Server Circle - Member profile for leoncino

leoncino's profile (1280 points)

About: engineer at an italian hosting company

At the output of last command i can see one of the ftp server users log in to it every night at 2 am. but its impossible in that time that person isnt there. and i just can see the first 3 oct of its ip (10.10.200) and i cant see the full ip of client that login to ftp. how should i know more information about it? thanks

Asked in: Linux-Servers (3 answers)
leoncino's response: last -i shows full ip

I don't want to install X windows on my server but want to be able to use browser functionality. Can this be done and can I install just a few packages so that I don't add security holes with lots of extra packages ?

Asked in: Ubuntu-Linux-Servers (4 answers)
leoncino's response: You can use ssh -X, but X libraries must be installed on server (you don't need to start an X session). E.g. from a grafical workstation: ssh -X user@server firefox and firefox window will appear in your desktop (using resources of server) Otherwise you can use freenx or nx, that start an X session on server that is accessible over ssh tunnel via specific client.

What does these mean when I run top? 14.3%us, 0.1%sy, 0.0%ni, 68.2%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Thanks.

Asked in: Linux-Servers (4 answers)
leoncino's response: is CPU activity, splitted by functions: user, system, nice, wait, hardware irq, software interrupt, steal time. see "man top"

I'm trying to convince someone that there are differences between Apache on Windows and on Linux and we should run Linux. Any pointers to help me please?

Asked in: Linux-Servers (2 answers)
leoncino's response: at page http://httpd.apache.org/docs/2.2/platform/windows.html in paragraph "Customizing Apache for Windows" you can read the main differences in Apache for Windows

I get a bizarre Java error when trying to build Red5 from source using the install docs:

Unable to find a javac compiler; com.sun.tools.javac. Main is not on the classpath.
Perhaps JAVA_HOME does not point to the JDK. It is currently set to "/usr/lib/jvm/java-6-openjdk/jre"

Thank you.

Asked in: Ubuntu-Linux-Servers (2 answers)
leoncino's response: you must use sun java instead openjdk. in Ubuntu 10.04 install it with apt-get install sun-java6-jdk

I need to run a script when the network is initiated. I can add sleep 3 to the script so it will wait until it's fully up but I seem to remember on Debian there's a directory to put these files. Where is it? Thanks.

Asked in: Debian-Linux-Servers (2 answers)
leoncino's response: in ubuntu there are the following folder /etc/network/if-up.d in wich you can put your script

I need to trigger: http://server:8080/script.php?var=1 from Bash. Any ideas welcome.

Asked in: ShellScripts (3 answers)
leoncino's response: you can use lynx -dump http://......

Can I just have UDP and not ICMP or TCP?

Asked in: Linux-Servers (4 answers)
leoncino's response: an example for listen udp protocol on interface eth0, without resolving reverse PTR (-n switch) tcpdump -ni eth0 proto udp

How secure is SCP - it it encrypted ?

Asked in: Linux-Servers (3 answers)
leoncino's response: scp is cp over ssh, i.e. secure shell. The security is the same of ssh, you can enforce it using pre shared keys

I've set the correct permissions and the script is in the normal directory /cgi-bin/ but it won't execute for some reason. What's missing ?

Asked in: Linux-Servers (3 answers)
leoncino's response: take a look at /var/log/apache/error.log

How would I lock everyone else out so only I can use it from my IP address? Thank you.

Asked in: OtherProgramming (2 answers)
leoncino's response: If you use apache as http server, you can block access to phpmyadmin application via directive Allow from site configuration. e.g.: Order deny,allow Deny from all Allow from your.ip.address more details at: http://httpd.apache.org/docs/2.0/howto/auth.html

During the OS install I can add a second IP easily enough but how do I add a second IP address to eth0 ? It's not something I've ever needed to do before. Thanks in advance.

Asked in: Ubuntu-Linux-Servers (5 answers)
leoncino's response: to add second IP to eth0 you must edit after installation the file /etc/network/interface with something like: auto eth0:1 iface eth0:1 inet static address XXX.XXX.XXX.XXX netmask YYY.YYY.YYY.YYY

Can someone give me a little bit of help please ? I'd like to backup a directory on a server over SSH using rsync. I get a bit lost with simple bash scripts though. So far I have this: #!/bin/bash cd backup_directory time rsync -e 'ssh -c blowfish -oPort=2222 -ax' -avzx --stats --progress user@server:/var/DIR . Does that look like a sensible approach to syncing a folder ? Thanks for any pointers.

