Recent Questions - Server Fault |
- Nginx does not open specified listen port
- How to reverse NS?
- How do you find where the rsync process is coming from?
- Disable nginx cache for a specific URL in site
- how to detect my jenkinsfile?
- Home Email Server Configuration
- EC2 instance with multiple EIP
- postfix MTA and SSL
- Ansible ec2_tag failing due to missing boto dependency, which is installed
- Nginx: Running multiple web apps on same server using subdomains
- Is there a difference in performance or capability in these sas cables?
- Migrate a QEMU/KVM VM from qemu:///system to qemu:///session
- How to redirect two domains to same local server IP with pfSense
- problems mounting curlftpfs
- No space left on device: Error writing to logs/access_log
- Avoiding unnecessary bounces with OpenSMTPD on OpenBSD
- ip_conntrack_max not found
- Bitlocker Network Unlock certificate issue
- How do I secure the access token, on Linux, to remote, automated secrets stores like Hashicorp Vault?
- AWS vmimport - stuck on booting phase
- How do I set Host Groups on Fail2ban for Wordpress?
- How to get Mod_pagespeed to output compressed (gzip) css?
- Kerberos constrained delegation using Citrix NetScaler
- Nginx error: "Primary script unknown" while reading response header from upstream
- Backup strategy for millions of files in lots of directories
- Exchange 2010 HELO header change
- Nginx drops connections
- Apache server not allowing mime type
- smb share takes forever to connect to from Mac OS X 10.7-8
- PHP with suexec/fcgid
| Nginx does not open specified listen port Posted: 18 Sep 2021 08:35 PM PDT I am trying to proxy SSH traffic from nginx (listening on port 7999) to a bitbucket server (listening on port 7998) on the back-end. Both nginx and bitbucket are running inside Docker containers. If I login to the nginx container and do But, I when I do this on my computer: And when I do It seems the problem is nginx is not listening on port 7999 inside the docker container. But, on the host I can see docker-compose.yaml (nginx) nginx.conf (inside the nginx container) And here's some output executed inside the nginx container: Any ideas how to fix this issue? I'm stumped.  |
| Posted: 18 Sep 2021 07:15 PM PDT I want to learn how can we reverse NS? I'm not talking about reverse DNS. Is there a Linux command that get domains connected to a NS? Let's say that we have ns1.example.com name server. I want to list domains that uses ns1.example.com.  |
| How do you find where the rsync process is coming from? Posted: 18 Sep 2021 06:29 PM PDT How do you find where the rsync process is coming from? We have a rsync process, but I am not sure what's the thing that initiate it. I looked at our cronjob running from the Wordpress project, looked at the code, and I don't really see anything that might be running it, but I know it's there, because I think I ran iotop and saw it. What are some helpful commands that would allow me to find it?  |
| Disable nginx cache for a specific URL in site Posted: 18 Sep 2021 05:01 PM PDT We want to disable cache on a specific URL in our site. The problem we have is that when a user buys something, this purchase only is reflected in user's profile when nginx cache is cleared User's profile URL looks like this: https://example.com/api/user/content/49642  |
| Posted: 18 Sep 2021 04:40 PM PDT
How do I run this Jenkins file successfully, connecting the file to a new pipeline?  |
| Home Email Server Configuration Posted: 18 Sep 2021 03:48 PM PDT A Nuc Computer with Ubuntu Operating System and a Control Panel host Websites and run computer programs and surf the Internet all from one computer?  |
| EC2 instance with multiple EIP Posted: 18 Sep 2021 03:21 PM PDT I have an EC2 host and I wish to have 2 public IP's available to access the host. One IP for HTTPS (443) access, and the other IP for SSH (22) access. Assume that I must have 2 public IP's for the sake of this question. I found this related SF question which is now out of date. I have already created 2 ENI's, and assigned a public IP to each. My security groups allow HTTPS and SSH access as described above. While I can access SSH (on the first ENI), I cannot reach the HTTPS server on the second. I'm suspecting a routing issue - since both EIP's can reach the internet. (and my SSH and HTTPS connections can come from any public address)...if either EIP is the default route I won't be able to reach the other. What is the solution here? Would attaching two EIP's to a single ENI solve the problem (if that is even possible)?  |
| Posted: 18 Sep 2021 03:53 PM PDT We have some services sending information to email receivers. The services use SMTP to send the mail to postfix and then postfix delivers it to the correct domains (gmail.com, hotmail.com etc). When the mail arrive in an gmail inbox its marked with this icon Im trying to understand how the encryption for email works. If we add an certificate to postfix, will it create an end to end encryption, so if our service send an email to @gmail.com - what will happen?
