dotancohen's questions

Consider an .htaccess file which must convert all underscores to dashes, and replace a potential .html suffix with a slash in the filename.

Example URL from client: http://foo.com/a_b/c_d.html
Example URL to redirect: http://foo.com/a-b/c-d/

I have been using this rule to replace the .html suffix:

RewriteRule ^(.*)\.html$ $1/ [R,L]

I have found this terrific serverfault.SE post for the underscore rewriting:

RewriteRule ^(.*)_(.*)_(.*)_(.*)$ /$1-$2-$3-$4 [R,L]
RewriteRule ^(.*)_(.*)_(.*)$ /$1-$2-$3 [R,L]
RewriteRule ^(.*)_(.*)$ /$1-$2 [R,L]

However, only one of the replacement types happens, whichever is first in the .htaccess file. I cannot seem to configure .htaccess to perform both replacements.

That means that the following code will replace the .html suffix only:

RewriteRule ^(.*)\.html$ $1/ [R,L]
RewriteRule ^(.*)_(.*)_(.*)_(.*)$ /$1-$2-$3-$4 [R,L]
RewriteRule ^(.*)_(.*)_(.*)$ /$1-$2-$3 [R,L]
RewriteRule ^(.*)_(.*)$ /$1-$2 [R,L]

And the following code will replace underscores only:

RewriteRule ^(.*)_(.*)_(.*)_(.*)$ /$1-$2-$3-$4 [R,L]
RewriteRule ^(.*)_(.*)_(.*)$ /$1-$2-$3 [R,L]
RewriteRule ^(.*)_(.*)$ /$1-$2 [R,L]
RewriteRule ^(.*)\.html$ $1/ [R,L]

How must .htaccess be configured to replace both the .html suffix and the underscores?

On a CentOS 7.3 machine running PHP 5.6 I have installed and configured the MS SQL driver for PDO, yet it is not available to PHP.

See that the driver is properly installed and configured:

$ yum list php56w-mssql
Installed Packages
php56w-mssql.x86_64            5.6.30-1.w7        @webtatic

$ cat /etc/php.d/mssql.ini
; Enable mssql extension module
extension=mssql.so

However, PHP doesn't recognize it:

$ php -i | grep 'PDO drivers'
PDO drivers => dblib, mysql, sqlite

How might I troubleshoot this?

I'm moving from a Debian-based distro to CentOS 7. I have files encrypted with blowfish that I edit transparently in VIM with this setting in ~/.vimrc:

:set cryptmethod=blowfish2

This is the error that I receive:

E474: Invalid argument: cryptmethod=blowfish2

However, I cannot seem to find the appropriate package in CentOS. I have installed the following packages, but I still get the error:

$ sudo yum install bcrypt cryptsetup-python libcryptui py-bcrypt 

Here are all the packages that seem to be relevant:

$ yum search bcrypt
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirror.nonstop.co.il
 * epel: mirror.nonstop.co.il
 * extras: mirror.nonstop.co.il
 * updates: mirror.nonstop.co.il
============================= N/S matched: bcrypt ==============================
libcryptui-devel.i686 : Header files required to develop with libcryptui
libcryptui-devel.x86_64 : Header files required to develop with libcryptui
rubygem-bcrypt.x86_64 : Wrapper around bcrypt() password hashing algorithm
rubygem-bcrypt-doc.x86_64 : Documentation for rubygem-bcrypt
bcrypt.x86_64 : File encryption utility
cryptsetup-python.x86_64 : Python bindings for libcryptsetup
libcryptui.i686 : Interface components for OpenPGP
libcryptui.x86_64 : Interface components for OpenPGP
py-bcrypt.x86_64 : Python bindings for OpenBSD's Blowfish password hashing code

  Name and summary matches only, use "search all" for everything.

