How to set it

Let’s play
I created 2 directories and 2 files, one with sticky bit set and one without for each type:

First I noticed that the sticky bit on the directory is shown as “t” in place of the last x, and as “T” for the file. Maybe it’s because the file isn’t world executable? Let’s verify that :

Ok, so “T” means sticky bit on but world executable off, “t” means both on.

The user “amandine” owns everything, and both users “amandine” and “test” belong to “amgroup”. Of course “amandine” can delete, rename and edit everything. What about user “test” ?

Ok. Nothing different, “test” can do everything too. Did I miss the point?? Let’s play more.

Now with user “test” :

Ha! Here’s one difference! I can’t delete another’s user file in a sticky bit enabled directory.

What about editing :

“test” can still edit both files.

but he can’t rename or delete them.

Ok for sticky bit on directories, but what’s the point of having a sticky bit switched on for a single file?

Ok, and on newer systems? Seems it’s just not used anymore on most systems :
From Wikipedia :
Linux : [...] the Linux kernel ignores the sticky bit on files. [...]
*BSD : [...]The sticky bit can still be set on files, but without any effect.[...]
MAC OS X : [...]the sticky bit has no effect on executable files[...]

except on solaris : [...] Solaris (as of Solaris 2.5) defines special behavior when the sticky bit is set on non-executable files: those files, when accessed, will not be cached by the kernel. This is usually set on swap files to prevent access on the file from flushing more important data from the system cache. [...]

Summary
The sticky bit on a directory allows users to create and modify their own files in it, edit other’s files if they are allowed to, but not delete or rename other’s files even if the classic rights allows them to normally do it. Typical usage of the sticky bit is /tmp .

That wasn’t so hard to learn after all ! ;)

This is what I want :

• you call -> you get
• www.yellow-sub.net -> index.php?page=somepage
• the-beatles.yellow-sub.net -> index.php?page=somepage-the-beatles
• blahblah.yellow-sub.net -> index.php?page=somepage-blahblah

The page parameter will in fact call a different page with name “somepage-blahblah.html”, and I wanted it to work for every single subdomain (if it doesn’t exist it will anyway be redirected to www home page)

The closest way I found was to use %{HTTP_HOST} in my rewriterule :

But this way I had to name my files somepage-the-beatles.yellow-sub.net.html instead of somepage-the-beatles.html, wich is not so bad but quite annoying when I want to copy that from beta (different domain name) to live or from live to beta.

So I found the Rewritemap parameter in the apache documentation website. And That’s just an amazing new feature I didn’t know about : it will let you do whatever you want with your rewrite rules! I let you read the manual page, It’s well written and I won’t explain something already well explained : See that Rewritemap doc

I used the last MapType : External Rewriting Program that allows you to write your own script in whatever programming language you fancy, taking stdin and writing to stdout. Mine is very simple, in bash :

I guess that’s a good practive to Keep It Simple, Stupid, as advised in the manual, cause it will be running as apache child, not called when needed. You can test it by giving it something to process :

To use it in you Virtualhost section :

Don’t be messy with the interesting part ${subdomain:%{HTTP_HOST}}, I sillily wrote a % instead of the $ and spent half an hour to figure it out! (no errors anywhere, the script was launched, it just didn’t work at all).

Reload apache to watch it running now :

You can watch it in action using the Rewritelog :

And now my files are just called the way I wanted to :)
I have to say, I love this feature more because I can imagine a lot of new functions in my rewriterules than because it solved my problem, for which I had other options anyway (not as sexy ones, but solutions though.)

The question now is : it is safe? What are the risks of using such a script within apache? If you have anything to say about that, please tell me :)

Have fun with mod_rewrite!

