Tag Info

New answers tagged

0

You are not able to do this with chrome. Instead, curl is the tool you are looking for. curl <website url>:80 (or 443 for https) from there, if you need to check something specific, you can grep out for what you are looking for. Or if you are creating a heath check style and just want to make sure it is up. -I flag will return the header which will ...


0

We ended up solving this issue by using another rule to not scan the URI. SecRuleUpdateTargetById 950120 !ARGS:REQUEST_URI This way this particular rule would not scan the URI but would still be scan the rest of the packet. It should be noted that this rule needs to be replicated for every rule you have.


0

Having been searching for a solution to my dnat to 127.0.0.1 failing, found the answer on the netfilter irc channel. It seems there is a sysctl setting preventing dnat to loopback. To allow it sysctl -w net.ipv4.conf.eth0.route_localnet=1 and to check the setting. cat /proc/sys/net/ipv4/conf/eth0/route_localnet


1

systemd logs all messages (startup/stop) to /var/log/message using syslog, the errors line you see are basically all matching lines for "nginx" with tail option. Its something =~ grep nginx | tail which will display the last 10 lines of the /var/log/message for "nginx" grep. Basically systemctl displays last 10 lines from log to help user identify the ...


0

Man page If you spec- ify both a day in the month and a day of week, it will be interpreted as the Nth such day in the month. [...] To request the last Monday, etc. in a month, ask for the "5th" one. This will always match the last Monday, etc., even if there are only four Mondays in the month: # run at 11 am on the first and last Mon, ...


0

That server predates Ubuntu! It's too old :) But honestly, you'll need an old HP Firmware disk or a supported operating system to run firmware updates on that controller. Here are the controller updates. Remember, this server went end-of-life in 2004 or 2005, so it's a decade old. Firmware updates weren't as important back then, so you're probably not ...


0

There is no command for this. You should ask your hosting provider to examine log files. Probably you have some backdoor with your CMS files. It uses your system() or similar function to manage the malicious PHP files. So, first of all, you should disable dangerous PHP functions exec/shell_exec/system/passthru for you account.


0

If you invoke the unix command ls -l (path-to-file) that should reveal the owner of the files. Use the popen() function so you can get stdout. Of course, if someone maliciously put them there, then the file owner information may not reflect who really put them. But I guess that and the timestamp on the files may give you some leads. Instead of using a ...


0

Assuming you have Chrome installed, and it somehow refreshes hourly, then you can use the import command, included with ImageMagick, to take a screenshot. If everything works as expected, setup a cronjob to run the import command once an hour. For CentOS: yum install ImageMagick ImageMagick-devel # I did not test this. For Ubuntu: apt-get install ...


0

After a lot of a research, and trial and error, it turns out this is pretty easy to do. You do have to run multiple instances, one per bridge, in order to isolate all of the users to their respective networks. You just add a new .conf file for each instance and Debian will automatically create a new instance per .conf file. Just make sure you use different ...


2

Run it with wineconsole instead. For example: wineconsole gwbasic.exe If you don't have a GUI then this will simply use the terminal as you expect, though it will take advantage of the GUI if you have one. Note that if you receive the message that "Application tried to create a window, but no driver could be loaded." it means your "console" application ...


0

I tried to set the root password by following Daffs instructions, but the issue persists. After a lot of troubleshooting it appeared that the cn=Manager,dc=my-domain,dc=com on CentOS 7 resides in dn: olcDatabase={2}hdb,cn=config instead of dn: olcDatabase={0}config,cn=config. After issuing ldapmodify -Y EXTERNAL -H ldapi:/// -f rootpw_cnconfig.ldif, ...


0

I ran into this problem on Fedora. Eventually I noticed: root@wisdom:/etc/ssh# ll total 268K drwxr-xr-x. 2 root root 4.0K Jun 30 06:06 ./ drwxr-xr-x. 128 root root 12K Jun 30 05:15 ../ -rw-r--r--. 1 root root 237K Jun 8 23:30 moduli -rw-r--r--. 1 root root 2.2K Jun 8 23:30 ssh_config -rw-------. 1 root root 4.3K Jun 30 06:03 ...


0

As far as I'm aware it is not possible to blanket ignore any particular part of the request (be it URI or any parameters) from all configured ModSecurity rules. While that may be useful it would likely open up a number of security holes. So you just need to see which rules are failing and add white list exceptions for those rules. If you give examples of ...


1

If, for example, your IPs are 192.168.10.10 and 192.168.10.11, and you want sshd to listen to port 443 on IP1, and httpd to Listen to port 443 on IP2: Add to your /etc/ssh/sshd_config file: ListenAddress 192.168.10.10:443 and restart SSH. SSH will now listen on port 443 of IP1. Add to your httpd.conf file (assuming Apache, should be easy with other ...


