Roundtable July 2017

roundtable@muug.ca

11 participants
11 discussions

Apache MPM choice for PHP + HTTP2
by Trevor Cordes 24 Jul '17

24 Jul '17

Trying to get HTTP2 support working in Apache, easy enough. Except when I restart apache it complains that mod_http2 is not compatible with mpm prefork and turns http2 off. OK, I go back to figure out why I'm running prefork. Turns out that still seems to be the easiest/best way to work with PHP via mod_php. Some research reveals talks from 5+ years ago that say that not every PHP module that may be compiled in (in a normal distro) is thread safe, so all of the threaded mpm's are out of the question. Doh. But some people (but not anyone official!) say that the above is dated and PHP should be fine with threaded mpm's. This isn't the type of thing I want to throw out there and see if users can deadlock my apache! Who to believe... So, what are MUUGers who use apache and PHP using as their mpm? Anyone successfully using a threaded mpm in this setup on complicated PHP sites without problems? It looks like the only other option (short of running 2 servers + rev proxy) is php-fpm, which I'm not familiar with but appears to run PHP outside of apache in its own daemon and talk directly with apache via fastcgi or similar. From what I read it shouldn't kill performance but I thought the whole point of mod_php was to put php inside apache for speed. And, no, I'm not interested in moving to nginx at this time (and from benchmarks I saw it's no faster for PHP anyhow). :-) Thanks!

2 1

32->64-bit OS upgrades for Fedora/RHEL systems WORKING!
by Trevor Cordes 24 Jul '17

24 Jul '17

Something I've asked about in the past on this list, and at MUUG meetings, as some may remember: How to upgrade an entire system from 32-bit to 64-bit x86_64 in-place, over a network, off-site. Specifically for Fedora (and RHEL). And ensuring the resulting system was "clean" without a mess everywhere. Well, I finally developed a method and have successfully upgraded all the boxes I'm responsible for. And for not a single one was I required to go on-site! Yay! I wasn't sure it was possible, as all Fedora forums said it was hopeless, and any instructions out there were for like Fedora 5 or 10 and relied on features and workarounds that are no longer present. Most people are like "just reinstall from DVD". Great if you're on-site and your system isn't heavily tweaked. Even then, you're looking at blowing a day (at least) on the upgrade. I couldn't do that for 20+ off-site systems! So I found new hidden methods and workarounds and tested and honed them to come up with a reliable procedure. And it worked! I now have boxes that have been successfully upgraded, using yum/dnf, from ~FC2 through to F24+ and multiple iterations of hardware from P1 to today's Xeon; never with any on-site upgrade or reinstall! And there's no mess & no leftovers! Try that on Windows!! (Boy, do I love Linux!) I'm mentioning it here for two reasons: 1) curiosity, as I'm sure at least someone wants to hear about the outcome of this loony proposition; and 2) I recall at least 2 members telling me they had a similar need (see, it's not just me!). I thought about doing a presentation or something but it would be so narrowly-focused that it would bore the 99% of have no need of this. So for now I'm keeping it under wraps and will be selling it as a service to those who have the need (gotta keep my computer company in business, after all, it is my day job!). So if you want info, email me privately; special uber-discount for MUUGers! P.S. The only other distro I could find with easy 32->64 instructions was Arch. Other than that it appears hopeless using online resources, though I'm pretty sure you could do the upgrade easily on Gentoo also.

