Hot answers tagged

74

sudo python -m SimpleHTTPServer 80 for python 3.x version, you may need : sudo python -m http.server 80 Ports below 1024 require root privileges. As George added in a comment, running this command as root is not a good idea - it opens up all kinds of security vulnerabilities. However, it answers the question.


13

The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in. By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before ...


12

Download the netinstall iso, boot it and select non-graphical install. I actually made a video once for it: http://www.youtube.com/watch?v=JOGSupJury4 The difference between ubuntu and debian is the way they are doing package testing. Debian is all about stability and ubuntu is more about all the new things (less stability).


11

The option accesslog.filename is for the mod_accesslog module, so you need to load that module. server.modules += ( "mod_accesslog" )


9

You can see where httpd is configured to look for it's configuration files using the -V switch: $ httpd -V Server version: Apache/2.2.15 (Unix) Server built: Feb 13 2012 22:31:42 Server's Module Magic Number: 20051115:24 Server loaded: APR 1.3.9, APR-Util 1.3.9 Compiled using: APR 1.3.9, APR-Util 1.3.9 Architecture: 64-bit Server MPM: Prefork ...


9

I always run services with a dedicated user. So I would create these users: nginx mongo apache mysql redis You should never run the actual services as root! Often when installing these applications using your distributions package manager, as part of the installation, a user will be automatically created for each of these services. I typically use ...


9

Advantages of Ubuntu: LTS releases are supported for 5 years for the server seed. Ubuntu has been certified to work on certain hardware For those wanting more up-to-date packages & are willing to use a non-LTS release, the 6 month release cycle means that a new stable release happens more frequently than with Debian Ubuntu has some better integration ...


9

You seem to confuse enable, start and mask operations. systemctl start, systemctl stop: starts (stops) the unit in question immediately; systemctl enable, systemctl disable: marks (unmarks) the unit for autostart at boot time (in a unit-specific manner, described in its [Install] section); systemctl mask, systemctl unmask: disallows (allows) all and any ...


9

Your goal is to completely separate your "regular" web files from your phpMyAdmin installation. It should be stressed that each server configuration in Nginx can (and should) have only one webroot. That being said, these are your options: Install phpMyAdmin in a directory under your webroot, which in your case is /var/www/phpmyadmin. It can be accessed ...


8

ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for. It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same ...


8

If you want a machine for local development (a desktop machine), and you want to learn a lot - then go with Arch. It will kind of force you to learn about some under-the-hood things about GNU/Linux because you have to assemble everything from command line, so be prepared, quite a lot of reading will be required although it's not actually that hard as people ...


8

This is a big topic, but I'll try to keep it short. You could try DevStack, which will get you up and running with less configuration work. If you want to really understand the inner workings of the platform, and since you have the hardware, I would go ahead and install it from scratch on your distro of choice (CentOS and Fedora are fully supported ...


8

Nginx does not have the right to read the users files. And it's a very bad idea to put all your users files available on the Web. A better idea is to only serve a dedicated directory in users home directory. To serve the www folder in each user folder when accessing /<USER>, use the following location: location ~ ^/(.+?)(/.*)?$ { alias ...


7

If you have root, you could just use tcpdump and grab everything. You can then pull it up in Wireshark and analyze to your heart's content. $ sudo tcpdump -i <interface> -w mycapture.tcpdump ... and then hit ctrl-c when you've had enough. Run in a screen session if you need to detatch, etc. By default, it'll only capture the first part of each ...


7

Assuming this isn't a typo, the install section in your typo service file contains a typo. It should be, multi-user.target instead of mulit-user.target (mulit vs. multi), e.g: [Install] WantedBy=multi-user.target


6

You're probably looking for mod_userdir: "This module allows user-specific directories to be accessed using the http://example.com/~user/ syntax." Don't be scared of fiddling with the config, just have backups of the config files and make sure your firewall blocks your apache to the outside world.


6

Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux. Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...


6

Actually, a slight modification to warl0ck's plan (because I'm paranoid) create the new partition boot to single-user mode mount the new partition as /new_var or something, and rsync as described you might as well run aptitude autoclean before running rsync, to reduce the amount getting copied over (or even ... clean if you don't mind re-downloading your ...


6

Even though password brute force attempts may not be successful on your system, using fail2ban has other benefits than simply blocking the attack: Keeps your auth log from filling up too much, saving disk space and making analysis easier. Reduces unnecessary CPU cycles and bandwidth servicing bruteforce attempts. fail2ban is a great tool for more than ...


6

(to summarise my comments on the OP) The three-way handshake that they are refering to is part of the TCP connection establishment, the option in question doesn't relate specifically to this. Also note that data exchange is not part of the three way handshake, this just creates the TCP connection in the open/established state. Regarding the existance ...


6

The logs are causing the errors because apache cannot write to the root of your website. Even if you were to fix the file permissions, you'd still be blocked by SELinux; which only allows apache to write logs to /var/log/httpd. The easiest solution would be to change your website to log to this directory - maybe with a filename that contains the website ...


5

Actually, many of your points depend on the kernel capabilities, and are therefore independent from the distribution in most cases. Even if some distributions maintain their own kernels, they still rely on source updates, especially for security-related and standard-related issues. Efficient utilization of multi-core CPUs : this is related to process ...


5

User Agent strings are typically information about the browser connecting to the server, not necessarily the information about the server. For example if you go to http://www.useragentstring.com/ you can find out information about your browser: it shows a breakdown of the user agent string. Example Here I'm using Chrome Mozilla/5.0 (X11; Linux x86_64) ...


5

Delays like this are often caused by reverse DNS lookups (i.e. resolving an IP address to a hostname). Do you have HostNameLookups turned on in the apache config? If so, turn it off. See also http://serverfault.com/questions/100225/apache-httpd-wont-stop-doing-reverse-dns-requests-for-clients-ips for other tips on disabling hostname resolution in apache.


5

One security risk is that you can possibly kill or otherwise tackle the webserver itself (because you are then using the same user.) This is probably not what you want. Same probably when you use root, right. Two solutions: Make a subdir beneath /var/www for yourself, chown it to yourself and then use your own user. (or create a new one) Example: ...


5

Your problem sounds exactly like the one that's described here: Shared folder in VirtualBox for Apache Try to add this setting to your Apache configuration: EnableSendfile off


5

For Apache, see if http://httpd.apache.org/docs/2.2/en/mod/mod_userdir.html#userdir and http://httpd.apache.org/docs/2.2/en/howto/public_html.html helps.


4

As Ulrich said, you can do this by enabling the userdir module. On Debian, this can be done by using the a2enmod utility, which enables or disables Apache modules. See man a2enmod. In this case, you just need to run sudo a2enmod userdir and then restart the Apache server to make the change take effect. Note that the userdir module is in base Apache, so ...


4

There are many tutorials for apache on how to do this. This is one of them. Here is another one One thing that you would change if you already have a certificate generated you would copy the certificate files to appropriate locations vs. generating them yourself. If you are not using apache please post the webserver you're using.



Only top voted, non community-wiki answers of a minimum length are eligible