Server Circle - Member profile for Trinity

Trinity's profile (2782 points)

About: You know, from that film ....

Fedora localtime quirks are puzzling

Asked in: Fedora Linux with 1 answers

Cacti update device via the command line

Asked in: Linux Servers with 1 answers

Using bash to change MySQL

Asked in: Shell Scripting with 3 answers

Wowza Media Server on EC2 and edge server configuration

Asked in: Fedora Linux with 1 answers

Dpkg install and remove packages in Debian

Asked in: Debian Linux with 2 answers

Correctly escaping a backslash in PHP

Asked in: Programming with 2 answers

Ethtool error message meanings

Asked in: Linux Servers with 2 answers

Bizarre nl2br and line break formatting

Asked in: Programming with 1 answers

PHP header not working in a script

Asked in: Programming with 2 answers

Script to extract email addresses from mysql

Asked in: Shell Scripting with 1 answers

Allowing users to forward mail themselves in Postfix

Asked in: Email Servers with 2 answers

Email load testing for benchmarking

Asked in: Linux Servers with 0 answers

Which package of the Ubuntu Amazon EC2 AMI handles the locale setting ?

Asked in: Ubuntu Linux with 0 answers

List of current route servers that let you run traceroutes

Asked in: Networking with 0 answers

Ubuntu .bash_profile and .bashrc

Asked in: Ubuntu Linux with 1 answers

Read lock on a MYSQL database

Asked in: Virtual Machines with 1 answers

Etags in Apache HTTP headers

Asked in: Fedora Linux with 1 answers

Analog modem that will definitely work with Ubuntu server

Asked in: Ubuntu Linux with 4 answers

Is there any need to have cups installed on a Suse server ?

Asked in: Suse Linux with 2 answers

MYSQL failover on EC2

Asked in: Cloud Servers with 0 answers

Permissions on ssh_config and sshd_config

Asked in: RedHat Linux with 2 answers

Any localepurge experiences ?

Asked in: Ubuntu Linux with 3 answers

Drupal experiences

Asked in: Programming with 5 answers

Fail2ban configs examples to work out my own filters from

Asked in: Linux Servers with 2 answers

REWARD: Banning BOGON Networks from my Web Server

Asked in: Networking with 7 answers

RAID inside a Server or a NAS device ?

Asked in: Linux Servers with 3 answers

Greylisting on Mail Servers

Asked in: Email Servers with 2 answers

Ubuntu .bash_profile not loading up on login

Asked in: Ubuntu Linux with 2 answers

Docs for Apache mod_rewrite

Asked in: Linux Servers with 2 answers

SSH config for only some users

Asked in: Linux Servers with 4 answers

Should I check MD5SUMs on ISO Downloads ?

Asked in: Linux Servers with 2 answers

Using iPerf for testing Throughput Problems

Asked in: Linux Servers with 1 answers

Been seeing a lot of reports of a bug in Apache which uses the range header to cause massive memory usage with very limited or even a single request, but wondering if this is as bad a problem as it seems. We've been having very odd things happen in the last few days with memory vanishing and no server load, so wondering if this might be the cause. Couple of places I've seen this mentioned: https://threatpost.com/en_us/blogs/apache-dos-bug-resurfaces-spurring-new-attacks-082411 http://marc.info/?l=apache-httpd-dev&m=131418828705324&w=2 Reading the blurb especially from the people who I guess are trying to find a fix, it sounds like this is really easy to trigger and something to do with making lots of very small requests but each being compressed...don't totally understand it. End result seems to be the server crashes. http://www.gossamer-threads.com/lists/apache/dev/401638 If it is that bad then I guess it's pretty much the death of Apache 1.3.x as that's not planned to be patched. But would be interested to know what the more knowledgeable know about it. Trev

Asked in: Linux-Servers (1 answers)
Trinity's response: I think it probably is as bad as it sounds! There are lots of quick fixes if your distribution hasn't released a fix (Debian has, Ubuntu hasn't). As for Apache 1.3, it's past its sell by date. That said, a MAJOR site I visited today still had .php3 extensions for its filenames! 1.3 might get a patch and a rebirth.

I have problem on squid 2.7 compiled with --enable-ssl on debian6 installed on vmware player I add this line to squid.conf but when i put proxy settings in browser((firefox)) i get " connection was reset " https_port 443 cert=/etc/squid/testcert.cert key=/etc/squid/testkey.pem the above line is the only line added to squid.conf and there is error in squid's cache.log

clientNegotiateSSL: Error negotiating SSL connection on FD 29: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request (1/-1)

there wasn't real solution in Internet just some places said that it's problem with browser

Asked in: Linux-Servers (4 answers)
Trinity's response: I know it's not too much help but my first guess would be pernissions around the certiicate files. SSH complains if files aren't chmod 600 file for example.

I've a small doubt can we run morethan 20 vps servers on a single dedicated server with 1 static ip? Is xen hypervisor best for production servers? and what are the other hardware based virtualization opensource software? Please help me with this. Thanks.

Asked in: Linux-Servers (3 answers)
Trinity's response: I would recommend http://wiki.openvz.org/Main_Page It's very light and gives you native speeds (really!) but you can only offer VPSs if they're the same OS as the Host OS.

I need to update a field via a bash script. Can it be done ? -e isn't working for me.

Asked in: ShellScripts (3 answers)
Trinity's response: I had to use mysql -uroot -pPASSWORD -DDATABASE< sqlfile.sql to get it working in the end. I uploaded the sql file via SCP and then ran the above in the script and it gets around environment and path problems.

I am having major headaches trying to get Transmission to work from my client machine ( Ubuntu 10.04 ) through my home server ( Ubuntu Server 11.04 ). Keeps telling me "Port is Closed". Server is set up as a NAT / iptables Firewall / squid3 proxy... Transmission works fine if I turn off the firewall but doesn't otherwise. I am using Port 51515 for Transmission. Can someone please post the necessary iptables rules to get this working

Asked in: Ubuntu-Linux-Servers (3 answers)
Trinity's response: Apparently it's not very easy at all: http://www.linuxquestions.org/questions/linux-security-4/transmission-immune-to-iptables-677509/ Can you close all other services down that aren't needed and run without a firewall on that box ?

how to fetch a string in the text. I need a /media/New Volume type in this text /dev/sda5 on / type ext4 (rw,errors=remount-ro,commit=0) proc on /proc type proc (rw,noexec,nosuid,nodev) none on /sys type sysfs (rw,noexec,nosuid,nodev) fusectl on /sys/fs/fuse/connections type fusectl (rw) none on /sys/kernel/debug type debugfs (rw) none on /sys/kernel/security type securityfs (rw) none on /dev type devtmpfs (rw,mode=0755) none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620) none on /dev/shm type tmpfs (rw,nosuid,nodev) none on /var/run type tmpfs (rw,nosuid,mode=0755) none on /var/lock type tmpfs (rw,noexec,nosuid,nodev) nfsd on /proc/fs/nfsd type nfsd (rw) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev) gvfs-fuse-daemon on /home/hamid/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=hamid) /dev/sdc1 on /media/FreeAgent GoFlex Drive type fuseblk (rw,nosuid,nodev,allow_other,blksize=4096,default_permissions) /dev/sde5 on /media/New Volume type fuseblk (rw,nosuid,nodev,allow_other,blksize=4096,default_permissions) the ' ' is importand

Asked in: ShellScripts (4 answers)
Trinity's response: Is it this you're after? grep '/media/New Volume type' FILE

how i can convert ppt to pdf in command line ?

