nbari's questions

I am trying to configure OSPF (using bird) to reach a subnet from a router that has no direct connection to the node with the subnet, something like this:

The AS has two networks, but for testing purposes, I am announcing them in different VMs,

VM1 advertises fdad:23e:f50::/48

VM2 advertises fdba:54:32::/48

Between VM1 and VM2 I have a wireguard tunnel and can reach/ping the networks

In VM3 I would like to use network fdba:54:32::2/64, I have a wireguad tunnel between VM2 and VM3 and I can ping/reach the IP's.

The problem I have is that from VM1 I can't reach VM3 and vice versa, this is my OSPF config:

VM2 configuration:

protocol ospf v3 wg6 {
    ipv6 {
        export all;
    };
    area 0 {
        interface "wg.4242421477";
        interface "wg.stub";
    };
}

VM3 configuration

protocol ospf v3 wg6 {
    ipv6 {
        export all;
    };
    area 0 {
        interface "wg.stub";
        interface "ens192";
    };
}

From VM3 (the stub) This is the output of show route for the IP In VM1

bird> show route for fdad:23e:f50::1
Table master6:
fdad:23e:f50::/48    unicast [wg6 17:35:44.984] E2 (150/20/10000) [217.160.50.77]
        via fe80::1:45:136:71:70 on wg.stub

How to use VM2 as the router between VM1 and VM2?

In AWS when creating a Codedeploy/application, how to enable the "Enable load balancing" option using the awscli or terraform?

Using the command line I can only select/define the target group but the "Enable load balancing" remains disabled

aws deploy update-deployment-group --application-name app_test --current-deployment-group-name app_test --load-balancer-info targetGroupInfoList=[{name=test}]

I am trying to learn more about BGP / IPv6, this is my goal:

Currently, for testing, I have a VM from a provider that gives me an /44 network

This is the current configuration on that VM:

router id <IP of VM>;

define OWNASN = 1234;

protocol device {
    scan time 10;
}

protocol direct {
    ipv6;
    interface "dummy*";
}

# templates
template bgp AS1234v6 {
   local as OWNASN;
   ipv6 {
      import all;
      export filter {
        if net = 2a0e:87c0:620::/44 then accept;
        reject;
      };
   };
   graceful restart on;
}

protocol bgp VM1 from AS1234v6 {
   neighbor <ipv6 of provider> as 1111;
   source address <ipv6 of VM>;
}

protocol bgp VM2 from AS1234v6 {
   description "test delegation";
   neighbor <public IP ov VM2> as OWNASN;
   source address <ipv6 of VM>;
}

If in that VM I add an alias to the main interface, something like:

ip -6 addr add 2a0e:87c0:620::1/64 dev eth0

I then can ping from any host to that address, so far all good, but now I would like to have 3 subnets:

• 2a0e:87c0:620:1::/64
• 2a0e:87c0:620:2::/64
• 2a0e:87c0:620:3::/64

For testing and keeping things easy, I am replacing the tunnel and pfsense from the picture above with another VM.

In that VM I installed also bird2 and I am using this configuration:

router id <public IP of VM>;

protocol device {
        scan time 10;
}

protocol direct {
        disabled;
}

protocol static my_routes {
        ipv6;
        route 2a0e:87c0:620:1::/64 reject;
}

filter export_my_routes {
        if proto = "my_routes" then {
                accept;
        }
        reject;
}

protocol bgp uplink0 {
        local as 1234;
        neighbor <public IP of VM1> as 1234;
        source address <public IPv6>;
        ipv6 {
                import all;
                export filter export_my_routes;
        };
        graceful restart on;
}

With this I manage to establish a session:

$ birdc s p
BIRD 2.0.8 ready.
Name       Proto      Table      State  Since         Info
device1    Device     ---        up     19:13:19.082
direct1    Direct     ---        down   19:13:19.082
my_routes  Static     master6    up     19:13:19.082
uplink0    BGP        ---        up     19:13:22.095  Established

But if I add an alias on this new VM, I can't ping to it, I get this error:

From 2001:1900:5:4::189 icmp_seq=356 Time exceeded: Hop limit

And on the main VM (the one from the provider) I see now in the logs:

Invalid NEXT_HOP attribute

Therefore need some help on how to advertise the networks from the internal router to the external one besides how to configure then the subnets in each device so that they could be routed? wondering what gateway to use? probably fe80::1%vtnet0 ?