So, after registering sysadmandine.42 domain name, I tried to surf on it. But I didn’t want to spend time to configure a secured but open bind on one of my servers, so I opted for the easy way : my local computer is on Ubuntu, Ubuntu is perfectly able to provide me a bind, so let’s go :

Then one line of config like they say on the 42registry website :

add :

restart bind (surprisingly, just reload didn’t do it) :

Check that it’s working :

(you have to see a ANSWER section id it’s working)

And then tell your system to use it :

Put this on the first line :

That’s it ! Now you just have to open your firefox or any other browser (be careful with chrome or chromium though, ther’s a trick to make it work with those ones, check the 42registry website to know how.), and try some domains !
* http://www.sysadmandine.42/ (of course)
* http://nic.42/
* I couldn’t find more websites in .42, do you know some?

- Check your partitions in your domU :

- create empty file of the size we want to add : (10gb here)

- stop your domU

- backup img files

- add the empty file to the img file :

You can repeat this step as many times as you need

- tell the filesystem to check and adapt its size :

- restart your domU

- check in your domU that everything is ok

Voila! Your disk is now bigger :)

You can also use this method to create a brand new blank disk image, and add it as a new disk for you domU :

or

add the new disk (xvda3) to your /etc/xen/mydomU.cfg :

after rebooting you domU, check if the new disk is available :

You’re now free to create your filesystem on this disk, and to mount it wherever you want!

This Howto was made under Ubuntu Hardy, Xen 3.2

This means : if the requested file is not a real file, and isn’t a directory, and isn’t a symlink, then redirect to index.php.

I was really surprised to discover that it doesn’t work. Though, everybody seems to use this syntax ! I checked my apache version : Apache/2.2.9 (Debian), nothing special with this one I guess.
To understand what Apache was doing with my rewrites, I activated the rewrite log :

Here’s what I got (the interesting part, cause I got a looot more !) :

So apaches verifies only ‘/toto.htm’ and not the whole path for “%{REQUEST_FILENAME}”? I thought though it was the whole path… let’s verify in the doc.
From http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html, by habit (cause I used apache 2.0 a lot more than apache 2.2 from now on) :

REQUEST_FILENAME : The full local filesystem path to the file or script matching the request.

Hmm. But I use apache version 2.2, so what do they say here http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html :

REQUEST_FILENAME : The full local filesystem path to the file or script matching the request, if this has already been determined by the server at the time REQUEST_FILENAME is referenced. Otherwise, such as when used in virtual host context, the same value as REQUEST_URI.

Ow.

REQUEST_URI : The resource requested in the HTTP request line. (In the example above, this would be “/index.html”.)

Ok, I understand, I use virtual hosts (like everybody, uh?), so the real syntax for my needs is :

This works even if it doubles the “/” between each variable (one / at the end of DOCUMENT_ROOT, and another at the beginning of REQUEST_FILENAME).

Here’s the rewrite log showing that it works :

Now I can disable this log if I want to keep space on my disk.

I must admit I read the description for REQUEST_FILENAME in apache2.2 several times before noticing that it was just the answer… too used to read too fast! Thanks to this old post that made me re-read slower ! ;)

Scripting
1. egrep : aaah… if I had to keep only one, this would be the one I’d choose… can’t spend 10 minutes without using it.
2. sed : because I always need to replace something by something else 10 times on each line in huge files
3. xargs : helps me avoid the for loop, shorter to write, easier to remember and understand when you find it in history
4. awk : for me the most difficult one to use, but I so know that it can do just what I want that I always take the time.

System
5. kill : ha ha, makes me feel I’m powerful
6. ps fauxww : makes me think I can watch everything that’s happening in real time. Like watching 10 movies at the same time.
7. aptitude : I like his way of telling me everything of what he’s doing… so chatty !
8. dstat : this one is really good : tells me a lot of things and with colors, I think he just knows what I’m looking for each time I call him.

Network
9. ssh : is it necessary to say something about it? without him I’d be nothing.
10. telnet : I like the raw output, no interpretation, he’s stupid and this is sometimes really appreciable
11. host : simple tool for so great usefulness, even the basic usage is perfect
12. nmap : I looove knowing everything about hosts I can’t access…
13. tcpdump : really useful when you really dont understand what’s happening.
14. netstat : nmap from the inside. Feels like a treasure hunt sometimes.
15. mtr : seems just easy and fast, but also gives a lot of interesting information.

