Tag Info

Hot answers tagged

4

There is a built in traffic shaper in linux kernel. You can implement it by tc directive. In your case I'd reccomend this: 1) Create a root directive # tc qdisc add dev eth0 handle ffff: ingress 2) Create a directive tree both both traffic classes (256k for http and 64k for ftp) #tc filter add dev eth0 parent ffff: protocol ip prio 50 \ u32 ...


3

I suspect that your colleague misunderstood the ssl related directives: the file pointed to by ssl_certificate should contain your server's certificate followed by intermediate certificates, and ssl_client_certificate is only needed for client cert verification and OCSP - I think he copied the intermediate(s) into that file. Now, a browser that already has ...


2

Try something like this, which passes 'john' or '1234566' as id in your examples to your php script. location ~ /user/(.*)$ { try_files /user/index.php?id=$1 =404; include fastcgi_php_params; } Adapted from here: http://stackoverflow.com/a/20059291/1666415


1

As long as you try to test $uri and/or $request_uri with an if, you should consider using location instead. That is, try something like this instead: location ~* /a/b/c { fastcgi_pass ... fastcgi_intercept_errors on; ... } Some additional details about if in nginx can be found at http://wiki.nginx.org/IfIsEvil.


1

Too many open files means that you have hit the ulimit variable for nginx defined by the default in /etc/nginx/nginx.conf (if using RHEL-based linux). What this means is that nginx has too many open connections and can not serve out any more requests. You can correct this by increasing the following variable: worker_rlimit_nofile <enter value here>; ...


1

That's strange. On Ubuntu 15.04's nginx 1.6.2 with all the default modules, I can do location / { rewrite ^/foo… http://example.com permanent; } ...and get the expected redirect. Assuming you have reloaded nginx and disabled your browser cache, are you sure the rewrite is happening in a location block that matches /info-cry…? It's also possible that ...


1

now you can upgrade nginx to 1.9.4 *) Feature: multiple "sub_filter" directives can be used simultaneously. see full change log here: http://nginx.org/en/CHANGES


1

This worked for me with Nginx 1.8. if ($server_protocol = HTTP/1.0) { return 444; } My reason for doing it was different. The Qualys Threat Report detected CVE-2000-0649, "allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request", on my server. I have the liberty of doing this because our site only supports ...


1

In Ubuntu, edit /etc/pam.d/su add or uncomment the line session required pam_limits.so Also, in /etc/security/limits.conf make sure you have TABS between the characters and not spaces.


1

For OCSP requests used for OCSP stapling nginx uses GET requests, as described in RFC 2560. On the other hand, OpenSSL as of last released OpenSSL 1.0.2d only supports POST requests in the OCSP responder daemon available via openssl ocsp. It doesn't recognize GET requests and prints Invalid request for such requests. To make this work, you may try OpenSSL ...


1

From a system point of view, there is no inherent differences in running 4 masters with 4 server sections, or a single master with 16 server sections. It implements the same architecture : parallelized event-based processes. The worker/core ratio must be accounted wrt the total of workers across all of your masters if you have several ones. This comes from ...


1

You could use only tomcat if you like. However, be careful! Tomcat is a servlet container. It uses JSSE to implement TLS, and by default it exposes management services on the network. It also has had a large number of security vulnerabilities (see https://tomcat.apache.org/security-7.html for example). It is somewhat slow and it's extremely complex. ...


1

It is possible to use Tomcat alone, however you need to avoid some obvious mistakes. Most important Run your Tomcat on a separate user account with minimal rights. When not running as root, Tomcat will not be able to bind the privileged port that is a good security feature, not a problem. There are many solutions for that, see here for instance. Do not ...



Only top voted, non community-wiki answers of a minimum length are eligible