networking - difference between local and inet socket?

I noticed that, while setting up opendkim, the options for the Socket are:

#SOCKET="local:/var/run/opendkim/opendkim.sock" # default
#SOCKET="inet:54321" # listen on all interfaces on port 54321

#SOCKET="inet:12345@localhost" # listen on loopback on port 12345
#SOCKET="inet:12345@192.0.2.1" # listen on 192.0.2.1 on port 12345

What is the difference (if any) between the local:[...].sock socket and the inet:[...]@localhost socket? Do user permissions come into play for one or the other? Is there a security benefit from using one or the other? Are there any functional differences at all?

centos5 - Near 100% disk usage, df and du show very different results, lsof not the answer

The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.

'df -h' shows 210G used, 8.6G avail

'ncdu' shows 28.6G used (same for apparent size)

As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.

Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.

Here is a summary of the output from ncdu:

   22.7GiB [##########] /opt
    2.8GiB [#         ] /usr
    1.5GiB [          ] /var
  812.4MiB [          ] /root
  310.6MiB [          ] /home
  194.3MiB [          ] /lib
  156.4MiB [          ] /etc
   36.5MiB [          ] /sbin

    7.3MiB [          ] /bin
  128.0KiB [          ] /tmp
   20.0KiB [          ] /mnt
e  16.0KiB [          ] /lost+found
e   8.0KiB [          ] /srv
e   8.0KiB [          ] /selinux
    8.0KiB [          ] /media
e   4.0KiB [          ] /backup
>   0.0  B [          ] /sys
>   0.0  B [          ] /proc

>   0.0  B [          ] /net
>   0.0  B [          ] /misc
>   0.0  B [          ] /dev
>   0.0  B [          ] /boot
    0.0  B [          ]  .autorelabel
    0.0  B [          ]  .autofsck

Output of 'df -Th':

Filesystem    Type    Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
              ext3    221G  210G  8.6G  97% /
/dev/sda1     ext3     99M   25M   74M  25% /boot
tmpfs        tmpfs    1.7G     0  1.7G   0% /dev/shm

This post mentions that outside of phantom files there are two other possible explanations:

1. corrupt filesystem


2. compromised machine

I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.

Thanks for your help!

Push DNS for only a domain OpenVPN

I have an OpenVPN server to access an Amazon VPC. I have a bind DNS on that same VPN server for solving local names (say *.local.example.com) and for everything else, bind uses forwarders as google DNS.

My problem is that I would like to avoid having my VPN/local DNS receive every DNS queries and forward them (for most of the time) and cache them since it is not a powerful server.

My question here is whether I can make the VPN users query my local bind DNS for the local queries and use their own DNS (e.g. defined in their resolv.conf before they connect to the VPN) for all others by pushing some configuration with OpenVPN.

Server : Debian 8, OpenVPN and bind9

Thanks

-- Edit --

To clear things a bit, here is my goal if possible :

A home user connects to OpenVPN server, which is also a local DNS (for only a set of private addresses). When the home user requests google.com, his query is directed to say 8.8.8.8. When the request is for local.mycompany.com, the query goes to my OpenVPN server/DNS. All this, without using a client-side add-on (push it with OpenVPN ?)

All this is to avoid a unnecessary load of DNS queries on my small VPN server/DNS (that he will anyway forward to Google DNS).

Answer

'Split Horizon' DNS, if servers behind the VPC are on a different domain then it is 'split brain' anyway - DNSMasQ is your friend:

https://www.linuxsysadmintutorials.com/configure-dnsmasq-to-query-different-nameservers-for-different-domains.html

vmware esx - vSphere templates what to put in them?

I am new to vmware and templates. From what I understand templates are meant to eliminate some repetitive tasks when creating virtual machines.