I have postfix compiled with blacklistd support running in a jail.

On the main host (FreeBSD 12.1) blascklistd is running with this config:

# Blacklist rule
# adr/mask:port type    proto   owner           name    nfail   disable
[local]
submission      stream  *       *               *       2       24h

How to configure postfix to notify blacklistd running on the main host?

I am capturing the user-agent using:

http-request capture req.hdr(User-Agent) len 192

And then trying to create a custom JSON log format like this:

log-format '{"User-Agent":%{+Q,+E}[capture.req.hdr(0)]}'

It works but when a User Agent includes square brackets, for example:

Dalvik/1.6.0 (Linux; U; Android 4.4.4; Ixion X LTE 4.5 [Build KTU84P])

The option +E escapes the square bracket and brakes the JSON, it creates something like:

"User-Agent": "Dalvik/1.6.0 (Linux; U; Android 4.4.4; Ixion X LTE 4.5 \[Build KTU84P])"

When the UA contains extra quotes there is no problem:

"User-Agent": "this \"works\" fine"

Therefore wondering if there is a way to specify escaping only double quotes or alternatives to make the log format JSON compatible

I am enabling stats with something similar to this configuration:

global
  log /var/run/log local0 info

defaults
  log global

listen stats
  bind *:9090
  stats enable
  stats auth secret:pass
  stats refresh 5s
  stats show-legends
  stats show-node
  stats uri /stats

They work but now I would like to know if there is a way to preventing the stats to emit logs, currently, In my logs, I have multiple lines like:

Connect from x.x.x.x:33970 to y.y.y.y:9090 (stats/HTTP)

Any idea of how to prevent to log the stats requests?

I already tried in the listen stats definitions without success:

 http-request set-log-level silent

I need to take a backup of an SQLite3 DB matching the state of other applications writing to disk, besides a vault using the filesystem as a backend.

I need to do this in a system with no ZFS so no snapshots could be taken.

Currently trying a basic script with something like this:

DAY=$(date +%d)

TDIR=$(mktemp -d)
cleanup() {
    test -n "${TDIR}" && test -d "${TDIR}" && rm -rf "${TDIR}"
}
trap cleanup EXIT

# define and create the working directory
WRKDIR="${TDIR}/${DAY}"
mkdir "${WRKDIR}"

# take dump of the sqlite db
sqlite3 /data/data/test.db ".backup '${WRKDIR}/test.db'"

# backup the vault keys
cp -R /data/vault/ ${WRKDIR}/vault

# backup logs
cp -R /data/logs/ ${WRKDIR}/logs

Is there any benefit or performance gain when using keepalive on an upstream that is using a UNIX socket as a server, for example:

upstream test {
    server unix:/tmp/test.sock;
    keepalive 60;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    location / {
        proxy_pass http://test;
        proxy_http_version 1.1;  
        proxy_redirect off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

From my understanding when using a UNIX socket there is no TCP three-way handshake so the keepalive 60; in the example don't apply, is this correct?

What are the pros/cons of using a resolver per location, I found this configuration on a server but my guess is that it not "re-resolving" since the proxy_pass is not also using a variable

location /foo {
    proxy_pass http://foo_backends;
    resolver 10.0.0.2 valid=300s;
    resolver_timeout 10s;
}

location /bar {
    proxy_pass http://bar_backends;
    resolver 10.0.0.2 valid=300s;
    resolver_timeout 10s;
}

From the docs:

When you use a variable to specify the domain name in the proxy_pass directive, NGINX re‑resolves the domain name when its TTL expires.

