945 reputation
1617
bio website matt.scharley.me
location Australia
age 27
visits member for 5 years, 5 months
seen Dec 6 at 2:49

Email: matt@scharley.me
Website: matt.scharley.me
Twitter: @mattscharley
CV: Stackoverflow Careers


Aug
14
comment How can I create an “su” only user (no SSH or SFTP) and limit who can “su” into that account in RHEL5?
Out of curiosity, why limit them to a shell? Seems an odd command to pick to limit to since once they have a shell they can run anything anyway.
Mar
21
comment iptables: difference between NEW, ESTABLISHED and RELATED packets
@Kris: It's pretty hard to fake outgoing packets, so by the wording of the man page in the answer, I don't see how. You are correct that it's possible to fake a packet which looks like it's bound for an open connection, but even without a firewall, the TCP stack would just drop the packet on the floor if it didn't already know about an open connection from the sender. If this is on a firewall on a router, it's still possible to maintain this state by inspecting SYN/ACK/RST/etc packets as they pass through the router, and I'd expect iptables to do this.
Mar
19
comment iptables: difference between NEW, ESTABLISHED and RELATED packets
Out of curiousity, do you know how it determines RELATED packets? Is there some mechanism that applications can use to signal to iptables that a connection will be a related connection, or is it purely part of the stateful part of iptables?
Mar
15
comment How ISPs will assign IPs /subnets for end users in IPv6
Can confirm that my residential provider here in AU (Internode) is also handing out /64's already to people who want them. Re: single addresses though, how many ISP's will hand out individual addresses? From all the conversations I've seen, NAT was only really to help sort out the shortage in the IPv4 address space.
Mar
8
comment How to add a user without knowing the encrypted form of the password?
@Jim: If not all, then 99%. It's part of the SSH client and server packages, so it's almost always installed, though technically I don't believe it's required. You can count on it being installed by default, but not necessarily that someone has not uninstalled it.
Mar
7
comment What happens if two machines respond to an ARP “who is” request?
@cabbagebot: ARP poisoning is a valid and common enough attack vector given it's limitations. You have to be on the same local link as your intended target, so out of all attacks it tends to be a lesser concern. However, if you're running a public network of some kind then definitely be wary of this one.
Mar
6
comment Snapshots == EBS backed instance, persistence, and S3 storage?
@BartSilverstrim: Unfortunately, the issue isn't the terminology, it's the shortening of it. AMI stands for Amazon Machine Image, which is quite clear, but just 'Image' is ambiguous if you're not sure what it's actually referencing :(
Mar
5
comment Snapshots == EBS backed instance, persistence, and S3 storage?
Volumes are hard disks that you can plug into any instance you like, either as the root or as any other drive. An image is an AMI. It's what you use to spin up new instances, based on the disk image stored in the snapshot.
Mar
5
comment Any other Linux application similar to Greyhole?
Atleast conceptually, it looks like Greyhole is just a simplified interface to mdadm and samba. What experience do you have with Linux? Setting up either of these is not particularly difficult, with a bit of research.
Mar
5
comment Amazon EC2 Backup Strategy With Restrictions (little to no snapshots can be taken?)
@BartSilverstrim: The other big advantage is near zero downtime in the case of a castrophic problem (intrusion/accident/whatever). You can just stop the instance, mount a new root EBS volume from a snapshot and start up again. 5 minutes turn around tops. And you still have a pristine version of the problem volume for examination to find out what went wrong.
Mar
5
comment Amazon EC2 Backup Strategy With Restrictions (little to no snapshots can be taken?)
@Bart: I'd also suggest that snapshots are as 'hot' a backup as you are going to get, and also far more internally consistent than rsync or similar. Files can change while others are transferring, meaning you may end up with a useless backup in some situations. I'd personally recommend that you eat the few hours downtime to change filesystems (if required) to make snapshots work. It's amazing how flexible a backup solution the EBS snapshots are, you can mount them on your running instance to restore.
Mar
5
comment Amazon EC2 Backup Strategy With Restrictions (little to no snapshots can be taken?)
@Bart: If you're willing to endure an hour or two downtime, it's possible to migrate an existing snapshot to XFS. I also believe that ext4 does now support the required stuff to make consistent-snapshot work, if you are on that filesystem instead.
Mar
3
comment Why does RAID5 with an odd number of data disks have poor write performance
meta.serverfault.com/questions/3073/…
Mar
3
comment Why does RAID5 with an odd number of data disks have poor write performance
@MDMarra: Then close the old question. Rewriting the entire question isn't productive either. The issue is nothing to do with Samba, and everything to do with the hardware.
Mar
1
comment How to identify which hdd to be replaced in RAID
@Radek: RAID5 has redundancy for one disk. It should keep going with just a single disk broken.
Nov
8
comment Unreasonably slow stunnel
@KitSunde In a live environment, it's not uncommon to have Django/Rails/etc servers running against localhost and have them reverse proxied by a 'real' HTTP server like apache or nginx. Is that viable? Nginx is pretty darn slim, but I don't know what sort of specs your dev machine has.
Nov
8
comment Unreasonably slow stunnel
Any reason you didn't just set up your HTTP server to serve HTTPS as well? Seems that'd be the simplest way to me.
Nov
4
comment Would it be okay to run Apache on one EC2 instance and MYQSL on another?
@Yuttadhammo: I've not used RDS myself, so I can't speak to it's effectiveness. We noticed it too late in our deployment to make it worth it.
Nov
1
comment Enable APC User Cache on certain sites only (Apache)
@DaedalusFall: WRT Plesk, that's why we're moving off Plesk with the new hosting server we're setting up for our clients. Instead, we're using Puppet. There's a bit more upfront cost, but set up well, it's looking like it'll greatly simplify things for us. But that's another conversation entirely.
Nov
1
comment Enable APC User Cache on certain sites only (Apache)
@DaedalusFall: I've been really happy with nginx. With regards to your problem though, if you're stuck with mod_php, then APC isn't a viable solution ever, so I have to agree with cstamas. Go with memcached.