X-Forwarded-For

NOTE: Following instruction are for apache >= 2.0

If you need to see the client real IP behind a reverse proxy non transparent connecting to your web server you have to play with LogFormat.

You have to ensure to have the mod_proxy enabled and to configure the LogFormat string.

By default the string is composed:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

To inspect in the header http for the client real ip address add the following:

%{X-Forwarded-For}i

NOTE: Following instruction are for apache >= 2.0

If you need to append anything in the apache response header you have to enable the mod_header in the server config this way:

LoadModule headers_module modules/mod_headers.so

The instruction are quite simple, in the VirtualHost section you want to modify the header you have to add the following instruction:

RequestHeader append peppe_SSL "https"

Where peppe_SSL is the name of the token containing https

SaMBa in /etc/fstab

In order to have your Samba File System mounted at boot time:

//1.2.3.4/share/     /san/share  smbfs   username=domain\user,password=peppe

w,rw 0 0

Restrict ProxyPass Directive

In order to honor only pdf files rule do the folowing: 

         ProxyRequests On

         ProxyPass /peppepdf/(.*)pdf http://examplepdf..it:8056/

         ProxyPassReverse /peppepdf/(.*)pdf http://examplepdf.it:8056/

              

                         Order deny,allow

                         Allow from all

              

 

TAR over SSH

ssh peppe "tar cj /var/www/statistiche" | tar xvj -C .

CUT example

ls  | cut -f 2 -d \. | grep MYI | wc -l

SED example

find . -name peppe.htm -exec sed -ibck s/peppe1/peppe2/g {} \;

Xine with subtitles

xine lost.s03e01.hdtv.xvid-xor.avi#subtitle:SubIta/Lost.s03e01.hdtv.xvid-xor-subITA.srt

OpenSSL

- To create a certifcation authority

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650 -config openssl.cnf

- To create a CSR:

openssl req -config openssl.cnf -new -keyout peppe.key -out peppe.csr

- To sign the csr with the CA we created:

openssl ca  -config openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem               

 

- To obtain a pkcs12 certificate:

openssl pkcs12 -export -nodes -inkey chiave.pem -in certificate.pem -out

certificate.p12

TCPDUMP examples

tcpdump host 1.2.3.4 -s 1500 -X

tcpdump host 1.2.3.4 -X -s 1500 -l |tee 1.2.3.4.trace

To kill semaphores

/usr/bin/ipcs -s | /bin/grep peppe|  /usr/bin/perl -e 'while

() {@a=split(/\s+/); print `ipcrm sem $a[1]`}'

To avoid re-connection...

- If you have to access to a server behind a firewall and the session often expires:

reset by

peer

Connection to 1.2.3.4 closed

Modify /proc/sys/net/ipv4/tcp_keepalive_time this way:

echo "60" > /proc/sys/net/ipv4/tcp_keepalive_time

Your machine sends tcp probe every 60 seconds

If you want this available at boot time enter in the /etc/sysctl.conf 

net.ipv4.tcp_keepalive_time = 30

NMAP

- To obtain the daemon version associated to the listening port

nmap 1.2.3.4 -v -sV 

Directory Listing

      

                Options Indexes FollowSymLinks IncludesNOEXEC

                AllowOverride All

                Order allow,deny

                Allow from all

                XBitHack Full

      

"POST" method in wget

while true; 

do wget --http-user=1111111 --http-passwd=222222

http://www.example.it/script.php; 

done

To stop a program unconditionally

ps axf |grep /opt/bin/peppe  |awk '{print $1}' |xargs kill -9

Some RewriteRule examples

- It means do not parse the rewirte rule:

RewriteCond %{REQUEST_URI} !^http://www.example.it/security/login$ [NC]

RewriteRule .*$ - [F]

- If in the request is not present www.example.it do not serve images

SetEnvIf Referer "^http://www\.example\.it/" sito_ok

SetEnvIf Referer "^$" sito_ok

    Order Allow,Deny

    Allow from env=sito_ok

and if in the request is present www.examples.it insert the image from www.cpcug.org