Asked in: Ubuntu-Linux-Servers (3 answers)
leoncino's response: two useful articles for backup with rsync http://www.thegeekstuff.com/2010/09/rsync-command-examples/ http://www.thegeekstuff.com/2011/07/rsync-over-ssh-without-password/

I'm looking for a GUI for my MySQL database and PHP admin work but find PHPMyAdmin unsafe and clunky. Does anyone use any alternatives ? Thank you.

Asked in: Linux-Servers (4 answers)
leoncino's response: you can see chive: http://www.chive-project.com/ or sql buddy: http://www.sqlbuddy.com/

I may have to copy about three hundred user accounts with passwords to a new Linux Server. How could I do that from a Windows Domain ? Thanks for any help.

Asked in: WindowsServers (1 answers)
leoncino's response: If the users connect to linux server via samba you can use net vampire utilities from samba http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/NetCommand.html

I've heard about tcpdump but it looks tricky and I'm new to networking. Any other network sniffers that run on the command line on Linux that are easier to learn ?

Asked in: Server-Networking (2 answers)
leoncino's response: tcpdump is a good tool, but you can try with tshark. I prefer tcpdump. If your target is simply discover what top traffic IPs, you can use iftop

What happens if one database server fails. Say one database server was just for non-essential things like news reports but that was unavailable. How can I tell the site to ignore it and still load the rest of the content ?

Asked in: OtherProgramming (1 answers)
leoncino's response: Test if connection to the database is failed then jump to rest of code.

Can someone please help me to create a compressed file for three home directories ? I know how to use tar and gzip but can't zip up three home directories in a script. If I could run it in Cron and then download the file every day manually that would be great. Thank you, I will give 100 of my points.

Asked in: ShellScripts (4 answers)
leoncino's response: You can even make three file, but if you want only one file: tar czf /pathwhereyouwant/backupfile.tgz /home/homedir1 /home/homedir2 /home/homedir3 After creation where you want to upload this file?

Is Winbind's NTLM authentication function the only way to do it for proxying with Squid ? Cheers.

Asked in: Linux-Servers (1 answers)
leoncino's response: I know only this way. A sample snippet of squid.conf, where only members of group usersAllowed can surf the web. First you must join domain with command "net join -U Administrator" external_acl_type wb_group concurrency=5 ttl=900 %LOGIN /usr/lib/squid/wbinfo_group.pl auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 30 auth_param ntlm max_challenge_reuses 0 auth_param ntlm max_challenge_lifetime 2 minutes # ntlm_auth from Samba 3 supports NTLM NEGOTIATE packet auth_param ntlm use_ntlm_negotiate on acl AuthorizedUsers proxy_auth REQUIRED acl usersAllowed external wb_group usersAllowed http_access allow AuthorizedUsers usersAllowed http_access deny all

How can I get a connection to a remote IP to use a NIC if there's already a default route that sends that traffic to the wrong NIC ?

Asked in: Server-Networking (2 answers)
leoncino's response: use the command: route add -host remoteIP dev /dev/ethX in this way all traffic ro remoteIP are routed by device /dev/ethX (chang ethX with NIC name) If you neead a gateway add gw IPgateway: route add -host remoteIP gw IPgateway dev /dev/ethX

I want to setup and virtual machine on my server htat can enable me to access it With graphical interface! like team viewer or remote desktop connection! I heard ubuntu can do that! whats the actuall solution!?

Asked in: Linux-Servers (5 answers)
leoncino's response: from ubuntu desktop you can choose: System->Preference->Remote Desktop In this window you can set remote access to desktop. For my opinion the best solution for remote Desktop is NX (http://nomachine.com), for 1 remote user is free. Also you can you the free version called freenx

I've heard that sometimes Google Analytics slows down your site if Google's servers are slow. Is this really right ? Thanks.

Asked in: Linux-Servers (1 answers)
leoncino's response: It's true for any content in your page that come from slow server

I lost a file when moving it inside my pendrive memory. Can I retrieve it?

