10:33.982396] W [MSGID: 103071] [rdma.c:4590:__gf_rdma_ctx_create] 0-rpc-transport/rdma: rdma_cm event channel creation failed [No such device]
[2015-08-23 19:10:33.982416] W [MSGID: 103055] [rdma.c:4896:init] 0-rdma.management: Failed to initialize IB Device
[2015-08-23 19:10:33.982427] W [rpc-transport.c:359:rpc_transport_load] 0-rpc-transport: 'rdma' initialization failed
[2015-08-23 19:10:33.982457] W [rpcsvc.c:1597:rpcsvc_transport_create] 0-rpc-service: cannot create listener, initing the transport failed
[2015-08-23 19:10:33.982464] E [MSGID: 106243] [glusterd.c:1619:init] 0-management: creation of 1 listeners failed, continuing with succeeded transport
[2015-08-23 19:10:35.272379] I [MSGID: 106513] [glusterd-store.c:2036:glusterd_restore_op_version] 0-glusterd: retrieved op-version: 30703
[2015-08-23 19:10:35.427785] I [MSGID: 106498] [glusterd-handler.c:3570:glusterd_friend_add_from_peerinfo] 0-management: connect returned 0
[2015-08-23 19:10:35.427848] I [rpc-clnt.c:972:rpc_clnt_connection_init] 0-management: setting frame-timeout to 600
[2015-08-23 19:10:35.508741] E [MSGID: 101075] [common-utils.c:314:gf_resolve_ip6] 0-resolver: getaddrinfo failed (Name or service not known)
[2015-08-23 19:10:35.508788] E [name.c:247:af_inet_client_get_remote_sockaddr] 0-management: DNS resolution failed on host gluster2
[2015-08-23 19:10:35.508957] I [MSGID: 106004] [glusterd-handler.c:5051:__glusterd_peer_rpc_notify] 0-management: Peer <gluster2> (<6184be8c-f171-455f-a94f-dcf3ac6e1be1>), in state <Peer in Cluster>, has disconnected from glusterd.
[2015-08-23 19:10:35.508993] E [MSGID: 106155] [glusterd-utils.c:199:glusterd_unlock] 0-management: Cluster lock not held!
[2015-08-23 19:10:35.514145] E [MSGID: 106408] [glusterd-peer-utils.c:120:glusterd_peerinfo_find_by_hostname] 0-management: error in getaddrinfo: Name or service not known
 [Unknown error -2]
[2015-08-23 19:10:35.519159] E [MSGID: 101075] [common-utils.c:3139:gf_is_local_addr] 0-management: error in getaddrinfo: Name or service not known

[2015-08-23 19:10:35.519192] E [MSGID: 106187] [glusterd-store.c:4243:glusterd_resolve_all_bricks] 0-glusterd: resolve brick failed in restore
[2015-08-23 19:10:35.519271] E [MSGID: 101019] [xlator.c:428:xlator_init] 0-management: Initialization of volume 'management' failed, review your volfile again
[2015-08-23 19:10:35.519280] E [graph.c:322:glusterfs_graph_init] 0-management: initializing translator failed
[2015-08-23 19:10:35.519285] E [graph.c:661:glusterfs_graph_activate] 0-graph: init failed
[2015-08-23 19:10:35.519655] W [glusterfsd.c:1219:cleanup_and_exit] (-->/usr/sbin/glusterd(glusterfs_volumes_init+0xcd) [0x7f8a6c1f507d] -->/usr/sbin/glusterd(glusterfs_process_volfp+0x126) [0x7f8a6c1f4f56] -->/usr/sbin/glusterd(cleanup_and_exit+0x69) [0x7f8a6c1f4589] ) 0-: received signum (0), shutting down

I believe I need to reset the configuration as the paths are now different. How do I do this?

glusterfs
Martin Hope
merlin
Asked: 2015-08-20 15:13:36 +0800 CST
  • 6

I have installed zookeeperd on Ubuntu 14.04 (Trusty Tahr) as suggested here:

Unfortunately this process is somehow not stoppable. I tried even kill -9

user@node1:/opt/zookeeper-3.4.6$ ps -ef | grep zookeeper
zookeep+  4008     1  8 01:07 ?        00:00:00 /usr/bin/java -cp /etc/zookeeper/conf:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=false -Dzookeeper.log.dir=/var/log/zookeeper -Dzookeeper.root.logger=INFO,ROLLINGFILE org.apache.zookeeper.server.quorum.QuorumPeerMain /etc/zookeeper/conf/zoo.cfg

show process

user      4055  2823  0 01:07 pts/3    00:00:00 grep --color=auto zookeeper

kill it

user@node1:/opt/zookeeper-3.4.6$ sudo kill -9 4008

Check:

user@node1:/opt/zookeeper-3.4.6$ ps -ef | grep zookeeper
zookeep+  4075     1 24 01:07 ?        00:00:00 /usr/bin/java -cp /etc/zookeeper/conf:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=false -Dzookeeper.log.dir=/var/log/zookeeper -Dzookeeper.root.logger=INFO,ROLLINGFILE org.apache.zookeeper.server.quorum.QuorumPeerMain /etc/zookeeper/conf/zoo.cfg

Try script

user@node1:/opt/zookeeper-3.4.6$ sudo /etc/init.d/zookeeper stop
user@node1:/opt/zookeeper-3.4.6$ ps -ef | grep zookeeper
zookeep+  4075     1 29 01:07 ?        00:00:04 /usr/bin/java -cp /etc/zookeeper/conf:/usr/share/java/jline.jar:/usr/share/java/log4j-1.2.jar:/usr/share/java/xercesImpl.jar:/usr/share/java/xmlParserAPIs.jar:/usr/share/java/netty.jar:/usr/share/java/slf4j-api.jar:/usr/share/java/slf4j-log4j12.jar:/usr/share/java/zookeeper.jar -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=false -Dzookeeper.log.dir=/var/log/zookeeper -Dzookeeper.root.logger=INFO,ROLLINGFILE org.apache.zookeeper.server.quorum.QuorumPeerMain /etc/zookeeper/conf/zoo.cfg

Nothing helps.

