Daniel's questions

I'm struggling with a strange issue that "logs out" users and seems to happen about ten times a day.

The application is an old PHP project. Clients log in; a PHP session is established. Sometimes if a client does nothing for e.g. 2 hours and afterwards sends a new HTTP request, Apache answers with a HTTP 408 error:

1.2.3.4 - - [17/Apr/2020:12:26:30 +0200] "-" 408 3281 "-" "-"

and the user is being sent to the Login page and has to enter their login credentials again, losing their data they have filled in into a form etc. I can't really reproduce the issue, in most cases an idle client can send the next request even 5 hours later and doesn't trigger a 408. It seems pretty random and for all browsers.

I can only reproduce the 408 error if I manually delete the PHP session file on the server. Also strange is that if I do that, I don't see the 408 in Chrome Developer Toolbar, only in the Apache logs.

The Session timeout is high (72 hours). These parameters are configured:

php_value session.gc_maxlifetime 259200
php_value session.gc_divisor 1
php_value session.gc_probability 1
php_value session.cookie_lifetime 0

Now I've read a lot about KeepAlive, but I think that is not the cause as there is not much traffic on the site. And we're talking about hours in between, not seconds.

Is this a common issue and someone can point me in the right direction?

EDIT:

session_unset() is unused in the project. session_destroy is only being called when a user logs out. By deleting the session file in /var/lib/php/sessions the user is logged out of course, hence it redirects to login.php. Seems ok to me. So I think the session file is somehow removed.

I also see this in the error.log:

[Fri Apr 17 22:42:32.386978 2020] [:error] [pid 15563] [client 1.2.3.4:55104] PHP Notice:  session_start(): ps_files_cleanup_dir: opendir(/var/lib/php/sessions) failed: Permission denied (13) in /var/www/myproject/htdocs/sessionReload.php on line 2, referer: https://myproject/page.php

Line 2 in sessionReload.php is:

session_start();

I'm using the official Docker image nextcloud:latest to run my Nextcloud instance. I managed to install Elasticsearch (on the host) and created an index. Search works so far.

Now I want to OCR PDFs and installed the Tesseract plugin in Nextcloud. However PDFs don't get OCR'd, I suspect it is because tesseract isn't available within the official Docker image.

How can I solve this, or do I have to create my own Docker image from scratch?

I need to allow a specific command on a Debian Linux box for a single user. I've tried this in the /etc/sudoers file:

# User privilege specification
zabbix  ALL=NOPASSWD: /usr/bin/apt-get --print-uris -qq -y upgrade 2>/dev/null |awk '{print $2}' | wc | awk '{print $1}'

This does not work as expected. If I run the command as user zabbix with sudo, it asks for the password (although I have specified the NOPASSWD option).

However, this works:

# User privilege specification
zabbix  ALL=NOPASSWD: /usr/bin/apt-get

But has the drawback that all subcommands of apt-get are allowd. Is there a way how I can fix this to only allow a specific command?

I run a Linux server in a subnet that is not under my control. From time to time, the server can not be reached from outside (the Internet) for a few seconds. I'm trying to trace why and started to have a look on the output of ip neigh show (written out to a file regularly with a cron job).

The next time it happened I looked at the file, and it read:

fe80::1 dev eth0 lladdr 00:22:64:b6:10:5c router STALE
192.168.14.1 dev eth0  FAILED

For me, this looks like the gateway (which is 192.168.14.1) does not respond on ARP requests made by the server. Is this correct?

I was trying to find more information, particularly in the iproute2 source code, but didn't find under which condition it would write out FAILED. But maybe that's because I'm not a C developer.

I want to create a soft RAID-5 and use UUIDs im the mdadm config file. So I have four disks with 1 partition each that spans the whole disk. But since the partitons don'5 have a filesystem, blkid does not give a UUID. Is there a way to do that?

My server has three default gateways, how can that be? Shouldn't there be one default gw?

I have three NICs, each attached to a separate subnet:

server1:~#  route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.5.0.0        *               255.255.255.224 U     0      0        0 eth3
localnet        *               255.255.255.224 U     0      0        0 eth0
192.168.8.0     *               255.255.255.192 U     0      0        0 eth1
default         10.5.0.1        0.0.0.0         UG    0      0        0 eth3
default         192.168.8.1     0.0.0.0         UG    0      0        0 eth1
default         10.1.0.1        0.0.0.0         UG    0      0        0 eth0

Sometimes, I can't ping a host on the Internet, sometimes I can. What I want is traffic to the Internet (0.0.0.0) routed through a specific NIC. Can I just add a route for 0.0.0.0 and default gw to one of the eth0-3 interfaces? Will it break my connection?

I'm using Debian, here is my /etc/network/interfaces:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
    address 10.1.0.4
    netmask 255.255.255.224
    network 10.1.0.0
    broadcast 10.1.0.31
    gateway 10.1.0.1

allow-hotplug eth1
iface eth1 inet static
        address 192.168.8.4
        netmask 255.255.255.192
        network 192.168.8.0
        broadcast 192.168.8.63
        gateway 192.168.8.1

allow-hotplug eth3
iface eth3 inet static
        address 10.5.0.4
        netmask 255.255.255.224
        network 10.5.0.0
        broadcast 10.5.0.31
        gateway 10.5.0.1

I have a pretty busy GNU/Linux server that I think needs more RAM. I know that the free command doesn't show the amount of RAM that is used.