If its option 2, what would be the benefit in this case to use TLS between the services and postfix? Since its only our internal services sending email, there is no passwords etc sent i clear text between our services and postfix. Can a wild card web site certificate be used for postfix (same domain name as the postfix configuration)  |
| Ansible ec2_tag failing due to missing boto dependency, which is installed Posted: 18 Sep 2021 02:55 PM PDT I am trying to set the tag on a resource on my EC2 machine, per below: And this fails with an error that botocore and boto3 are required. Based on the IP in the error message it is required on the target machine. However, I confirmed that both the source (control node) and target machine have boto, botocore, and boto3 installed. (My script did that earlier, and I even SSH'd to the target and confirmed they are installed) Earlier in the script I saw a warning about an available PIP upgrade, but on this OS (CentOS 7) that leads to broken dependencies so I just leave PIP as is. Hopefully that is not the cause. Is this a known issue, or is there a simple workaround?  |
| Nginx: Running multiple web apps on same server using subdomains Posted: 18 Sep 2021 01:13 PM PDT I am having a I am basically have three config files in my folder
My The nginx-config of my My nginx config of All the subdomains and the domain is routed on the DNS to my server's ip. I can open BUT when opening All three applications are laravel applications. Any suggestions what I am doing wrong?  |
| Is there a difference in performance or capability in these sas cables? Posted: 18 Sep 2021 12:44 PM PDT I'm looking at sas sff-8644 to sff-8088 cables and noticed that some are single cable where as others are dual cable. What's the difference between these, and is one better when connecting an hba to an array than the other?
 |
| Migrate a QEMU/KVM VM from qemu:///system to qemu:///session Posted: 18 Sep 2021 01:50 PM PDT I have a created a Windows 10 VM using However, when try to list the VMs with
 |
| How to redirect two domains to same local server IP with pfSense Posted: 18 Sep 2021 01:06 PM PDT I am planning to setup the firewall before my webserver in cloud that hosts 3 websites. However, all the three websites are proxied by cloudflare. So my question is it possible to map the public IP of PFsense in cloudflare and inturn PFsense will forward the http requests to webserver accordingly to each website: Cloudflare --> PFsense public IP --> site1.com(connected to pfsense through private IP) 2)Cloudflare --> PFsense public IP --> site2.com(connected to pfsense through private IP) Cloudflare --> PFsense public IP --> site3.com(connected to pfsense through private IP) If it is possible, please provide me the steps to achieve this, thanks in advance.  |
| Posted: 18 Sep 2021 03:00 PM PDT I am attempting to mount an FTPS connection but am not having much success in getting it to automatically mount. I am using AWS Linux. I can get it working from the command line with: The credentials are specified in /root/.netrc. That connection seems to work fine: so with some confidence I add this into /etc/fstab : and then I enter and I get: dmesg | tail gives the following: The same thing before and after mount -a That userid and group ID are valid on the local server. I also tried a user ID and group ID that are valid on the remote server. Some googling suggested that I need to install some sort of helper program. I installed cifs-utils as was suggestged at one point, but that felt like a long shot and indeed it did not seem to help. returns the following on AWS Linux: So at this point I'm thinking that I need to find something equivalent for AWS linux, but I seem to only be able to find documentation about EFS. Any insight would be appreciated.  |
| No space left on device: Error writing to logs/access_log Posted: 18 Sep 2021 02:00 PM PDT Getting the following error: The access log file seems to be filling up and not archiving. I have copied the old file and created a new one but the same thing seems to be happening. Plenty of space on the drive etc (see below) Any advice much appreciated. Danny. Services running —  |
| Avoiding unnecessary bounces with OpenSMTPD on OpenBSD Posted: 18 Sep 2021 08:59 PM PDT I am running OpenSMTPD on OpenBSD together with spamd, spampd and spamassassin, DKIMproxy and dovecot. My setup is to handle both local e-mail on the server and (external) email for my domain. My setup seems to be working (still in testing phase). I am happy to be able to realise my setup with an opensmtpd.conf file of 17 lines excluding comments and spaces. There are however a few things that I am not happy with. I hope someone can suggest how to address these: While building the setup I initially had no spampd / spamassessin. In that config there was exactly one 'accept' command picking up the email and delivering to dovecot. The OpenSMTPD server checks existence of the recipient address and if not existing returns error 550 and does not allow submission of the e-mail. This is good. After I incorporated spampd and spamassassin the 'accept' command picking up the incoming e-mail forwards to spampd (which runs spamassassin). After spampd / spamassasin processing the message is picked up by another OpenSMTP accept command that delivers to dovecot. Though this works there are some unwanted side effects that, if not fixed, would lead to vulnerabilities: 1) spampd / spamassassin will process all incoming messages for my domain, also those for recipients on that domain that do not exist. Spampd/spamassassion are not exactly 'light' tasks. Together this makes the opportunities for a DOS attack higher. 2) All incoming messages for my domain are first accepted. In case of unknown recipients this will only be detected after spampd / spamassassin processing. Once the unknown recipient is detected a delivery status e-mail will be send by the mailer deamon to the sender stating the recipient is unknown. That allows an attacker to use my server to send spam-like email to any valid recipient by sending an e-mail to my server with as sender any valid e-mail address and as recipient any invalid recipient on my domain. Questions:
