Tag Info

Hot answers tagged

22

Ensure that the libssl1.0.0 package has been updated as well (that package contains the actual library, the openssl package contains the tools) and that all services using the library have been restarted after the upgrade. You have to RESTART all services using openssl (service apache restart).


11

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted. If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake ...


10

When a process starts reading from a file, it creates a filehandle attached to the inode where the file lives. When you delete a file, you delete the link from the directory to the inode. That link will be removed immediately, so that no other process will be able to find the file. However, as long as there is an active filehandle to the inode, the ...


9

Is there a reason why they are not running as www-data ? Yes. You most likely haven't specified the user in your nginx config. User Directive: http://nginx.org/en/docs/ngx_core_module.html#user syntax: user user [group]; default: user nobody nobody; context: main How to run nginx as a particular user? You can specify the user/group that ...


8

You can use multiple names in server_name and even repeat it. For instance, to answer to three hostnames, you could do something like: server { server_name example.com www.example.com; server_name api.example.com;


8

Memcached requires your code to actually use it. But if you wrote this code then this should be easy to do :) MySQL caching works to an extent. Ideally, upgrade to SSD drives if not already. I've never heard of FastCGI caching. Are you referring to caching dynamic pages as static? Honestly, if you have tuned everything that best that you can, I would ...


8

As a general rule when mitigating a major vulnerability in a library which is used by many programs: rebooting your server is the easiest way to ensure you've restarted every affected program, and that nothing is using the old (vulnerable) code. You should not fear rebooting your systems (you should be doing it pretty regularly when you install patches ...


7

It seems like they are trying to use your web server as an open proxy. As long as you don't see your servers responding with a 200 OK, you shouldn't be worried. UPDATE: Although there may be ways to handle this with builtin nginx functionality, I found easier to install/enable mod_security and let him handle this and other nasty attacks. As you'll see in ...


7

what other steps should I take to lock down my server as well as protect from DDoS? Firewall off any ports and protocols that are unused. Limit access to only trusted IPs where applicable and possible. Apply all security patches and updates in a timely fashion Implement a network monitor that can alert on suspicious bursts of activity $200 a ...


7

You don't. That's the simple answer, anyway -- you don't need it. uWSGI is itself a capable server. However, other servers like nginx have been around longer and are (probably, anyway) more secure, as well as having additional features not supported by uWSGI -- for example, improved handling of static resources (via any combination of Expires or E-Tag ...


6

Environment variables cannot be used in the upstream module, nor in server or location blocks. They can only be referenced in the main config, which doesn't help you. You could do this with the openresty bundle that includes Lua. If you don't want to use openresty/Lua, the only other solution is to do some substitution at container startup. Your docker run ...


5

There's no such network as 192.168.0.1/24, because it doesn't start on a legitimate boundary between /24 network ranges. The last bit of the address is set, but is meaningless in this context. The correct address would be 192.168.0.0/24, which means the range from 192.168.0.0 to 192.168.0.255.


5

CloudFront requests come from the documented IP ranges as well as with a User-Agent string that includes Amazon CloudFront. You can block either, but with AWS's IP ranges expanding fairly frequently I'd go with the User-Agent block.


5

Manually running logrotate -f /etc/logrotate.d/nginx will forcefully rotate the logs configured in that file.


5

Let me guess, this is how you made your symbolic link: dystroy@server:/etc/nginx$ ln -s sites-available/dystroy.org sites-enabled/ Well, this creates a wrong symbolic link. As you can see in this image with colors enabled, the symbolic link doesn't point to an existing path. For simplicity, use absolute paths. dystroy@server:/etc/nginx$ ln -s ...


5

inetplumber's answer is great. I would add that another option is to configure your app to scale, so that you could handle a larger attack without impacting your user. You can set up a Virtual Private Cloud (VPC) on Amazon AWS, for example, with your PostgreSQL server accessible only from inside your VPC. You can set up a load balancer front end to ...