Asked in: Linux-Servers (5 answers)
leoncino's response: You can try to use testdisk/photorec utilities.

Off my existing server so I have a live backup ? Thanking you.

Asked in: Linux-Servers (1 answers)
leoncino's response: How to configure replication in mysql is detailed at: http://dev.mysql.com/doc/refman/5.5/en/replication.html

I haven't ever set up a proxy server of any kind. How do I do it with incoming e-mail ?

Asked in: Linux-Servers (1 answers)
leoncino's response: Usually a proxy is used for http, for e-mail you can use an internal server that collect mail with some fetchmail script

I read about mod_log_config and all the parameters it uses here: http://tinyurl.com/bmxx6 Would disabling this module so there was no logging dramatically improve Apache performance ?

Asked in: Linux-Servers (1 answers)
leoncino's response: I don't think this will improve Apache performance, it depends on workload of your server. Only if the server hosts many pages fragmented in many files, with a high number of request per second, you can have some improvement. You can consider to use a separate disk for logging, this will improve performance without losing the logs.

Is it the case that the newer version of Ubuntu Linux Server will be less reliable and I should go for the older version ?

Asked in: Ubuntu-Linux-Servers (1 answers)
leoncino's response: Usually the best choice for a server is a LTS version, thus lucid lynx (10.04). Lucid will be mantained just to 2015

How do I go about forcing users that choose passwords to use upper and lower case and numbers etc so that the passwords are strong ?

Asked in: OtherProgramming (1 answers)
leoncino's response: You can use the function crack_check http://it.php.net/manual/en/function.crack-check.php

Is there a quick way of speeding up my MySQL database server ? It's a default installation currently. Is that usually tuned for performance already ? Cheers.

Asked in: Linux-Servers (1 answers)
leoncino's response: there are no standard ways to speed up mysql. What kind of database you plan to use? How many simultaneous connection you expect? Using optimized query and a right choice of indexes is the better way to have an efficient database

I'm looking for one that will work with Debian and Ubuntu Servers ideally. Where would I get one ? I'm in the UK.

Asked in: Debian-Linux-Servers (4 answers)
leoncino's response: every card with realtek chipset work in Ubuntu, if you want a card more performant (minor load for CPU) you must find an intel or broadcom card.

How should I back up my MySQL database so I don't lose the data ? It's changing quite a lot so what do people do to back up their databases ? I'm new to LAMP set ups if you can't tell :)

Asked in: Ubuntu-Linux-Servers (5 answers)
leoncino's response: The use of a slave is for database replication. This mean that when you write something in database, the same write is made in database replica. You must have one separated server for replica, and configure your server as showed in http://dev.mysql.com/doc/refman/5.0/en/replication.html. mysqldump is a "snapshot" of database made when you run command

A new install can't see my motherboard's built-in NIC :( I'm at a loose end, what do I do ? Thanks !

Asked in: Ubuntu-Linux-Servers (3 answers)
leoncino's response: Please specify the motherboard model, if you don't know use lspci for listing devices. Check with ifconfig -a if there are some problem with address confifguration.

How can PHP just break ? I haven't changed anything at all ! Any ideas ?

Asked in: OtherProgramming (1 answers)
leoncino's response: maybe some changes in php.ini file

How should I back up my MySQL database so I don't lose the data ? It's changing quite a lot so what do people do to back up their databases ? I'm new to LAMP set ups if you can't tell :)

Asked in: Ubuntu-Linux-Servers (5 answers)
leoncino's response: You can use mysqldump command. For example: mysqldump -u user -p databasename > destinationfile.dmp

How do I start and stop Apache on Ubuntu Server Lucid Lynx ? I have changed the server name to a new domain name.

Asked in: Ubuntu-Linux-Servers (1 answers)
leoncino's response: You can use the command: sudo /etc/init.d/apache2 restart or sudo service apache2 restart

I'd like to add a server to an existing setup where there are 6 computers using a 4-port wireless router. At present 4 computers are cabled and 2 use wireless to connect to the router. I'm thinking when I add a server to the setup, it will need a static local IP and will be best connected by cable to the router. If I don't want to switch one of the other computer's to using wireless connection, that will leave me one port short for connecting the other 4 cabled computers to the router. Can I insert a 10/100 network switch into one of the router ports and use that to connect 2 of the 4 cabled computers to the one router port? Will it create any problems for those 2 computers using the internet / accessing the server?