Therefore if I am right the previous configuration could be rewritten like this:

resolver 10.0.0.2 valid=300s;
resolver_timeout 10s;

location /foo {
    set $foo_backend_servers foo_backends.example.com;
    proxy_pass http://$foo_backend_servers;
 }

location /bar {
    set $bar_backend_servers bar_backends.example.com;
    proxy_pass http://$bar_backend_servers;
 }

Is this correct or there is some trick when using location per location? could it be that by using a resolver per location there is no need to create a variable and pass it to proxy_pass?

I am trying to setup some IPV6 address on a FreeBSD 11 server, I was told to use as a gateway this IP:

2001:4ba0:fffd:1:beef::1 /128

My addresses are:

2001:4ba0:fffd:0063::0 /64

I tried this:

ipv6_activate_all_interfaces="YES"
ipv6_defaultrouter="2001:4ba0:fffd:1:beef::1"
ifconfig_bge0_ipv6="inet6 2001:4ba0:fffd:0063::1 prefixlen 64"

But I get this message:

route: writing to routing socket: Network is unreachable
add net default: gateway 2001:4ba0:fffd:1:beef::1 fib 0: Network is unreachable

By doing an npd -a I got this:

> ndp -a
Neighbor                             Linklayer Address  Netif Expire    S Flags
2001:4ba0:fffd:63::1                 2c:44:fd:9a:3f:90   bge0 permanent R
fe80::1%bge0                         28:92:4a:cd:08:18   bge0 22h8m42s  S R
fe80::2a92:4aff:fecd:818%bge0        28:92:4a:cd:08:18   bge0 23h27m31s S R
fe80::2e44:fdff:fe9a:3f90%bge0       2c:44:fd:9a:3f:90   bge0 permanent R

Then I give a try to use as a default router fe80::1.:

ipv6_activate_all_interfaces="YES"
ipv6_defaultrouter="fe80::1%bge0"
ifconfig_bge0_ipv6="inet6 2001:4ba0:fffd:0063::1 prefixlen 64"

When using the link-local fe80::1 address as the gateway, IPV6 works.

I would like to know what are the advantages/disadvantagtes of using the link-local address as the gateway and also how to use the provied gateway or using either is the same ?

While using FreeBSD 11 on Google Compute engine creating a vpn with openvpn & l2tp (mpd), I notice that the network speed was extreamly slow, first I disable the TSO:

ifconfig vtnet0 -tso

But didn't work, therefore I disable the full vtnet checksum offload by adding this line to the /boot/loader.conf file:

hw.vtnet.csum_disable="1"

After doing that network speed boosted noticeable.

But wondering if this could raise other issues or is totally fine to disable it been an virtual environment?

I have configured HAProxy with a single Frontend and Backend, from the stats page I see the following stats:

system limits: memmax = unlimited; ulimit-n = 20013
maxsocs = 20013; maxconn = 10000; maxpripes =0
current conns = 361; current pipes 0/0; conn rate = 27/sec
Running tasks: 1/366; idle = 98%

On the Frontend on the Sessions section I see:

Cur: 360
Max: 427
Limit 2000

An on the Backend:

Cur: 0
Max: 3
Limit: 2000

To simplify I attach the image with this numbers:

The thing that I don't properly understand, is why if the current connections are: 361, the Backend has 0.

Could it be that HAproxy limit/queue the incoming connection to some how protect the backend(s), due the timeout queue setting?

How to know the time it takes the Frontend to contact the Backend?