$ yum search blowfish
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirror.nonstop.co.il
 * epel: mirror.nonstop.co.il
 * extras: mirror.nonstop.co.il
 * updates: mirror.nonstop.co.il
============================ N/S matched: blowfish =============================
perl-Crypt-Eksblowfish.x86_64 : Eksblowfish block cipher
php-horde-Horde-Crypt-Blowfish.noarch : Blowfish Encryption Library
php-pear-Crypt-Blowfish.noarch : Quick two-way blowfish encryption
php-phpseclib-crypt-blowfish.noarch : Pure-PHP implementation of Blowfish
py-bcrypt.x86_64 : Python bindings for OpenBSD's Blowfish password hashing code

  Name and summary matches only, use "search all" for everything

When using the ssh or ftp commands from the Bash shell, does the server that I am connecting to learn of the domain name used? I understand that the domain name is locally translated into an IP address via DNS. In HTTP, after that happens, the server is told the original domain name as well in order to serve the correct page, or to present the correct TLS cert (SNI).

host serverfault.com
GET /

Does a similar phenomenon happen when connecting to ssh or ftp?

I ask because I am trying to ssh into a server (GoDaddy webhosting) which expects a domain name, but is not letting me in when I try to connect via user@IPaddress as the DNS is not yet moved to the GoDaddy IP address.

Is there a way to create SSL cert requests by specifying all the required parameters on the initial command? I am writing a CLI-based web server control panel and I would like to avoid the use of expect when executing openssl if possible.

This is a typical way to create a cert request:

$ openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout foobar.com.key -out foobar.com.csr
Generating a 2048 bit RSA private key
.................................................+++
........................................+++
writing new private key to 'foobar.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New Sweden
Locality Name (eg, city) []:Stockholm
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Scandanavian Ventures, Inc.
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:foobar.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:FooBar

I am hoping to see something like this: (unworking example)

$ openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout foobar.com.key -out foobar.com.csr \
-Country US \
-State "New Sweden" \
-Locality Stockholm \
-Organization "Scandanavian Ventures, Inc." \
-CommonName  foobar.com \
-EmailAddress [email protected] \
-Company FooBar

The fine man page had nothing to say on the matter, nor was I able to find anything via Google. Must SSL cert request generation be an interactive process, or is there some way to specify all the parameters in a single command?

This is on a Debian-derived Linux distro running openssl 1.0.1.

Google chrome will start to warn users that their SSL connection is insecure under the following conditions:

1. The cert uses the SHA1 hashing algorithm, and
2. The cert expires on or after 2016-01-01 (or 2017-01-01 by different sources)

Therefore I am trying to script a method to determine if a cert is affected. Here is an example of a SHA1 cert on another server that I maintain, that expires in the 'safe' timeframe:

$ curl -v --silent https://example.com/ 2>&1 | grep "expire\|SSL connection using"
* SSL connection using DHE-RSA-AES256-GCM-SHA384
*        expire date: 2015-07-20 00:00:00 GMT

How could I have determined that this cert is SHA1 from the string DHE-RSA-AES256-GCM-SHA384? That 256 in the string makes it sure look like it is using a 256 bit algorithm, even though I know it is not because I myself did the cert request with $ openssl req -new -newkey rsa:2048 -nodes. Googling around I found this resource or supported ciphers but I don't see how I could determine the cipher strength from that document.

How could I determine the cipher strength via curl, so that I could script it?

I am administering an RHEL 6.6 server which I inherited from an admin the company no longer has contact with. I need to replace the SSL cert, for which some information regarding the physical organisation is needed:

$ openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout example.com.key -out example.com.csr
Generating a 2048 bit RSA private key
..........+++
.........................................................+++
writing new private key to 'example.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New Jersey
Locality Name (eg, city) []:Salem
Organization Name (eg, company) [Internet Widgits Pty Ltd]:International Widgets
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:example.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:International Widgets

Given the extant SSL cert or key, how might I recover the organisational information used? I'm not sure how critical it is that this information match what was there before, but I would rather be safe than sorry. Unfortunately, this being an online business there is no single physical address to simply use, and the business is split between four owners none of whom know whose information was in the original cert.

Maybe it really doesn't matter if I simply answer everything "foobar", but I cannot assume that.