So I was stumbling upon Commited_As in /proc/meminfo. It currently shows 57972 kB which isn't much. Is this the amount of RAM that the processes use "right now" or is this an estimate of how many additional RAM it would take to never run out of memory with this load?

I am trying to set up port forwarding with iptables.

I've read several stuff (including here on serverfault) but every example I try fails.

I have a Debian GNU/Linux box with a globally routed IP address, say 1.2.3.4. I also have an internal network 192.168.15.0/24, which has one host (192.168.15.2) in it.

I simply want port 2200 on 1.2.3.4 forwarded to 192.168.15.2:22, so this is what I've done:

iptables -A PREROUTING -t nat -p tcp --dport 2200 -j DNAT --to 192.168.15.2:22
iptables -A INPUT -p tcp -m state --state NEW --dport 2200 -j ACCEPT

However, this does not work. If i try to ssh to 1.2.3.4:2200, I get "Connection refused".

Trying for over 3hrs now and I'm feeling like I've tried everything and there must be something wrong.

IP forwarding is on:

[email protected]:~# cat /proc/sys/net/ipv4/ip_forward
1

I have set up a BIND9 on a Linux box and I'm playing with the nsupdate command for some time now. It works pretty good for changing a zone's RR (commands update create and update delete). I am wondering how new zones should be created. There seems no way that nsupdate can do this.

So far, I've always copied an existing zone file and changed it afterwards. However, I am looking for a less painful way. I am interested how you guys do that.

I have set up a BIND 9 server and configured cryptographic keys in order to allow updates from a client. Now in my named.conf, I have set the following:

allow-update { key dns1.example.org.; };

This works and I can perform updates (add, delete zone records) from my client (nsupdate command).

I am wondering if I can combine it with an ACL. Basically I want that the client needs the correct key, but also must come from a certain subnet or IP address. Can I do this somehow? I failed to find anything about that scenario in the docs.

I have a QEMU image myserver.img that is about 20GiB. The file serves as a "virtual" hard disk for the server. Now the first 512 bytes contain the MBR, and I am trying to overwrite those bytes with zeroes. On a normal disks, this one would work:

dd if=/dev/zero of=/dev/sda bs=512 count=1

But when I try that on the image file, the file gets overwritten and is only 512 bytes in size (instead of 20GiB). Is there a way to change only the first 512 bytes, preferably with dd?

I'm wondering if there is a way to query a DNS server and bypass caching (with dig). Often I change a zone on the DNS server and I want to check if it resolves correctly from my workstation. But since the server caches resolved requests, I often get the old ones. Restarting or -loading the server is not really something nice.

Can I manage a QEMU guest from the host's CLI? I'm coming from Xen and I liked the xm command. I'd like to shutdown the guest, attach PCI devices to it and so on. Is there a way?

There's the QEMU monitor, but I'd really like to have a "scriptable" solution.

I'm using libvirt with Xen 4. Every time I use the virsh tool, it takes a long time until it's started. I start virsh on the same machine where the Xen hypervisor resides.

Example:

root@xen1:~#: time virsh list
 Id Name                   State
------------------------------------
  0 Domain-0               running


real    0m6.505s
user    0m0.000s
sys     0m0.020s

How can I speed this up? It also happens when I run virsh without arguments. I don't get any errors, even in the log file.

How can I selectively install a package from the centosplus repository in CentOS 6.0? If I enable that repo and run a yum update, it would install other packages (newer kernels etc.) too. I just need one package from centosplus, but I'd like to get everything else from the base repository.

What does mdev mean in ping output (last row below)?

me@callisto ~ % ping -c 1 example.org   
PING example.org (192.0.43.10) 56(84) bytes of data.
64 bytes from 43-10.any.icann.org (192.0.43.10): icmp_seq=1 ttl=245 time=119 ms

--- example.org ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 119.242/119.242/119.242/0.000 ms

I am looking for a way to visualize writes to a big file (2GB) in real-time. The writing process isn't just appending data to the end of the file. Instead, it acts like a container or like a block device. So data is written anywhere within the file.

Is there a tool that shows me which parts of the file are changing? It does not need to be precise - in fact - I just need to know wheter it's at the beginning, in the middle or end of the file. Best would be a tool that works on the CLI.

I was unable to find such a tool, but maybe someone here can help.

I have a Xen-enabled host and Libvirtd running on a machine. The LAN (on eth0) is 192.168.1.0/24, and the host has 192.168.1.174 as its main IP address.

Now what I want to do is to create a domU instance (using virt-install) and have it on that physical network, giving an IP address like 192.168.1.200.

I have no bridges except one NAT bridge I was able to set up with libvirt:

root@host:~/xen# brctl show
bridge name bridge id       STP enabled interfaces
nat     8000.feffffffffff   yes         vif13.0

The nat network works perfectly. Is there a way to create a bridged network using libvirt alone? Can someone please provide me the XML for it?

I need to log disk statistics (MB/read, MB/write) of block devices. As I understand, iostat shows an average value. This is not exactly what I want when I'm about to monitor a server. Is there a way to show current values rather than the average?

Thanks