1 0

Re: [RndTbl] IP ID field
by Vijay Sankar 21 Jul '17

21 Jul '17

Quoting roundtable-request(a)muug.ca: > Send Roundtable mailing list submissions to > roundtable(a)muug.ca > > To subscribe or unsubscribe via the World Wide Web, visit > https://muug.ca/mailman/listinfo/roundtable > or, via email, send a message with subject or body 'help' to > roundtable-request(a)muug.ca > > You can reach the person managing the list at > roundtable-owner(a)muug.ca > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Roundtable digest..." > > > Today's Topics: > > 1. IP ID field (Vijay Sankar) > 2. Re: IP ID field (Trevor Cordes) > 3. Re: IP ID field (Robert Keizer) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 20 Jul 2017 05:17:38 -0500 > From: Vijay Sankar <vsankar(a)foretell.ca> > To: roundtable(a)muug.ca > Subject: [RndTbl] IP ID field > Message-ID: > <20170720051738.Horde.Njt9ul6yxkwX9F4SgaRrt_f(a)server3.foretell.ca> > Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes > > I am a bit confused about IP ID and was wondering about the following. > > Is it normal to have the same IP ID for the initial SYN packet from > different source IP addresses? There is no fragmentation issues in > this case since it is only 40 bytes and I see this same IP ID only > with attempts to establish a session to 161/TCP. > > I read through RFCs (mostly 6861 and 4413) but not sure. Please let me > know if you can give me any clues or suggestions. > > Thanks very much, > > Vijay > -- > Vijay Sankar, M.Eng., P.Eng. > ForeTell Technologies Limited > vsankar(a)foretell.ca > > > > ------------------------------ > > Message: 2 > Date: Thu, 20 Jul 2017 05:29:47 -0500 > From: Trevor Cordes <trevor(a)tecnopolis.ca> > To: roundtable(a)muug.ca > Subject: Re: [RndTbl] IP ID field > Message-ID: <20170720052947.3d308709(a)pog.tecnopolis.ca> > Content-Type: text/plain; charset=US-ASCII > > On 2017-07-20 Vijay Sankar wrote: >> I am a bit confused about IP ID and was wondering about the following. >> >> Is it normal to have the same IP ID for the initial SYN packet from >> different source IP addresses? There is no fragmentation issues in >> this case since it is only 40 bytes and I see this same IP ID only >> with attempts to establish a session to 161/TCP. > > Off the top of my head, and without consulting anything (I can do that > later), I recall reading something about this being OS specific. Some > OS's randomize, some start with whatever. I think it can be used to > determine what OS is hitting you in some cases. My guess would be > older OS's don't randomize. Or I'm completely out to lunch at this late > hour... > > > ------------------------------ > > Message: 3 > Date: Thu, 20 Jul 2017 08:10:00 -0500 > From: Robert Keizer <robert(a)keizer.ca> > To: roundtable(a)muug.ca > Subject: Re: [RndTbl] IP ID field > Message-ID: <581b99bc-697e-a196-c4ba-00ab38af6a3e(a)keizer.ca> > Content-Type: text/plain; charset="utf-8" > > This might be useful. I had bookmarked it years and years ago because I > thought it was neat. > > http://lcamtuf.coredump.cx/oldtcp/tcpseq.html > > > Rob > > On 2017-07-20 5:29 AM, Trevor Cordes wrote: >> On 2017-07-20 Vijay Sankar wrote: >>> I am a bit confused about IP ID and was wondering about the following. >>> >>> Is it normal to have the same IP ID for the initial SYN packet from >>> different source IP addresses? There is no fragmentation issues in >>> this case since it is only 40 bytes and I see this same IP ID only >>> with attempts to establish a session to 161/TCP. >> Off the top of my head, and without consulting anything (I can do that >> later), I recall reading something about this being OS specific. Some >> OS's randomize, some start with whatever. I think it can be used to >> determine what OS is hitting you in some cases. My guess would be >> older OS's don't randomize. Or I'm completely out to lunch at this late >> hour... >> _______________________________________________ >> Roundtable mailing list >> Roundtable(a)muug.ca >> https://muug.ca/mailman/listinfo/roundtable > > >

1 0

IP ID field
by Vijay Sankar 20 Jul '17

20 Jul '17

I am a bit confused about IP ID and was wondering about the following. Is it normal to have the same IP ID for the initial SYN packet from different source IP addresses? There is no fragmentation issues in this case since it is only 40 bytes and I see this same IP ID only with attempts to establish a session to 161/TCP. I read through RFCs (mostly 6861 and 4413) but not sure. Please let me know if you can give me any clues or suggestions. Thanks very much, Vijay -- Vijay Sankar, M.Eng., P.Eng. ForeTell Technologies Limited vsankar(a)foretell.ca