Asked in: Server-Networking (3 answers)
leoncino's response: If the 4 ports of the router are parts of an unique internal switch, then you can insert another switch in a router port, and connect all cabled computers to switch.

Is it possible to use Ubuntu cloud infrastructure to build a private cloud and is it commercially available for free ?

Asked in: Ubuntu-Linux-Servers (1 answers)
leoncino's response: Yes, on the Ubuntu Server CD there are a choice for installing private cloud. This cloud is based on a free version of Eucalyptus. You can follow the instructions at http://www.ubuntu.com/cloud/private

I have ntpdate installed and configured to check and set the time after a reboot on my server, which hardly ever happens, but I get the error operation not permitted in syslog on Ubuntu server. What could it be ? Thank you very much.

Asked in: Ubuntu-Linux-Servers (2 answers)
leoncino's response: Under what user does ntpdate run ? Is this script you call ntpdate with using the right path ? I use ntpdate as root cronjob.

I have this at the top of the default_ssl vhost in Apache with the cert and key working okay:

< VirtualHost _default_:443 >
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html

This works fine but I have another site I want to use another SSL certificate for. What do I change the _default_ bit to ? I've found the places to change the certificates and keys. Thank you.

Asked in: Linux-Servers (2 answers)
leoncino's response: You must put an IP address. You need an IP for each https site you want, or you must use different ports

What other precautions should I take with running an FTP server these days ? I have this:


ssl_enable=yes
force_local_data_ssl=yes
force_local_logins_ssl=yes

Is a chroot really necessary do you think ? Thanks.

Asked in: Linux-Servers (2 answers)
leoncino's response: Yes, chroot limit users to home directories (or other directories you choose)

I got vsftpd up and running okay, thanks for the suggestions. I have loads of files in a directory (of about 34,000 images !) and when I login over FTP sometimes the LIST command timeouts. I suppose I could try another FTP client or do you have any other ideas ?

Asked in: Debian-Linux-Servers (1 answers)
leoncino's response: If you can't separate images in multiple directories, you can try to increase timeout in vsftpd.conf (parameter data_connection_timeout)

The last octet in an IP address changes in my script, what's a foolproof way of replacing that last octet in PHP with another variable ?

Asked in: OtherProgramming (2 answers)
leoncino's response: You can use preg_replace like the following $s="123.123.123.123"; $r="$1.$2.$3"; $p="/(d+).(d+).(d+).(d+)/"; echo preg_replace($p,$r,$s);

I need to install an FTP server on a server that runs Debian Lenny. How would I do that and what's the easiest one to configure ? I've only heard of vsftp before. Will that be safe for about 50 office users ? Help would be greatly appreciated.

Asked in: Debian-Linux-Servers (1 answers)
leoncino's response: I think vsftpd is a good choice. For install in Debian it's sufficient just to do: apt-get install vsftpd Configuration is made by file /etc/vsftpd.conf and is easy.

I'm suddenly getting lots of "Function eregi() is deprecated errors" in PHP 5.3.0 and my application looks very broken :( If I'm right preg_match replaces eregi but that looks scary. How can I get my app back up and working ? Thanks very much.

Asked in: OtherProgramming (3 answers)
leoncino's response: you can found an example of sustitution of eregi with preg_match at: http://stackoverflow.com/questions/1374881/how-to-change-phps-eregi-to-preg-match

Asked in: OtherProgramming (3 answers)
leoncino's response: If you put an @ before eregi() you mask the error and the look of the application is saved, after you can change all eregi with preg_match.

If I was to give my users passwords to send e-mail through our servers how would I do that in Postfix ? That way only they could send e-mail. Could I make the passwords encrypted so they were safe and could I ban IP addresses if the passwords were wrong a few times ? Thanks !

Asked in: Email-Servers (1 answers)
leoncino's response: You can use a Mysql database for storing domain and mailboxes informations. In ubuntu you can install postfix-mysql package, and take a look at http://sourceforge.net/projects/postfixadmin/ for database structure and management tool. For banning IP that try to crack server, you can use a process that analize log files, or you can personalize the authentications queries

Sometimes a spammer will send an email a second for up to about thirty seconds presumably checking to see which addresses exist. No legitimate SMTP server that connects to my mail server ever sends more than about 3 emails in 3 seconds. Can I drop the spammers in Postfix ?