Kind Regards,  |
| Posted: 18 Sep 2021 04:00 PM PDT I did reconfigure /etc/sysctl.conf
After sysctl -p, I have received;
I have tried to install ip_conntrack module (sudo modprobe ip_conntrack) but it was not installed. No error just lsmod | grep ip_conntrack gives no output. I am running Debian Jessie and I installed conntrackd 1.4.2  |
| Bitlocker Network Unlock certificate issue Posted: 18 Sep 2021 07:01 PM PDT I'm trying to enable Bitlocker Network Unlock feature. I followed this article: https://technet.microsoft.com/en-us/library/jj574173(v=ws.11).aspx My environment is:
Following the article I created a certificate template by copying "User" template on my CA. The template is published so it can be requested. Then, on my WDS server I open up certificates console as a user and I request a new certificate. The certificate request appears as pending on a CA, which I accept manually. The issued certificate never shows in the "Personal" store on the WDS server, even though on the CA it appears as issued. I feel this article may be wrong, because "Bitlocker Network Unlock" cert store only appears in certificate console ran as Local Computer, not the User. But the current cert template doesn't allow requests from computer accounts. What should I do?  |
| Posted: 18 Sep 2021 02:00 PM PDT There seems to be a bit of a "chicken and egg" problem with the passwords to the password managers like Hashicorp Vault for Linux. While researching this for some Linux servers, someone clever asked, "If we're storing all of our secrets in a secrets storage service, where do we store the access secret to that secrets storage service? In our secrets storage service?"‡ I was taken aback, since there's no point to using a separate secrets storage service if all the Linux servers I'd store the secrets on anyway have its access token. For example, if I move my secrets to Vault, don't I still need to store the secrets to access Hashicorp Vault somewhere on the Linux server? There is talk about solving this in some creative ways, and at least making things better than they are now. We can do clever things like auth based on CIDR or password mashups. But there is still that trade-off of security For example, if a hacker gains access to my machine, they can get to vault if the access is based on CIDR. This question may not have an answer, in which case, the answer is "No, this has no commonly accepted silver bullet solution, go get creative, find your tradeoffs bla bla bla" I want an answer to the following specific question: Is there a commonly accepted way that one secures the password to a remote, automated secrets store like Hashicorp Vault on modern Linux servers? Obviously, plaintext is out of the question. Is there a canonical answer to this? Am I even asking this in the right place? I considered security.stackexchange.com, too, but this seemed specific to a way of storing secrets for Linux servers. I'm aware that this may seem too general, or opinion based, so I welcome any edit suggestions you might have to avoid that. ‡We laugh, but the answer I get on here may very well be "in vault". :/ For instance, a Jenkins server or something else has a 6-month revokable password that it uses to generate one-time-use tokens, which they then get to use to get their own little ephemeral (session limited) password generated from Vault, which gets them a segment of info. Something like this seems to be along the same vein, although it'd only be part of the solution: Managing service passwords with Puppet  |
| AWS vmimport - stuck on booting phase Posted: 18 Sep 2021 09:07 PM PDT Currently importing an OVA from an S3 bucket. Windows 2008 R2 Standard Process stops at the booting phase "StatusMessage": "FirstBootFailure: This import request failed because the instance failed to boot and establish network connectivity.", This is a single volume machine that boots up fine if the OVA is reimported back to VMware. There is a logon disclaimer box configured to appear before choosing the account to logon to. I've followed the AWS VMimport pre-reqs, It is not domain joined, AV disabled, Windows Updates set to manual. A similar OVA has imported fine, so struggling to understand what is different about this one. Anyone able to offer a view on what might be the issue?  |
| How do I set Host Groups on Fail2ban for Wordpress? Posted: 18 Sep 2021 03:48 PM PDT I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No 'host' group in '/etc/... I've been researching this problem and I see that filters are supposed to be wrapped in (?P ... ) as per the documentation So my file looks like this: I've tried different permutations of placing the (?P ... ) around different parts of the regex but after looking around, I'm honestly not sure what the correct syntax is. Can someone explain the syntax to me so that I can get this up and running? I'm not sure if these details matter but, my server is running Apache/PHP and has cloudflare running on it. Thanks in advance.  |