3 2

Attempted murder of sysadmin
by Trevor Cordes 17 Jul '17

17 Jul '17

I've been thinking about this a lot lately, as each new buzzword layer enters the scene (SaaS, IaaS, MS, VZ, cloud, containers, ...). Each time one of these technologies comes along I look at it and say "boy, is that stupid / inefficient / costly". Of course, I'm thinking as a sysadmin. A couple of years ago it dawned on me that the whole point of these techs was to eliminate sysadmins. These techs *are* inefficient in that they all take more CPU cycles / RAM / storage; they are more costly in that they aren't as cheap as I can do it myself (i.e. cloud vs dedicated server). But that's me, computer expert, who can do everything myself (from hw to os to sw) very quickly. Not CEO who doesn't even know what an OS is. I mean, look at docker or flatpacks or even VMs. These things are the opposite of what we spent 30 years working against... duplication. So now we have the same/similar 100-thousand OS files duplicated everywhere. Now they want to undo the entire concept of shared libraries and essentially make libs static again (well, shared but distribute specific lib versions with the apps, duplicating out the wazoo). For an efficiency purist it seems insane. So what gives? *** It's to eliminate/reduce one of the most highly paid workers in IT: sysadmins. Or at least, to (finally) allow the overseas outsourcing of sysadmin duties. As MUUGers, a lot of us are sysadmins. We should care. Personally, I'm not worried (as I'm sure many of you aren't), as our skillsets are so diversified, we can't be pigeonholed, and, as required, we can be the masters of any new technology. My only question is one of curiosity, will they succeed in murdering most sysadmins? Will they save their $100kUS$/yr/sysadmin by giving it all to AWS? Will people accept the obvious inefficiencies of flatpacks in order to delete the cost of people? Actually, I'm dubious, as I've read these buzzwords in trade pubs ever since I started in tech ~1997, every single one claiming to be the admin-killing panacea, and they came and went, and most turned out to be waaay overblown. I'll be shocked if they actually succeed in killing sysadmins this time. Anyone else thinking about these things? Bonus question: What happens the day AWS (or whatever) screws up / has a major data loss / some other calamity? You sure are putting a lot of trust in *their* sysadmins, who may not be as smart as you are! Decent new article about it all this here: https://www.informationweek.com/devops/rip-systems-administrator-welcome-de…

5 12

disk usage
by Kevin McGregor 13 Jul '17

13 Jul '17

Here's another attempt to send this out: I copied a bunch of stuff with rsync from a Linux system to a BSD system. I'm fairly sure it worked fine, but as a check, I'd like to compare the total number of bytes in files on both systems. du -sk <dir> produces slightly different results on both systems (smaller on dest) I also tried out find <dir> -type f -print0 | xargs -0 stat --format=%s | awk '{s+=$1} END {print s}' on Linux and find rsync -type f -print0 | xargs -0 stat -f %Dz | awk '{s+=$1} END {print s}' on BSD. I think they're equivalent, but maybe not. At any rate, this also produced differing results for each system, with the destination having the smaller numbers. Not a huge difference, but it leaves me wondering what might be missing. Any ideas?

