Home / user-89644

Mike's questions

Martin Hope
Mike
Asked: 2022-03-04 13:55:38 +0800 CST
  • 0

I have a catch-all email address for my domain, however I want to block certain addresses from receiving mail. Before, I was doing it like this:

:0
* ^(X-Original-To): [email protected]
/dev/null

This works fine, however, the email is silently disregarded. I want a bounce mail to be sent back to the sender so that they know that it's being rejected. I used similar code to this answer:

:0
* ^(X-Original-To): [email protected]
{ EXITCODE=67 HOST= }

However, now the emails are being delivered and no bounce mail is being sent.

email postfix email-server procmail email-bounces
Martin Hope
Mike
Asked: 2021-10-05 09:19:22 +0800 CST
  • 1

I recently upgraded from Apache 2.2 to 2.4 (I know, I'm slow to upgrade, don't hate me). I have the following virtual host:

<VirtualHost _default_:30000>
    DocumentRoot /opt/phpmyadmin
    ErrorLog ${APACHE_LOG_DIR}/error.log

    <Directory /opt/phpmyadmin>
        Options -Indexes +IncludesNOEXEC +FollowSymLinks
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateChainFile /etc/letsencrypt/live/example.com/chain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    LogLevel warn
</VirtualHost>

This was working previously using the Allow from all syntax, and HTTPS is working perfectly for other virtual hosts on port 443. However, when I go to https://localhost:30000, it serves HTTP content instead of HTTPS. This is also the only virtual host that uses port 30000, so I'm assuming it can't be due to conflicts with other virtual hosts taking precedence.

HTTPS request:

$ curl -v https://localhost:30000
* Rebuilt URL to: https://localhost:30000/
* Hostname was NOT found in DNS cache
*   Trying ::1...
* Connected to localhost (::1) port 30000 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

This then produces the following in the Apache access log:

127.0.0.1:80 XXX.XXX.XXX.149 - - [04/Oct/2021:13:14:37 -0400] "\x16\x03\x01\x02" 400 0 "-" "-"

HTTP request

$ curl -v http://localhost:30000
* Rebuilt URL to: http://localhost:30000/
* Hostname was NOT found in DNS cache
*   Trying ::1...
* Connected to localhost (::1) port 30000 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.38.0
> Host: localhost:30000
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Mon, 04 Oct 2021 16:47:46 GMT
* Server Apache is not blacklisted
< Server: Apache
< Vary: Accept-Encoding
< Content-Length: 481
< Content-Type: text/html;charset=UTF-8
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /</title>
 </head>
 <body>
<h1>Index of /</h1>
  <table>
   <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr>
   <tr><th colspan="5"><hr></th></tr>
   <tr><th colspan="5"><hr></th></tr>
</table>
</body></html>

Edit:

I just noticed one thing. I have -Indexes set, but the HTTP content returned is a directory index. So I'm thinking that maybe somehow another virtual host is being used. I still don't know how that's possible since this is the only one using port 30000.

linux apache-2.2 ssl https apache-2.4
Martin Hope
Mike
Asked: 2019-08-06 12:24:22 +0800 CST
  • 0

I recently added a DMARC record for one of my domains. Let's call it mydomain.com:

v=DMARC1;p=none;rua=mailto:[email protected];ruf=mailto:[email protected];fo=1"

I have been receiving reports over the last couple of days, but there are a few records I don't quite understand. For example:

  <record>
    <row>
      <source_ip>217.72.192.73</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>mydomain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>mydomain.com</domain>
        <result>pass</result>
        <selector>2014</selector>
      </dkim>
      <spf>
        <domain>srs2.kundenserver.de</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

My SPF record does not include 217.72.192.73 or srs2.kundenserver.de and I have never heard of or used this server to send emails before, so it's pretty safe to assume this was someone trying to spoof an email from mydomain.com. It's also understandable that it would report SPF as passed, but unaligned. However, what I'm wondering about is how did this PASS the DKIM?

