Reputation
67,097
Next tag badge:
120/100 score
19/20 answers
Badges
13 93 177
Newest
 Nice Answer
Impact
~3.1m people reached

Mar
24
comment Tools for simulating DDoS attacks
@ABerezovskiy I'm going to assume your sarcasm is because you're missing the reason for the notification: Most provider agreements (literally every one I've signed) prohibit this kind of testing without prior notice. If you violate that agreement and your test disrupts other people's service you will find yourself dropped off the network, and possibly facing legal action. An attacker has nothing to lose in this situation, a sysadmin or company has everything to lose.
Jan
29
comment How to configure ntpd to sync time more frequently?
@RomanGaufman and I'm pointing out that you're asking ntpd to do things it's not designed to: The ntp daemon disciplines the local clock. It assumes your network connection will be stable and your local clock will remain within a sane window if the network dies. It re-synchronizes with the time servers after a network failure if the time delta between the local clock & the time server is still sane, but if not it will fail because It doesn't (and can't) know if your clock is bad or the time server is. If ntpd behaved as you suggest it could do a huge amount of harm in the pathological case.
Jan
29
comment Apache stability on a VERY high traffic server
@StarWars The best answer I can offer is "Test it and see" - It depends on what your environment is doing, but if you're not having any problems you can probably defer making changes until your analytics start pointing at something that needs to change…
Jan
28
comment How to configure ntpd to sync time more frequently?
@RomanGaufman You're asking ntpd to do something it's not designed to do (fix a clock that's wildly incorrect). You should run the ntpdate command (with the -b option) to set the clock initially, and then start the NTP daemon to maintain it (this can be part of your internet up/down scripts). If your connection or power are wildly unreliable you can also run ntpdate out of cron every 5 minutes, which may give "Good Enough" clock accuracy. (You may also consider investing in a hardware clock for your Raspberry Pi as an alternate solution. Google can help you find resources for that.)
Jan
22
comment Load Balancing long running TCP connections
@BobAman Yup, 4+ years ago when I wrote this HAProxy wasn't as big a thing but if I were implementing this today I'd give preference to doing the load balancing in HAProxy (because of its other capabilities like leastconn to assign new clients to the servers with the fewest connections) and make pf or similar my second choice.
Jan
20
comment Sudo as different user and running screen
@sudo In order to do its thing script opens its own tty device, owned by the user who ran it (look in /dev and you'll see it appear after you run script). screen then grabs that tty device (which is owned by the user running screen so it has no trouble accessing it). It's a total hack job, but it works. Looking at some of my machines it appears new versions of screen seem to install setuid-root, which also works, but means you have another setuid-root binary floating around, which makes some folks justifiably uncomfortable.
Jan
20
comment How are SMART selftests related to badblocks?
@endolith The tests are not direct equivalents, but the purpose they serve is equivalent (discover and allow the remapping of bad sectors). My main point was the last paragraph: if you want to run badblocks as a disk exerciser (to see if you can provoke SMART errors because it's finding a bunch of bad blocks) go for it, but if you're running badblocks today with the intention of then loading the bad-block list to avoid using those sectors (as we did in the stone age) you're Doing It Wrong: Visible bad sectors mean you should chuck the drive in the nearest trash bin.
Jan
20
comment Does Ubuntu Server have any sort of cron job to automatically clear /tmp?
@guettli Lots of reasons: Because it's good practice. Because /tmp isn't a magical infinite pool and 1000 scripts all leaving their detritus in it can fill the volume (which breaks things). Because it doesn't take appreciable time to clean up your temporary files (do it right before you exit, no different than clearing a lock that prevents 2 copies of a script from being run). Because guessing that a temp file is OK to delete just because it's X days old is a kludge that can in fact break things. I can go on if you'd like…
Dec
16
comment Why is “chmod -R 777 /” destructive?
@Deji everyone is defined as the union of set including the user who owns the file, users in the group which owns the file, and users who do not meet either of those criteria (literally the three octal permission digits: User, Group, and Other). In other words any user with access to the system. ("Access" in this context could be a shell account, which is how I would normally address it, but it also includes access through a web form/CGI which writes data to disk: The www user can now write to any file on the system, which means random visitors can too.)
