715 reputation
719
bio website bitdepth.thomasrutter.com
location Australia
age 33
visits member for 5 years, 2 months
seen Jul 7 at 8:36

Web application developer by day who has also dabbled in audio, video and image tools.


May
9
comment How to redirect all mail from one domain to another in Postfix?
Thanks, this looks right.
Apr
9
comment What User Should NGinx and PHP be running as?
The reason for www-data is that it is an account with zero privileges - it cannot write to any file on the entire file system, not read to anything but world-readable files. Previously, you would use built-in user "nobody" to achieve this. However, by creating "www-data" you have the possibility to allow this user to write to some files, without having to make those files world-writable (which is bad). The basic principle, that "www-data" is as privileged as "nobody" in every other way, holds true.
Apr
5
comment which disto to pick for Linode?
Mandrake or Fedora for a server??
Mar
25
comment Clarify something about Linux directory permissions
Thanks Wes for your answer - it was helpful as well
Mar
24
comment Clarify something about Linux directory permissions
Thanks JeffG, I understand that with a soft link, they would be, but with a hard link or bind mount, they don't - so hard links and bind mounts can bypass this, but then a regular user wouldn't be able to create a hard link or bind mount into there anyway.
Mar
22
comment Clarify something about Linux directory permissions
Sorry packs, but I was trying to ask a question a bit different to the one you answered. I already suspect that the lack of read or execute permissions on the directory would prevent access to its files regardless of the file permissions. I was wondering if this was definitive or if there were still ways for other users to read the files. JeffG's answer helped me out, for example. I will try to clarify my question.
Mar
22
comment Securing /var/www
This answer sounds like a good solution to me - can anyone tell me any downsides?
Mar
4
comment How long does a blocked connection from Iptables last? Is there a way to set the timeout?
It's more like "If there are 15 connections, and the last one was less than 5 seconds ago" according to my interpretation of the docs. Not all 15 connections would need to have been within the last 5 seconds.
Feb
15
comment Is there an alternative to /dev/urandom?
Actually shred is much faster than /dev/urandom. My guess is it provides its own pseudorandom data using /dev/urandom or /dev/random as a seed.
Feb
10
comment Is there a way to reduce the avarage time it takes to fsck a device?
Well, fsck.xfs basically just returns success without doing anything. There are xfs_check and xfs_repair utilities for when you need them.
Oct
1
comment Which VPS configuration would be better?
It's not true that with two smaller nodes, you get twice as much CPU and IO. The reason for this is contention. On Linode you only share your node with other nodes of the same size. With a single Linode 1024 you are sharing CPU and IO with 19 other nodes; with two Linode 512s each one is sharing CPU and IO with 39 other nodes. Then again, two separate nodes may still be a good idea for redundancy or even isolation.
Aug
10
comment Preventing the contents of /var/www from being listed when a browser visits my IP
If Options -Indexes isn't working for you remember that it may be overridden somewhere else. Your Apache uses a variety of configuration files within /etc/apache/conf.d for example as well as its main configuration file. But as for me, I just put in a blank index.html file (see my answer below).
Jun
15
comment How to find all occurences of an email address on a website
Sorry LukeR didn't see your question. I was looking for a solution that wasn't dependant on server-side technology - so would work with static, dynamic etc equally. The site in question uses a combination of static site plus blog software plus other software.
Jun
3
comment How to find all occurences of an email address on a website
Ah, I'd forgotten about wget's --mirror option. Thanks!
May
13
comment LAMP stack security question - uploading files to server
@morpheous, this page includes some info about setting up key based auth over SSH: troy.jdmz.net/rsync/index.html Given that both computers are Linux-based then it'll make it a bit easier. As for preserving permissions, you'll be fine. The -a part preserves those. It won't preserve owners/groups, which you probably don't want when going between servers unless it's a backup, in which case look into --fake-super option under rsync's documentation, but that is kinda complicated and requires xattrs on the destination filesystem.
May
11
comment Security issues of running PHP scripts as the owner of the PHP file with suexec
What about using suexec to run scripts with some unprivileged username, and the group name of the user? For example running scripts as <www-data2>:<username> where www-data2 has basically no write permissions anyway, and a user can make a file writable by setting group write on. Then the scripts can't write to themselves, but can't write to other users' writable files either. I'm guessing, however, that given that people don't seem to do this, there must be a reason against it...
May
11
comment when should I use “apache:apache” or “nobody:nobody” on my web server files?
Reason for having Apache run as a user other than "nobody" is that if someone compromises Apache (through a bad PHP script, for instance) they are stuck in a user account that's only used for Apache and nothing else. Other services use the "nobody" account.
May
10
comment Best Linux flavor for web application development (LAMP)
I'm a Debian person myself, but I would also include Ubuntu LTS in that list of stable distros. Each release has security support for at least 5 years.
May
10
comment Best Linux flavor for web application development (LAMP)
I've read that Ubuntu and Debian installations far outnumber other distros on virtual private servers at linode.com and slicehost, for example. Not that CentOS isn't popular elsewhere...
May
10
comment Choosing a Wiki for an academic institute
I work at a university that uses Confluence...