Asked in: Linux-Servers (3 answers)
Trinity's response: This works in scripts apparently. http://www.artofsolving.com/opensource/jodconverter

I had a ubuntu server 10.04 running on Dell Poweredge sc1425 which has two networking slots. the problem is both network is disabled. and i can't connect on the net to update the server. manual configuration of network does seems to work locally. Does Anybody encountered the same problem? Help please?

Asked in: Linux-Servers (13 answers)
Trinity's response: If your NICs aren't listed with ifconfig -a then you need to install drivers for them. You can use lspci -vv to find the model of your NIC (and dmesg possibly at the start of the output). If that's a struggle try your Dell badge number on their site and get the exact model of NIC and then download the driver from the manufacturer and compile from source with ./configure, make and make install etc.

I can't switch off the warnings in SSH for changing fingerprints. Anyone know how ?

Asked in: Linux-Servers (2 answers)
Trinity's response: ssh -p22 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i KEY.pem root@IPADDRESS Should help.

what is meaning of LD , CC during make bzImage command in compiling kernel?

Asked in: Linux-Servers (3 answers)
Trinity's response: I know that CC is the compiler name (eg gcc). Not sure about LD.

what is difference between inetd and xinetd?

Asked in: Linux-Servers (2 answers)
Trinity's response: xinetd is not just an inetd replacement. Anybody can use it to start servers that don't require privileged ports because xinetd does not require that the services in its configuration file be listed in /etc/services.

Can you please let us know how to Manage Distribution Lists with postfix LDAP. Thanks in Advance.

Asked in: Linux-Servers (2 answers)
Trinity's response: This might give a few pointers, it's a thorough tutorial: http://www.howtoforge.com/postfix-virtual-hosting-with-ldap-backend-and-with-dovecot-pop3-imap-on-ubuntu-8.10

Can anyone recommend a good SSH client app which I can use to connect to my linux servers from my iPhone? Thanks

Asked in: Linux-Servers (4 answers)
Trinity's response: This unfathomably long URL might help you: http://comments.deasil.com/2008/08/18/iphone-ssh-review-issh-v-pterm-v-touchterm/

Has anybody used any APIs for shortening links in PHP? I need a noobie function that even I will be able to understand. Thanks.

Asked in: OtherProgramming (3 answers)
Trinity's response: This should help: http://www.hashbangcode.com/blog/using-e-modifier-php-pregreplace-228.html

I have a SSL site working now but the certificate runs out soon. I purchased a renewed certificate and installed it like I have done a thousand times before but it doesn't work. When I reload the web server it just fails no errors in stdout or in the logs. I put the old certs back in and everything works fine. Now my cert provider has upgraded to 2048 encryption so I had to regenerate my private key before I could use the new cert. Yes I am pointing to the new key and the new cert in my conf file. If I could get an error that would be great then I could figure it out but I'm getting anything. This is a production system so down time is unacceptable but I need to update this cert. Any body know how I can troubleshoot this? Ubuntu 10.04 server x86_64 Apache 2.2.14

Asked in: Linux-Servers (2 answers)
Trinity's response: This caught me out recently. These days you need an intermediate certificate to create a trusted chain. See second part here: http://help.globalscape.com/help/me3/ssl_ca_certificate_chain_support__.htm Your cert's root authority website should give you it, eg Geotrust even if you bought the cert from RapidSSL. Sorry if my terminology is a bit wrong, hopefully you get the idea.

I am getting boot time message for sun E420R server. I need urgent help.

Hardware Power ON 

CPU Offline (not present) 

Master CPU : 0000.0001.0055.11a0 

CPU Offline (not present) 

CPU Offline (not present) 

Master E$ : 0000.0000.0040.0000 


Button Power ON 

CPU Offline (not present) 

Master CPU : 0000.0001.0055.11a0 

CPU Offline (not present) 

CPU Offline (not present) 

Master E$ : 0000.0000.0040.0000 

Probing keyboard Done 

Executing Power On SelfTest

Asked in: UnixServers (2 answers)
Trinity's response: I know it's not what you want to hear but it sounds as if your CPU isn't available to the boot process. I'd guess it's either died or isn't seated properly on the main board.

I'm seeing this NTP error a lot on a server: Requested time correction of 1208 seconds exceeds sanity limit. You must set the clock manually to correct this. It's beginning to get tiresome. How can I workaround it ?

Asked in: Linux-Servers (5 answers)
Trinity's response: Adding the -g parameter means that NTP ignores the sanity check. Something like this (possibly in /etc/init.d/): ntpd -g THE REST OF YOUR COMMAND

Our primary HD is crashing and turning the ext3 system into read_only mode, I guess its due to high i/o usage because of about 8k simultaneous users on high traffic hours. Can anyone tell me how to detect high I/O and from what process it's coming from? (apache, php, email, etc). Also, any tips to reduce I/O usage? I'm using a 500 GB SATA HD. Thanks a lot!

Asked in: Linux-Servers (9 answers)
Trinity's response: It's probably not the answer you would like but it would suggest the cause is pretty nasty: http://forums.theplanet.com/lofiversion/index.php/t32730.html BTW you're not using a loop disk are you ?

My netcat (nc) doesn't listen! It means when I write nc -l 3333, I can't communicate data with nc 127.0.0.1 3333 in another terminal! Also after writing nc -l 333, I don't see port 333 between the ports which are listening, by netstat -ln | grep 3333. What should I do? Thank you!

Asked in: Linux-Servers (9 answers)
Trinity's response: Have you checked firewalling ?

Are there any ways I can customise someone else's script (for free) to run an RSS feed from my server ? I think it's the way I'd prefer to do it if possible.

Asked in: ShellScripts (1 answers)
Trinity's response: Here you go: http://forums.digitalpoint.com/showthread.php?t=32265

$myfeed = new RSSFeed();
$myfeed->SetChannel('http://www.mysite.com/xml.rss',
          'My feed name',
                  'My feed description',
          'en-us',
          'My copyright text',
                  'me',
          'my subject');
$myfeed->SetImage('http://www.mysite.com/mylogo.jpg');
$myfeed->SetItem('http://www.mysite.com/article.php?id=bla',
                   'name',
                   'description');
....
echo $myfeed->output()

It's quite clear that some people prefer their own handmade kernels and to get better security and performance out of their servers and don't mind the sacrifice of some time whenever there are security updates but how safe are loadable kernel modules ? Can hackers can inject lines of code from root kits and the like into a running kernel in another way ?

Asked in: Server-Firewalls (2 answers)
Trinity's response: They are very useful but like many things removing for security reasons adds an admin overhead. The choice is yours.

In Centos 5.5 i didn't get any problem after a clean install of centos 5.6 64bit mysqld is using around 500% CPU usage. Can any one help me how to fix this or i need to go back 5.5?

Asked in: Linux-Servers (6 answers)
Trinity's response: Trying running show processes like this: mysql -p -u USER -D DATABASENAME show processes; to check what's using the most CPU. And run top from the command line to make sure it is mysqld hogging all the resources.