I have the following entry in my domain's DNS:

2014._domainkey.mydomain.com.   IN  TXT ( "v=DKIM1; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArbY9HBzct5lz6"
    "43Wv4pnudx+Ei6/YKifIr+AIUi5mpNGOYu6P81ooIJozVlY8flLSseurs8CFDuvs1j7FznUyrfVuYE/g"
    "6uD17VSaZwqfciW9wBdN25ruM0wRX+9tC7p8IDBUo1hJhrk5ngiwJpz/jpcXmfTjQdbE1M+yMrujUFNC"
    "vMqS2YAaAqVYPe4TMgpRum23oZm9PX0iqgkShiUXzNLzTM8NIaWXrHPnBaeKoNChbPZlHPCyvLqbJbRJ"
    "L+bj3P7B+9Pey04xbi2SalqH1XNLKU20Nd4wZAQAVHFvUoyj2XAzaOQnRSLavDCUYgBpt/Y9u9oAU+mb"
    "Cg2SLWzrQIDAQAB" )

As we can see from the report, the selector that matched is 2014, which is from this DNS entry.

Since this email was presumably not signed by my server's private key, should this not be a fail? Could this mean that perhaps someone has gained access to my private key? The weird thing is that there are 5 records for emails that were sent by servers not listed in my SPF record, and ALL of these list DKIM as "passed". I don't have any DKIM failed reports.

email
Martin Hope
Mike
Asked: 2016-08-18 15:13:49 +0800 CST
  • 4

On my server I have a KVM virtual machine called "cards2". It was created by executing (as root):

# virt-install --connect qemu:///system --virt-type kvm --name cards2 --ram 2048 --disk /var/kvm/cards2.qcow,size=3 --vcpus=8 --cdrom /var/kvm/debian-8.5.0-amd64-netinst.iso --vnc --os-type linux --network network=default

The image has permissions:

# ls -l /var/kvm/cards2.qcow 
-rwxr-xr-x 1 libvirt-qemu libvirt-qemu 3221225472 Aug 17 18:49 /var/kvm/cards2.qcow

However I noticed that any user with SSH access is able to gain access to the VM by executing:

virt-viewer --connect qemu+ssh://[email protected]/system vmname

(Note, this command is executed remotely, not on the server. This connects to the hypervisor with connection URI qemu+ssh://[email protected] by tunneling over SSH)

The user username is only a member of the username group. When SSH'ing in with the username account the list of virtual machines appear empty:

$ virsh list --all
 Id    Name                           State
----------------------------------------------------

And I am also unable to connect using a socket when executing the following over SSH:

$ virsh --connect qemu:///system list --all
error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied

I also tried removing permissions to all /usr/bin/vir* files to users not in the kvm group:

# chown root:kvm /usr/bin/vir*
# chmod o-rx /usr/bin/vir*
# ls /usr/bin/vir* -l
-rwxr-x--- 1 root kvm  321120 Jul  1 04:46 /usr/bin/virsh
-rwxr-x--- 1 root kvm   32184 Dec  7  2013 /usr/bin/virt-alignment-scan
-rwxr-x--- 1 root kvm   28128 Dec  7  2013 /usr/bin/virt-cat
-rwxr-x--- 1 root kvm    9774 Sep 29  2014 /usr/bin/virt-clone
-rwxr-x--- 1 root kvm   10277 Sep 29  2014 /usr/bin/virt-convert
-rwxr-x--- 1 root kvm     806 Dec  7  2013 /usr/bin/virt-copy-in
-rwxr-x--- 1 root kvm     808 Dec  7  2013 /usr/bin/virt-copy-out
-rwxr-x--- 1 root kvm   54584 Dec  7  2013 /usr/bin/virt-df
-rwxr-x--- 1 root kvm   33312 Dec  7  2013 /usr/bin/virt-edit
-rwxr-x--- 1 root kvm   54536 Dec  7  2013 /usr/bin/virt-filesystems
-rwxr-x--- 1 root kvm   30112 Dec  7  2013 /usr/bin/virt-format
-rwxr-x--- 1 root kvm   14656 Jul  1 04:46 /usr/bin/virt-host-validate
-rwxr-x--- 1 root kvm    7944 Sep 29  2014 /usr/bin/virt-image
-rwxr-x--- 1 root kvm   44696 Dec  7  2013 /usr/bin/virt-inspector
-rwxr-x--- 1 root kvm   36992 Sep 29  2014 /usr/bin/virt-install
-rwxr-x--- 1 root kvm    5338 Dec  7  2013 /usr/bin/virt-list-filesystems
-rwxr-x--- 1 root kvm    6686 Dec  7  2013 /usr/bin/virt-list-partitions
-rwxr-x--- 1 root kvm   53816 Dec  7  2013 /usr/bin/virt-ls
-rwxr-x--- 1 root kvm   18641 Dec  7  2013 /usr/bin/virt-make-fs
-rwxr-x--- 1 root kvm    9600 Jul  1 04:46 /usr/bin/virt-pki-validate
-rwxr-x--- 1 root kvm   36264 Dec  7  2013 /usr/bin/virt-rescue
-rwxr-x--- 1 root kvm 1322488 Dec  7  2013 /usr/bin/virt-resize
-rwxr-x--- 1 root kvm 1231256 Dec  7  2013 /usr/bin/virt-sparsify
-rwxr-x--- 1 root kvm 1289592 Dec  7  2013 /usr/bin/virt-sysprep
-rwxr-x--- 1 root kvm    8949 Dec  7  2013 /usr/bin/virt-tar
-rwxr-x--- 1 root kvm     804 Dec  7  2013 /usr/bin/virt-tar-in
-rwxr-x--- 1 root kvm     806 Dec  7  2013 /usr/bin/virt-tar-out
-rwxr-x--- 1 root kvm      55 Jul 12  2012 /usr/bin/virtualenv
-rwxr-x--- 1 root kvm  132400 May 28  2012 /usr/bin/virt-viewer
-rwxr-x--- 1 root kvm   23886 Dec  7  2013 /usr/bin/virt-win-reg
-rwxr-x--- 1 root kvm    3531 Jul  1 04:46 /usr/bin/virt-xml-validate