This is the test configuration I am using:

global
    maxconn 10000
    spread-checks 3
    log /var/run/log local0 notice
    daemon
    tune.ssl.default-dh-param 2048
    ssl-default-bind-options no-sslv3 no-tls-tickets
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5:!DSS
    ssl-default-server-options no-sslv3
    ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5:!DSS
defaults
    balance roundrobin
    option http-server-close
    option abortonclose
    option dontlognull
    mode http
    timeout check           3s
    timeout client          30s  # Client and server timeout must match the longest
    timeout connect         5s
    timeout http-keep-alive 10s
    timeout http-request    10s  # A complete request may never take that long.
    timeout queue           10s  # Don't queue requests too long if saturated.
    timeout server          10s  # Time we may wait for a response from the server.
    retries 3
    log global
    errorfile 408 /dev/null
frontend http-in
    bind *:80
    option httplog
    option forwardfor if-none
    default_backend nodes-http
backend nodes-http
    option httpchk GET /
    http-check disable-on-404
    rspirep ^Cache-Control Cache-Control:\ public,\ max-age=60,\ must-revalidate
    server node1 :8000 maxconn 2000 check

Thanks in advance.

I am working on a VPS with 512 of RAM, I installed mysql, run the command top and found that the value of SIZE for mysql is 638M:

last pid:  2023;  load averages:  0.17,  0.19,  0.21                                                                                              up 0+03:05:43  19:26:01
27 processes:  1 running, 26 sleeping
CPU:  0.4% user,  0.0% nice,  1.2% system,  0.0% interrupt, 98.4% idle
Mem: 60M Active, 216M Inact, 94M Wired, 59M Buf, 104M Free
Swap: 1024M Total, 1024M Free

  PID USERNAME       THR PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
 1324 mysql           30  20    0   638M   168M uwait    2:12   0.00% mysqld

From the man page I got this:

SIZE is the total size of the process (text, data, and stack)

Having only 512M of RAM on the VPS, I though I was consuming all memory but based on the MEM line seems that not:

Mem: 60M Active, 216M Inact, 94M Wired, 59M Buf, 104M Free

Therefore I would like to know what more detail how the SIZE and RES are calculated and how to properly interpret them.

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify things, otherwise login to each machine makes things very complicated.

Instead of sending all the host logs via syslog with something like:

*.* remote.log.host

I would like to only send the logs related to the application, in theory svlogd is capable of doing this, from the docs:

ua.b.c.d[:port]
    tells svlogd to transmit the first len characters of selected log messages to the IP address a.b.c.d, port number port. If port isn’t set, the default port for syslog is used (514). len can be set through the -l option, see below. If svlogd has trouble sending udp packets, it writes error messages to the log directory. Attention: logging through udp is unreliable, and should be used in private networks only.
Ua.b.c.d[:port]
    is the same as the u line above, but the log messages are no longer written to the log directory, but transmitted through udp only. Error messages from svlogd concerning sending udp packages still go to the log directory.

The content of my config file /service/my-service/log/main/config:

u127.0.0.1:5514 

or

U127.0.0.1:5514

For testing I created a very basic UDP server/client, but for an unknown reason svlogd is not sending the logs, I also give a try with netcat using this:

nc -ul 5514

The log run script I am using for this /service/my-service/log/run:

#!/bin/sh

exec svlogd -tt ./main

The only error message I get is:

warning: failure sending through udp: 

A work around I have been using is to call logger within the log run script, something like:

#!/bin/sh

exec chpst -u nobody logger -i -h remote.host.tld -P 42060 -t my-app

But with this approach I lose all the advantage of svlogd besides the sv status . is always on/off (1,0) since logger don't run like daemon.

At the end I would like to continue having the logs from svlogd but been available to make work the ua.b.c.d[:port] option.

Update: Doing a ktrace this is what I get:

  4909 svlogd   CALL  socket(PF_INET,SOCK_DGRAM,IPPROTO_IP)
  4909 svlogd   RET   socket 7
  4909 svlogd   CALL  fcntl(0x7,F_GETFL,0)
  4909 svlogd   RET   fcntl 2
  4909 svlogd   CALL  fcntl(0x7,F_SETFL,0x6<O_RDWR|O_NONBLOCK>)
  4909 svlogd   RET   fcntl 0
  4909 svlogd   CALL  sendto(0x7,0x609580,0x3c,0,0x609c3c,0x10)
  4909 svlogd   STRU  struct sockaddr { AF_UNSPEC, unknown address family }
  4909 svlogd   RET   sendto -1 errno 47 Address family not supported by protocol family
  4909 svlogd   CALL  write(0x6,0x609760,0x62)
  4909 svlogd   GIO   fd 6 wrote 98 bytes
       "warning: failure sending through udp:

STRU struct sockaddr { AF_UNSPEC, unknown address family }

Any ideas ?