I'm new to MYSQL and have read this post: Displaying row number (rownum) in MySQL: http://jimmod.com/blog/2008/09/displaying-row-number-rownum-in-mysql/ I get the idea but can't adapt it to me own SELECT rule. How does this: select @rownum:=@rownum+1 ‘rank’, p.* from player p, (SELECT @rownum:=0) r order by score desc limit 10; work with this: SELECT userid FROM people WHERE age=28; I just can't get it working. Help please !

Asked in: OtherProgramming (2 answers)
Trinity's response: Sometimes using a counter like this in a while loop helps:

$counter = 0;

while { ...

$counter++;

}

The ++ increments the counter on and you can refer to the running count of output in the while loop.

Can I safely allow apt-get (or aptitude or dpkg) on port 80 in IPtables for package updates on Ubuntu Server ? Thank you in advance.

Asked in: Ubuntu-Linux-Servers (3 answers)
Trinity's response: That looks pretty good. For HTTPS change 80 to 443 obviously.

How can I log exactly what in and out traffic is per IP address ? I have a few IPs on a server. Thank you for any help.

Asked in: Linux-Servers (2 answers)
Trinity's response: Yes, ifstat is just per interface and NIC I seem to remember.

I'm getting annoyed with lots of scraps of info on Postfix and need it all in a book I think. There's so many official and unofficial docs out there for Postfix it's pretty easy to get lost in it. Any really good books you can recommend please ? I think the O'Reilly one looks okay so far.

Asked in: Email-Servers (2 answers)
Trinity's response: I'd rate this: http://oreilly.com/catalog/9780596002121

Can anyone recommend any, slightly more advanced than majordomo or mailman, mailing list packages ? Ideally a GUI and generated unsubscribe links please. Small lists only really needed. Thanks.

Asked in: Linux-Servers (1 answers)
Trinity's response: I think someone may have written a GUI for Mailman if that helps at all.

I'm astonished at the number of security vulnerabilities available for Apache. Why does it have so many security problems compared to other packages ? I've heard about the most popular packages having more exploits announced but that is still a high number. http://httpd.apache.org/security/vulnerabilities_20.html Can someone shed some light on this ?

Asked in: Ubuntu-Linux-Servers (1 answers)
Trinity's response: I don't really see that it has a higher count of security holes than any other package. It means it's well maintained (usually) if patches and new versions are being released frequently and as you mention it is the most popular web server on the Internet so the developers keeping it patched is very important.

In device manager their is no section for cd/dvd-rom drives. I went to delete the upper and lower registry values but they weren't there. I tried the microsoft help it said the values were not there but when I reboot nothing happens. Both drives physically open when I push the button but don't read cd's, and they aren't in my computer or device manager still. Any help is greatly appreciated, thanks.

Asked in: WindowsServers (1 answers)
Trinity's response: This is usually down to drivers not being loaded up. You'll need the drivers from the drive manufacturers, install them and then reboot.

I am trying to create a control panel for openvz ... what i need is to execute a shell command to start or stop a vm ... I have googled about this and have found many people asking about this but i was not able to do this... i tried using sudoers file ... and setting setuid etc... please I need step by step method to do this ...

Asked in: Linux-Servers (1 answers)
Trinity's response: I've used this method before and it works but sometimes commands are funny about environments and paths:

<?
$output = shell_exec('ls -lart');
echo "<pre>$output < /pre >" ;
?>

More here: http://php.net/manual/en/function.shell-exec.php If you're running vzctl stop 101 if you give the full path to vzctl I can't image it won't work with the right permissions.

How to install and configure IPcop V3 on the Centos 5.6

Asked in: Linux-Servers (1 answers)
Trinity's response: I know this is the wrong version but it can't be that different surely and it's a good HOWTO: http://www.howtoforge.com/perfect_linux_firewall_ipcop

I just found this in dmesg, 451 is a container name, on an OpenVZ host. Fatal resource shortage: numiptent, UB 451 Any advice ? Thanks.

Asked in: Virtual-Machines-Servers (2 answers)
Trinity's response: This seems to be IPtables related. You're not getting enough resource to firewall packets. Try increasing buffers as much as you can without causing slowdowns.

Can I limit each individual IP to a certain amount of hits per minute and then slow them down somehow ? Thanks for your help.

Asked in: Ubuntu-Linux-Servers (2 answers)
Trinity's response: You can look up details regarding the "state" and "recent" modules in IPtables. There should be a few examples online.

I've migrated over to lighttpd from Apache but the site is a bit slower. What can I check ? Thanks.

Asked in: Linux-Servers (1 answers)
Trinity's response: Try benchmarking with one of Apache's utils "ab" if you can to try and get actual results to compare.

Is there a safe way of allowing users to forward their own mail in posftix ? Along the lines of .qmail files with Qmail ? Thanks.

Asked in: Email-Servers (2 answers)
Trinity's response: Ahh, okay I see, thanks.

I'm trying to use "Volume Shadow Copy" on Windows XP to export a shadow copy of a Windows volume over Network Block Device. For that, I'm using vshadow from Microsoft VSS toolkit. That takes a snapshot, and I can use nbd-server (from nbd.sourceforge compiled on cygwin) to export the volume snapshot over nbd. That is working great except that I realised that the snapshots are actually not snapshots: they do change over time: I did two ntfsclone of the same nbd device from the same shadow copy and they do differ. On the one instance I'm investigating on none of the file contents in the two clones differ. Even the \pagefile.sys files are the same. Though on a 8GiB volume, there were about 3MiB of differing bytes. From wikipedia, vss is meant to work at block level, so I don't understand why there would be any difference there. Any idea what I could be doing wrong, what's happening, how to avoid it?

Asked in: WindowsServers (4 answers)
Trinity's response: Something strange is going on. All I can find is this doc but it doesn't really answer your question directly: http://www.sbs-rocks.com/Windows%20Server%20Hacks%20Excerpt.htm

About every month or so my ETH0 NIC drops off the network. How can I troubleshoot this kind of NIC problem ? It needs /etc/init.d/net.eth0 restart to fix it.

Asked in: Gentoo-Linux-Servers (3 answers)
Trinity's response: Try using: lspci -vv | grep Ethernet

I took Mysql off my server and put in on a server of its own and the page load times are slower ! Really ! Now there's an Apache server and a Mysql server and it's actually slower ! How can that be ?

Asked in: Linux-Servers (2 answers)
Trinity's response: Is it maybe the network connection between them causing a bottleneck ? More here: http://northernmost.org/blog/site-slow-after-scaling-out-yeah-possibly/

I've been using session_register for ages and didn't think register_globals, since that was switched off, would affect it. What's the safe alternative ? Thanks.

Asked in: OtherProgramming (1 answers)
Trinity's response: I'm willing to be corrected but I think that if you just do this without using session_register then it should be pretty safe:

session_regenerate_id();
             $_SESSION['loginid']=$var['3'];
             $_SESSION['name']=$var['0'];
             session_write_close();

This is no longer working (I'm using PHP5) ! echo date("F j, Y g:i a", strtotime($output[date])); What am I doing wrong ?