And even though now I can't access any of these commands over a regular SSH connection, I can still bring up the VM by executing virt-viewer remotely (like above) over the SSH tunnel.

So, how can I make it so that only specific user accounts have access to the VMs?

Edit:

Here's what appears in my /var/log/libvirt/qemu/cards2.log when the VM is started, in case that gives any indication:

LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=none /usr/bin/kvm -S -M pc-1.1 -enable-kvm -m 2048 -smp 8,sockets=8,cores=1,threads=1 -name cards2 -uuid 70905b35-9df3-71c9-d5e9-f804a2826055 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/cards2.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/var/kvm/cards2.qcow,if=none,id=drive-ide0-0-0,format=raw -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 -drive if=none,id=drive-ide0-1-0,readonly=on,format=raw -device ide-cd,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -netdev tap,fd=23,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:c6:14:68,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -vnc 127.0.0.1:3 -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4

Edit 2:

On another note, this appears to be only a problem for virt-viewer, and not for virsh.

For example here are some commands being executed on the remote client:

$ virsh --connect qemu+ssh://[email protected]/system
error: failed to connect to the hypervisor
error: End of file while reading data: nc: unix connect failed: Permission denied: Input/output error

$ virsh --connect qemu+ssh://[email protected]/system
Welcome to virsh, the virtualization interactive terminal.

Type:  'help' for help with commands
       'quit' to quit
linux kvm-virtualization ssh permissions libvirt
Martin Hope
Mike
Asked: 2015-12-12 19:29:40 +0800 CST
  • 2

I was under the assumption (apart from restrictions due to old operating systems not being able to read large drives) that as long as a hard drive was of the same type as what is available for the computer (e.g. if the computer has IDE, you can plug any IDE drive into it, or if it has SATA that you can plug any SATA into it). However recently I was going to purchase a relatively old computer and wanted put a couple of 4TB drives on it because it will be used to store surveillance videos, so I need very little actual computing power, but lots of storage. However the sales representative told me that a 4TB drive wouldn't work with that server. When I checked the specs, it says:

Internal storage capacity of up to 1.5TB (2 x 750GB Hot Plug 3.5" SATA hard drives), 1 TB (2 x 500 Non-Hot Plug SATA hard drives) or 600GB (2 x 300GB Hot Plug 3.5" SAS hard drives)

Is this because there is some actual hardware restriction putting a drive larger than this on the server, and if so, what would cause this and what would happen if you did put a larger drive on the server?

Or, is this because those were the largest drives of those types that existed at that time, so that's what they used in the specs, but it is actually possible to put any drive that can physically be plugged in (e.g. 2 x 4TB 3.5" SATA drives) and they will function correctly?

hard-drive
Martin Hope
Mike
Asked: 2015-04-16 23:01:34 +0800 CST
  • 1

I'm trying to create a restful API using mod_rewrite.

I have the rule: 

RewriteRule v2/(.*)$ v1/index.php?request=$1 [QSA,NC,L]

However the path could contain base64 encoded strings (i.e. can have + or /) and they are being decoded before it gets to PHP.