0

If you want to segregate IP1 ==> NGINX and IP2 ==> SSHD, I suggest you to turn on NetFilter w/ PREROUTING : Nginx listen on 8443 and SSHD on 22 ; close these ports and PAT the 443 port regarding of the source. Else, sorry, this isn't possible for one server to have two processes handling one Net socket (TCP/443), because the system couldn't know which ...


0

Yes, fail2ban is a good idea. But out of Netfilter that can be quite dirty because of bad TCP reply (you should add INPUT -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT for instance) The best solution is actually in your /etc/ssh/sshd_config, limiting there your IPs : ListenAddress 70.5.1.1 ListenAddress 10.1.5.1


0

Try the following... Login to your home and work computer and execute the command below on each of them. dig +short myip.opendns.com @resolver1.opendns.com This will return the actual public IP you will be connecting from home and work respectively. These are the two IPs you need to add to your rule on your ssh server.


0

Try fail2ban. Most distros have it packaged and it comes with default rules for sshd. It will automatically ban all IPs (via iptables) with more then a certain amount of login failures.


0

To throw in my $.02: Take a look at ceph. Throw at it half a gigabyte of memory on each server (make them all OSDs) and designate three servers as MDS/MON (depending on the load they may or may not run other intensive stuff as well). Use it as a object storage or as a block device or as a filesystem ... that is up to you ... It can be redundat and it can ...


1

Do not do this. I repeat: Do not do this! You will get cluster headaches out of this. If metadata changes in meantime, it could cause crashes and/or invalid data returned. These filesystems are not designed to work like this. Do not use them that way. This is especially bad idea with ZFS. If you really have to, use something very very basic, without ...


0

I believe LizardFS and GfarmFS are well suited for the task. Both storage systems use metadata (i.e. directory) servers allowing low-latency operations on millions of files. LizardFS "master" (i.e. metadata server) uses RAM (memory footprint is less than 3 GiB for 7_000_000 files) while GfarmFS metadata server uses PostgreSQL.


0

You can't run ntp server without connecting to another time server.


1

Your nginx configuration isn't good at all. Try something like this: listen 80; listen [::]:80 default_server ipv6only=on; root /home/website/www; index index.php index.html index.htm; server_name example.com; error_page 404 /home/website/error/index.php?er=404; location / { rewrite ^view/execute(.*)$ /home/website/view/execute.php?a=$1; ...


0

Since services like Google drive are in the Cloud and their IPs might change at any time I believe your approach sooner or later will stop working. There is another method to differentiate the traffic of those applications you want by doing DSCP marking on the guest OS level. The DSCP marks will be 'attached' on the packets themselves so then you will be ...


0

I recently had a similar issue on my Ubuntu 12.04 system. Clearly sound was working on the system since I had no issues with games and mpg123, but I was unable to get any audio output from mplayer. I solved it in this simple way: sudo apt-get install mplayer2


0

You can also manually look at your Cron jobs, as Cron is what usually triggers processes systematically at specified times. Ubuntu is a fairly complex server distro compared to some other minimal linux server distributions. My guess would be some type of job that automatically searches for security updates. so look for any apt-get processes at 12AM daily. As ...


3

You have New Relic monitoring. You literally have a monitoring solution that can tell you what your server is doing with 1-minute granularity! Select the relevant timeline in the Overview graph. Click on Processes. Sort the processes by RAM utilization. Select the process you're concerned about to drill down for more detail. Profit.


0

Skype can use either a HTTPS or a SOCKS5 proxy, and not a HTTP proxy, which is what Squid is. Squid supposedly has support for HTTPS, but I couldn't figure out an easy way to get it to work. What I did was I installed dante-server, configured it and then configured Skype to only use a SOCKS5 proxy. I first installed dante-server sudo apt-get install ...


1

First, I think you may need to enable ip forwarding. sysctl -w net.ipv4.ip_forward=1 to get your machine to be a router. Full details on ip forwarding are here. Second, I won't swear to this but your iptables rules look wrong to me. It seems you need something more like this: iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1044 -j DNAT ...


4

Because that's what the flag is suposed to do; this from man mkdir (from GNU coreutils 8.21): -p, --parents no error if existing, make parent directories as needed


0

I figured out why this was happening. In my environment, I have a secondary Linux DNS server that does not allow dynamic DNS updates except from the Windows master DNS server which is also the domain controller. When the net ads join command is used, it does a DNS lookup for the name server of the domain and sometimes it returns the Linux DNS server as the ...


2

When you have a problem like this, you have to: obtain all requirements (latency, bandwidth, redundancy, reliability, security, required features...) analyse the current systems. If they are none, create test environments. Understand how all components work. Understand the current and the expected load. add system monitoring (with graphs) for both ...