#www.example.it

Listen 8080

RewriteEngine On

RewriteCond %{HTTP_REFERER} http://www.examples.it/images [NC]

RewriteRule ^.* http://www.cpcug.org/user/deverett/cracked/assets/images/marquee3.jpg [R,L]

- Recreate the request and check the access log for the failing component:

127.0.0.1 - - [23/Jan/2006:08:09:51 -0500] "GET /foo.html HTTP/1.1" 404 317

(core.c/404/handler)

127.0.0.1 - - [23/Jan/2006:08:10:45 -0500] "GET /testcount.jsp HTTP/1.1" 500

644 (mod_was_ap20_http.c/500/handler)

127.0.0.1 - - [23/Jan/2006:08:11:19 -0500] "GET /cgi-bin/printenv HTTP/1.1"

404 322 (mod_cgid.c/404/handler)

- Redirect everything except peppe.html :

           RewriteEngine On

           RewriteCond %{REQUEST_URI} !peppe.html$  [NC]

           RewriteRule ^/(.*)$ https://www.example.it/$1 [L]

- Parse the Rewrite if in the QS (after the "?" in the url) find example_html 

    RewriteEngine on

    RewriteCond %{QUERY_STRING}  example_html

    RewriteRule ^/(.*)$ https://www.example.it/public? [R=301,L]

- Parse the RewriteRule if in the Request URI find

    RewriteCond %{REQUEST_URI} ^/public/example\.jsp$         [OR]

    RewriteCond %{REQUEST_URI} ^/public/example\.html$

    RewriteRule ^/(.*)$   https://www.example.it/$1 [R=301,L]

File Descriptor

Introduction

Before deploying a live system, load testing should be performed to identify any bottle necks in your hardware/OS/web server combination.
            
A common bottle neck in the default Operating System configuration is a lack of file descriptors.

A file descriptor is an object that a process uses to read or write to an open file and open network sockets (although there are other uses).

Operating Systems place limits on the number of file descriptors that a process may open. In addition to per-process limits, an OS will also have a global limit on the amount of file descriptors that all its processes together may consume.

Zeus Web Server uses 2 file descriptors per connection from a client so it is important to ensure that the Operating Systems on high traffic web sites have been configured to provide sufficient numbers of file descriptors to ZWS.

A lack of available file descriptors can cause a wide variety of symptoms which are not always easily traced back to this OS limit making it essential to tune the OS according before deploying a live service.

There are two ways to resolve the issue

    * Raise the OS limit on the number of available file descriptors
    * Run more zeus.web child processes

The first method is preferred as using more zeus.web child processes results in less cached data that can be shared with may impact performance negatively.

Configuring file descriptor limits is platform and even distribution specific so please consult your Operating System documentation for the definitive guide. As a convenience, we have provided a basic details for a number of platforms:

    * Linux
    * Solaris
    * HP-UX
    * Compaq Tru64
    * FreeBSD

The second method might be easier if you operating system does noteasily allow you to increase the file descriptors limit. Details ofhow to do this can be found on the tuningpage, where 'num_children' is the tunable in question.

File Descriptors under Linux

Tuning file descriptor kernel parameters is non-trivial, and Zeus Support are only able to provide very general advice on how to do this: The best settings for any server will be unique to it and the load that it is designed to handle.
Global File Descriptor Tuning

To examine your file descriptor usage as a snapshot in time, use the following

cat /proc/sys/fs/file-nr

Three numbers will be returned, for example:

1022    427     8192
|        |       |
|        |       |
|        |       maximum open file descriptors permitted
|        total free allocated file descriptors
total allocated file descriptors since boot

A low value or even 0 in the second column would indicate a lack of available file descriptors.

In current (2.4+) Linux kernels, file descriptors are dynamically created as necessary, but cannot be removed or reduced other than by rebooting the server.

A very large number of file descriptiors (the maximum possible number of which is 2,147,483,647; although this is realistically limited to less than 536,870,912) could actually result in server instability due to lack of memory.
Process File Descriptor Tuning

In addition to configuring system-wide global file-descriptor values, you must also consider per-process limits.