3 2

FW: BSides Winnipeg 2017 CFP
by Adam Thompson 10 Jul '17

10 Jul '17

For all those who might be interested… From: Mak Kolybabi [mailto:mak@kolybabi.com] Sent: July 10, 2017 08:35 To: athompso(a)athompso.net Cc: cfp(a)bsideswpg.ca Subject: BSides Winnipeg 2017 CFP The BSides Winnipeg 2017 CFP is open from now until August 16th. Please find the text of the CFP below, as well as the PDF version attached. -Mak Call For Papers BSides Winnipeg 2017 occurs on November 4th & 5th, and will consist of a single speaking track. Presentations are expected to be 20 to 25 minutes, followed by a few minutes for Q&A. Like all BSides, we especially encourage people that have never presented before to submit to this CFP! We are looking for presentations that talk about infosec tools, specific exploits, legal issues, privacy, defensive and offensive measures, cryptography, password cracking, reverse engineering, lockpicking, and software-defined radio. If your presentation doesn't fit into any of those categories, pitch it anyway! Submissions should be in plain text and answer the following questions: * May we refer to you by your name? If so, what is your name? If not, by what pseudonym should we refer to you? * What email address should we use to contact you? * What is the title of your presentation? * In one paragraph, provide a description of your presentation (i.e. an abstract) * Who are you, what are you known for? * Has this material been presented elsewhere? If so, where and when? * Are you presenting as a representative of: * Yourself? * A company? If so, what is its name? * A group? If so, what is its name? * Will you be traveling to the event? If so, from where? Failure to answer any of the above questions will likely result in your submission being summarily rejected. Any talks we feel are marketing or sales pitches will definitely be rejected. We will live stream, and record for online distribution, all presentations made at the event. Your name (or pseudonym), the title of your presentation, and your presentation’s abstract will appear in several places and be posted indefinitely along with the recording of your presentation; take some time to consider what to write for them. Submissions must be emailed to <mailto:cfp@bsideswpg.ca> cfp(a)bsideswpg.ca. The CFP opens on Saturday, July 1st and the deadline for submissions is Wednesday, August 16th. Each submission that we receive will have its receipt confirmed within 24 hours, for your peace of mind. You will be informed if any information that we require is missing. Every submission will be responded to by Friday, September 1st with our decision as to whether it has been accepted. Speakers will receive a complimentary ticket to the event, and a token of our appreciation. All submissions are greatly appreciated, but we're running a single track for two days, so there are limited slots available, constraining the number of presentations that we can accept. If you have any questions about the CFP or the conference, please email the organizers at <mailto:organizers@bsideswpg.ca> organizers(a)bsideswpg.ca.

1 0

Attempted murder of sysadmin
by Hartmut W Sager 10 Jul '17

10 Jul '17

Adam wrote: > (Oh, and it's not just sysadmins. Remember "visual programming"? Each time > it gets reinvented, it's going to let business users do their own programming > and get rid of all those overpaid programmers. Yeah, right. I still see lots > of programmers. Just, hardly any of them write in assembler or COBOL anymore. > Although 4GLs haven't exactly taken over the world...) > Trevor wrote: > Nice reply, Adam, guess the rest of MUUG is off to the cottage, or not > an admin, or too busy shaking in their boots to reply :-) As we both > said, no reason for anyone to get scared about any of this stuff as > long as your skillset is deep and wide. No cottage for me. I'm still here and enjoying this whole thread, which strikes a real chord with me. I've made many similar observations in my IT life. Even as far back as circa 1988-1990, I remember an IT journal article entitled "The End of Programmers (Again)". Non-programmers generally don't even understand or appreciate the concepts of algorithms and processes, and seem to think that a simple script without conditional logic/branching can do everything. Hartmut W Sager - Tel +1-204-339-8331

1 0

No Starch books on sale today
by Adam Thompson 09 Jul '17

09 Jul '17

FYI. Peter N. M. Hansteen (@pitrh) tweeted at 11:35 AM on Sun, Jul 09, 2017: For #DayAgainstDRM, all @nostarch ebooks are now 50% off at https://t.co/95Xm5QtBDv! https://t.co/PzC3V2TvB8 (https://twitter.com/pitrh/status/884088701969715200?s=09) -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Linux "write"
by Trevor Cordes 07 Jul '17

07 Jul '17

Can someone else confirm this bug on another Linux system, preferably a modern one that uses systemd? In X, as non-root: open a term (call it term1) open another term (term2) type "tty" in term2, not your tty number/string in term1: type "write <your-login> <tty-string-from-above>" replace your-login with the output of "who" if you don't know who you are logged in as please try both /dev/pts/42 and pts/42 format for the tty part of write example: write trevor pts/42 When I run this I get: write: trevor is not logged in on pts/42 Even though I clearly am. This used to work perfectly up until last year (I think), and I think systemd changed something (big surprise). No chatter about this anywhere that I can see. Probably the last person on earth to use write (at least on F24). I found some other things to test that indicate that something is really amiss: >write trevor write: trevor has messages disabled >mesg is y >mesg y mesg is y >write trevor write: trevor has messages disabled >ll /dev/pts/42 crw--w---- 1 trevor tty 136, 42 Jun 28 02:48 /dev/pts/42 If someone else can confirm this bug on a non-Fedora (or a newer one) that would be great. If someone can also confirm that the above behaviour is insane, that too would be great. If anyone has some ideas on what to try next, shoot away! Then I'll file a bz. Thanks!

4 13

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Roundtable July 2017