189 reputation
110
bio website
location
age 23
visits member for 5 years
seen Nov 25 at 10:05

Consultant


Aug
5
comment Using telnet in shell script
If I execute this, I get some garbled output, but the command doesn't exit. Does someone know why?
Apr
9
comment Apache: How can I restrict access to a directory while the whole server has lower restrictions?
@Shane Madden: Alright, thanks for your help.
Apr
9
comment Apache: How can I restrict access to a directory while the whole server has lower restrictions?
@Shane Madden: Yes, it would be possible to use a <Location> block. However, the Apache documentation clearly states: "It is important to never use <Location> when trying to restrict access to objects in the filesystem.". I was trying to follow this advice, but if it is not possible I'll have to live with that.
Apr
9
comment Apache: How can I restrict access to a directory while the whole server has lower restrictions?
@Shane Madden: Done, see question.
Apr
8
comment Apache: How can I restrict access to a directory while the whole server has lower restrictions?
This Apache acts as a reverse proxy for a lot of web servers on other, internal servers. Therefore, there has to be an access restriction on the whole server. So <Location /> has to contain permission settings.
May
23
comment How can I log all traffic with its exact length?
I need to account the traffic each of our users makes. I don't need the byte count to be 100% accurate, but the fault margin shouldn't be too high.
May
23
comment How can I log all traffic with its exact length?
I load-tested it today. When I create a chain with over 9000 rules (over 2000 users, each with a subnet and a VPN IP, two rules - one for Source, one for Destination IP checking - for each IP or IP range) ksoftirqd takes 100 % CPU and the kernel starts massively dropping packets. It looks as if the iptables approach is doomed. Even if I optimize the rules so that heavy users are at the top I won't be able to stop the dropping. The internet became totally unusable during the test.
May
5
comment How can I log all traffic with its exact length?
In initial tests tcpdump causes the kernel to drop about 3-5 % of all packages. I initially thought of the iptables solution, the advantage I saw in tcpdump was the ability to process packets in real time. However, I guess it might be enough to use iptables chains and read the byte count every 60 seconds or similar. Thanks for your advice.
Dec
17
comment What is the best solution for traffic control in a large system (ca. 2000 users)?
Unfortunately, we can't afford to invest much money into this, neither for a dedicated packet shaper nor for more bandwidth. Our system is working at the moment, the question is how, instead of blocking users that have exceeded their allocated traffic, we can only reduce the bandwidth available to them.