For example, if I go to 

/v2/cards/9VwQLli%2Bf0ogFl19AVRFLuztbp8cP0rYCgXBu3H9%2BDc%3DBe

PHP gets $_REQUEST['request'] as cards/9VwQLli f0ogFl19AVRFLuztbp8cP0rYCgXBu3H9 Dc=Be'.

And to make things worse, if I add a slash in there (e.g. 9VwQLli%2Bf0ogFl19AVRFLuztbp8c%2FP0rYCgXBu3H9%2BDc%3DBe - the %2F is the slash) I get a 404.

How can I prevent this from happening?

Note: I tried the B and NE flags but they didn't have any effect. I suppose as a hack I could just convert all + characters to _ and all / to -, or maybe even double url encoding it, but I was wondering if there was a better way.

apache-2.2
Martin Hope
Mike
Asked: 2015-02-13 22:31:46 +0800 CST
  • 3

I have a Debian host that has several allocated IPs and KVM with a Debian guest using a bridged network. The guest is completely unable to reach the network, including the LAN or even the host. Pinging the host from the guest produces a Destination Host Unreachable error. If I try to ping the guest from the host, I get a response from the host itself instead of from the guest.

Host's /etc/network/interfaces

# The loopback network interface
auto lo

auto eth1

iface lo inet loopback

allow-hotplug eth1
iface eth1 inet static
        address 108.xxx.xxx.130
        netmask 255.255.255.248
        network 108.xxx.xxx.128
        broadcast 108.xxx.xxx.135
        gateway 108.xxx.xxx.129
        dns-nameservers 127.0.0.1 208.167.225.22 64.237.42.82
        dns-domain example.com
        # dns-* options are implemented by the resolvconf package, if installed

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        bridge_ports eth0
        bridge_stp on
        bridge_fd 0
        bridge_maxwait 0

Host's bridges:

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.bc5ff43b621c       yes             eth0
                                                        vnet0
virbr0          8000.000000000000       yes

Host's KVM networks:

# virsh net-list --all
Name                 State      Autostart
-----------------------------------------
br0                  active     yes       
default              active     yes

br0 network config:

<network>
  <name>br0</name>
  <uuid>cc78c850-b182-11e4-ab27-0800200c9a66</uuid>
  <forward mode='bridge'/>
  <bridge name='br0' />
  <mac address='52:54:00:43:58:77'/>
</network>

VM's interface settings:

<interface type='bridge'>
  <mac address='52:54:00:ea:c0:83'/>
  <source bridge='br0'/>
  <model type='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>

Host's sysctl

# sysctl -p /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

Host's iptables:

# iptables -vnL
Chain INPUT (policy ACCEPT 16 packets, 3436 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU

Chain OUTPUT (policy ACCEPT 9 packets, 832 bytes)
 pkts bytes target     prot opt in     out     source               destination

Guest's network settings:

auto eth0
iface eth0 inet static
        address 108.xxx.xxx.132
        netmask 255.255.255.248
        gateway 108.xxx.xxx.129

Edit (after making host and guest IPs different as per shodanshok's answer)

Host's ifconfig:

# ifconfig
br0       Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          inet addr:108.xxx.xxx.132  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2584 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:594801 (580.8 KiB)  TX bytes:0 (0.0 B)

eth0      Link encap:Ethernet  HWaddr bc:5f:f4:3b:62:1c  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21817 errors:0 dropped:0 overruns:0 frame:0
          TX packets:493 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:5806951 (5.5 MiB)  TX bytes:38774 (37.8 KiB)
          Interrupt:20 Memory:f7d00000-f7d20000 

eth1      Link encap:Ethernet  HWaddr 68:05:ca:05:f2:1e  
          inet addr:108.xxx.xxx.130  Bcast:108.xxx.xxx.135  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:84560 errors:0 dropped:0 overruns:0 frame:0
          TX packets:140042 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:9419446 (8.9 MiB)  TX bytes:157587628 (150.2 MiB)
          Interrupt:16 Memory:f7cc0000-f7ce0000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13361 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13361 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3897517 (3.7 MiB)  TX bytes:3897517 (3.7 MiB)

virbr0    Link encap:Ethernet  HWaddr 3e:14:8f:80:03:75  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:ea:c0:83  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:956 (956.0 B)  TX bytes:583780 (570.0 KiB)

