Internet Consulting
This can be a tricky one to debug. The 'origin not allowed' only comes from one place in Grafana: hostnameMatches := origin == netAddr.Host if netAddr.Host == "" || !trustedOrigin && !hostnameMatches { return &errorWithStatus{Underlying: errors.New("origin not allowed"), HTTPStatus: http.StatusForbidden} } Normally you'd either modify the header or add the proxy domain to csrf_trusted_origins in…
I spent too long thinking that ModSecurity was necessary for this, but you can do it with just the ngx_http_geoip2_module Install nginx along with the module: apt-get install nginx libnginx-mod-http-geoip2 Download the free GeoLite mmdb database from MaxMind into /etc/nginx/GeoLite2-Country.mmdb (you can and probably should use their tools to update this automatically). Create…
Recently I had an issue where I migrated ProFTPD from one server to another, but the PassivePorts was being ignored (as was AllowOverwrite ). Connections were timing out and tcpdump showed the client was connecting to the wrong port range for passive mode. Nothing in the logs, but dumping the config showed the PassivePorts wasn't being loaded: # proftpd -t -d 10 |& grep -i port server.host.name…
In a previous post I discussed an issue where 1ms of increased latency to a MySQL server was causing a problem due to thousands of queries. Generally, there are only two ways to handle this problem: Bring the servers closer together (according to the speed of light); Reduce the number of queries being sent to the database server. In our case, the database server was already only 2ms away and they…
I want to begin by saying that this specific example is very niche problem, but real. A client moved their LAMP application to a new hosting provider and noticed that simple operations were taking several seconds longer, yet profiled queries were quicker if anything. I setup a test database server with identical specs with the same provider and did some simple profiling by setting…
This article is going to go through the steps to setup multiple MySQL slaves on one server using Docker Compose. These slaves will be used only for backup purposes, and MySQL slaves work by pulling the binary logs from the master, so no ports need to be exposed to the Internet. Additionally all interaction with the MySQL instances will be done using docker exec , not the network. I'm going to…
There are probably thousands of guides on this, but I was looking for the basic steps and couldn't find anything I would be happy sending someone, so here's my take on it. Aside from the operating system itself, three parts are needed to serve a Wordpress site: PHP, to run the Wordpress application itself;- MySQL, as a database to store Wordpress data such as posts and user accounts;- A webserver,…
The IP ranges used by Azure Public Cloud are updated weekly, and the URL to download the JSON file containing them changes too. I found a couple of scripts online to automate this but they mostly relied on updating the URL manually every week, which I did not want to do. This meant that my first step was to programmatically determine the JSON URL from the download page. The download page is…
A walled garden, in the context of the Internet and freedom of data, is an environment where access to data within the ‘garden’ is controlled and can only be accessed via approved apps or websites. There are many well-known examples of these, such as app stores, social media platforms, and messaging and collaboration platforms (including Slack, Teams, WhatsApp). It is worth pointing out that the…
Last year I was approached by The Internet Society to help with an IPv6 crawler they'd had running since 2010. They're keen for other people to run their own version of this crawler, so if you're interested please see instructions at the bottom of this post. The crawler was designed to take the most popular million sites from Alexa, and collect data regarding IPv6 reachability of them all. It…
In a previous post , I wrote about working with The Internet Society to rewrite an IPv6 crawler. In this post, I wanted to share some of the results I found interesting from the most recent crawl of the top million websites (27th January 2022). Website Records This crawl found 1,734,877 published A records for website hostnames (note that it doesn't take the stem, so www.silvermou.se would be…
If you're using LetsEncrypt for SSL certificates and have been paying attention, you'll know that one of their root CA certificates ( DST Root CA X3) expired on 30/09/2021 and that older devices (really old devices) will have stopped working. What might not be so clear (though is hinted at in the announcement https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ ) is that any…
Serverless is one of those technologies that sounds really simple, but can be quite tricky to actually implement. There are so many different parts and sometimes the only error you'll see if you get something wrong is either a 404 or a ValidationException . I also found that a lot of the documentation was aimed towards using REST API, so here is a tutorial for using the HTTP API to implement a…
A client came to me with what was initially a Virtualmin backup problem: Copying Apache aliases .. .. failed to find target virtual website! The virtual host existed within /etc/httpd/conf/httpd.conf but there were errors: # apachectl configtest httpd: Syntax error on line 394 of /etc/httpd/conf/httpd.conf: Expected </Directory> but saw </VirtualHost> I fixed a couple of these issues but it…
Quick post about this error you might experience if you're trying to compile a Varnish module from source. root@varnish001:libvmod-curl# ./autogen.sh Package varnishapi was not found in the pkg-config search path. Perhaps you should add the directory containing `varnishapi.pc' to the PKG_CONFIG_PATH environment variable Check if the file exists (it comes from libvarnishapi-dev on Ubuntu):…
This might be a really simple error to solve, but I couldn't find anything in the documentation about how to use a STEVEDORE instead - in fact some of the documentation examples or ServerFault provided by Varnish (eg. [1] [2] ) used strings instead of stevedores, so I'm not sure if this has changed at some point. Upgrading from Varnish 3 to VCL 4.0+ you'll get the following: varnishd[108440]:…
mod_proxy_http2 is considered experimental at the time of writing. Follow this guide at your own risk EDIT (10th July 2022): As of Debian 11 (I'm not sure if this was due to a newer Apache or a newer Nginx) this stopped working again because Apache is sending multiple Host headers to the proxy backend. The fix is to add RequestHeader unset Host and a2enmod headers . The Apache config below has…
In late 2019 I was approached by FLG Business Technology to submit a proposal to refresh their existing infrastructure. FLG is a CRM product focused on workflow to automate and control processes. They are a UK-based business founded over 11 years ago. Existing Setup In brief, they had a number of PHP servers running behind a highly available pair of load balancers, which connected to a MySQL…
This is mostly a reference post in case I ever have to go through this again. If it helps you too - well I've been there, I feel your pain, hopefully your pain doesn't last as long and you find some answers here. PHP memory_limit (mod_fcgid: stderr: PHP Fatal error: Allowed memory size of X bytes exhausted in framework/core/Config.php on line 592) - this is probably caused by the cache. In either…
Today I needed to capture a list of erroring MySQL queries on a server without introducing client-side code changes or a man in the middle proxy. The slow_query_log will only log successful queries. The general_log will log everything if raw_log is set to ON , but will not differentiate between successful and erroneous queries so I would have had to replay everything to find the erroring queries.…