How could I stop ZooKeeper?

linux
Martin Hope
merlin
Asked: 2015-08-19 12:19:44 +0800 CST
  • 3

I have a LAMP Application running with solr 3.x on one server for several years now. Now I am migrating due to heavy load to a setup with two dedicated machines where all services are loadbalanced via 2 keepalived HAProxy Servers.

The only thing remaining is Solr and I am having a hard time to understand the concept. I understand that there are at least 3 Zookeepers which are managing the cluster. But what is the URL to query for? In an HA setup with HAProxy I have one VIP and the system will take care that traffic is splitted and there is no SPOF, but how is it with SolrCloud? If I use 10.0.0.2:8984 and that server goes down the query will not be answered.

Could please somebody shed some light on what the URL is to query for? Currently I have one cronjob on the single machine that does deltaupdates via localhost:... and php doing queries also via localhost:... How would that change?

Thank you in advance for any help on this.

load-balancing
Martin Hope
merlin
Asked: 2015-08-18 23:21:31 +0800 CST
  • 3

I have two VMs running Ubunut 14.04 on Virtualbox. They are connected via VIP. Syslog on node1 shows recuring error messages from Avahi and I can't find the problem nor the solution.

tail /var/log/syslog

Aug 18 09:15:16 localhost avahi-daemon[902]: Host name conflict, retrying with node1-47
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for fe80::a00:27ff:fef0:2b00 on eth2.*.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 192.168.0.59 on eth2.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for fe80::a00:27ff:fe01:2f25 on eth1.*.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 10.0.0.121 on eth1.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 10.0.0.120 on eth1.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for fe80::a00:27ff:fe60:7f89 on eth0.*.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 10.0.0.10 on eth0.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 192.168.56.151 on eth0.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 192.168.56.150 on eth0.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 192.168.56.121 on eth0.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering new address record for 192.168.56.120 on eth0.IPv4.
Aug 18 09:15:16 localhost avahi-daemon[902]: Registering HINFO record with values 'X86_64'/'LINUX'.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for fe80::a00:27ff:fef0:2b00 on eth2.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 192.168.0.59 on eth2.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for fe80::a00:27ff:fe01:2f25 on eth1.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 10.0.0.121 on eth1.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 10.0.0.120 on eth1.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for fe80::a00:27ff:fe60:7f89 on eth0.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 10.0.0.10 on eth0.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 192.168.56.150 on eth0.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 192.168.56.121 on eth0.
Aug 18 09:15:36 localhost avahi-daemon[902]: Withdrawing address record for 192.168.56.120 on eth0.

node1:~$ ifconfig -a

 eth0      Link encap:Ethernet  HWaddr 08:00:27:60:7f:89  
           inet addr:192.168.56.120  Bcast:192.168.56.255  Mask:255.255.255.0
           inet6 addr: fe80::a00:27ff:fe60:7f89/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:1470 errors:0 dropped:0 overruns:0 frame:0
           TX packets:2088 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:110754 (110.7 KB)  TX bytes:425774 (425.7 KB)

 eth0:0    Link encap:Ethernet  HWaddr 08:00:27:60:7f:89  
           inet addr:192.168.56.121  Bcast:192.168.56.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

 eth1      Link encap:Ethernet  HWaddr 08:00:27:01:2f:25  
           inet addr:10.0.0.120  Bcast:10.0.0.255  Mask:255.255.255.0
           inet6 addr: fe80::a00:27ff:fe01:2f25/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:4328 errors:0 dropped:0 overruns:0 frame:0
           TX packets:5036 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:336379 (336.3 KB)  TX bytes:524405 (524.4 KB)

 eth1:0    Link encap:Ethernet  HWaddr 08:00:27:01:2f:25  
           inet addr:10.0.0.121  Bcast:10.0.0.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

 eth2      Link encap:Ethernet  HWaddr 08:00:27:f0:2b:00  
           inet addr:192.168.0.59  Bcast:192.168.0.255  Mask:255.255.255.0
           inet6 addr: fe80::a00:27ff:fef0:2b00/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:575 errors:0 dropped:0 overruns:0 frame:0
           TX packets:789 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:118869 (118.8 KB)  TX bytes:178305 (178.3 KB)

 lo        Link encap:Local Loopback  
           inet addr:127.0.0.1  Mask:255.0.0.0
           inet6 addr: ::1/128 Scope:Host
           UP LOOPBACK RUNNING  MTU:65536  Metric:1
           RX packets:8938 errors:0 dropped:0 overruns:0 frame:0
           TX packets:8938 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:534220 (534.2 KB)  TX bytes:534220 (534.2 KB)

How could I fix this problem? Config looks OK to me.

ubuntu