The following example describes how to raise the maximum number of file descriptors per process to 4096 on the RedHat distibution of Linux:

   1.

      Allow all users to modify their file descriptor limits from an initial value of 1024 up to the maximum permitted value of 4096 by changing /etc/security/limits.conf

   *       soft    nofile  1024
   *       hard    nofile  4096

      In /etc/pam.d/login, add:

   session required /lib/security/pam_limits.so

   2.

      Increase the system-wide file descriptor limit by adding the following line to the /etc/rc.d/rc.local startup script:

   echo -n "8192" > /proc/sys/fs/file-max

      or, on 2.6 kernels:

   echo -n "8192" > $( mount | grep sysfs | cut -d" " -f 3 )/fs/file-max

      Now restart the system or run these commands from a command line to apply these changes.
   3.

      You will then need to tell the system to use the new limits:

ulimit -n unlimited (bash)

      or

ulimit -n 65535 (bash)

      or

unlimit descriptors (csh, tcsh).

   4. Verify this has raised the limit by checking the output of:

ulimit -a (bash) or limit (csh, tcsh)

   5. Restart the web server using:

$ZEUSHOME/restart-zeus

      or by running:

$ZEUSHOME/stop-zeus

      followed by:

$ZEUSHOME/start-zeus

File Descriptors under Solaris

To increase the OS limit, see your Solaris OS documentation. This SunWorld article describes the issues involved in more detail.

In summary, the most important variable to change is the following:

set rlim_fd_max = 8192

which should be changed via the /etc/system file, to a higher value than it is currently set. 8192 should be enough for smaller sites, but your benchmarking may indicate that you need a higher value.

File Descriptors under HPUX

To increase the number of file-descriptors under HPUX, you must use the 'sam' configuration tool provided by HP to adjust some of the system defaults. Go to the 'Kernel Configuration' page, then through to 'Configurable Parameters'.

The parameters that may need adjusting are:

nfile Max number of open files
maxfiles_lim Hard file limit per process
ninode Max number of open inodes

You can check the current limits by running the following command:

sysdef | egrep "NAME|ninode|nfile|maxfiles_lim"

The values that should be used depend greatly on how busy your site is. For extreme cases, values of up to 60000 may help greatly.

Note that in some versions of 'sam', it will incorrectly report that nfile and maxfiles_lim cannot be raised higher than 2048. This is a bug with 'sam', contact HP for a newer version of the tool.

File Descriptors under Tru64

On Compaq Tru64 UNIX, the webserver can now be configured to run with support for upto 64K file descriptors, instead of the default of 4096. Add the line:

tuning!maxfds 65536

to $ZEUSHOME/web/global.cfg to raise the limit to its maximum. Smaller values can also be used; values over 4096 invoke the setsysinfo() call to raise the process's hard file limit to 64K.

File Descriptors under FreeBSD

FreeBSD has a default limit of 1064 file descriptors per process and 1064 file descriptors in the entire system. Unfortunately, in order to raise the limit for sockets, it is necessary to recompile the kernel.

For help recompiling the kernel see the FreeBSD HandBook. In your new kernel configuration, the following options should be used.

options         MAXFILES="(64 * 1024)"
options         NMBCLUSTERS=4096

In order to raise the number of file descriptors per process, the following commands should be executed as root:

bash$ sysctl -w kern.maxfiles=65536
kern.maxfiles: 1064 -> 65536
bash$ sysctl -w kern.maxfilesperproc=32768
kern.maxfilesperproc: 1064 -> 32768

For a permanent change, add the following lines to the
/etc/sysctl.conf file:

kern.maxfiles=65536             # System-wide limit
kern.maxfilesperproc=32768      # Per-process limit

In addition, you may need to check the default ulimit settings in
/etc/login.conf.

/etc/rc.sysctl is run on boot-time to parse /etc/sysctl.conf.
Content Manager [Administrator] 19 September 2005