Asked in: Email-Servers (1 answers)
leoncino's response: For reducing spam there are many methods using parameter smtpd_recipient_restrictions. My tipical use of this parameter involve smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination reject_rbl_client sbl-xbl.dnsbl check_policy_service inet:127.0.0.1:60000 In this way I use: spamhaus black list (not free, but you can use the free version) - greylist via postgrey package (check_policy_service inet:127.0.0.1:60000) - reject_unauth_pipelining for avoid bots - reject_unknown_recipient_domain is self explain If you want more restriction you can implement a before queue filter, or identifying some pattern you can use regular expression for dropping messages via header_checks

I've just downloaded ubuntu-10.04.2-dvd-i386.iso from: http://cdimage.ubuntu.com/releases/10.04.1/release/ The download list includes a list of MD5SUMS, in particular for my ISO; e1b88a1d9cc625ce45bb26fba8fa855c *ubuntu-10.04.2-dvd-i386.iso My question is, should I be checking the MD5SUMs on ISO downloads, and if so, how?

Asked in: Linux-Servers (2 answers)
leoncino's response: You can use the command md5sum ubuntu10.04.2-dvd-i386.iso

How do I mount a backup USB drive that has been plugged into the external USB port for me on my 11.04 Ubuntu Server ? How do I add it at boot time Thank you in advance.

Asked in: Ubuntu-Linux-Servers (1 answers)
leoncino's response: With command dmesg | grep SCSI you can discover the name of device assigned to your USB drive. E.g. [12035.519777] sd 9:0:0:0: [sdf] Attached SCSI removable disk in this example is /dev/sdf you can mount it with command: sudo mount /dev/sdf1 /mnt For mounting at boot time use the command blkid for discoer UUID of your drive and add a line to file /etc/fstab like: UUID=05582e84-fccd-794c-d092-12c50372f38f /mnt ext2 defaults 0 2 Change ext2 with the file system used on your usb drive

Is it possible to simulate a user clicking on a few pages for load testing ? Ideally it would include DNS lookups all the way through to a set number of clicks and maybe even a form being filled in.

Asked in: Fedora-Linux-Servers (1 answers)
leoncino's response: you can see at http://jakarta.apache.org/jmeter/

I have changed my SSH port but what else should I do to Ubuntu server after installing it.

Asked in: Ubuntu-Linux-Servers (1 answers)
leoncino's response: changing port for ssh is not a security improvement. You must plan what must be open, and for who. For instance some services (e.g. SSH) must be used only in local network, others from public network (e.g. apache). You must configure firewall rules directly with iptables, or you can use an interface like ufw for apply your security plan.

I need to be able to swap an IP address in a script - I'm trying to use sed as follows: sed 's/green/blue/' < old > new How would I do that with 123.123.123.123 and 456.456.456.456 ? It doesn't work when I try it. Thank you for your help.

Asked in: ShellScripts (2 answers)
leoncino's response: dots must be "escaped" sed 's/123\\.123\\.123\\.123/456\\.456\\.456\\.456/' < old > new

What advantages are there to having directories like /home on different partitions ? I remember someone once saying that /tmp being on another partition is safer but I can't remember why. Surely the default installation options in Ubuntu Server choose sensible partitioning, or don't they ? Thank you.

Asked in: Ubuntu-Linux-Servers (3 answers)
leoncino's response: if you mount /tmp separatly, you can to mount it with noexec flag, this enforce security because many malicious scripts attempt to write a file in /tmp and execute it

I know I can manually add a line like: mount /dev/sdf1 /directory but how do I make it mount at boot time so I don't have to mount it by hand. I'm using Natty Narwhal 11.04 if it makes any difference.

Asked in: Ubuntu-Linux-Servers (3 answers)
leoncino's response: you must insert in /etc/fstab a line like this: /dev/sdf1 /home ext4 defaults 0 2 you must specify filesystem used in partition. Better is using UUID instead /dev/sdf1, you can discover UUID by comman blkid