Reputation
864
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
10 22
Newest
 Yearling
Impact
~272k people reached

Jul
14
comment Preventing SSL access to an Nginx Server
Yes, if a client without SNI connects it would go to your default_server for that listening port, which will result in the return 444. There's not really such a thing as a wildcard certificate from an actual CA, and multiple domain certificates are never cheap. Furthermore, in my testing the return 444 was only effective after the SSL connection was established, meaning nginx still served up a certificate for one of my other SSL sites, which had to be accepted, before the return 444 had an effect. However, my testing may have been flawed - I did not test with no other SSL sites.
Jul
8
comment Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Note: that will probably result in a key file with permission of 600 or 700; to get 400 I think the umask should be 0377. Not that there is really any significant difference between them in this particular case.
Jul
7
comment Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Looks like my question is answered here: unix.stackexchange.com/questions/196802/… But that's a different site so I can't flag as duplicate.
Jan
31
comment Is it bad to have the reverse DNS for two IPs point to the same domain name?
For example I just looked up google.com and the IP I got was 216.58.220.110. The reverse record for that is syd10s01-in-f14.1e100.net. I looked up that and got the same IP: 216.58.220.110. So that Google server passes FCrDNS check, even though the name it used for that purpose, syd10s01-in-f14.1e100.net, had nothing to do with the name I access that server by (which is google.com) or names used for things like SSL.
Jan
31
comment Is it bad to have the reverse DNS for two IPs point to the same domain name?
This shouldn't affect any services you have, that is it should not not affect your ability to do HTTPS or LDAPS or to load balance with many servers. The FCrDNS check does not have to use the same hostname as the hostname you are using to access the server. It can use any hostname; usually an internal hostname not necessarily seen by end users unless they did a PTR check. All that is required is that each unique IP visible to the world uses something for a unique hostname that resolves back to that IP.
Oct
18
comment What is the best Linux distribution for a production Web Server?
Debian went to a scheduled freeze date, but not a scheduled release date. It's still released "when it's done" ie when all RC bugs are eliminated and thus actual release date can still vary. Plus even the freeze date is only used as a guideline, not set in stone. Its aim was to make release schedule more predictable without compromising stability and the freeze process.
Oct
3
comment Nginx with SPDY Draft 3, is possible?
Note to current visitors: Chrome and Firefox (at least) have since dropped SPDY/2 support completely.
Jul
16
comment Nginx as network edge HTTP cache?
Its support for caching is poor, and it does not support proxying of HTTPS (ie, the CONNECT method). It supports just enough proxying features to make it useful as a reverse proxy, and the fact it works as a forward proxy at all is just a bonus.
Jul
15
comment Nginx as network edge HTTP cache?
You can use nginx as a forward proxy - but it is not as full-featured as something like Squid.
Jul
7
comment How to redirect all mail from one domain to another in Postfix?
The virtual file is the virtual_alias_domains list.
Jun
24
comment How can you test a backup / secondary MX server?
@EvanAnderson This is a good general principle until it comes to testing STARTTLS or any AUTH other than PLAIN. But yes in this case you're absolutely right.
Jun
24
comment How can you test a backup / secondary MX server?
@joeqwerty I'm actually thinking of migrating a mail server to another machine which will involve setting up the old server to relay to the new server during the DNS propagation (even with low TTL values, some resolvers will cache for 30 minutes or more). Since I'll need to put in the effort to get this relaying working correctly anyway, I thought I may as well create a backup MX server configuration. And it'll be a learning experience. This was just to give a bit of background about why.
Jun
24
comment How can you test a backup / secondary MX server?
@Halfgaar if the secondary MX server is misconfigured it could lead to loss of mail in the unlikely event that a sender is unable to connect to the primary MX server for any reason (including a connectivity problem at their end). At least if it hasn't been added to the DNS yet then a transient issue with the primary won't cause loss of mail - a sender will just queue the mail and try again later.
Jun
21
comment Recommended DNS SOA record TTL default?
All those intodns / dnscog / dnsstuff etc type sites just copy the same misinformation from each other. You can tell because a lot of their text is copy-pasted. I've found MXToolbox (mxtoolbox.com/DNSCheck.aspx) to be a more reliable resource. For example, their explanation of the SOA MINTTL value here is accurate - a rare quality.
Jun
21
comment Recommended DNS SOA record TTL default?
Really, there is so much misinformation about what these records mean online that it's hard to find anything that's actually true. In summary, most of the values in the SOA record are meaningless for actual DNS queries, and are intended instead for you to use for your own internal zone transfer mechanism from your primary to secondary nameservers. The exception is the MinTTL but that isn't, as the standards suggest, minimum TTL nor is it a "default" TTL, but instead a suggested TTL for caching negative results. What matters much more are the individual TTLs for records like A and NS.
Jun
7
comment Recommended DNS TTL
Both those standards you quote are referring to the "Minimum" field of the SOA record only, which is no longer used for determining the default or minimum TTL anyway, as was intended back when those standards were written. DNS best practices written 27 and 18 years ago were written when DNS - indeed the internet - was a different beast. Nowadays, 300 seconds (5 minutes) is a fairly common TTL for main A/AAAA records, although only useful when needing fast failover otherwise 6 hours+ would be more appropriate. NS records, and the A/AAAA records for the NS addresses, are usually 1 day or more.
May
31
comment How to get Ubuntu back into pristine conditions?
Presumably it is always logged in dpkg.log whether you use aptitude, apt-get or anything else is that right?
May
1
comment How can I make an internet facing TFTP server secure?
From wikipedia: "Due to the lack of security, it is dangerous to use it over the Internet. Thus, TFTP is generally only used on private, local networks."
Apr
28
comment How to investigate the cause of a 100% CPU event that lasted for hours?
It's unlikely to happen again, at least in a reasonable time frame that would allow some closure. It didn't happen for about a year of that server running that configuration, and so far hasn't happened since. I was hoping to get some advice on to what extent it's possible to investigate something that happened in the past. Have I done all that's possible?
Apr
28
comment How to investigate the cause of a 100% CPU event that lasted for hours?
I've added some more info to the question.