Hot answers tagged

76

sudo python -m SimpleHTTPServer 80 for python 3.x version, you may need : sudo python -m http.server 80 Ports below 1024 require root privileges. As George added in a comment, running this command as root is not a good idea - it opens up all kinds of security vulnerabilities. However, it answers the question.


19

Most people run their httpd (Apache, Nginx, etc) through an init system. That's almost certainly the case if you've installed from a package. Almost all of these init systems have a method work working out if it's running. In my case I'm using nginx which ships a SysV-style init script and that accepts a status argument, like so: $ /etc/init.d/nginx status ...


16

You can use the services command universally on most Linux distros. $ service <service> status Example $ service httpd status httpd (pid 23569) is running... This same command can be used for all services that are running on an individual basis or to find all the services' status. $ service --status-all python is stopped automount (pid 22457) ...


13

The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in. By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before ...


12

Download the netinstall iso, boot it and select non-graphical install. I actually made a video once for it: http://www.youtube.com/watch?v=JOGSupJury4 The difference between ubuntu and debian is the way they are doing package testing. Debian is all about stability and ubuntu is more about all the new things (less stability).


11

The option accesslog.filename is for the mod_accesslog module, so you need to load that module. server.modules += ( "mod_accesslog" )


9

Advantages of Ubuntu: LTS releases are supported for 5 years for the server seed. Ubuntu has been certified to work on certain hardware For those wanting more up-to-date packages & are willing to use a non-LTS release, the 6 month release cycle means that a new stable release happens more frequently than with Debian Ubuntu has some better integration ...


9

I always run services with a dedicated user. So I would create these users: nginx mongo apache mysql redis You should never run the actual services as root! Often when installing these applications using your distributions package manager, as part of the installation, a user will be automatically created for each of these services. I typically use ...


9

You can see where httpd is configured to look for it's configuration files using the -V switch: $ httpd -V Server version: Apache/2.2.15 (Unix) Server built: Feb 13 2012 22:31:42 Server's Module Magic Number: 20051115:24 Server loaded: APR 1.3.9, APR-Util 1.3.9 Compiled using: APR 1.3.9, APR-Util 1.3.9 Architecture: 64-bit Server MPM: Prefork ...


9

Nginx does not have the right to read the users files. And it's a very bad idea to put all your users files available on the Web. A better idea is to only serve a dedicated directory in users home directory. To serve the www folder in each user folder when accessing /<USER>, use the following location: location ~ ^/(.+?)(/.*)?$ { alias ...


9

Your goal is to completely separate your "regular" web files from your phpMyAdmin installation. It should be stressed that each server configuration in Nginx can (and should) have only one webroot. That being said, these are your options: Install phpMyAdmin in a directory under your webroot, which in your case is /var/www/phpmyadmin. It can be accessed ...


9

You seem to confuse enable, start and mask operations. systemctl start, systemctl stop: starts (stops) the unit in question immediately; systemctl enable, systemctl disable: marks (unmarks) the unit for autostart at boot time (in a unit-specific manner, described in its [Install] section); systemctl mask, systemctl unmask: disallows (allows) all and any ...


8

ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for. It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same ...


8

If you want a machine for local development (a desktop machine), and you want to learn a lot - then go with Arch. It will kind of force you to learn about some under-the-hood things about GNU/Linux because you have to assemble everything from command line, so be prepared, quite a lot of reading will be required although it's not actually that hard as people ...


8

This is a big topic, but I'll try to keep it short. You could try DevStack, which will get you up and running with less configuration work. If you want to really understand the inner workings of the platform, and since you have the hardware, I would go ahead and install it from scratch on your distro of choice (CentOS and Fedora are fully supported ...


7

If you have root, you could just use tcpdump and grab everything. You can then pull it up in Wireshark and analyze to your heart's content. $ sudo tcpdump -i <interface> -w mycapture.tcpdump ... and then hit ctrl-c when you've had enough. Run in a screen session if you need to detatch, etc. By default, it'll only capture the first part of each ...


7

Assuming this isn't a typo, the install section in your typo service file contains a typo. It should be, multi-user.target instead of mulit-user.target (mulit vs. multi), e.g: [Install] WantedBy=multi-user.target


6

Actually, a slight modification to warl0ck's plan (because I'm paranoid) create the new partition boot to single-user mode mount the new partition as /new_var or something, and rsync as described you might as well run aptitude autoclean before running rsync, to reduce the amount getting copied over (or even ... clean if you don't mind re-downloading your ...


6

Even though password brute force attempts may not be successful on your system, using fail2ban has other benefits than simply blocking the attack: Keeps your auth log from filling up too much, saving disk space and making analysis easier. Reduces unnecessary CPU cycles and bandwidth servicing bruteforce attempts. fail2ban is a great tool for more than ...


6

(to summarise my comments on the OP) The three-way handshake that they are refering to is part of the TCP connection establishment, the option in question doesn't relate specifically to this. Also note that data exchange is not part of the three way handshake, this just creates the TCP connection in the open/established state. Regarding the existance ...


6

Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux. Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...


5

For Apache, see if http://httpd.apache.org/docs/2.2/en/mod/mod_userdir.html#userdir and http://httpd.apache.org/docs/2.2/en/howto/public_html.html helps.


5

One security risk is that you can possibly kill or otherwise tackle the webserver itself (because you are then using the same user.) This is probably not what you want. Same probably when you use root, right. Two solutions: Make a subdir beneath /var/www for yourself, chown it to yourself and then use your own user. (or create a new one) Example: ...


5

When people ask this I always tell them: Let somebody else host your DNS Seriously. You don't have the network stability that professionals have and for DNS stability is key to a happy life. It's not weakness to admit that somebody else is better at it than you can be. They have something you don't: epic redundancy. Most registrars offer a free ...


5

User Agent strings are typically information about the browser connecting to the server, not necessarily the information about the server. For example if you go to http://www.useragentstring.com/ you can find out information about your browser: it shows a breakdown of the user agent string. Example Here I'm using Chrome Mozilla/5.0 (X11; Linux x86_64) ...


5

Your problem sounds exactly like the one that's described here: Shared folder in VirtualBox for Apache Try to add this setting to your Apache configuration: EnableSendfile off


5

You are trying to test connectivity to a remote Web server with telnet? Then, no: you do not need telnet servers. The remote HTTP server is waiting for commands, as indicated by the escape character. When it times out waiting, the connection is closed. So... telnet <hostname or ip address> 80 Then type some HTTP commands: GET / HTTP/1.1 host: ...


5

Actually, many of your points depend on the kernel capabilities, and are therefore independent from the distribution in most cases. Even if some distributions maintain their own kernels, they still rely on source updates, especially for security-related and standard-related issues. Efficient utilization of multi-core CPUs : this is related to process ...


4

I assume that your gateway device to the internet does NAT (network address translation), i.e. your home network uses for example a private network like 192.168.0.* and you dynamically get one IP from your ISP which is used by the gateway. In that case someone on the internet only is able to access port 80 on your home network web-server, when you have ...



Only top voted, non community-wiki answers of a minimum length are eligible