Category Archives: Linux

nginx – avoid 501 and 502 nginx errors

This are my settings on /etc/php5/fpm/pool.d/www.conf to avoid 501 and 502 nginx errors… on CentOS 7 location of www.conf is at /etc/php-fpm.d/.
The server has 16Gb RAM. This configuration is for a 8Gb RAM server so…

pm.max_children = 70
pm.start_servers = 20
pm.min_spare_servers = 20
pm.max_spare_servers = 35
pm.max_requests = 500

Sources & more readings
http://myshell.co.uk/blog/2012/07/adjusting-child-processes-for-php-fpm-nginx/
http://jeremymarc.github.io/2013/04/22/nginx-and-php-fpm-for-performance/

modsecurity – MULTIPART_UNMATCHED_BOUNDARY

 

Forbidden

You don’t have permission to access /phpmyadmin/import.php on this server.

WOW!

 PHP Warning:  POST Content-Length of 9028812 bytes exceeds the limit of 8388608 bytes in Unknown on line

Looks like modsecurity is working…

ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_UNMATCHED_BOUNDARY" required. [file "/etc/modsecurity/modsecurity.conf"] [line "80"] [id "200003"] [msg "Multipart parser detected a possible unmatched boundary."]

OK!, lets comment some lines @ modsecurity.conf and then restart apache to solve it…

nano /etc/modsecurity/modsecurity.conf

lets comment the following lines

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

and then restart apache

service apache2 restart

 

Force www on a domain with apache

This is how!
Edit a .conf (in my case I have a redirects.conf) for this kind of redirects….

nano /etc/apache2/sites-enabled/redirects.conf

And add the following lines…

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / http://www.example.com/
</VirtualHost>

and naturally restart apache! 😉

service apache2 restart

Enabling cgi-bin on apache

I had to enable CGI on this new recent server

sudo a2enmod cgi
sudo service apache2 restart

Simple!,
But I was getting a error script not found or unable to stat

[Mon Nov 30 18:00:32.380748 2015] [cgi:error] [pid 18799] [client 84.91.XXX.XXX:62545] script not found or unable to stat: /usr/lib/cgi-bin/HiPGZ23est4

I had to edit the .conf file

nano /etc/apache2/sites-enabled/domain.com.conf

and add the following lines

ScriptAlias /cgi-bin/ /path_to_cgi_folder/cgi-bin/
<Directory "/path_to_cgi_folder/cgi-bin/">
 AllowOverride None
 Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
 Order allow,deny
 Allow from all
</Directory>

and then reload the apache configurations

service apache2 reload

sshd – Did not receive identification string from

fuckz!

Nov 30 06:27:58 ns33XXXXX sshd[16965]: Did not receive identification string from 5.196.20.94
...
Nov 30 06:31:07 ns33XXXXX sshd[17139]: Connection closed by 5.196.20.94 [preauth]
...
Nov 30 06:35:09 ns33XXXXX sshd[17313]: Connection closed by 5.196.20.94 [preauth]

So, what does this means?

Some miscreant (surprise!) is hammering at ssh to try to find a username/password combination that gets them into the system. Probably from some botnet doing the same to who knows how many other unsuspecting victims.

Source: http://serverfault.com/questions/483852/sshd-log-full-of-did-not-receive-identification-string-from

This one below means ssh server waited and did not receive what it needed in a timely fashion. This is typically due to connectivity issues. In an ssh connection, the server first provides its identification string, then waits for the client to then provide its identification string. If there is a loss in connection, or the client just bails, this is what you will see in the logs.

If someone uses telnet or netcat to fetch your ssh banner, or other various scans, the logs on the server side will show this as well.

 

Source: https://scottlinux.com/2012/03/07/troubleshooting-ssh-server-logs-and-error-messages/

So, I went to fail2ban and increased the values!
This is my /var/log/fail2ban.log.

2015-11-30 13:11:24,144 fail2ban.filter : INFO Set maxRetry = 3
2015-11-30 13:11:24,146 fail2ban.filter : INFO Set findtime = 6000
2015-11-30 13:11:24,146 fail2ban.actions: INFO Set banTime = 6000

Fuckers!

Microsoft’s Software is Malware

Microsoft Back Doors

Microsoft Sabotage

The wrongs in this section are not precisely malware, since they do not involve making the program that runs in a way that hurts the user. But they are a lot like malware, since they are technical Microsoft actions that harm to the users of specific Microsoft software.

Microsoft Surveillance

Microsoft DRM

Microsoft Jails

Microsoft Tyrants

As this page shows, if you do want to clean your computer of malware, the first software to delete is Windows.

ERROR 502 – connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream

 

2015/11/24 12:01:49 [error] 48055#0: *14094117 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client:

Once again, i’m struggling with nginx + php-fpm

sudo nano /etc/php5/fpm/pool.d/www.conf

search for

listen = /var/run/php5-fpm.sock

and replace it for

listen = 127.0.0.1:7777

On the *.conf files of sites-enabled (/etc/nginx/sites-enabled/)

replace (or comment)

fastcgi_pass unix:/var/run/php5-fpm.sock;

with

fastcgi_pass 127.0.0.1:7777;

More readings