Guest's ifconfig:

ifconfig on guest

linux
Martin Hope
Mike
Asked: 2015-02-13 21:19:53 +0800 CST
  • 0

I am trying to get KVM working on my Debian server and I am having a slight problem with networking with my guest OS (also Debian). The virtual machine is using the "default" network (without a bridge). The host server gets all of the IPs and to allow the guest to serve content, I add these rules to my iptables:

/sbin/iptables -t nat -I PREROUTING -d xxx.xxx.xxx.134 -j DNAT --to 192.168.122.160
/sbin/iptables -t nat -I POSTROUTING -s 192.168.122.160 -j SNAT --to xxx.xxx.xxx.134
/sbin/iptables -t filter -I FORWARD -d 192.168.122.160 -j ACCEPT
/sbin/iptables -t filter -I FORWARD -s 192.168.122.160 -j ACCEPT

I also have several other virtual machines I want to add and give them internet access without having any public-facing servers, therefore no ports need to be forwarded to these VMs (besides, I don't have enough public IPs to give each server its own IP).

The problem is that if don't add these rules to iptables, I can only access the local network from the VM (however DNS is working fine). If I try to ping anything (e.g. google.com), it resolves the IP, but doesn't receive any response. Is there some other sort of rule I need to add to iptables or anything else I need to do so that the guest can access the internet without forwarding any ports to it?

linux
Martin Hope
Mike
Asked: 2015-02-10 14:39:52 +0800 CST
  • 1

I have a server with one network card in it (eth1). My server is assigned 5 public IP addresses and it is currently configured like this (/etc/network/interfaces):

# The primary network interface
allow-hotplug eth1
iface eth1 inet static
    address xxx.yyy.zzz.130
    netmask 255.255.255.248
    network xxx.yyy.zzz.128
    broadcast xxx.yyy.zzz.135
    gateway xxx.yyy.zzz.129

iface eth1:0 inet static
    address xxx.yyy.zzz.131
    netmask 255.255.255.248

iface eth1:1 inet static
    address xxx.yyy.zzz.132
    netmask 255.255.255.248

iface eth1:2 inet static
    address xxx.yyy.zzz.133
    netmask 255.255.255.248

iface eth1:3 inet static
    address xxx.yyy.zzz.134
    netmask 255.255.255.248

This is working perfectly, however I wanted to add a KVM virtual machine with a bridged connection with the public IP xxx.yyy.zzz.131.

If I do this:

auto br0
iface br0 inet static
  bridge-ports eth1
  bridge_stp off
  bridge_fd 0
  bridge_maxwait 0
  address xxx.yyy.zzz.131
  netmask 255.255.255.248

Then only xxx.yyy.zzz.131 is accessible. None of the other IPs are.

If I change it to bridge-ports eth1:0 I get the error:

SIOCSIFFLAGS: Cannot assign requested address
RTNETLINK answers: File exists
Failed to bring up br0.

If I comment out the other sections about eth1:0, in addition to the above error, I also get Ignoring unknown interface eth1:0=eth10. at the beginning.

How do I add a bridged device if I only have one NIC and multiple IPs?

linux
Martin Hope
Mike
Asked: 2013-05-23 12:12:19 +0800 CST
  • 1

I have a Debian 6 server and I was previously using Apache with mod_php but decided to switch to using fcgi instead since Wordpress was somehow causing Apache to crash. I have the following in my site's Apache config file:

Options +ExecCGI
AddHandler fcgid-script .php
FCGIWrapper /usr/lib/cgi-bin/php5 .php

SuexecUserGroup "#1001" "#1003"

Everything works fine if I don't include the SuexecUserGroup, but it obviously then runs the script as www-data instead of the user and group above. When I include that line, I get a 500 error and the following shows up in my suexec.log file:

[2013-05-22 16:00:12]: command not in docroot (/usr/lib/cgi-bin/php5)

Everything was installed using the packages, so I don't even know where the docroot is.

Here is my suexec info:

# /usr/lib/apache2/suexec -V
 -D SUEXEC_CONFIG_DIR=/etc/apache2/suexec/
 -D AP_GID_MIN=100
 -D AP_LOG_EXEC="/var/log/apache2/suexec.log"
 -D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
 -D AP_UID_MIN=100

And the permissions on my php5 file if that has anything to do with it:

# ls -l /usr/lib/cgi-bin/php5
-rwxr-xr-x 1 root root 7769160 Mar  4 08:25 /usr/lib/cgi-bin/php5
apache-2.2
Martin Hope
Mike
Asked: 2013-05-04 23:23:40 +0800 CST
  • 1

I have a computer with Ubuntu 13.04 with a local IMAP server that I use to share email over the LAN. I set this computer up to have an encrypted /home, however this therefore means that anyone logging into the server won't be able to view the IMAP folders unless the local user is also logged in. I want to therefore move the mail to /var/mail/Maildir/%u.

