ddinchev's questions

I'm using G SUITE to accept mail for my domain, so I've set my SPF record as recommended by Google to v=spf1 include:_spf.google.com ~all. Now I want to send emails from my webservers and I want to add them to my SPF record. Google suggests that I add the IP of my additional server to the SPF record like this:

v=spf1 ip4:1.2.3.4 include:_spf.google.com ~all

However, I have multiple web servers and I'd prefer any of them to be able to send emails. Is the following valid?

v=spf1 +a include:_spf.google.com ~all

I have a domain like images.example.com served from Apache server. The requests that go there currently are images that are drawn using server-side language (PHP) and are cached on the application side but it seems like huge overhead to me.

Is there an easy way (Apache module) to cache every request that goes to images subdomain so that it doesn't reach the PHP at all, if it's still in the cache?

I want to pipe a stream to split. I know how big will be the stream in bytes (very big, comes from network), I want split to create N files of relatively equal size, without splitting lines in half. Is it possible to achieve that. Something like:

cat STREAM | split $SIZE_OF_STREAM $NUMBER_OF_FILES_TO_PRODUCE

I could not find a way to achieve that through docs, I'm sorry if it was obvious but I couldn't find it.

I want to have a custom "stop" script runit (runsv) to execute when having to stop/restart the process. Currently it simply kills the process, then runs the "finish" script. But in my case, my process spawns dynamically child processes, so instead of simple kill, I need a "killtree" to get rid of them. How do I do that?

I know it should be done through the control options of runit but from reading the docs its not really clear to me how the stop script should be named :(

http://smarden.org/runit/runsv.8.html

In Ubuntu I could do something like:

sudo echo something | logger -t logstuff

Then I would get well formatted message in syslog (/var/log/messages). On Debian Squeeze that isn't the case, the above command would not log there.

It would also be nice if I could log as normal user there...

Any ideas are welcome.

I'm pretty new to runit. I installed it on a Ubuntu host.

What I did:

1) created a dir testrun in /etc/sv

2) created a script run in /etc/sv/testrun/run, the script content:

#! /bin/bash
exec /root/FP/annotate-output python /root/FP/test.py | logger -t svtest

3) If I call directly /etc/sv/testrun/run it executes successfully

4) I run sv start testrun (or sv run testrun, sv restart testrun), all of them end up with the same error msg:

fail: sv: unable to change to service directory: file does not exist

Any ideas what am I doing wrong? I'm new to runit and base all my actions on the information found here: http://smarden.org/runit/

I installed rssh on CentOS 5 from RPMForge. Then I tried to change the shell to rssh to one existing user like this:

[root@ddinvps ofertoza]# chsh -s /usr/bin/rssh ofertoza
Changing shell for ofertoza.
Warning: "/usr/bin/rssh" is not listed in /etc/shells
Shell not changed.

OK, I added /usr/bin/rssh to /etc/shells and now I don't get the warning, just this:

[root@ddinvps ofertoza]# chsh -s /usr/bin/rssh ofertoza
Changing shell for ofertoza.
Shell not changed.

Any ideas why would this happen? It's a normal user with /home/ofertoza as home dir. I want to use rssh to restrict the access for sftp/scp to only that dir where will reside the files of one website.

I have a VPS where I have successfully set up VPN. I connect with OpenVPN client. The VPN server interface is 10.8.0.1 and the client receives 10.8.0.? IP. And I am able to ping 10.8.0.1. I also seem to be able to do telnet to 10.8.0.1:80, 10.8.0.1:443, etc standard ports with working services on them but not 10.8.0.1:3306.

This is the VPN connection as printed by ifconfig:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:383 errors:0 dropped:0 overruns:0 frame:0
          TX packets:358 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:29356 (28.6 KiB)  TX bytes:149232 (145.7 KiB)

MySQL is not binded to any IP, so it receives connections from anywhere. I want to cut it's visibility by IPTABLES.

Then I added these rules to IPTABLES:

# allow connections from the vpn
iptables -A INPUT -s 10.8.0.0/24 -p tcp --dport 3306 -j ACCEPT
# allow local connections eg your scripts running locally
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 3306 -j ACCEPT
# deny any other attempts of connecting to mysql
iptables -A INPUT -p tcp --dport 3306 -j DROP

Now I'm able to connect to 127.0.0.1 from the server itself. I'm not able to connect to the server by it's public IP. And I'm not able to connect to it through 10.8.0.1 (VPN IP).

This is my full IPTABLES:

[root@ddinvps mail]# iptables -L -n
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:1723
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
icmp_packets  all  --  0.0.0.0/0            0.0.0.0/0
tcp_packets  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  10.8.0.0/24          0.0.0.0/0           tcp dpt:3306
ACCEPT     tcp  --  127.0.0.1            0.0.0.0/0           tcp dpt:3306
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain icmp_packets (1 references)
target     prot opt source               destination
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 3
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 11
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
DROP       icmp --  0.0.0.0/0            0.0.0.0/0

Chain tcp_packets (1 references)
target     prot opt source               destination
ACCEPT     all  --  127.0.0.1            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:26
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  10.3.124.200         0.0.0.0/0           tcp dpt:9102
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:143
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:993
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:10000
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0
DROP       udp  --  0.0.0.0/0            0.0.0.0/0

Any ideas?

I have a VPS with MySQL 5.5, which is listening only on localhost because of obvious security reasons. I have set up VPN connection from my own machine to that VPS and I connect successfully.

What would be the best way to grant same access to all MySQL databases to anyone connected to the VPN as if it was a localhost request?

I might be asking this question in rather silly way, so if you don't get my idea, I will elaborate.

edit: The VPS is Linux (Cent OS 5.6), if that helps. MySQL is listening on 3306. I have currently forwarded all connections that come from my IP to port 3306 on the public address of the machine to 127.0.0.1:3306. But this is not very convenient, as I tend to travel and when I'm not at home, this method fails.

OK, so lets say I have a Nagios setup that monitors different services using the so-called nagios-plugins.

What would be the best practive for my nagios plugin (probably written in python) to determine if given service is running OK?

The particular service in question is a python socket server that listens on some port. So I will make sure nagios frequently checks that service and if it stops responding / dies, I should restart it. What should I do to know if the socket server is alive? Eventually how would I check if it is responding.

I have control over the service - I can change the way it works if that would help me determine it's health state.

Any ideas are welcome!

OK, guys, sorry for my probably stupid questions but I'm very new at this. I was assigned to research how to use Nagios to monitor different services and if a service falls down, to attempt to restart it and send out notification. Nagios seems to be huge software and I don't find the docs to be very friendly for a newcommer like me...

I've successfully installed Nagios on a Debian box, I've configured the web interface and now I'm frustrated.

So, I want to be able to monitor a service. I can write all the logic as a python plugin probably - I can write a command_line program in python that will read in the parameters supplied by Nagios, return the status code, message, etc but I do not know where to put that plugin, how to configure it so that Nagios is aware if it.

I also do not know how to attach event handlers if service' status changes - to implement some logic like restarting the service, etc.

Any help will be very appreciated - a link to tutorial might be all I need, just point me the direction.