I am currently setting up a virtual machine on win2008 R2, and configuring it to be a base template using the following link as a guide. http://jeremywaldrop.wordpress.com/2008/10/28/how-to-build-a-windows-2008-vmware-esx-vm-template/

Ok great, I can eliminate some of the OS setup tasks when creating a virtual machine using my base template.

My question however is, what else are other users here putting in their templates?

Should I setup external applications in my templates such as SQL Server 2005, notepad++, wireshark? Or are templates only meant to be used for OS type settings like in the above guide?

Thanks.

Answer

There's 2 main components to templates, if you're running vSphere (ESX and vCenter). The template Vms themselves, and Guest Customization. If you configure guest customization (just by coping sysprep for each OS onto the vcenter), all the windows deployment steps (naming, network, license, time zone, owner info) is taken care of for you.

So once that's running, all you have to do with the templates is provide a base OS configuration, patched, with a temporary network name. If you have 'standard build' apps that you must layer on your builds (e.g. monitoring agents, wallpaper) then you can do this to the template VM before marking it as a template.

Beyond that, I don't think there's too much more to it, everything else you could add on is at your discretion. I find that keeping a relatively small number of templates/guest customizations, usually one per OS, is sufficient and saves a chunk of deployment time.

script works manually but not in cron job

I create my system graphs in rrd using perl script. When I run the script manually it'll update the graphs. On the other hand cron shows in logs that the job has been executed but it does not update graphs.. Any help please?

I've set apache2 directory permission root:apache with 770

Distro: CentOs 5.5.

Cron Config:

0,5,10,15,20,25,30,35,40,45,50,55 * * * *       /home/user/graphs/script-rrd.pl  > /dev/null 2>&1

I've already check /var/log/cron it shows that the above script has been executed but it does not update graphs in /var/html/www/graphs.png

Resolution of this issue:

cp -rf /opt/rrdtool-1.4.4/lib/perl/5.8.8/i386-linux-thread-multi/* /usr/lib/perl/site_perl

after copying rrd stuff in /usr/lib/perl5/site_perl issue has been resolved.

I've already created PERL5LIB. After creating PERL5LIB i was able to run scripts manually but it was not being run by cron so that is why i've to copied files as the above.

SELINUX is as following:
SELINUX=disabled
SELINUXTYPE=targeted

SETLOCALDEFS=0

domain name system - How to Detect Split Horizon DNS from a Single Device

I'm building an iOS app that uses Bonjour for device discovery on the same WiFi network. It works fine on some networks, but not on others (like Starbucks or Panera). The devices see themselves, but not each other.

I got a tip that these networks may be using Split Horizon DNS. I've confirmed that I cannot ping one device from another.

The problem is, I want to show an error message if the WiFi network won't work.

I thought maybe I wouldn't be able to ping myself on such a network, but I can.

What is the best strategy for detecting Split Horizon from a single device? In other words, I cannot ping another device at runtime since I don't know anything about other devices.

Answer

As mentioned, this is almost certainly due to wireless clients being isolated. It makes perfect sense to do this on public wifi networks and I'd be surprised if any public networks don't do it. (With client to client communication enabled someone could sit on the network trying to hack other users devices. It's a large security risk for users and when you're providing a hotspot for Internet access what's the point in allowing clients to see each other).

If you can't ping other clients at all (by IP address) then it clearly has nothing to do with DNS.

I can't see any way to detect this and there is no real simple solution to get round it. Some apps use a central server which all clients connect to, which relays data between clients (such as IM apps), although depending on the goal of your app that may not be a viable solution.

The most obvious answer is that your app will just have to tell the user it can't find any other clients, maybe with a more information button/section that details the fact that it may not be able to discover other clients on certain networks (especially public ones).

linux - How to list Apache enabled modules?

Is there a command that list all enabled Apache modules?

Answer

To list apache loaded modules use:

apachectl -M

or:

apachectl -t -D DUMP_MODULES 

or on RHEL,CentoS, Fedora:

httpd -M

For more options man apachectl. All these answers can be found just by little google search.