I have the following in my /etc/dovecot/conf.d/01-mail-stack-delivery.conf

mail_location = maildir:/var/mail/Maildir/%u

And my /etc/postfix/main.cf has:

home_mailbox = Maildir/

However when I log in locally with a mail client over IMAP, it recreates the ~/Maildir directory instead of using /var/mail/. What am I missing?

Edit:

Here is my postconf -n after applying shutupsquare's answer:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
inet_interfaces = all
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -m "${EXTENSION}"
mailbox_size_limit = 0
mailbox_transport = dovecot
mydestination = $myhostname, $mydomain, localhost.$mydomain, localhost, localhost.localdomain, ubuntu
myhostname = host
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_relay_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
virtual_alias_maps = hash:/etc/postfix/virtual

Edit 2: my /var/log/mail.log contains the following:

May  4 02:10:01 servername postfix/local[469]: warning: connect #7 to subsystem private/dovecot: No such file or directory
May  4 02:10:11 servername postfix/local[469]: warning: connect #8 to subsystem private/dovecot: No such file or directory
May  4 02:10:21 servername postfix/local[469]: warning: connect #9 to subsystem private/dovecot: No such file or directory
May  4 02:10:31 servername postfix/local[469]: warning: connect #10 to subsystem private/dovecot: No such file or directory
May  4 02:10:41 servername postfix/local[469]: fatal: connect #11 to subsystem private/dovecot: No such file or directory
May  4 02:10:42 servername postfix/qmgr[30763]: warning: private/local socket: malformed response
May  4 02:10:42 servername postfix/qmgr[30763]: warning: transport local failure -- see a previous warning/fatal/panic logfile record for the problem description
May  4 02:10:42 servername postfix/master[30759]: warning: process /usr/lib/postfix/local pid 469 exit status 1
May  4 02:10:42 servername postfix/master[30759]: warning: /usr/lib/postfix/local: bad command startup -- throttling
ubuntu
Martin Hope
Mike
Asked: 2012-12-09 07:55:58 +0800 CST
  • 3

I have a postfix mail server on Debian. A client of mine just informed me that they were unable to send an email to me and it appears that there is a problem with their mail server. I would like to get back to them with the actual problem, but I'm unable to figure this out. This was in the bounce email:

The address to which the message has not yet been delivered is:

[email protected]
Delay reason: SMTP error from remote mail server after RCPT
TO::
host dog.myhostname.com [{server_ip}]: 450 4.7.1
:
Recipient address rejected: SPF-Result=server.thehostingserver.co.uk:
'SERVFAIL' error on DNS 'TXT' lookup of 'server.thehostingserver.co.uk'

Checking through the /var/log/mail.log file I see the following lines which coincide with the bounce email:

Dec  6 10:32:16 dog postfix/smtpd[366]: connect from unknown[37.26.106.210]
Dec  6 10:32:16 dog postfix/smtpd[366]: setting up TLS connection from unknown[37.26.106.210]
Dec  6 10:32:16 dog postfix/smtpd[366]: Anonymous TLS connection established from unknown[37.26.106.210]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
Dec  6 10:32:18 dog postfix/policy-spf[421]: Policy action=DEFER_IF_PERMIT SPF-Result=server.thehostingserver.co.uk: 'SERVFAIL' error on DNS 'TXT' lookup of 'server.thehostingserver.co.uk'
Dec  6 10:32:18 dog postfix/smtpd[366]: NOQUEUE: reject: RCPT from unknown[37.26.106.210]: 450 4.7.1 <[email protected]>: Recipient address rejected: SPF-Result=server.thehostingserver.co.uk: 'SERVFAIL' error on DNS 'TXT' lookup of 'server.thehostingserver.co.uk'; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<server.thehostingserver.co.uk>

I am having a bit of trouble understanding this.

1) Why does it say "connect from unknown"? This IP clearly resolves to server.oovavoohosting.co.uk. (Note, other incoming connections do show up correctly with their hostnames)

# nslookup 37.26.106.210
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
210.106.26.37.in-addr.arpa      name = server.oovavoohosting.co.uk.