Sep
26
comment Apache2.4/nginx - route all traffic to requesting host?
Yeah if you can rely on %{REMOTE_ADDR} being a real machine's address that works very well. (Alternatively if you can always assume localhost will serve what you need that's an option too - just slap that in there.)
Sep
26
comment Apache2.4/nginx - route all traffic to requesting host?
@StefanKendall It's slightly less horrible in that case - the most egregious risk (cross-site scripting) is much more limited. I would however recommend against the xp.io style solution (because theoretically an external IP can be plugged into it and would then open up the potential for XSS again). Restricting access to the redirecting URLs (by password or ACL) would also be wise.
Sep
19
comment what percentage of iowait is considered to be high?
@GabrielSousa I've seen it on a variety of systems ranging from 1-CPU 486s to 8-core Sun machines. On modern multicore systems with the same kinds of workloads you could probably sustain even higher load averages as long as the OS scheduler and the disk/memory subsystems can deal with it. Load average (like iowait, %CPU busy, etc.) is not always directly correlated to performance. It is one component in a system which ultimately determines performance.
Sep
16
comment what percentage of iowait is considered to be high?
@kofemann Load Average (RunQueue depth) is a useful metric, but it too can be misleading. I've had systems operating with load averages of 10-20 but the users had no issues with performance (lots of processes waiting, but they only need a couple of microseconds and then they give the CPU back). User-perceived performance is always the great and final arbiter.
Sep
16
comment what percentage of iowait is considered to be high?
(For what it's worth I subscribe to the user-centered view of performance tuning: A computer can be horribly overloaded by the numbers, but working beautifully from a user perspective, and users are the ones who open support tickets and complain about things, so it's their opinion that matters.)
Sep
16
comment To get PHP communicate with PostgreSQL
FYI: This is being downvoted for two reasons: (a) it's commented out as written, so it has no effect, and (b) If you uncomment it it's dangerous: You are allowing ANYONE on the local system to connect to any Postgres database as any user (including the DB superuser) - you're one badly written PHP script away from someone using SQL injection to drop your production databases.
Sep
9
comment Setting timezone to UTC in unattended install
I'm not sure about the virtualized guests (bhyve or such?) - I would reboot after doing this just to be 100% sure you catch everything though. (Same logic as fixing timezones for DST changes: you could restart every daemon on the box & hope you don't miss anything, or you could just reboot, let ntpdate re-sync the clock on boot, and then know everything is using the correct time zone.)
Sep
8
comment Why is hash join slow in postgresql 9.1?
@Dmitro You could try running a manual VACUUM ANALYZE on the table to update the query planner's statistics, but like Tometzky said if the underlying query is confusing the planner this may not help (and if it does the "help" may not be persistent: the next time the planner statistics refresh it could change its mind again). Rewriting the query to make it easier for the planner to understand is The Right Fix (same as for any database system).
Sep
8
comment localhost in a DNS zone
5 years on but worth clarifying: 4.1 of RFC 1912 is explicit that the localhost zone should exist on the server (so if it gets a request just plain "localhost" it doesn't pass it up the chain to the next server), that's a far cry from including localhost in say example.com's zone (creating localhost.example.com), which it is equally explicit in saying you should not do because of possible unintended side effects. The expectation is for "localhost" to be a special, magical, fully-qualified domain in its own right.
Sep
8
comment localhost in a DNS zone
5 years on but worth clarifying: 4.1 of RFC 1912 is explicit that the localhost zone should exist on the server (so if it gets a request just plain "localhost" it doesn't pass it up the chain to the next server), that's a far cry from including localhost in say example.com's zone (creating localhost.example.com), which it is equally explicit in saying you should not do because of possible unintended side effects. The expectation is for "localhost" to be a special, magical, fully-qualified domain in its own right.
Aug
11
comment Why are cronjobs running at the wrong time?
@WildVelociraptor Yeah syslog will also use the old timezone data until restarted (so it's going to timestamp things wrong even though they're running at the right time). Anything else that's long-running and started before the timezone data changed will exhibit similar behavior, which is why a reboot is generally indicated.