While trying to setup an Ubuntu Linux server as a client to an l2tp/IPSEC server, I notice inconsistencies while trying to send data.

The tunnel/VPN establish the connection / handshake properly and from the client I can ping / ssh to all the machines as expected.

I notice the problem while trying to send data from the client to a remote machine while using scp.

I can copy / get anything without problems:

scp user@vpn:/tmp/test.file

But if I try to send data and the file size to be sent is > the vpn MTU (1280):

scp /tmp/test.file user@vpn:/tmp

I get a "Packet Corrupt" message.

Without success I tried this: ethtool -K eth0 tx off

Using tcpdump I notice that all outgoing packages no matter the size all contain the DF flag, for some reason packages going through the ppp0 interface where not fragmented.

The configuration I am using is:

ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1280
mru 1280
defaultroute
usepeerdns
debug
lock
connect-delay 5000

Some of the logs I get:

pppd[26423]: sent [LCP EchoReq id=0x1 magic=0x4501dc87]
pppd[26423]: rcvd [LCP EchoRep id=0x1 magic=0xd6736575]

If I send files in chunks bigger than the MTU:

pppd[12603]: Protocol-Reject for unsupported protocol 0xb8af
pppd[12603]: rcvd [LCP ProtRej id=0x8 ...]

A way around to this is to use rsync and limit the outgoing bandwidth:

rsync -vvv --bwlimit=16 -P -e "ssh -i ssh_key.pem" /tmp.test.file user@vpn:/tmp

Other clients running iOS / OS X from same network have no issues at all, both can send/get data with out any problems, therefore I am not suspecting a problem with the VPN server.

Any ideas or possible patches to fix this issue?

I have configure Nginx with the upload_module.

I can upload & resume files but anybody can post to the /upload location.

is there a way of making the location /upload internal and use X-Accel-Redirect so that only authenticated users could post files?

Or any idea of how to secure the server so that only certain users could post files, having the authentication logic on the application side?.

I have a Dell Poweredge 2900 III with FreeBSD 9 (amd64), the server uses mfi wich handles a raid10, I had to reboot the server, but notice that either when rebooting or shutting down the server, something is going wrong, besides taking to much time to reboot/shutdown, after rebooting I notice that that some ldap instances within some jails could'nt start and this was because the database was corrupted.

This make me think that probably something was wrong with the disks or mfi card, but checking the disk array / logs everything seems to be working fine.

My set up is something like this:

Host server has the minimum base of FreeBSD 9 amd64, within I create some jails, the ones contain services like mysql, email, and some others ldap.

With FreeBSD 7 and 8 I didn't notice this behavior but with FreeBSD 9 something is not working well. I did a clean installation of FreeBSD 9 and root filesystem is using ZFS.

Attached is an image hoping some one can give me a hint of what to check or any kind of advice.

reboot capture screen image

I am using the latest XenCenter 6.0.2, On a Xenserver version 6.0.0 when doing a right click on the VM I get a menu that has options for a Shut down and Reboot.

ON a server with XenServer 6.0.2 the same VM does not show the Shut Down / Reboot option.

Any idea of how to enable the Shutdown/Reboot options ?

the VM are running FreeBSD 9 amd 64, could it be something related to hardware compatibility, the server that does not show the Shutdown/Reboot is a Dell poweredge 2900 III.

I was testing XenServer 5.6 100-47101p, I installed four VM's, two FreeBSD and two Windows.

