Alexander's questions

I've tried to install a firewall such as ufw on my Xen Debian VPS, however it just would not start up no matter what I had done, so I had looked for a more suited firewall, arno-iptables-firewall.

Unfortunately, when I start it up it lists about fifty iptables warnings:

/sbin/iptables: (1) iptables: No chain/target/match by that name.
/sbin/iptables: (1) iptables: No chain/target/match by that name.
/sbin/iptables: (1) iptables: No chain/target/match by that name.
/sbin/iptables: (1) iptables: No chain/target/match by that name.
/sbin/iptables: (1) iptables: No chain/target/match by that name.
(and thirty or so more)

I am not entirely sure where they come from, however the firewall functions flawlessly for what I need to use it for.

My question is: how do I remove the offending entries so it does not bother me when I restart them? is there a way to do this without rebuilding the list?

And also: If I were to flush the list, would things be fine networking wise once I install the firewall again, or will I remove essential entries left by the system beforehand? I am not entirely sure where the entries came in to my system.

This is greatly troubling me,

I have generated a .csr and .key file to send to dynadot (which sends that to AlphaSSL) with this command:

openssl req -out foo.com.csr -new -newkey rsa:2048 -nodes -keyout foo.com.key

It had asked me for confirmation and I received apparently an intermediate chain certificate, however I just placed it in foo.com.crt and it worked fine on my domain.

Contrary to what the purchasing pages had stated, SSL only works on (domain.com) and not (www.domain.com) and I had used domain.com for my common name when generating the original signing request.

I thought this was due to me not using the intermediate chaining, so I had foolishly overwritten the .csr and .key to try to install the GlobalSign root cert before the AlphaSSL one provided to me by dynadot in the same .csr file, however it gives me a warning about a mismatch with my .key file now (I am using nginx)

I had tried to reproduce my steps and settings, however I cannot get the (fresh crt, just what was given to me by dynadot) and .key that I regenerated with the same settings - it just mismatches.

Is it possible to re-request the csr? or generate the private .key from the .csr I was given?

I would rather not spend another chunk of money, and I've no actual AlphaSSL account so I am not sure I can really ask for support or redo the signing.

If you could provide any advice or help I would appreciate it.

I've been wanting SSL for one portion of my website, which is one single domain name on my VPS.

As most certificates look fairly expensive, I had looked at my domain name provider and had found a fairly good deal: http://www.dynadot.com/ssl/about.html

I would be looking at the AlphaSSL one of which provides an intermediate (chained) certificate for me to install I assume which is what I wish for.

I however have started to host a few small project websites for users and had started to wonder if I could possibly use this certificate for them as well, as it is on the same physical host and IP address, just differing by top level domain name that they give me.

Would I be able to install the certificate for all of them with this AlphaSSL certificate?

Also, would I be able to use this freely for imaps (especially as the domain names are not part of the picture) and secure all my IMAP users?

I've a VPS and am hosting a few peoples websites, namely people who I will have a lot of contact with although would like to provide what I can without being there to do it.

I have written a script to add a sample database and user upon my "account" creation script, i.e.:

CREATE DATABASE <username>_main
GRANT ALL ON <username>_main.* 
    TO <username>@localhost 
    IDENTIFIED BY 'randomfoobar';

I am unsure about this, would they need to contact me to run the script to add another database? I was kind of wanting it so they had phpmyadmin (not much trouble for me) and then log in as their user/password, then have a clean phpmyadmin interface where they can add databases and whatnot, of course without affecting others.

Is this possible with mysql? or would I need to completely separate the mysql portion for each user so that they can create databases freely, but not affect other users?

Ken.

I've had issues with Apache 2 on my server of which I had an Apache2-worker/php-fpm setup and am migrating to Nginx.

I've followed various guides to set up the wrapper script for fastcgi spawning for PHP-cgi and Nginx, however I can find no guide on running the actual cgi script under specific users.

i.e. this Linode guide (and others) hardcoding the wrapper in an init.d script: http://library.linode.com/web-servers/nginx/php-fastcgi/debian-6-squeeze

Right now I have made a script to add a user/group for each individual vhost directories, and chowning the public_html directories - however this seems useless as the PHP process will still be ran under the www-data user.

Any guides for doing this? Am I just searching the wrong things this late?

My VPS host uses Xen, and instead of using its custom kernels I could use my own (with pv-grub), the sample kernel of which I had installed to test this was is the following, I am running Debian 6 (Squeeze): http://packages.debian.org/squeeze/linux-image-2.6.32-5-xen-amd64

Would I be right to assume, that if I download the sources for 2.6.32-5 I can set up the appropriate Xen options to build a Xen compatible kernel just like the binary one listed?

Would I be able to apply say kernel patches (such as grsecurity as I've wanted), and apply the Xen configuration, to use for my VPS once compiled just like that?

Thank you, Ken.

I've the choice of crafting a NetBSD image for a Xen VPS host, and was just wanting to play around as I like BSD and wished to use it for my general web hosting. I will be hosting a low-mid traffic website and maybe a few other simple services.

Do you think NetBSD would be a sufficient choice, in terms of general performance of multiple system users and fair amount of traffic to Apache compared to what Linux could normally handle?

I am concerned if I do start to really like it and keep it, I may be limiting myself if I am to move further with my web host and get more traffic (and maybe a lot of FTP access and user shell accounts)

Ken

I've ran a general audit of the system and found that a few packages were aging, such as OpenSSH and related so I went to apt-get update then upgrade.

