Apache proxy issues

(from http://httpd.apache.org/docs/trunk/mod/mod_proxy.html#access)
"Strictly limiting access is essential if you are using a forward proxy (using the ProxyRequests directive). Otherwise, your server can be used by any client to access arbitrary hosts while hiding his or her true identity. This is dangerous both for your network and for the Internet at large. When using a reverse proxy (using the ProxyPass directive with ProxyRequests Off), access control is less critical because clients can only contact the hosts that you have specifically configured."

I.e. This should be OK
proxy.conf:


Order deny,allow
Deny from all
#Allow from .your_domain.com



ProxyPass /viewcvs http://localhost:8080/viewcvs/
ProxyPassReverse /viewcvs http://localhost:8080/viewcvs/

more CVS trixs

To start a new project

1) Copy a premade empty repository directory and point your CVSROOT to it.

2) cvs co .

3) cvs add

No need to fuzz with CVS import & init and stuff, which actually would make the next tip impossible (or very hard at best).

Backup your servers settings (DO THIS ON YOUR OWN RISK)

su root
cd /
cvs co -p .
cvs_addall etc
cvs_addall root
cvs add usr
cd usr
cvs add lib
cd lib
cvs add yp
cd yp
cvs add *
cd /var/yp
cvs add Makefile
cd ..
cvs add geoipDB.txt #In case you have this file i.e.
cvs add log
cd log
cvs add apache2
cd apache2
cvs add access.log
cd ..
cvs add auth.log
cd /
cvs commit -m "System initial mirror"




To prune CVS out from an existing directory:

cd
find . -type d -name CVS -exec rm -rf '{}' ';'

BIG FAT NOTE
If you put the whole /etc/ in repo, some services might not start because they object finding a file CVS in some of it's directories. You must then use the above command line to remove the directories.

Since you're only going to go one way (i.e. to the repo) and never go from the repo (exept when diffing), you can just check out the offending module/subdir again. Any changes made locally "should" be merged with the ones in repo.

Alternative (and safer), you can rename the CVS dirs to .CVS. Prefixing with a dot is a convention to "hide" stuff, and most services should not be offended by any "hidden" directories.

Services known to be offended by CVS directories:

• apache2 - The server will not start
  
• modprobe.d - This will create a bunch of error entries in system log but is otherwise harmless.
  

Therefore before you reboot your machine, repeat the following on each directory above:

cd /etc
mdrename.sh CVS .CVS

NIS and NFS services

(Please read this post first: http://michael-ambrus-tipps.blogspot.com/2006/11/nis.html)

This contains minimum information to set up NIS and NFS services.

NFS
1)
make sure you have the nfs-kernel-server package installed and running

2)
Add this entry in the file /etc/exports

/home 192.168.0.0/255.255.255.0(rw)

NIS
1) Modify the file /var/yp/Makefile to the following:
*)
< MINUID=1000
< MINGID=1000
---
> MINUID=4
> MINGID=500

*)
< MERGE_PASSWD=false
---
> MERGE_PASSWD=true

*)
< merge_group="false"
---
> MERGE_GROUP=true

*)
< ALIASES = /etc/aliases
---
> ALIASES = /etc/aliases.yp

*)
< GROUP = $(YPPWDDIR)/group
< PASSWD = $(YPPWDDIR)/passwd
---
> GROUP = $(YPPWDDIR)/group.yp
> PASSWD = $(YPPWDDIR)/passwd.yp

3) The NIS domain
(This differs from other distributions)

Set the NIS domain in the file /etc/defaultdomain
ypdomain.logiccroft.de

4) Configure NIS service to be a server
Edit the file /etc/default/nis

NISSERVER=master

You might consider setting
NISCLIENT=false

..but you can leave it until were done testing.

If you do want to test the domainserver locally, you'll have to add the followin line in /etc/yp.conf:

ypserver 192.168.0.2

(Please use the IP number and not IP name for security reasons and for ease of setting up and usa in case nameservice is broken).

5) build the service database
cd /etc
cp aliases aliases.yp
cp group group.yp
cp passwd passwd.yp
(edit each destination file above and remove unwanted entries)
cd /usr/lib/yp
./ypinit -m

6) Test the service locally - Optional
/etc/init.d/nis stop
/etc/init.d/nis start
ypcat passwd

7) Test the service on a client
Log in as root on the client and:

/etc/nfs stop
/etc/nfs start
/etc/nis stop
/etc/nis start

Repeat the process as in 6)

Setting up a new server (2) - Basic network setup

To minimize the efforts on each client, the new server is about to take over the services as the old one did. That includes having the same IP and the same name on the network.