After installing the four VM's, I recompiled the VM containing FreeBSD 8.2 i386 kernel to enable/support XEN, after rebooting, the console on the XenCenter, did not show nothing (buggy kernels normally do not boot), I tried to force Shutdown/force Reboot the VM, but nothing happened, on the logs I got the common message that the stop or reboot could not be done because a pending task.

via ssh on the XenServer, I tried the: xe task-list xe task-cancel force=true uuid=, xe vm-shutdown, etc but nothing worked. the only way to stop the VM was to reboot the XenServer and disabling the Auto-Start on server boot on the properties of the VM.

After rebooting the full Xenserver (all other VM went down ), I started again the FreeBSD 8 (buggy KERNEL) to debug or found something on the console, but instead of getting at least the BIOS of the boot process I got the console for the WINDOWS OS, images below:

And again I couldn't stop, restart, or delete the VM.

After rebooting the server, the same behavior happens, someone XenServer is not properly holding/encapsulating the VM at a point that allow or shares the VNC of another VM within the buggy instance, this is for sure a bug.

But I would like to know, how to prevent rebooting the Xenserver every time something like this happens, since I want to test different FreeBSD kernels, but is a pain to reboot the full server affecting other working VM, since currently I can not stop/delete/reboot the test VM instance.

In theory XenServer should have the ability to properly isolate the VM instance, but as explained here is not properly doing it. And in my case it not being useful for testing since Is like having a single machine the one I have to reboot every time freezes.

So, any ideas of how to solve this, excluding changing XenServer with something like VMWARE ESXI in where indeed this issue doest not happen.?

Does XenServer uses the same code/source of the open-source the Xen project? does it make any difference related to this issue use either one of them?

just for the record, I have successfully installed FreeBSD 8.2 amd64 and FreeBSD 9 BETA both with XEN support enable on the kernel with out any issue, but besides the OS the point is that if some one else want's to test any KERNEL, LINUX ETC the VM should be isolated, otherwise is very difficult and tedious to make this kind of tests.

If some would like to replicate this, just needs to install FreeBSD 8.2 i386 (install the sources) and later recompile the kernel using the XEN options (usr/src/sys/i386/conf/XEN)

#cd /usr/src
#make buildkernel=XEN
#make installkernel=XEN

reboot and you will crash something inside XenServer that wont allow you to delete/stop/remove this VM.

on the XenServer Eventlog you will see this: Error: Another operation involving the objects is currently in progress

for the installation I am using the FreeBSD-8.2-RELEASE-i386-disc1.iso

MD5 (FreeBSD-8.2-RELEASE-i386-disc1.iso) = ac6b2485e0e8a9e3c5f3a51803a5af32

I am used to work with FreeBSD jails but I wanted to give a try to XenServer 5.5 / Vmware ESXI 5, hoping it can really limit resources per VM, after installing a couple of Virtual Machines, I tried to execute on one small VM (512RAM, 1 VCPU), (server has 8GB ram 2 processors) the following code:

$ cat > fork.c    
#include <stdio.h> 
int main() { while(1) fork(); }
$ gcc fork.c -o bomb
$ ./bomb

On a FreeBSD server with out virtualization (no Xenserver/Vmware) that code will kill the machine and a hard reset needs to be done, but I was surprised that on XenServer the behavior is "almost" similar causing some damage.

The XenServer started to consume all the CPU available, and the other FreeBSD VM start to have poor performance.

On the other hand, using the latest version of Vmware Exi, the bomb only affected the Virtual machine that fired the fork bomb, the CPU for the full server did not start consuming all the resources, just approximately 40% of it, at a point that it allow me to create a second VM and run a second bomb on it, with out noticing performance on the rest of the VM. Having 2 bombs running at the same time the total use of CPU was of 90%.

In my case I just use FreeBSD but still haven't found away to prevent a fork bomb that can kill the host server, using XenServer did not help much. Vmware looks promising but is out of question because of the cost.

So, any idea of how to fine tune Xenserver or Freebsd to handle fork booms ?