Authoritative answers can be found from:
106.26.37.in-addr.arpa  nameserver = ns1.racksrv.com.
106.26.37.in-addr.arpa  nameserver = ns2.racksrv.com.
ns1.racksrv.com internet address = 37.26.104.214
ns2.racksrv.com internet address = 37.26.105.214

2) If the aforementioned IP resolves to server.oovavoohosting.co.uk, where does it get the hostname server.thehostingserver.co.uk from? I can see this hostname doesn't exist, which is why it's returning a SERVFAIL, I just don't know where it comes from.

domain-name-system
Martin Hope
Mike
Asked: 2012-11-21 20:37:17 +0800 CST
  • 2

I'm using PHP with Apache on Ubuntu 12.10. Errors are not being displayed to the browser for some reason and I can't figure it out.

I have the following in my php.ini file:

error_reporting = E_ALL & ~E_DEPRECATED
display_errors = On
display_startup_errors = On
log_errors = On

I am also positive that I have edited the correct ini file by verifying it with php_ini_loaded_file(). I can also verify that the values are correctly set by doing the following in my script:

echo ini_get("display_errors"); // Outputs 1
echo ini_get("display_startup_errors"); // Outputs 1
echo ini_get("log_errors"); // Outputs 1
echo ini_get("error_reporting"); // Outputs -1

I have tried what seems like every possible combination of these settings (and restarting Apache after each change) and it is just not outputting errors. I am also not using ini_set anywhere in the script. It is being set only from the ini file.

Any ideas why errors aren't being displayed?

Update:

It turns out it IS showing some errors, but not all of them.

echo 'hello''; // Shows syntax error
trigger_error("E_USER_WARNING", E_USER_WARNING); // shows error
trigger_error("E_USER_NOTICE", E_USER_NOTICE); // shows error
trigger_error("E_USER_ERROR", E_USER_ERROR); // Doesn't show error
apache-2.2
Martin Hope
Mike
Asked: 2012-08-23 14:24:17 +0800 CST
  • 0

I recently purchased an existing domain name through the site name.com and after I made the payment, I realized that the domain expired about 10 days earlier. Is it legal/good practice to sell already expired domains as-is, or would most domain selling companies also extend the expiration date by an extra year. It wouldn't be such a big deal, however domains with this particular TLD cost $89/year to renew.

domain
Martin Hope
Mike
Asked: 2012-07-11 16:21:31 +0800 CST
  • 12

I'm trying to get SSI to work on Debian running Apache, however the .shtml files are not being parsed. From a PHP file with phpinfo() I can see that the following show up in the loaded modules section:

mod_mime_xattr mod_mime mod_mime_magic

In /etc/apache2/mods-enabled/mime.conf I have (among other things):

AddType text/html .shtml
AddOutputFilter INCLUDES .shtml

In /etc/apache2/sites-enabled/domain.com.conf (for the virtual host in question) I have:

<Directory /home/username/public_html>
Options +Includes
allow from all
AllowOverride All 
</Directory>

and for good measure, I added the following as well:

<Directory />
Options +Includes
</directory>

In the user's .htaccess file, I tried adding:

Options +Includes
AddType text/html shtml
AddHandler server-parsed shtml

Nothing seems to work. How can I even debug this?

Edit:

Here is the output of ls /etc/apache2/mods-enabled/ in case this helps

actions.conf          dav_svn.load         proxy_balancer.load
actions.load          deflate.conf         proxy.conf
alias.conf            deflate.load         proxy_connect.load
alias.load            dir.conf             proxy_http.load
auth_basic.load       dir.load             proxy.load
auth_digest.load      env.load             python.load
authn_file.load       fcgid.conf           reqtimeout.conf
authz_default.load    fcgid.load           reqtimeout.load
authz_groupfile.load  mime.conf            rewrite.load
authz_host.load       mime.load            ruby.load
authz_user.load       mime_magic.conf      setenvif.conf
autoindex.conf        mime_magic.load      setenvif.load
autoindex.load        mime-xattr.load      ssl.conf
cgi.load              negotiation.conf     ssl.load
dav_fs.conf           negotiation.load     status.conf
dav_fs.load           php5.conf            status.load
dav.load              php5.load            suexec.load
dav_svn.conf          proxy_balancer.conf
debian apache-2.2 server-side-includes