1) Open the Network Settings wizard (Administration->Networking)




2) Click the button properties and fill in as below



On our network we have a DSL modem that normally provides clients with IP addresses, but in our case we want services to be accessible from the outside and we need a fix address.

Please note that we need the "Gateway address" to be filled in (this has to do with that gateways today don't normally follow standard by placing themselves on the networks last address which in our case would be 192.168.0.254)


3) Change the name to the old servers name




4) DNS setting



Our router provides a DNS proxy. Enter the address of the router as a DNS server and we don't need to update this setting each time the router reboots (or the ISP changes their setting)

Debugging crashing modules

Usefull commands:

cat /proc/kmsg
dmesg
depmod
modprobe
insmod
rmmod


Usefull files:

/etc/discover.conf # Automatic HW detection and module loaing (new)
/etc/modules #Mention module for auomatic loading
/etc/modprobe.d/ #Options

sysrq - crashmanager

( /usr/src/linux-source-/Documentation/sysrq.txt )

echo "1" > /proc/sys/kernel/sysrq

This will enable the following:

'r' - Turns off keyboard raw mode and sets it to XLATE.

'k' - Secure Access Key (SAK) Kills all programs on the current virtual
console. NOTE: See important comments below in SAK section.

'b' - Will immediately reboot the system without syncing
or unmounting your disks.

'c' - Will perform a kexec reboot in order to take a crashdump.

'o' - Will shut your system off (if configured and supported).

's' - Will attempt to sync all mounted filesystems.

'u' - Will attempt to remount all mounted filesystems read-only.

'p' - Will dump the current registers and flags to your console.

't' - Will dump a list of current tasks and their information to your
console.

'm' - Will dump current memory info to your console.

'v' - Dumps Voyager SMP processor info to your console.

'0'-'9' - Sets the console log level, controlling which kernel messages
will be printed to your console. ('0', for example would make
it so that only emergency messages like PANICs or OOPSes would
make it to your console.)

'f' - Will call oom_kill to kill a memory hog process

'e' - Send a SIGTERM to all processes, except for init.

'i' - Send a SIGKILL to all processes, except for init.

'l' - Send a SIGKILL to all processes, INCLUDING init. (Your system
will be non-functional after this.)

'h' - Will display help ( actually any other key than those listed above will display help. but 'h' is easy to remember :-)

Video44 using bttv chrashes

... or how to disable modules at boot-up.

I have an old PCI TV card, BT848A video (MIRO PCTV). This card does not have any circuits for audio sample grabbing, and any video4linux application like xawtv, wmtv or kdetv will break on the module tvaudio.ko (the module video seems dependant of it).

We want to disable loading of this and that can be done by adding the following line in /etc/discover.conf

skip tvaudio

( tip from: http://www.webservertalk.com/message173405.html )

Originally no player could control the card. Detecting which card was used and which module (and parameters) were used using the command:

xawtv -hwscan

We got some information about a generic card beeing used. So I added (in the file /etc/modules):

bttv

And the file /etc/modprobe.d/tv was added including the following line:

options bttv card=1 radio=0 tuner=0 gbuffers=15

I'm not certain about the radio option, but it doesnt seem to matter. The module tvaudio does however...

Instead I used the analog cable and connected it to a free analog input on the MB. Now we only need to figure out how to make VLC mix in this audio-streem so that we can broadcast the whole thing ;)

Setting up a new server

I was setting up a new server to replace the old one. This post contains notes for that.

* Temporary enable root to access ssh
/etc/ssh/ssd_config:
PermitRootLogin yes


The following config files are copied to the new server as *.kato and are to be used to get the settings specific (and only the specific things, not the whole thing).

/etc/ssh/sshd_config
/etc/samba/smb.conf
/etc/exports
/etc/httpd/conf/httpd.conf
/var/yp/Makefile
/var/yp/ypservers

/var/log/httpd/access_log
/var/log/httpd/access_log.txt
/var/geoipDB.txt
.

UID staring off somewhere else than 1000

On Red Hat UID for normal users (as opposed to processes and services) used to start on 500.

This turns out to be an obsticle when one wants to move the users (their homedirs) from an server based on that convenrion to an Ubuntu (Debian) based server. The following files need correcting and a new pawwd needs to be created with the same UID's as the old ones:

adduser.conf:FIRST_UID=1000
gdm/factory-gdm.conf:MinimalUID=1000
gdm/gdm.conf:MinimalUID=1000
X11/gdm/factory-gdm.conf:MinimalUID=1000
X11/gdm/gdm.conf:MinimalUID=1000


I know NIS and SSH has some issues with this too. Will post more on this topic when I find out.