I tried using the openssl tool to get the information, but nothing of interest came up:

$ openssl x509 -text -in example.com.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1xxxxxxxxxx1 (0x4xxxxxxxb)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification Authority/serialNumber=07969287
        Validity
            Not Before: Aug 11 12:16:01 2014 GMT
            Not After : Aug 11 12:16:01 2015 GMT
        Subject: OU=Domain Control Validated, CN=*.example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    ...
                    7d:05:34:ac:7f:e2:c2:13:d3:56:9e:4e:fb:57:e3:
                    ...
                    16:cb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.godaddy.com/gds1-112.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.114413.1.7.23.1
                  CPS: http://certificates.godaddy.com/repository/

            Authority Information Access: 
                OCSP - URI:http://ocsp.godaddy.com/
                CA Issuers - URI:http://certificates.godaddy.com/repository/gd_intermediate.crt

            X509v3 Authority Key Identifier: 
                keyid:FD:AC:xx:xx:xx:xx:xx:xx:xx:CC:E7

            X509v3 Subject Alternative Name: 
                DNS:*.example.com, DNS:example.com
            X509v3 Subject Key Identifier: 
                1C:EB:xx:xx:xx:xx:xx:xx:F0:2F
    Signature Algorithm: sha1WithRSAEncryption
         ...
         43:fd:fb:92:8b:ee:82:0e:63:db:4f:dc:66:46:0f:fb:ac:de:
         ...
         d8:a5:89:eb
-----BEGIN CERTIFICATE-----
...
ODcwHhcNMTQwODIxMTAyNjA2WhcNMTUwODIxMTAyNjA2WjA8MSEwHwYDVQQLExhE
xZHYpYnr
-----END CERTIFICATE-----

I notice that when doing one-liners via ssh into a Linux server, the value of ~ remains the value of the local user's home directory, not the remote user's home directory. Witness local user dotancohen and remote user atwood:

$ whoami
dotancohen

$ ssh beta whoami
atwood

$ ssh beta ls ~/.ssh
ls: cannot access /home/dotancohen/.ssh: No such file or directory

$ ssh beta ls $HOME/.ssh
ls: cannot access /home/dotancohen/.ssh: No such file or directory

$ ssh atwood@beta ls ~/.ssh
ls: cannot access /home/dotancohen/.ssh: No such file or directory

$ ssh beta ls /home/atwood/.ssh
authorized_keys

$ ssh beta ls .ssh             
authorized_keys

Note that even specifying the username in the connection details, and even using $HOME in place of ~ did not help. Not that I expected them to, but it was worth trying.

I have no problem looking in .ssh/config for the username when I'm doing one-liners if need be, but the inability to use ~ in scripts is rather inconvenient. Other than parsing ~/.ssh/config for the username, is there any way around this limitation? The last example shows that I can assume that we're in his home directory and reference things relative to that, but I would prefer to explicitly call the directory if possible.

How can I reference the user's home directory via SSH oneliners, without parsing ~/.ssh/config locally for it?

Tested on local system Kubuntu 14.04 and remote systems Ubuntu Server 12.04, 14.04, and RHEL 6.5.

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check:

$ php -v
PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08)

However, the PHP website claims that this version is depreciated, and the 5.3 branch ended with 5.3.29 anyway, not the 5.3.3 as in RHEL 6.5.

Since the distro is supported by Red Hat, I assume that all the applications are security-maintained, but where can I find this information for certain? According to the Production Support Scope of Coverage "If we ship it, we ... Do not support ... Third-party software / Community projects". Is PHP considered third-party software or a community project for purposes of RHEL support?

I have examined the Red Hat Enterprise Linux Life Cycle and RHEL Top Support Policies documentation, but I have not found an answer. I actually don't have access to the RHEL support service in my current position with regards to this account, otherwise I would just ask Red Hat! However, I do feel that this information should be publicly available and would apply to any users of RHEL, hence I ask here.

It seems that on a Ubuntu 14.04 machine the user mysql cannot access anything. It is not writing logs nor reading files. Witness:

 - bruno():mysql$ cat /etc/passwd | grep mysql
mysql:x:116:127:MySQL Server,,,:/nonexistent:/bin/false

 - bruno():mysql$ sudo mysql_install_db
Installing MySQL system tables...
140818 18:16:50 [ERROR] Can't read from messagefile '/usr/share/mysql/english/errmsg.sys'
140818 18:16:50 [ERROR] Aborting
140818 18:16:50 [Note] 

Installation of system tables failed!  Examine the logs in
/var/lib/mysql for more information.