Unfortunately it seems to get the packages correctly (downloading), however cannot finish the upgrade process. Here is an exact copy of my recent command line to show this error, note that packages were already downloaded from previous test of this so it needs to retrieve zero bytes (note I am root:)

root@foobar:~# apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be upgraded:
  apt apt-utils at bind9-host binutils bsdutils curl dhcp3-client dhcp3-common
  dnsutils dpkg-dev ifupdown initscripts krb5-multidev language-pack-en
  language-pack-en-base libapache2-mod-php5 libapr1 libapr1-dev
  libavahi-client3 libavahi-common-data libavahi-common3 libbind9-60 libblkid1
  libc-bin libc-dev-bin libc6 libc6-dev libcurl3 libcurl3-gnutls libdbus-1-3
  libdns64 libgssapi-krb5-2 libgssrpc4 libisc60 libisccc60 libisccfg60
  libk5crypto3 libkadm5clnt-mit7 libkadm5srv-mit7 libkdb5-4 libkrb5-3
  libkrb5-dev libkrb5support0 liblcms1 libldap-2.4-2 libldap2-dev liblwres60
  libmysqlclient-dev libmysqlclient16 libnss3-1d libpam-runtime libpam0g
  libpango1.0-0 libpango1.0-common libplymouth2 libpq-dev libpq5 libssl-dev
  libssl0.9.8 libtiff4 libudev0 libuuid1 libxml2 libxml2-dev linux-libc-dev
  login logrotate mount mysql-client mysql-client-5.1 mysql-client-core-5.1
  mysql-common mysql-server mysql-server-5.1 mysql-server-core-5.1 nginx ntp
  ntpdate openjdk-6-jre-headless openjdk-6-jre-lib openssh-client
  openssh-server openssl opera passwd perl perl-base perl-modules php-pear
  php5 php5-cli php5-common php5-dev php5-gd php5-mysql plymouth postfix rsync
  rsyslog sudo sysv-rc sysvinit-utils tzdata tzdata-java udev update-inetd
  upstart util-linux uuid-dev vsftpd xkb-data
112 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
Need to get 0B/124MB of archives.
After this operation, 3,506kB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Extracting templates from packages: 100%
Preconfiguring packages ...
/tmp/ifupdown.config.188089: 13: dpkg: Permission denied
/tmp/openssh-server.config.188701: 49: dpkg: Permission denied
Could not exec dpkg!
E: Sub-process /usr/bin/dpkg returned an error code (100)

I am completely unsure of what I have done wrong, this version is 10.04.2 LTS of Ubuntu and it is of course the server edition no of which I am using on my VPS, will it force me to do some dist-upgrade or something first? is it just some simple permission problem?

One thing I have done recently before this, I had set the sticky bit in /tmp as recommended by an auditing guide so I could not allow other users to modify other users' files in that folder (it is just a folder), I am wondering if that is it, or I need to run this in a different manner..

Ken.

As requested per below comment,

ls -la output:

root@foobar:~# ls -la /tmp
total 20
drwxr-xr-t  5 mainuser mainuser 4096 2011-07-06 03:17 .
drwxr-xr-x 23 root   root   4096 2011-07-05 04:39 ..
drwxr-xr-x  2 root   root   4096 2011-06-17 03:30 hsperfdata_root
drwxrwxrwt  2 root   root   4096 2011-06-15 03:47 .ICE-unix
-rw-------  1 root   root      0 2011-07-05 04:13 lsat1.lsat
drwxrwxrwt  2 root   root   4096 2011-06-15 03:47 .X11-unix

Update: now is this after suggestion to fix permissions:

total 20
drwxrwxrwt  5 root root 4096 2011-07-06 03:50 .
drwxr-xr-x 23 root root 4096 2011-07-05 04:39 ..
drwxr-xr-x  2 root root 4096 2011-06-17 03:30 hsperfdata_root
drwxrwxrwt  2 root root 4096 2011-06-15 03:47 .ICE-unix
-rw-------  1 root root    0 2011-07-05 04:13 lsat1.lsat
drwxrwxrwt  2 root root 4096 2011-06-15 03:47 .X11-unix

And problem still persists.

I believe I had set everything up correctly when I had built the server (maybe it was a pre-configured LAMP that the VPS host Linode supplied that set things up)

It seems that every Apache process runs under the user nobody which is what I had intended in the configuration, however the lower PID (longest running Apache process) is still running under root, an my PHP scripts seem to report the current user as root through asking in phpinfo().

is this due to the fact root may be spawning Apache, and its children are spawning correctly under the defined nobody user as per its configuration? Do any of the actual pages get processed through that root Apache process or is it just there to be a parent?

I am a little concerned, however have no problem with starting a new Apache with a fresh mind to fix this if it is a little more than a configuration mishap.

Minor extra info edit: It appears $_SERVER['user'] is root even though $_SERVER['apache_run_user'] (similar to that) shows www-data (even though not nobody), I am unsure if this is PHP's fault, maybe I will try editing a root file in PHP and see..

edit 2: nope, PHP cannot edit root files. Guess $_SERVER['user'] (and a hacky audit script) is wrong to assume PHP is root then. still wondering about the Apache process though,.

Lets just say I am a fanatic to using something such as this, and would be willing to purchase the appropriate licenses (or open version of Solaris maybe) and install it.

My questions are, do software packages such as (an) sshd and recent Apache versions install nicely on such flavours of Unix? Can you install BASH on them for the sake of easier administration? I currently do not care for the ease of Ubuntu as much of my work if any is very precise and often automated.

I would just like some insight on if this is a good idea, of if something such as Solaris runs many sites online. I would see the use of Solaris to run my site more important than the bit more ease Linux distributions could provide (just me:))

Ken.