Tools
16. vim : makes me save so much time
17. screen : How did they live before screen? And I use only a small amount of its potential…

Storage
18. fdisk : boring in the begenning, fun once you know it by heart
19. sfdisk : really handy to mirror a disk partitionning scheme
20. mdadm : I love mdadm. Just love it, don’t know why.

So, how does it work? How is it possible to compare a password with its encrypted version when you can’t be sure to have the same encryption string each time you encrypt it?
I googled and found that it has something to do with the “salt”. the salt seems to be the 2 first letters of the string, and the password is generated considering those. To be sure, I generated the same password enough times to see :

After looking closely to the sorted file, I can say that every time the first 2 letters are identical, the second part of the encrypted string is also identical.

To try to generate a password with a specified salt, you can use the perl crypt function :

And then you can see that this comand outputs exactly the same string as the htpasswd had generated above !
Mystery solved ! ;)

Easy to use, just does what I need from it, here’s a extract from the man page :

So…

Great ! :p

Pound is made by a Swiss company named Apsis GmbH (http://www.apsis.ch/), and its purpose is to achieve 3 goals :
- reverse proxy
- load balancing
- HTTPS front-end

You don’t need to use all 3 features, but you might need it anyway. Don’t assume it can do other things : No caching, no webserver, no acceleration. Just what it’s meant for.

Why to use pound with an example
Now let’s say you have several (n) webservers, running at the same time, and maybe for several websites. Maybe you have the luck to have a public IP address for each of your webservers or websites, and assigned one website to one webserver. Then, if one of the webserver goes down or fails, then you have one website down.

You might have thought to spread all the websites on a part or even all of the wervers, and load-balance them with dns Round-robin. But now, if one server fails, what happens? Your website will seem to be down each 1/n call, because round robin is just simple load balancing, it doesn’t know if a server is alive or not. So, maybe you could use heartbeat to take one server IP when it goes down, and then overload another webserver. And the more server you have, the more it becomes tricky.

Or you could use pound. Pound wil be the single entry point for all of your websites. It takes everything, and dispatch query amongst servers according to their header hostname. So, you can have one website per server, but it’s kind of stupid cause if one server goes down the website is still down. Let’s just spread all the websites on all the servers, and assign different priorities to specialize each server and partition the traffic, in order to avoid some website to slow done another website.

For example, you have 3 websites and 4 servers :
server1 : pound
server2 : web1 with priority 9, web2 with priority 1, web3 with priority 1
server3 : web1 with priority 1, web2 with priority 9, web3 with priority 1
server4 : web1 with priority 1, web2 with priority 1, web3 with priority 9

In this example, 9 of 11 pages for web1 will be served by server1, and 2 of 11 pages by server 2 ans server 3. If server1 goes down, the traffic will be automatically and fairly spread amongst server2 and server3, so that the overload shouldn’t slow down too much another server/website and end by getting all of them down. Same with the other websites of course.

Installation
If you’re on Debian or Ubuntu, just aptitude it :

If not, install it your distro way (as long as you have version 2.x and above, it should be ok.), or download it from the official website, and in this case I can just invite you the read the README file, it’s really well explained.

I will now assume that you run Pound on Ubuntu or Debian.
Once installed via aptitude, edit the file /etc/default/pound and change “startup=0″ in “startup=1″, or pound will refuse to start.

Setup and configuration options
The configuration takes place in one single file : /etc/pound/pound.cfg The example config is simple but gathers the main options.

by

(64 for example)

Then you have to disable the module :

and re-enable it :

But the new devices won’t append automatically for sure, so if you don’t see them in /dev/loop*, you can make them appear this way :
Edit /sbin/MAKEDEV and change :

By:

And execute

For me this step didn’t work either, so I had to create it really by hand :