...boilerplate trimmed...

 - bruno():mysql$ ls -la /usr/share/mysql/english/errmsg.sys
-rw-r--r-- 1 root root 59535 Jul 29 13:40 /usr/share/mysql/english/errmsg.sys
 - bruno():mysql$ wc -l /usr/share/mysql/english/errmsg.sys
16 /usr/share/mysql/english/errmsg.sys

Here we have seen that mysql cannot read /usr/share/mysql/english/errmsg.sys even though the permissions are open to read it, and in fact the regular login user can read the file (with wc). Additionally, MySQL is not writing any logs:

 - bruno():mysql$ ls -la /var/log/mysql
total 8
drwxr-s---  2 mysql adm    4096 Aug 18 16:10 .
drwxrwxr-x 18 root  syslog 4096 Aug 18 16:10 ..

What might cause this user to not be able to access anything? What can I do about it?

Consider a server that hosts several Git repositories:

$ ls -l /opt/git/
drwxrwxr-x 7 ubuntu root   4096 Jan  2  2014 george.git
drwxrwxr-x 7 ubuntu root   4096 Dec 29  2013 john.git
drwxrwsr-x 7 ubuntu root   4096 Jul  4  2013 paul.git
drwxrwsr-x 7 ubuntu root   4096 Jun 30  2013 ringo.git

Until now, all developers had access to all the Git repos via SSH. I am now adding a dev who should only have access to the john.git repo. I've created a Linux user yoko but I'm not sure how I should let yoko access the /opt/git/john.git directory in the safest manner without letting him access the other directories in /opt/git/.

What is the canonical way of restricting access as such?

My inclination is to make the john.git as group foobar and add that group to user yoko's groups. However, what happens if I later need to add another user that could access two repos? For instance, I might want to add user cynthia with access to both john.git and to paul.git. Should I have a separate group for each Git repo? I could see that getting unwieldy very quickly

Note that these users should have access to nothing other than their own /home/user/ directories and additionally to the Git repo(s) that they are permitted. If there is a way to symlink i.e. /home/yoko/john.git to /opt/git/john.git in a way that prevents access to the rest of /opt/git/ that would be best, however I cannot seem to configure the system as such.

The server is running Ubuntu Server 12.04 but I could possibly update it to 14.04 if there is need. The users connect via SSH using RSA keys, no password. They will be performing git pull and git push on the server, nothing more.

Considering the excellent answers on the SF question "Preventing brute force attacks against SSH", I am considering configuring port knocking on a test server. I am debating how I will connect to this server and to other port-knocking servers easily.

I usually configure rsa authentication, addresses, and user names in /.ssh/config as such:

Host msUpdate
    User bgates
    Hostname updates.microsoft.com
    IdentityFile ~/.ssh/id_rsa.bgates.pub

Thus, I can simply type ssh msUpdate to log into the server. So far as I know /.ssh/config has no facility for configuring port knocking. Thus, I am considering a wrapper script for ssh that will automatically handle knocking:

$ cat login
#!/bin/bash

msUpdate=( 2000 3000 4000 )
otherServer=( 1024 2048 4096 )

for PORT in ${$@}; do
    ssh -p $PORT
    sleep 1
done

ssh $@

My question is how to write the for line. I cannot seem to get the script to recognise the argument as the name of an array to substitute. Although ostensibly a Bash question, I ask on SF because I feel that the completed script will be most useful to users of this site, and also because if there is a better way than it will most likely be here that someone will let me know about it.

On a small non-commercial website I am using a no-cost Class 1 cert from Start SSL. There is no sensitive data going over the wire, but I do feel that I would like to provide at least a minimum of privacy to whoever browses to the site. When visiting the site in Firefox one receives the "Untrusted cert" warning. Here is an example using wget:

$ wget https://example.com/images/dog.jpg
--2013-08-09 15:21:10--  https://example.com/images/dog.jpg
Resolving example.com (example.com)... 54.43.17.16
Connecting to example.com (example.com)|54.43.17.16|:443... connected.
ERROR: The certificate of `example.com' is not trusted.
ERROR: The certificate of `example.com' hasn't got a known issuer.