Asked in: OtherProgramming (1 answers)
Trinity's response: This works for me okay: echo date("l jS F Y",$input) ;

I'm lost with: $shorten = substr($clean, 0, 55); this trims my string to 55 characters but how do I add "..." only if the string is trimmed ? Thanks !

Asked in: OtherProgramming (3 answers)
Trinity's response: This should do it: if(strlen($text) > 99) { $short = substr($text,0,99) . " ..."; }

Or does it also give useful daily, weekly, monthly and yearly 95th percentile stats ? Thanks.

Asked in: Linux-Servers (1 answers)
Trinity's response: I think it gives you lots of historical info too. Not certain but installing it shouldn't be too tricky.

Any suggestions on how I could change the way page counts are recorded on a site ? I think I could use AJAX or write them to a text file but that would add IO. Any clever ideas welcome !

Asked in: Linux-Servers (2 answers)
Trinity's response: You could use a separate (non-critical master) database for this information by setting a different database connection for specific queries (INSERTs and UPDATES relating to page counts).

How do I add new MIME types in Apache ? Thank you.

Asked in: Linux-Servers (1 answers)
Trinity's response: It is a little hidden these days but this file should answer any questions, it's quite clear: /etc/apache2/mods-available/mime.conf

I need to use a package from Ubuntu's Meercat Maverick, will it break ? Thanks.

Asked in: Ubuntu-Linux-Servers (1 answers)
Trinity's response: This page here: https://help.ubuntu.com/community/Repositories/CommandLine mentions this, so I guess not: If you decide to add other repositories to sources.list, make sure that the repository is meant to work (and known to work) with Ubuntu. Repositories that are not designed to work with your version of Ubuntu can introduce inconsistencies in your system and might force you to re-install. Also, make sure that you really need to add external repositories as the software package(s) you are looking for may already have been introduced into the official repositories!

I've just read this: http://enginesmith.wordpress.com/2010/09/11/mysql-read-write-split-myth-and-why-i-wouldnt-use-it/ I think I want two master databases for safety and load balancing but should I definitely only use ONE node for writing ? Any experiences must be well received and welcome.

Asked in: Linux-Servers (2 answers)
Trinity's response: I may be completely wrong but I thought that the auto-increment stuff in MYSQL 5 prevented Primary Key corruption. That was the problem with running two masters at once - you'd get two rows written at the same time in different databases with the same key and replication would fail altogether. Am I right ? Any experts care to elaborate ?

I want to setup Squid proxy server on my Centos based linux server ! What's the easiest and best way to do that ?

Asked in: CentOS-Linux-Servers (3 answers)
Trinity's response: This looks good too: http://tinyurl.com/9dyf46

Sometimes we get sent loads of emails at once and I'd like to slow them right down so it doesn't ruin my mail servers. Can IPtables do this ?

Asked in: Server-Firewalls (1 answers)
Trinity's response: Here's an IPtables rate limiting script for email. Just adjust the port number to rate limit any other port.

# Limit the number of incoming port 25 tcp connections

iptables -A INPUT -p tcp --dport 25 -m limit --limit 100/m --limit-burst 3 -j ACCEPT

iptables -A INPUT -p tcp --dport 25 -m limit --limit 100/m --limit-burst 3 -j LOG --log-prefix SMTP-DROP:

iptables -A INPUT -p tcp --dport 25 -j DROP

iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

You can also use the recent module in IPtables. Some distros (like Gentoo) won't include it as default (along with others): http://www.debian-administration.org/articles/187

Can someone check to see if this is a valid sshd_config setting in SSH on Debian Squeeze ? UsePrivilegeSeparation For some reason it doesn't appear in my config file and I don't want to add it unless it'll do something good, it's an important server. I think the config must have been copied off another server. Thank you.

Asked in: Debian-Linux-Servers (1 answers)
Trinity's response: Yes, I have UsePrivilegeSeparation in my sshd_config in OpenSSH on Debian Squeeze.

I need to learn DNS and DHCP. I know how to configure them but I just know what all files should be modified :/ I wish to learn them properly and want to understand the files which need to be modified while configuring them. Please help.

Asked in: Linux-Servers (8 answers)
Trinity's response: Have a look at this: http://www.howtoforge.com/traditional_dns_howto

What's the best encrypted cloud back up service to use ?

Asked in: Cloud-Servers (1 answers)
Trinity's response: From the command line you can use s3cmd for Amazon S3 if that helps.

Does such a tool exist ? Where would I get it if so ? Is it Linux compatible ? Thank you.

Asked in: Virtual-Machines-Servers (1 answers)
Trinity's response: This should be of help: http://howtoforge.com/vmware-server-2.0.2-x-on-ubuntu-server-10.04-with-vmware-remote-console-plug-in-p3

I'd like to add a server to an existing setup where there are 6 computers using a 4-port wireless router. At present 4 computers are cabled and 2 use wireless to connect to the router. I'm thinking when I add a server to the setup, it will need a static local IP and will be best connected by cable to the router. If I don't want to switch one of the other computer's to using wireless connection, that will leave me one port short for connecting the other 4 cabled computers to the router. Can I insert a 10/100 network switch into one of the router ports and use that to connect 2 of the 4 cabled computers to the one router port? Will it create any problems for those 2 computers using the internet / accessing the server?

Asked in: Server-Networking (3 answers)
Trinity's response: Some routers/switches/hubs call it an uplink port. The device would consider it an upstream connection as if it's connected to an ISP etc. On older devices they weren't self-detecting (for the type of connection - crossover or straight through (MDI/MDI-X)) so there's sometimes a little button next to the uplink port to toggle the uplink functionality or standard port use. When you connect two switches it's called cascading or daisy-chaining if you want to look it up further. You shouldn't notice any degradation in speed. If there's a management interface just make sure you're running the ports at 100Mbit Full Duplex so there's no chance of them just using 10Mbit.

A production machine is doing this suddenly. Nothing out of the ordinary was done with aptitude or dpkg ... nightmare ... ! How can I fix it ?

Unpacking g++ (from .../g++_4%3a4.4.3-1ubuntu1_amd64.deb) ...
Selecting previously deselected package build-essential.
Unpacking build-essential (from .../build-essential_11.4build1_amd64.deb) ...
Processing triggers for man-db ...
Setting up g++ (4:4.4.3-1ubuntu1) ...
Use of uninitialized value in string ne at /usr/sbin/update-alternatives line 279.
update-alternatives: warning: /etc/alternatives/c++ has been changed (manually or by a script). Switching to manual updates only.
update-alternatives: warning: forcing reinstallation of alternative /usr/bin/g++ because link group c++ is broken.

>> EDIT >> Incidentally this happens for any packages I try and install.

Asked in: Ubuntu-Linux-Servers (2 answers)
Trinity's response: I've seen this before actually. It's a corrupt alternatives file(s) in /etc/alternatives. Try and search the corrupt file and delete the mentions of the dependency failing to install (in blocks of text per package) from that file and then apt-get update and try again. With some patience it is a recoverable error you'll be glad to know!

Is keepalived still the most popular and is it relatively easy to get going ? Thanks.

Asked in: Linux-Servers (2 answers)
Trinity's response: Keepalived is pretty intuitive to set up and comprehensively documented. Use a couple of test VMs to set it up initially.

We use Amazon S3 for most of our offsite cloud storage and for redundancy we're going to start using Rackspace Files. There are some really important files we want spread across both clouds though. At file creation time do I have to upload the files to each cloud ? It would be much more bandwidth efficient for us to get the clouds to sync up to each other. Is this a pipe dream ? Is there an import utility on one of the clouds maybe that I can't find ? Thanks !

Asked in: Cloud-Servers (1 answers)
Trinity's response: Using rsync to upload the files to both clouds at the time of file creation time is my guess. There may be an import facility as you say though and that would be easier initially - at least for the large uploads.

I want to see what I'm forgetting :)

Asked in: Debian-Linux-Servers (1 answers)
Trinity's response: Personally I always go for SSH first, lock it down and change AllowUsers, Port and login auth details. Then I get on with the build.

I'm getting slow ftp uploads to my FileZilla server from the internet side of the router using FireFTP - typically speeds of only about 10Kb (inside the LAN everything's speedy enough). The speeds initially start out much higher - 100Kb+ - but rapidly drop to 10Kb or less. This is despite the broadband speed of the connections at each end being around the 10-meg mark. I tried FileZilla Client - same thing. I have no speed limits, global or individual user, set. Maximum number of threads is set at 10 and the number of connections is set at 0 (unlimited) for future use, but these slow speeds are happening during the testing phase of setting up the server with only one user defined and connected. Any ideas what could be the cause of this? Are there any good diagnostic tools in people's toolkits that might help me find the cause if there is one?

Asked in: Linux-Servers (11 answers)
Trinity's response: Let's say that's roughly 315kbps of upload, that's still enough to make 10kbps far too slow ! Remember 10Kb is actually eight times 10kbps (80kbps). There's probably a 'multiple connections' or 'concurrent transfers' setting or something similar you could look for. That might open up a bottleneck in the software. A wild guess I'm afraid but think along those lines initially and it can't do too much harm. I think user "s" asked if it was one big file in case your MTU settings were wrong. Check your local router is set as per your ISP's recommended MTU properly too.

I can't get a CNAME working in djbdns or tinydns. The syntax is tricky. Can someone help please ? I'm sure it's really simple actually.

Asked in: DNS-Servers (1 answers)
Trinity's response: This is so simple it looks tricky ! Cmail.domain.com:othermailserver.domain.com:7200 Note about the example: MX records shouldn't contain CNAMEs because it's two DNS lookups and breaches RFCs !

I have one ethernet connection to a server over ADSL and one over my ISP's network. I get bizarre messages in dmesg about source routing when both NICs are up and active. I only want the IP that the traffic was directed at to respond and if one is unavailable the other to still work (so if my ISP is down I can still get to the server). Is this possible ? I can't find anything useful to search for properly unfortunately. Any experts able to help me with this please? Cheers.

Asked in: Ubuntu-Linux-Servers (1 answers)
Trinity's response: This is possible with multiple routing tables and isn't as difficult to set up as it sounds. You config one table for each IP. The top link should get it working (check your kernel has advanced policy routing enabled) and the others should help with theory a bit further. http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/ http://linux-ip.net/html/routing-tables.html http://lartc.org/howto/lartc.rpdb.multiple-links.html http://www.policyrouting.org/PolicyRoutingBook/ONLINE/TOC.html

Is it possible to delete some messages from the mail queue ? And is it possible to delete all the Postfix mail queue emails ? Thanks.

Asked in: Email-Servers (1 answers)
Trinity's response: To print the queue use: postqueue -p To delete one message use: postsuper -d 4DEU3F244BA For all (be careful): postsuper -d all

Not for the faint of heart ... I have a custom built kernel that runs on approximately 500 servers, split over about 6 different sets of hardware. Everything that's needed is built into the kernel so we can easily deploy it, the problem is every time our hardware vendor changes the hardware we've to track down the modules for the new hardware. What I'm looking for is something which I can run on each set of hardware to determine what's required of the kernel and then merge them into a single config file.

Asked in: Linux-Servers (2 answers)
Trinity's response: I know what you mean, and it's not a trivial task as you say :) My instinct is that it would require a few custom scripts using something along the lines of this GUI: http://kmuto.jp/debian/hcl/

I have set up Filezilla Server in Xp and am having a problem accessing it from the intenet side of the router. On the client I am getting the response "425 - Can't open data connection." I have set a static local IP for the server and have a dyndns hostname. I have SSL/TLS set up on FileZilla Server, have generated a certificate and the client computer has this stored as an exception. On the server's Netgear router, I've opened port 990, checked it is open, and have told the router to forward to the router's static local IP. I've told the firewall to allow FileZilla Server. On the client side, I'm using FireFTP set to Implicit SSL on port 990. Everything seems to go ok when I try to connect up to the point where the server folders appear. All I see is one folder with a + by it. Iif I try to expand it by clicking on it, I get the 425 error. I'm guessing there's something I've missed, but what? Any ideas welcome.

Asked in: WindowsServers (15 answers)
Trinity's response: Glad you got it working :) I can't be sure of how your firewalling is but FTP is a two way transfer so both probably. In the interest of security, get it working and then switch off one at a time to test it.

Asked in: WindowsServers (15 answers)
Trinity's response: This is very vague I'm sorry but it's firewalling (filtering) of some sort most likely.

Asked in: WindowsServers (15 answers)
Trinity's response: That looks as if it's not connecting at all. Are there any logs with FileFTP ? Maybe someone else has used these packages.

Asked in: WindowsServers (15 answers)
Trinity's response: Hmm, tricky. It's another wild guess but can you try another FTP program with Passive Mode enabled maybe ?

Asked in: WindowsServers (15 answers)
Trinity's response: Is it possible that your directory listing isn't enabled on the folders that you're looking at ? So it's basically just showing an empty folder. Try just copying a file like an image with full permissions to test it. If you can't see that then permissions at the directory level are preventing the viewing.

Asked in: WindowsServers (15 answers)
Trinity's response: It's a wild guess but opening using Passive Mode in FireFTP might mean you get both directions of traffic flowing.

I have purchased a second user Intel Express 535T Switch Hub. According to the documentation I have found the default IP to log on to it to administer it is 192.0.2.1 However, I cannot connect using this IP address, I think the previous owner has changed the default ip to something different, I have tried to use nmap to search 192.*.*.* and 10.*.*.* ranges without success. Does anyone have any idea how to find the switch's IP address using Linux (Ubuntu). Many thanks in advance.

Asked in: Server-Networking (4 answers)
Trinity's response: Fieropunk is quite right, if you haven't gone down the serial console route then that's the way to go.

Asked in: Server-Networking (4 answers)
Trinity's response: If you can force it back to factory defaults which sounds a little unlikely from what you've said then try and follow any BOOT-P instructions in the docs that come with it you might have some luck. I've sniffed the network while sending BOOT-P broadcasts and successfully found the IP and then consequently broken into a second user switch that had been changed from its defaults doing this. (You're looking for the magic pin-sized reset button BTW to force some devices back to defaults or some mention in the docs about a reset sequence (and that might also give you the IP range in the docs too)).

How can I set up a mailserver with Ubuntu Server using dyndns.com?

Asked in: Linux-Servers (1 answers)
Trinity's response: I hope that this might help: https://help.ubuntu.com/community/DynamicDNS

I have a remote server and I can't eject the CD in the drive or unmount it. Why would that be ? I haven't used Linux much before. Thank you for helping.

Asked in: RedHat-Linux-Servers (5 answers)
Trinity's response: This is usually because a user of service is using the mounted CD. If it's a user then use cd.. to move off the CD's filesystem and if it's a bit of software use ps -ef to see what is running and try to figure out what might be using /dev/cdrom. Try lsof if ps -ef doesn't offer anything useful. The try umount /dev/cdrom as usual.

How do I join a windows computer to linux domain server ?

Asked in: Linux-Servers (2 answers)
Trinity's response: Is this what you're looking for ? http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/FastStart.html#id2560504 http://www.steve-lacey.com/2006/11/linux_as_a_wind You can use Samba on Linux to share files.

My web logs fill up too quickly with not that many hits. How do you turn off logging for ALL images but keep HTML and PHP logging on ? Is it possible on Apache ? Does it mean less work for the web server too, making it faster ? Thanks !

Asked in: CentOS-Linux-Servers (4 answers)
Trinity's response: Very interesting. I hadn't heard about this. That link from BonoEstente (half way down or so) says that IE6 was strict but Chrome does appear to flout the RFC completely it. Any more info any one ?

Any good guides out there ? I'm used to Linux and I'm lost even with the basic networking stuff. Thanks.

Asked in: UnixServers (2 answers)
Trinity's response: Any good for what you're doing ? http://www.sun.com/bigadmin/features/articles/solaris_networking.jsp

What's the consensus ? Do people keep this enabled on Servers ? It seems it might cause untold problems and be tricky to diagnose problems against.

Asked in: Ubuntu-Linux-Servers (3 answers)
Trinity's response: I third that :-) From what I've heard it's not always a good idea.

I've been asked to look into this. Does anyone have any recommendations for me please ? I may be able to spend some money on licenses but performance and ease of install are most important. Thanks alot.

Asked in: Ubuntu-Linux-Servers (1 answers)
Trinity's response: I think that this is still a popular streaming solution: http://uk.real.com/realplayer/

In terms of reliability and performance should I choose Debian over Ubuntu for a fairly standard LAMP configuration ? I know Ubuntu better but they can't be that different surely.

Asked in: Debian-Linux-Servers (2 answers)
Trinity's response: This is more about preference than anything. Ubuntu is more bleeding-edge and has newer package versions but Debian is more stable.

Is it possible to use it on Ubuntu Server for backups ? It's seems like a good idea.

Asked in: Ubuntu-Linux-Servers (2 answers)
Trinity's response: Yes, there is a command line tool: http://joysofprogramming.com/u1sdtool-complete-ubuntu-one-sync/

I don't want all the fake logins and need to change from port 22 but how do I do that ?

Asked in: Linux-Servers (2 answers)
Trinity's response: The file that you need is usually /etc/ssh/sshd_config and Port is the setting. Change that to 222 or whatever and then /etc/init.d/ssh restart. I just asked about something similar to do with this. More slightly unrelated info here: http://www.servercircle.com/RedHat/Permissions-on-ssh_config-and-sshd_config_330

Any ideas ? Thank you. An error occurred at line: -1 in the jsp file: null

Asked in: Linux-Servers (2 answers)
Trinity's response: Have you had it working in the past ?

Are there any security reasons why ssh_config should only be readable by root. I think it's safer to keep details about key services like SSH private from local users (by tightening up sshd_config) but is the SSH config file "important" ?

Asked in: RedHat-Linux-Servers (2 answers)
Trinity's response: Thanks.

Basically any file mentioned in an include using normal PHP or @import in Smarty is loading twice on my homepage according to Apache logs. I can't think what might be causing it. I've looked for duplicate mentions. Any ideas ? It's a mystery.

Asked in: OtherProgramming (4 answers)
Trinity's response: Easy to miss these things with a few vhosts.

How do I stop local users having more than 12 characters in their login passwords ? Thanks !!

Asked in: Ubuntu-Linux-Servers (4 answers)
Trinity's response: I think Cracklib is the only way to go.

There's something that just baffles me right now and I'm out of ideas. Would anybody have some idea? Basically, I have a Dell PowerEdge R415 rack server. Running xen 4.1 with a debian squeeze dom0. On two occasions (and now is the second one), I see weird behaviours as follows: I've got a ssh connection open from my workstation to the server and it works. However, I cannot ping it nor establish new TCP connections. I can see the packets go out of the workstation interface, the switch claims it forwards it to the server, but I cannot see them on the server with tcpdump, nor do the interface statistics increase. I can see the same from other workstations while others are OK. What really baffles me is that there is an established and working ssh connection. Initially, I was seeing the "dropped" statistics increase, and ethtool -S eth0 on the server showed some rx_fw_discard, but after increasing the rx ring buffer that went away, but still same problem. There's a bridge br0 with eth0 and the virtual interfaces for the Xen domUs, everything looks fine there. That server has a BMC with a net interface with a different MAC address. I can ping the bmc from my workstation, but not from the server. That BMC shares the same physical network connection (I'm not sure how that works, if there's an internal bridge in the server, could it be where the problem lies?) That's a Broadcom Corporation NetXtreme II BCM5716 Gigabit Ethernet # ethtool -i eth0 driver: bnx2 version: 2.0.2 firmware-version: 5.2.3 NCSI 2.0.11 bus-info: 0000:02:00.0 From dmesg, the link went down a few times. I think the problem started to occur when a message like: NETDEV WATCHDOG: eth0 (bnx2): transmit queue 7 timed out appeared in dmesg. Any idea? Update (2011-05-11) - same problem with opensuse with Xen 4.1 and 2.6.37-xen dom0 kernel. - upgrading to bnx2 2.0.23b from Broadcom's site improves matters (at least if I boot with this one, not if I unload the old one and load this one) especially if I increase the size of the receive ring buffer. I'm under the impression that those ethernet adapters do things at level 3 and 4 which worries me a bit

Asked in: Server-Networking (8 answers)
Trinity's response: Glad it's looking better now :) Any further info might be useful.

Sometimes I don't trust my tools and I'd like a remote site that gives a good list of things I might have missed. Do you know of any ?

Asked in: DNS-Servers (4 answers)
Trinity's response: I use http://intodns.com/ which is pretty good.

Asked in: Server-Networking (8 answers)
Trinity's response: Very tricky :) All I can think of is running strace and seeing if it's a Xen bug.

Is there an easy way to deal with spam getting through an Ubuntu - ISPConfig2 server? Other than changing the spam score for each user (which isn't working very well anyway)? I.e. creating global rules my self and is there a web GUI for doing this sort of job? I have the settings for individuals so high I'm getting false positives and yet obvious spam is still getting through!

Asked in: Linux-Servers (5 answers)
Trinity's response: I haven't used ISPconfig but can't recommend greylisting enough for stopping 90% of spam. It's worked really well, see here: http://www.servercircle.com/Email/Greylisting-on-Mail-Servers_246

I've used it on desktops and it frees up disk space really nicely by deleting other locale data. I'm about to try it on our Ubuntu Servers. But before I do ... anybody had it break things badly before ? Thanks.

Asked in: Ubuntu-Linux-Servers (3 answers)
Trinity's response: That's exactly what I was looking for !! I didn't see that when I was looking, thanks :)

I need to be able to remotely test that I've set up the Reverse DNS at RIPE correctly for a /24 IP range I have. Their online wizard says I have (there's a few simple, minor non-fail errors, like name servers on the same subnet) but I need to be confident that it's propagating. I have a �5 Amazon Voucher and 50 Best Answer points for the, ahem, best answer (if you win then be sure to tell me which Amazon site you would like it sent from). I'm using host 123.123.123.123 PRI.AUTHDNS.RIPE.NET at the moment but firstly I'm not sure that I'm using the correct name servers and secondly although I'm querying a RIPE name server I think I might need to use another tool like dig so there's more information and less likelihood of caching but the parameters for dig are gobbledygook. Thanks in advance.

Asked in: DNS-Servers (4 answers)
Trinity's response: Dig can be really verbose and helps check if it's a live result and not cached. Note that the /24 IP range is written backwards in essence for the in-addr.arpa notation below. dig +multiline @PRI.AUTHDNS.RIPE.NET 123.123.123.in-addr.arpa NS So if your example range was: 123.456.789.0/24 then the in-addr.arpa notation would be 789.456.123.in-addr.arpa above. I'm not sure about a list of NSs with RIPE but the one above seems correct,

I've compiled varnish from source and using varnishstat doesnt seem to change over time. the problem i have is that i had too few threads to manage the traffic, so i upped this to 5000 max threads, now vanish stat still says 11k threads were limited, but it also said this when threads were limited to 100. So i guess the question is who do i reset varnishstat without restarting varnish and is 12 000 threads too much (loads of traffic). CPU usage is 0% and there isnt much in the cache for longer than 30 mins (very dynamic site). Just wondering before i do more investigating

Asked in: Linux-Servers (1 answers)
Trinity's response: I'm not sure about versions but this says that feature is in the pipeline http://www.varnish-cache.org/trac/wiki/PostTwoShoppingList if that helps at all. Have you considered graphing the counter stats ? This mentions Munin: http://itsok.be/nl/node/29 at the bottom under "Statistics".

Does any one have Fail2ban running and would be willing to share some of their filters ? I'm not much good at the configs and the examples aren't what I need. It's Apache stuff that I'm mostly interested in.

Asked in: Linux-Servers (2 answers)
Trinity's response: Thanks very much.

How often should I upgrade my kernel on Ubuntu Server ? Some people seem to leave their kernel upgrades for a few releases which is why I ask.

Asked in: Ubuntu-Linux-Servers (3 answers)
Trinity's response: Upgrade with every kernel release if you can manage the reboots on your server. Each release is like any other package and has a changelog that lists changes, usually containing security patches, so to make your system as secure as you can make sure these patches are on your system by running the latest kernel.

Are there any good guides someone could please recommend ? That'd be great.

Asked in: Linux-Servers (3 answers)
Trinity's response: This is a good guide for hardening Apache: http://xianshield.org/guides/apache2.0guide.html

There's a lot more on the Internet now. How do I stop them testing my Apache's defences ?

Asked in: OtherProgramming (2 answers)
Trinity's response: Have you looked at Fail2Ban with regex for Apache ? http://www.fail2ban.org/wiki/index.php/HOWTOs

Can anybody please suggest a few alternatives for me to look at ?

Asked in: Fedora-Linux-Servers (4 answers)
Trinity's response: Seen this one before ? http://linuxbox.co.uk/postcode_database.php

I have a single 2008 Server and I'd like the whole disk backed up offsite. Any ideas welcome. I have about $300 to spend on it.

Asked in: WindowsServers (2 answers)
Trinity's response: http://www.ghacks.net/2011/04/03/gladinet-cloud-desktop-adds-amazon-cloud-drive-integration/ I would backup to the cloud.

I'm looking at using the Drupal CMS. Does any one have any experiences that they'd like to share ? Security, reliability etc ? Thanks a lot.

Asked in: OtherProgramming (5 answers)
Trinity's response: Thanks very much.

Asked in: Server-Networking (8 answers)
Trinity's response: That's a tricky problem then ! I'd be most concerned with "The ifconfig and ethtool statistics increase, but a tcpdump shows nothing (!?)." :-) and probably figure out how to capture whatever is increasing the counters.

I have this in my default HTTP vhost:

rewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.domain\.com [NC] 
RewriteRule ^(.*)$ http://domain.com [L,R=301]

It's shifts www.domain.com to just domain.com. How can I do that in my default HTTPS vhost file ?

Asked in: Linux-Servers (3 answers)
Trinity's response: Just changing HTTP_HOST to HTTPS_HOST and http:// to https:// might help.

Asked in: Server-Networking (8 answers)
Trinity's response: A few things spring to mind to hopefully narrow it down an little: Check MTU across everything. As I'm sure you know tiny data transfers usually work with a misconfigured MTU but anything else drops out and that's what you usually notice. Try a USB NIC instead of the one built-in and rule that and the driver out. It'll take 2 minutes and if you don't mind it being 100Mbit instead of 1000Mbit then you can do it at any time. Try another switch port or switch ideally and cable. You said this has happened twice. How far apart were the occurrences ? Think in terms of load and the time of day ... cron or backups and bandwidth on the switch's backplane etc.

I have a sun4u box running Gentoo which works very well but it uses the Tulip NIC drivers and even at 10HD it crashes out every few weeks, falling offline, needing reset. Any fixes ? Latest drivers etc installed.

Asked in: Gentoo-Linux-Servers (2 answers)
Trinity's response: These NIC drivers have been buggy across lots of kernel versions. I would experiment if you can with one version of the NIC that stays up the longest and keep it to 10HD or 100HD for stability.

I can't find anything online for Amazon's EC2 multi-region hosting that's easy to follow. Can someone help please ?

Asked in: Cloud-Servers (1 answers)
Trinity's response: These are very useful: https://cloudyscripts.com

For data that's backed up offsite every day should I bother with a NAS device ? Surely the RAID on the Server itself is fine for reliability and redundancy. Does anyone have any experience of this ?

Asked in: Linux-Servers (3 answers)
Trinity's response: Thanks, that's helpful.

I've heard that some attacks originate from spoofed Private LAN IPs but I'm not sure how I would go about setting my web server up to ban them. There's a 100 points reward for the best answer. Thanks.

Asked in: Server-Networking (7 answers)
Trinity's response: User "s" said: "route reject" or "route blackhole" stops you from *sending* to those hosts, not from receiving. As a matter of interest is there a ip route command that also blocks incoming traffic too ? I know iptables would work but can ip route do it too ?

Asked in: Server-Networking (7 answers)
Trinity's response: Thanks but I don't understand @s. How can I drop all traffic from those IP ranges ? Using something like ip route reject 169.254.0.0/16 instead ?

Asked in: Server-Networking (7 answers)
Trinity's response: Thanks, Bogofilter. That's exactly what I was after. 100 well-earned points winging their way to you.

I have some production servers and get bogged down with what feels like constant kernel upgrades. Has anyone used Uptrack from Ksplice ? It seems to increase security fine enough but I'm not sure if the reliability of the servers is ever compromised at all. Shared experiences would be welcomed.

Asked in: Linux-Servers (2 answers)
Trinity's response: I can second that.

From a stock build Ubuntu Lucid instance, as supplied by Rackspace, I get a few screens worth of locale errors when I boot up their Server. Has anyone else seen this and will it break things in the future if I don't fix it ?

Asked in: Cloud-Servers (1 answers)
Trinity's response: This is exactly what I had and although it only showed lots of errors when I used apt-get it didn't effect anything else. I've been using a different cloud provider since though !

Is it possible to ban a sender on the number of errors at the HELO initialisation ?

Asked in: Email-Servers (2 answers)
Trinity's response: To see default values in Postfix you can use: postconf -d Change this setting if the default is no good:

smtpd_soft_error_limit (default: 10) The number of errors a remote SMTP client is allowed to make without delivering mail before the Postfix SMTP server slows down all its responses

In the console I get lots of locale errors but that shouldn't stop it booting. Any ideas ?

Asked in: Cloud-Servers (1 answers)
Trinity's response: I would give up on that instance and create another, hopefully you have the key data backed up. Paste the other errors if you can and there are any that don't just mention locales.

Can someone please help me choose ? I heard some people still use i386 for their hardware because AMD64 userland changes when you user AMD64 hardware. Is that correct ?

Asked in: Linux-Servers (5 answers)
Trinity's response: There can be userland issues with some packages but it's usually just on desktops from what I've seen and not Servers. FWIW for every high performance obviously 64 bit is better but it's debatable if i386 is any more reliable.

Having upgraded PHP to 5.3.2-1ubuntu4.7 on Ubuntu Server suddenly some of my PHP pages break when I'm posting data between them. I am not sure if it's got something to do with magic quotes being deprecated. Has anyone else seen this on Ubuntu ?

Asked in: Ubuntu-Linux-Servers (1 answers)
Trinity's response: Magic quotes are old news. The upgrade to PHP 5.0.3 broke ereg for example but you just had to replace it with preg_match in your PHP code and it solved the deprecated issue.

I am having headaches with Fail2ban ignoreregex, I am trying to get it to ignore subdirectories ? ignoreregex = .*"GET /(town|city|street.* This works fine but I would also like to explicitly ignore splash.html too and not just the sub-directory.

Asked in: ShellScripts (2 answers)
Trinity's response: What is your failregex ? ignoreregex = .*"GET /(splash.* might work (don't add another ignoreregex) but just start a new line under your existing ignoreregex. See the examples for formatting help.

I've tried using {php} and {literal} tags but my pages still continue to parse the javascript and PHP code as if it were through smarty. Any known fixes ? I've hunted high and low.

Asked in: Linux-Servers (1 answers)
Trinity's response: Have you tried using {include file="filename.php"} instead ? That might help after escaping using {literal} tags.

Are there any ways I can customise someone else's script (for free) to run an RSS feed from my server ? I think it's the way I'd prefer to do it if possible.

Asked in: ShellScripts (1 answers)
Trinity's response: Here you go: http://forums.digitalpoint.com/showthread.php?t=32265

$myfeed = new RSSFeed();
$myfeed->SetChannel('http://www.mysite.com/xml.rss',
          'My feed name',
                  'My feed description',
          'en-us',
          'My copyright text',
                  'me',
          'my subject');
$myfeed->SetImage('http://www.mysite.com/mylogo.jpg');
$myfeed->SetItem('http://www.mysite.com/article.php?id=bla',
                   'name',
                   'description');
....
echo $myfeed->output()

Asked in: Email-Servers (2 answers)
Trinity's response: I'd rate this: http://oreilly.com/catalog/9780596002121

I've migrated over to lighttpd from Apache but the site is a bit slower. What can I check ? Thanks.

Asked in: Linux-Servers (1 answers)
Trinity's response: Try benchmarking with one of Apache's utils "ab" if you can to try and get actual results to compare.

About every month or so my ETH0 NIC drops off the network. How can I troubleshoot this kind of NIC problem ? It needs /etc/init.d/net.eth0 restart to fix it.

Asked in: Gentoo-Linux-Servers (3 answers)
Trinity's response: Try using: lspci -vv | grep Ethernet

I've been using session_register for ages and didn't think register_globals, since that was switched off, would affect it. What's the safe alternative ? Thanks.

Asked in: OtherProgramming (1 answers)
Trinity's response: I'm willing to be corrected but I think that if you just do this without using session_register then it should be pretty safe:

session_regenerate_id();
             $_SESSION['loginid']=$var['3'];
             $_SESSION['name']=$var['0'];
             session_write_close();

I'm lost with: $shorten = substr($clean, 0, 55); this trims my string to 55 characters but how do I add "..." only if the string is trimmed ? Thanks !

Asked in: OtherProgramming (3 answers)
Trinity's response: This should do it: if(strlen($text) > 99) { $short = substr($text,0,99) . " ..."; }

How do I add new MIME types in Apache ? Thank you.

Asked in: Linux-Servers (1 answers)
Trinity's response: It is a little hidden these days but this file should answer any questions, it's quite clear: /etc/apache2/mods-available/mime.conf

Sometimes we get sent loads of emails at once and I'd like to slow them right down so it doesn't ruin my mail servers. Can IPtables do this ?

Asked in: Server-Firewalls (1 answers)
Trinity's response: Here's an IPtables rate limiting script for email. Just adjust the port number to rate limit any other port.

# Limit the number of incoming port 25 tcp connections

iptables -A INPUT -p tcp --dport 25 -m limit --limit 100/m --limit-burst 3 -j ACCEPT

iptables -A INPUT -p tcp --dport 25 -m limit --limit 100/m --limit-burst 3 -j LOG --log-prefix SMTP-DROP:

iptables -A INPUT -p tcp --dport 25 -j DROP

iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT

You can also use the recent module in IPtables. Some distros (like Gentoo) won't include it as default (along with others): http://www.debian-administration.org/articles/187

What's the best encrypted cloud back up service to use ?

Asked in: Cloud-Servers (1 answers)
Trinity's response: From the command line you can use s3cmd for Amazon S3 if that helps.

Does such a tool exist ? Where would I get it if so ? Is it Linux compatible ? Thank you.

Asked in: Virtual-Machines-Servers (1 answers)
Trinity's response: This should be of help: http://howtoforge.com/vmware-server-2.0.2-x-on-ubuntu-server-10.04-with-vmware-remote-console-plug-in-p3

Is keepalived still the most popular and is it relatively easy to get going ? Thanks.

Asked in: Linux-Servers (2 answers)
Trinity's response: Keepalived is pretty intuitive to set up and comprehensively documented. Use a couple of test VMs to set it up initially.

I can't get a CNAME working in djbdns or tinydns. The syntax is tricky. Can someone help please ? I'm sure it's really simple actually.

Is it possible to delete some messages from the mail queue ? And is it possible to delete all the Postfix mail queue emails ? Thanks.

Asked in: Email-Servers (1 answers)
Trinity's response: To print the queue use: postqueue -p To delete one message use: postsuper -d 4DEU3F244BA For all (be careful): postsuper -d all

Asked in: WindowsServers (15 answers)
Trinity's response: It's a wild guess but opening using Passive Mode in FireFTP might mean you get both directions of traffic flowing.

I don't want all the fake logins and need to change from port 22 but how do I do that ?