5

Here is a quick example of how easy it is :) sudo mkdir /etc/nginx/ssl cd /etc/nginx/ssl sudo openssl genrsa -des3 -out server.key 1024 sudo openssl req -new -key server.key -out server.csr -- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a ...


5

Second way is better... server { listen 80; server_name www.domain.com; return 301 $scheme://domain.com$request_uri; } Why Let me quote directly from the official Nginx wiki at http://wiki.nginx.org/Pitfalls#Taxing_Rewrites ... By using the built-in variable $request_uri, we can effectively avoid doing any capturing or matching at all, and by ...


5

I am assuming you mean local unix sockets here. In linux, when making connection to local sockets, does such a thing as keepalives exist? No, keepalives prevent the remote side timing out. Since the host knows the status of both sides of the connection a keepalive is redundant. Would having a connection kept alive remove (even a tiny bit) some ...


5

Yes, you need a SSL certificate. The browser expects a certificate as you are connecting using https; unless you'd connect to http://my.site.com:443 instead of https://my.site.com. You can self-sign it, but that would still give a warning in most (all) browsers before finally redirecting you to the http website.


5

The best approach is to put everything on single domain using SPDY. If you can't do that, you need to calculate the appropriate number based on how many files you are serving. DNS lookups will cost you about 20-120 milliseconds and are cached for varying periods. Most browsers in use at the moment allow 6 concurrent connections to a single domain (over ...


5

You are right that ECC in RedHat's (and therefore in CentOS's) openssl is disabled, due to patent concerns; see (eg) this bugzilla entry for more details. Note how any time anyone opens a new tracker to compain, it's closed as a duplicate of this one, so don't be fooled by the age of the tracker into thinking that it's a lapsed problem (side note: although ...


5

If you're in a development environment, you can send variables via headers. add_header X-uri "$uri"; and you'll see in your browser's response headers: X-uri:/index.php I sometimes do this during local development. It's also handy for telling you if a subsection is getting executed or not. Just sprinkle it inside your clauses to see if they're ...


5

They disconnect. TCP has no protocol part for changing the IP address so the clients will not know that it has changed magically. A new connection will have to be established.


4

Since you have varnish in front of nginx, it thinks all the requests are coming from 127.0.0.1, since technically they are. To resolve this, use the nginx real ip module to pick the client's IP address out of the X-Forwarded-For header, which Varnish automatically adds to requests (unless you told it not to). An example nginx configuration would be: ...


4

Probably not an answer yet, but more than I can make readable in comments: That error code (and string) are about a Diffie-Hellman public key. Unless you are using static DH, which would be very unusual -- I've never even seen a public CA issue a DH cert -- this must be the client's ephemeral DH key for a DHE ciphersuite. For it to be invalid suggests ...


4

While you can theoretically implement OAuth on the webserver level (example: http://chairnerd.seatgeek.com/oauth-support-for-nginx-with-lua/), it's generally a pretty bad idea. There are examples for server-side languages because that's where you should implement it - in your code, not your server.


4

This should not be the case, but if you're getting a lot of requests from the same source constantly and this is causing a Denial of Service (DoS) on your server you should consider using something like fail2ban to temporally ban abusive clients from your server. Anyway it's a good idea to avoid bruteforce attacks for example, if you don't have some ...


4

Two approaches here: Force Apache to only be reachable from localhost by binding it to the loopback interface instead of listening to all ip-addresses # Listen 8080 Listen 127.0.0.1:8080 The second approach is configure the firewall where you only open port 80 for the general internet public. A basic firewall configuration can be created with ...


4

For anyone else who may have arrived here looking for an answer but the accepted one didn't fit your case - I may have your solution! I didn't have a setup problem - at least not to my knowledge. I am running nginx + php5-fpm. My php.ini file was correctly configured and all my other extensions were working properly - test it with phpinfo() or php --ini. ...



Only top voted, non community-wiki answers of a minimum length are eligible