The FAQ entry from StartSSL states that to avoid the warning, one must install the intermediate CA certificate to the browser. It is a bit unreasonable to expect all website visitors to do that!

I don't mind installing a cert from a larger company, but while researching the situation I find that the larger companies have the same issue. Another fine ServerFault question mentions that the server admin should install an intermediate certificate, but I am not sure that an intermediate certificate exists for Start SSL. Before moving to another company, how would I know if they have all the proper intermediate certificates that we would need? As the previous two linked questions demonstrate, even going with Verisign or GoDaddy may not resolve the issue.

This is a conventional LAMP stack (Ubuntu Server 12.04, Apache 2.2) running on Amazon Web Services.

I am configuring a Postfix install on Ubuntu Server 12.04 to forward a small volume of mail from a specific address on the server to a specific address at another domain.

$ pwd
/etc/postfix

$ cat main.cf 
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

append_dot_mydomain = no
readme_directory = no

smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = awsBeta
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = awsBeta, localhost.localdomain, , localhost, someDomain.com
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

virtual_mailbox_domains = someDomain.com
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000

virtual_alias_domains = someDomain.com
virtual_alias_maps = hash:/etc/postfix/virtual

$ cat virtual
[email protected] [email protected]

$ 

When I log into the PHP CLI interpreter on the server to send mail, the mail is properly delivered to [email protected]. Note that the dotancohen.com is a Google Apps domain, the MX records are hosted at Google.

$ php -a
Interactive shell

php > mail('[email protected]','Subject','tMessage', 'From: <[email protected]>');

I can see the mail has arrived in the [email protected] inbox. This tells me that the forwarder works. Now I try from my desktop's telnet prompt:

$ telnet mail.someDomain.com 25
Trying x.x.x.x...
Connected to mail.someDomain.com.
Escape character is '^]'.
220 someHostname ESMTP Postfix (Ubuntu)
EHLO dotancohen.com
250-someHostname
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: [email protected]
250 2.1.0 Ok
RCPT TO: [email protected]
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: [email protected]
SUBJECT: Hi, telnet!

This is a second attempt! 
.
250 2.0.0 Ok: queued as 9851E81579
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
$ 

This mail is not delivered, and I find the following in the postfix logs:

Jul  4 16:02:58 someHostname postfix/smtp[24898]: connect to ASPMX.L.GOOGLE.com[2607:f8b0:400c:c03::1b]:25: Network is unreachable
Jul  4 16:02:58 someHostname postfix/smtp[24898]: 935BC81579: to=<[email protected]>, orig_to=<[email protected]>, relay=ASPMX.L.GOOGLE.com[173.194.75.26]:25, delay=15, delays=15/0.02/0.08/0.15, dsn=2.0.0, status=sent (250 2.0.0 OK 1372953778 d3si1064427vck.0 - gsmtp)

That looks like Google got the mail, but decided (probably due to SPF) not to deliver it. It is not in my Spam folder either! Lastly, I try to simply email the domain from an unrelated Hotmail account. This email is not delivered either, but nothing is in the Postfix logs.

For completeness sake, here is the anomitized MX record:

$ dig mx someDomain.com
someDomain.com.        1800    IN      MX      10 mail.someDomain.com.

$ dig a mail.someDomain.com
mail.someDomain.   1790    IN      A       x.x.x.x

I can confirm that x.x.x.x is in fact the correct IP address for the server, and it is the same address to which I had done telnet.

Why might the emails from legitimate email accounts (such as the hotmail account) not be delivered to the [email protected] account?

What are these flush processes?

$ ps aux | grep flush
root       710  0.0  0.0      0     0 ?        S     2012   2:29 [flush-202:1]
root     10732  6.2  0.0      0     0 ?        S    Apr14 453:33 [flush-202:80]
ubuntu   24009  0.0  0.0   8080   900 pts/3    S+   06:26   0:00 grep --color=auto flush

I notice that the flush-202:80 process often jumps to the top of top. This is on Ubuntu Server 12.04 running Apache, MySQL, and Solr processes. Googling the subject I found another SF post which mentions that these processes should never consume much CPU. The solution presented in that post mentions to reboot the system, which is exactly how I came to poke around in top and discover the processes in the first place: the system won't reboot.