| How to get Mod_pagespeed to output compressed (gzip) css? Posted: 18 Sep 2021 03:00 PM PDT Ubuntu 14.04 Apache 2.4.7 php-FPM 5.5.9 Using latest stable Pagespeed Module for Apache (1.9.32.3-4448). I'm in the process of optimizing a WordPress website for speed (bandwidth and rendering). Mod Deflate is set up. A plugin (Better Wordpress Minify) compresses and combines all css files into one (thus reducing the number of requests). With Pagespeed switched off, if I check the produced link (using FeedTheBot) it confirms that the content is compressed using gzip. But If Pagespeed is switched on, it shows Gzip is not working. Using PageSpeed Insight (chrome extension) confirms this. Here is what I've tried:
Do you have an explanation ?  |
| Kerberos constrained delegation using Citrix NetScaler Posted: 18 Sep 2021 09:07 PM PDT I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. Example: A web application is published via TMG. Members of a certain Active Directory group are not allowed access to this site. TMG has to request credentials from the client, check group membership and then pass those credentials to the web server hosting the application. Unfortunately moving the membership check to the web server and allowing the client to authenticate directly is not an option. I have tried several tutorials (e.g. http://support.citrix.com/article/CTX139133) to do this with NetScaler, but to no avail. The authentication request the browser gets does come from the NetScaler, but all it returns is this: This looks "broken" to me. Whitespaces being used in tag IDs. Placeholder "{lang}" not being replaced with an actual value. I've gone through the document's troubleshooting section (5.4). Every command returns as expected. Only the last one gives me an error: Returns:
"ns-t1" is the hostname of the NetScaler server. I really hope someone can help me with this. Thanks in advance. Regards, Kevin  |
| Nginx error: "Primary script unknown" while reading response header from upstream Posted: 18 Sep 2021 01:06 PM PDT I have installed Nginx 1.6.2 with PHP-FPM (PHP 5.5.18) under CentOS 6.6 server. I didn't touch nothing else but After restart Nginx and try to access
I have checked also permissions/owner for I did not touch anything under PHP-FPM pool so Could be permissions the issue? I have read several posts here (as for example 1,2,3) talking around the same error and possible solutions and tried to apply to my situation but can't get it to works so I need some help here from any, what I'm doing wrong? Note: I get out commented lines from the file showed since aren't relevant  |
| Backup strategy for millions of files in lots of directories Posted: 18 Sep 2021 05:08 PM PDT We have millions of files in lots of directories, for example: backing up these to tape is slow as backing up data in this format is much slower than backing up a single large file.
Would the backup performance significantly increase by creating a virtual hard drive, hosting the data on it once mounted then backing up the vhd instead? I'm unsure if the underlying data within the vhd would affect this. what are the drawbacks to this method?  |
| Exchange 2010 HELO header change Posted: 18 Sep 2021 05:08 PM PDT I couldn't find any appropriate step by step guide for changing HELO header values in Exchange 2010. The problem is that the server doesn't allow changing the Default FQDN in: EMC -> Server configuration -> Hub transport -> Receive Connectors -> Default entry. The problem comes from the reason it is Default. I've read that I have to use Power Shell to change it. If someone knows the correct commands to change this in Exchange 2010 I'd be rather thankful for this major help. Regards!  |
| Posted: 18 Sep 2021 08:08 PM PDT I'm having a setup where I use the linode nodebalancer (loadbalancer) for my nginx/php5-fpm servers. This balancer passive checks. These passive checks, check the status code of requests. If there are too many 5XX status codes the node (vps) is marked offline by the loadbalancer The nodebalancer is putting my servers offline in a random way. When contacting linode support they came to the conclusion that there are no 500 errors, but connections are dropped (or timeout). I can't find anything in my nginx logs. Is there any way to debug this problem and see what connections have been timed-out dropped by nginx? EDIT I can see a lot of 408 requests from the same IP/user agent. They come in by bulk.. Is this suspicious? How would you handle this situation? Snapshot from access.log Thanks!  |
| Apache server not allowing mime type Posted: 18 Sep 2021 04:00 PM PDT How does one set mime types in Ubuntu 12.10 for I have kept these 3 lines in But when I run the index.html page from  |
| smb share takes forever to connect to from Mac OS X 10.7-8 Posted: 18 Sep 2021 07:01 PM PDT Ive got a dozen users and half of them take forever to connect to the smb share coming from a windows server 2008 r 2 standard server. Some users instantly connect with no issue. These Mac OS X workstations have been clean formatted to see if it was a OS issue but still some take forever to connect. I am wondering if there is something on the server side that can assist.  |
| Posted: 18 Sep 2021 08:08 PM PDT httpd.conf file: and this is my wrapper: my error is: /usr/local/apache2/logs/suexec_log /usr/local/apache2/logs/error_log UPDATES: I've edited: but no I get no errors and nothing found...  |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment