apache 2.2 - Logwatch: connection attempts using mod_proxy

Today I noticed this entry in my log file:

Connection attempts using mod_proxy:
175.180.113.83 -> 66.135.210.61:80: 1 Time(s)

This is something I do not normally see in my logs. I have a few questions about this:

1. What does this actually mean? Does this mean that someone tried to access my server through a proxied connection?


2. What is the first IP address? Is this the originating IP?


3. What is the second IP address? Is this the server they used as a proxy?


4. If what I said for 2 and 3 are correct, how is it that Logwatch (or whatever in Linux is resolving this) can detect the originating IP? I thought that a proxy is supposed to help with anonymity and make it so that the originating IP address is completely masked?


5. What does this mean? Are these requests usually from bots that are looking for additional security holes? What's the hole point of going through a proxy to access my server?

EDIT: It looks like 66.135.210.61 belongs to eBay and the other IP belongs to someone in Taiwan. Does this mean someone accessed my server through eBay? Shouldn't eBay's security be good enough to prevent things like that?

Thanks

Answer

It actually means the opposite to what you suggested: the person in Taiwan accessed (or attempted to access) eBay via your server. It means that someone was using your machine as an open proxy. Most likely they were probing to see if you had an open proxy configured. The fact that the message says "attempted" would suggest that they didn't succeed, but a bit of Googling suggests that it may mean they actually got through. What you want to do is make sure you're not running mod_proxy and you disable the CONNECT verb if you don't need them.

An article I found that might be of use is http://www.davekb.com/browse_computer_tips:logwatch_connection_attempts_using_mod_proxy:txt

windows server 2016 - Storage Spaces Direct MTBF

I'm testing S2D now and I would like to calculate MTBF for the whole system. It seems very fragile to me:

Let's have 4 nodes (x) with 12 drives (y) in each. MTBF for one node is 1/12 of single drive value. For three-copy mirror we can tolerate 2 node failures (equals two failed disks in different nodes). That gives me 2/4 MTBF of single node value. In total it is 1/24 or 2/(x*y) MTBF in comparison to single drive.

This value is quite low and gets even lower for larger deployments. Is my calc correct? I know that Microsoft recommends to reserve capacity of 2 disks in the pool aka hot-spares, but is it sufficient for production use?

Answer

Microsoft recommends % of usable capacity, "2 disks" is too bold statement for say 90 disk JBOD.

How to set file/folder permissions using Rsync from Windows to Linux

I want to transfer lots of files/folders from Windows to Linux using Rsync. On linux server(destination), I want the file permission set to 644, and folder permission set to 755. If possible, I want the ownership set to root.root for all the files/folders. I have tried -p option, but it doesn't work. Thank you for any help.

Answer

You can set the perms using the --chmod parameter e.g.

--chmod=Du=rwx,Dgo=rx,Fu=rw,Fog=r 

will force the permissions to be set to 755 for Directories and 644 for Files.

Linux server activity and logs monitor

Good day everyone, we have a web based POS PHP program hosted on a VPS. One of the users has his/her account username and password acquired by an unknown person and encoded data to the database through the program. Our program has a function that records date and time but not the IP used by the user to login to the program.

I have access to our Linux server which is running Centos 5 OS, is there a way to get the history of IP addresses that connected to our server through http or our web based program on the specific date and time the data was encoded through netstat command or any software/tools?

I already contacted the tech support of our VPS and they replied that it is the responsibility of the administrator to install software/tools to monitor server activity and logs. Aside from updating our program to include a function that will record the IP of a user whenever he/she logs in, can you guys recommend any Linux software/tools that can monitor daily server activity, specifically one that can record IP address, date and time whenever a user accesses our server via http or our web program?

I read a thread on ipclog & constat, would this tool provide the details I need for daily server activity and logs monitor?

I'm fairly new to the Linux environment and my knowledge in Linux administration is limited. I hope you guys can help me, thank you very much.

virtual memory - Linux: How do I explicitly swap out everything possible?

This is essentially the reverse of "Linux: how to explicitly unswap everything possible?".

I want to maximize the amount of available free memory before running a process I know will use system memory intensively and I don't want it to pause for long periods of time until the OS gets it into its head that everything else should be swapped out.

Also, I know a lot of programs have memory they only use on initialization and then never touch again.

How do I make this happen?

I have tried doing sysctl vm.swappiness=100 but that hardly swaps out anything.

Answer

The unused initialization code will be freed as soon as the memory is needed for other purposes. (It will be backed by files from which it is read.)

The memory paging mechanisms on Linux are well designed and have been tested for years. It is rare you would want to swap any process out of memory. This would result in heavy paging activity any time the swapped process is scheduled for execution.

If you truly need the memory from the other applications, you have too little memory. You can prevent the other programs from executing by sending them a STOP signal with the kill command. Be careful which programs you stop or you could lock yourself out of the system.

If you are experiencing large pauses during startup of your process, consider using sar to determine where the bottleneck is. You can also use top to determine which process are being paged or swapped heavily. Don't be surprised if your process shows up as the problem.

I've run servers which were severely starved for memory. To perform startups, it was essential to limit the number of processes starting at any one time. Process start almost instantaneously even if memory is far over-committed.

If you really want to force everything possible out of memory you could write a program that allocates the desired amount of memory and continually writes to each page of the allocated memory for a few loops. It will experience all the issues you want to avoid.

email - saslauthd authentication error

My server has developed an expected problem where I am unable to connect from a mail client.

I've looked at the server logs and the only thing that looks to identify a problem are events like the following:

Nov 23 18:32:43 hig3 dovecot: imap-login: Login:
user=, method=PLAIN, rip=xxxxxxxx,
lip=xxxxxxx, TLS Nov 23 18:32:55 hig3 postfix/smtpd[11653]:

connect from xxxxxxx.co.uk[xxxxxxx] Nov 23
18:32:55 hig3 postfix/smtpd[11653]: warning: SASL authentication
failure: cannot connect to saslauthd server: No such file or directory
Nov 23 18:32:55 hig3 postfix/smtpd[11653]: warning:
xxxxxxx.co.uk[xxxxxxxx]: SASL LOGIN
authentication failed: generic failure Nov 23 18:32:56 hig3
postfix/smtpd[11653]: lost connection after AUTH from
xxxxxxx.co.uk[xxxxxxx] Nov 23 18:32:56 hig3
postfix/smtpd[11653]: disconnect from
xxxxxxx.co.uk[xxxxxxx]

The problem is unusual, because just half an hour previously at my office, I was not being prompted for a correct username and password in my mail client. I haven't made any changes to the server, so I can't understand what would have happened to make this error occur.

Searches for the error messages yield various results, with 'fixes' that I'm uncertain of (obviously don't want to make it worse or fix something that isn't broken).

When I run

testsaslauthd -u xxxxx -p xxxxxx

I also get the following result:

connect() : No such file or directory

But when I run

testsaslauthd -u xxxxx -p xxxxxx -f
/var/spool/postfix/var/run/saslauthd/mux -s smtp

I get:

0: OK "Success."

I found those commands on another forum and am not entirely sure what they mean, but I'm hoping they might give an indication of where the problem might lie.

When I run

ps -ef|grep saslauthd

This is the output:

root 1245 1 0 Nov24 ? 00:00:00 /usr/sbin/saslauthd -a
pam -c -m /var/spool/postfix/var/run/saslauthd -r -n 5 root 1250
1245 0 Nov24 ? 00:00:00 /usr/sbin/saslauthd -a pam -c -m
/var/spool/postfix/var/run/saslauthd -r -n 5 root 1252 1245 0
Nov24 ? 00:00:00 /usr/sbin/saslauthd -a pam -c -m
/var/spool/postfix/var/run/saslauthd -r -n 5 root 1254 1245 0
Nov24 ? 00:00:00 /usr/sbin/saslauthd -a pam -c -m
/var/spool/postfix/var/run/saslauthd -r -n 5 root 1255 1245 0

Nov24 ? 00:00:00 /usr/sbin/saslauthd -a pam -c -m
/var/spool/postfix/var/run/saslauthd -r -n 5 root 5902 5885 0
08:51 pts/0 00:00:00 grep --color=auto saslauthd

If it makes any difference, I'm running Ubuntu 10.04.1, Postfix 2.7.0 and Webmin/ Virtualmin.

Answer

Postfix can run in a chroot (by default in /var/spool/postfix) or not. If it is, it will try to open /var/spool/postfix/var/run/saslauthd/mux for sasl authentication. If it's not, it will try to open /var/run/saslauthd/mux

It seems that, for some reason, your postfix instance was running in a chroot, and it's not anymore. It's odd, but that's what I guess from the details of your question. If it's what's happened, you may change saslauthd configuration to use /var/run/saslauthd or run postfix in a chroot again.

To know if your Postfix is running chroot, you can check /etc/postfix/master.cf:

1. If it has the line smtp inet n - y - - smtpd or smtp inet n - - - - smtpd, then your Postfix is running in a chroot;


2. If it has the line smtp inet n - n - - smtpd then your Postfix is NOT running in a chroot.

This check comes from /etc/default/saslauthd (Ubuntu sasl configuration file).

performance - What is the relation between IO wait utilisation and load average

Load average uses processes that are running or runnable or in uninterrupted sleep state. So do the processes in uninterrupted sleep state correspond with the %wa as per the top command? Both are referring to threads waiting for IO so it seems intuitive to assume that if one increases, the other will as well.

However, I'm seeing quite the opposite. %wait doesn't increase, the %idle is high and the load average is also high. I've read other questions on this but I have't found a satisfactory answer because they don't explain this behaviour.

• If the %wait does not include uninterrupted sleep state, then what is
  it exactly? Is it that the %wait does not really correspond with the
  load? (eg. the load could be 10 on a 2 CPU machine but it contributes
  to only 30% wait%)


• And how is this IO different from the IO referred
  
  to in uninterrupted state? What is a possible remedy in this case?

Clearly increasing CPU wouldn't help because there's tasks in the queue which the CPU is not picking up.

Another situation where it seems unintuitive that load average and CPU utilisation don't add up:

This situation is a bit different. The CPU idle time is high, the load average high (often double the number of CPUs), no disk I/O, so swap usage, some network I/O. There are no processes in uninterruptible sleep, the run queue goes up high frequently. How is the CPU still idle though? Shouldn't I expect the CPU to be at 100% utilisation? Is it that the high number of tasks can't be put on the CPU because they are waiting on network (or something else?)? It only seems reasonable to assume that that those tasks each consume very little time on CPU. Is that correct? What is the bottleneck in this case? Is it correct to say that increasing the CPU will not help? How can I find out what to configure or which resources to increase in order to reduce the load average?

sar -n TCP,ETCP,DEV 1

sar

netstat number of connections
netstat

iostat
iostat

vmstat
vmstat

uptime
uptime

top
top

nicstat
nicstat