Amazon EC2 lets users reserve EC2 instances. When a Reserved Instance is created, it is valid only for instances of the specific instance type (i.e. m1.Medium) and zone (i.e. us-east-1d). How can I be sure when launching a new instance that I am selecting the correct Type and Zone so that the reserved instance will be used?

Note that I did find a similar question but it seems that question is asking (and indeed, the answer fits) how to be sure that an already running instance is using the Reserved Instance. My question is how to start a new instance such that I can be sure that it will use a Reserved Instance. There are many instance types to choose from with similar names (m1.Medium, m2.Medium, m2.Micro), and there are many "sub zones" that are easily confused (us-east-1b, us-east-1c, us-east-1d). At best the use must open two windows so that he could meticulously compare his available reserved instances with the options on the Launch Instance screen.

Consider this environment:

$ cat .htaccess
AddType application/x-httpd-php .php .html
SetEnv Foo Bar

$ cat test.php
<?php
echo "Hello: ";
echo $_SERVER['Foo'];
echo $_ENV['Foo'];
echo getenv('Foo');
?>

$ cat test.html
<?php
echo "Hello: ";
echo $_SERVER['Foo'];
echo $_ENV['Foo'];
echo getenv('Foo');
?>

This is the output of test.php:

Hello BarBarBar

This is the output of test.html:

Hello 

Why might that be? How might I fix it?

Here is phpinfo.php: http://pastebin.com/rgq7up61

Here is phpinfo.html: http://pastebin.com/VUKFNZ36

If anyone knows where I can host a real webpage instead of just the HTML for one, please let me know and I'll move the content to there. Thanks.

The usual way of parsing .html files as PHP is to add either the first (PHP as an Apache module) or both (PHP as CGI) of the following lines to an .htaccess file:

AddType application/x-httpd-php .html .htm
AddHandler application/x-httpd-php .html .htm

Sometimes that needs to be x-http-php5, depending on the host:

AddType application/x-httpd-php5 .html .htm
AddHandler application/x-httpd-php5 .html .htm

However, I am now on a new host and no permeation of those lines work. In all cases the raw file is being sent to the browser, and wget shows that x-httpd-php is being presented as the Content-Type!

HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Tue, 07 Aug 2012 14:16:40 GMT
  Server: Apache
  Last-Modified: Tue, 07 Aug 2012 07:46:44 GMT
  ETag: "862239-14-4c6a83216c100"
  Accept-Ranges: bytes
  Content-Length: 20
  X-Powered-By: PleskLin
  Keep-Alive: timeout=15, max=100
  Connection: Keep-Alive
  Content-Type: application/x-httpd-php
Length: 20 [application/x-httpd-php]
Remote file exists.

Note that Length: 20 is exactly the length of <?php phpinfo(); ?>, and that is what it is serving. I have confirmed that PHP is running as a module with the terrific tip in this SO answer. I have spoken with the maintainer of the server (an associate, so even if I switch hosts I would still like to help him resolve the issue) and he does not know what the issue or correct configuration is. The server is running Plesk on a Debian-based distro, if that matters at all.

How might one escape the exclamation point in a password:

$ mysql -umyuser -pone_@&!two
-bash: !two: event not found

Trying the obvious backslash did not help:

$ mysql -umyuser -pone_@&\!two
[1] 22242
-bash: !two: command not found
[email protected] [~]# ERROR 1045 (28000): Access denied for user 'myuser'@'localhost' (using password: YES)

All my google searches suggest that the backslash would help, but it does not. There is no way to use quotes as suggested in this question. The line will be used in a .bashrc alias. Don't worry, the usernames and passwords shown here are examples only and not used in production!

Is there any way to configure Bash to print a newline or horizontal line after commands that provided more than N lines of output? For instance, after a simple cd I don't need a newline or horizontal line, but after a long cat a visual indication of the end of each command's output would be great when I am comparing the output of various commands.