0

Do you have a .htaccess file in ./public_html/? If so, what's inside it? The way .htaccess works is by giving the directory closest to the actual root top priority. As an example: /home/username/public_html/.htaccess is given a higher priority (i.e. more control) than /home/username/public_html/sub_directory/.htaccess If you're primary .htaccess file ...


0

I can only think of two things you need to do to insure FTP is working inside Azure: FTP must be in Passive Mode, edit that depending on your Linux OS. Open a port "Endpoint" for the passive FTP protocol on the Azure Firewall, here are the steps to do so: https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-set-up-endpoints/ If that ...


1

You need to open the end point as you have done as well as opening that port on the firewall inside the actual VM (Windows firewall or the equivalent on Linux, depending on which OS you are running).


0

Only interactive accounts you intend to log into should have sudo or root rights. The number of scenarios where a service could justifiably have sudo or root privileges is extremely limited: backups, antivirus, host intrusion prevention. I don't recommend using sudoers to grant service accounts restricted admin rights. It is very difficult to contain the ...


0

Your rules are allowing incoming requests, but you may have a very restrictive IPTable configuration that is blocking all outgoing communications. If this is the case, then you will need to add additional rules. iptables -A OUTPUT -p tcp -d 12.34.56.78 --sport ssh -j ACCEPT iptables -A OUTPUT -p tcp -d 23.45.67.89 --sport ssh -J ACCEPT The rules above ...


1

According to documentation, the HP 2810-48G supports both LACP (802.3ad) and "non-protocol" trunking/bonding (the naming differences get even more confusing when mixing network gear vendors!). HP describes the "non-protocol trunking": This method creates a trunk group that operates independently of specific trunking protocols and does not use a ...


1

My problem solved ,i do reinistall gnome3 Command: sudo apt-get purge gnome-shell sudo apt-get purge ubuntu-gnome-desktop sudo add-apt-repository ppa:gnome3-team/gnome3-staging sudo add-apt-repository ppa:gnome3-team/gnome3 sudo apt-get update sudo apt-get dist-upgrade sudo apt-get install ubuntu-gnome-desktop


1

Based on this gist, I've made a concise and clean version: # Prevent sudo timeout sudo -v # ask for sudo password up-front while true; do # Update user's timestamp without running a command sudo -nv; sleep 1m # Exit when the parent process is not running any more. In fact this loop # would be killed anyway after being an orphan(when the parent ...


-2

To shut it down immediately ,type: shutdown -h now and to shut it down immediately and restart type: shutdown -r now


0

What does myscript do? $ perl -e 'print $$."\n";sleep(60);' & echo $! [1] 11957 11957 11957 $ ps waux |grep perl user 11957 0.0 0.0 17688 1480 pts/34 S 19:16 0:00 perl -e print $$."\n";sleep(60); $ echo 'print $$."\n";sleep(60);' > /tmp/foo $ perl /tmp/foo & echo $! [1] 12004 12004 12004 $ ps waux | grep perl user 12004 0.0 0.0 ...


0

There is no actual question in the "question" here, but I have one answer for the question "How do I get SSH to connect again?" I ran into this same issue with Lubuntu 14.04 LTS. I purged ssh with sudo apt-get purge openssh-server and promptly reinstalled with sudo apt-get install openssh-server I was then able to connect with ssh again. If you have ...


2

Create a VM of the appropriate specification and disk size and let it live entirely in as a VM on the SAN. I'm not sure the other options you present are worth the complexity. How do you plan to take backups?


1

As c4f4t0r commented, respawn will run the command again when the script exits. By using -f it runs in the background, effectively exiting and causing upstart to respawn it. If you remove -f then it will remain in a running state that upstart can observe when it unexpectedly exits. start on (local-filesystems and net-device-up IFACE=eth0) stop on ...


0

There is no "reverse lookup" for canonical names. That is: given an A record, there is no way to get a listing of what CNAME records point to it.


0

Schematic: ssh ssh A ------> B ------> C ^ ^ using A's using B's ssh key ssh key Preconditions: A is running ssh-agent; A can access B; B can access C; A's ssh public key is present in B:~/.ssh/authorized_keys B's ssh public key is present in C:~/.ssh/authorized_keys In ~/.ssh/config on A, add Host C ...


0

This is not exactly right place to ask this question, but I'll throw in my $.02 anyway. Get something, that runs linux. Install Postgres on it. Connect to it via TCP. Having the same database files accessed by two different computers would either not work, or lead to data corruption and cluster headaches. (besides being slow) Use git for code. It's defacto ...


1

That's normal for any machine - whenever the CPU usage goes up the power consumption (and thus the heat dissipation) increases dramatically. To get a rough idea how much power a particular machine can consume look at the wattage its power supply is rated for (ok, that'd be an absolute maximum normally never reached).



Top 50 recent answers are included