Wednesday, March 30, 2011

How can I log the client IP address on the backend in Varnish?

All I see is the IP address of the varnish server. How can I log the client IP address?

We will need to add the IP address to a header used for the backend request, and configure the backend to log the content of this header instead of the address of the connecting client (which is the varnish server).

Varnish configuration:

sub vcl_recv {
# Add a unique header containing the client address remove
req.http.X-Forwarded-For;
set req.http.X-Forwarded-For = client.ip;
# [...] }

For the apache configuration, we copy the “combined” log format to a new one we call “varnishcombined”, for instance, and change the client IP field to use the content of the variable we set in the varnish configuration:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" varnishcombined

And so, in our virtualhost, you need to specify this format instead of “combined” (or “common”, or whatever else you use):

 ServerName www.example.com 
# [...]

CustomLog /var/log/apache2/www.example.com/access.log varnishcombined

# [...]



Reference: Varnish Website

Installing Varnish on Debian

Varnish is the key software that speeds up your web site. It is Open Source, built on industry standards and requires very few resources.

Install on Debian:

curl http://repo.varnish-cache.org/debian/GPG-key.txt | apt-key add -
echo "deb http://repo.varnish-cache.org/debian/ $(lsb_release -s -c) varnish-2.1" >> /etc/apt/sources.list
apt-get update
apt-get install varnish



Change the Apache's port in /etc/apache2/ports.conf

NameVirtualHost *:8000

Listen 8000

The configuration daemon for Varnish is located in /etc/default/varnish. Here you can pass the startup options:

DAEMON_OPTS=
"-a :80 \
-T localhost:6082 \
-f /etc/varnish/default.vcl \
-S /etc/varnish/secret \
-s malloc,256M \
-u www-data \
-g www-data"


Now let's get to the configuration file (/etc/varnish/default.vcl). This is a very simple use of Varnish
which strips the cookies of some static files, like jpg and png, allowing them to be cached. In my case
this works best, and it also gives me a header information of what was cached and what not
(if you check the headers with something like FireBug). Of course you can find even better configurations available.
Having a specific configuration for your platform.

backend apache { 
.host = "127.0.0.1";
.port = "8000"; }

acl purge {
"localhost";
"127.0.0.1"; }

sub vcl_recv {
// Strip cookies for static files:
if (req.url ~ "\.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html|htm)$") {
unset req.http.Cookie;
return(lookup); }

// Remove has_js and Google Analytics __* cookies.
set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js)=[^;]*", "");

// Remove a ";" prefix, if present.
set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

// Remove empty cookies.
if (req.http.Cookie ~ "^\s*$") {
unset req.http.Cookie; }
if (req.request == "PURGE") {
if (!client.ip ~ purge) {
error 405 "Not allowed.";}
purge("req.url ~ " req.url " && req.http.host == " req.http.host);
error 200 "Purged."; }
}

sub vcl_hash {
if (req.http.Cookie) {
set req.hash += req.http.Cookie; }
}

sub vcl_fetch {
// Strip cookies for static files:
if (req.url ~ "\.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html|htm)$") {
unset beresp.http.set-cookie; }

// Varnish determined the object was not cacheable
if (!beresp.cacheable) {
set beresp.http.X-Cacheable = "NO:Not Cacheable"; }
// You don't wish to cache content for logged in users
elsif(req.http.Cookie ~"(UserID|_session)") {
set beresp.http.X-Cacheable = "NO:Got Session";
return(pass); }
// You are respecting the Cache-Control=private header from the backend
elsif ( beresp.http.Cache-Control ~ "private") {
set beresp.http.X-Cacheable = "NO:Cache-Control=private";
return(pass); }
// You are extending the lifetime of the object artificially
elsif ( beresp.ttl < 1s ) {
set beresp.ttl = 300s;
set beresp.grace = 300s;
set beresp.http.X-Cacheable = "YES:Forced"; }
// Varnish determined the object was cacheable
else {
set beresp.http.X-Cacheable = "YES"; }
return(deliver);
}



then Restart Apache2 and Varnish processes:

/etc/init.d/apache2 restart
/etc/init.d/varnish restart

Wednesday, November 10, 2010

Add new rule to SpamAssassin

Add this lines to /etc/mail/spamassassin/local.cf:

body LOCAL_DEMONSTRATION_RULE /test/
score LOCAL_DEMONSTRATION_RULE 0.1
describe LOCAL_DEMONSTRATION_RULE This is a simple test rule

then you must restart the SpamAssassin Process:

/etc/init.d/psa-spamassassin restart

You can also add rule to each user in ~/.spamassassin/user_prefs

but remember that by default allow_user_rules is 0, and you must change
that to 1. Add this line to:

/etc/mail/spamassassin/local.cf


allow_user_rules 1

Don't forget to restart the SpamAssassin.

Friday, August 13, 2010

Likewise-Open: Authenticate a Linux machine to an Active Directory domain

To install the likewise-open package in Ubuntu, open a terminal prompt and enter:
sudo apt-get install likewise-open

Or you could download appropriate Script from here.

The main executable file of the likewise-open package is /usr/bin/domainjoin-cli, which is used to join your computer to the domain. Before you join a domain you will need to make sure you have:

  • Access to an Active Directory user with appropriate rights to join the domain.

  • The Fully Qualified Domain Name (FQDN) of the domain you want to join. If your AD domain does not match a valid domain such as example.com, it is likely that it has the form of domainname.local.

  • DNS for the domain setup properly. In a production AD environment this should be the case. Proper Microsoft DNS is needed so that client workstations can determine the Active Directory domain is available.


To join a domain, from a terminal prompt enter:

sudo domainjoin-cli join example.com Administrator

See here for more details.

Qmail & SpamAssassin - Change Default Rules Score

Under this directory:

/var/qmail/mailnames/DOMAIN-NAME/USERNAME/.spamassassin

edit user_prefs and add the new Score for desire rule:

Example:

score RDNS_NONE 5.0

that overrides the defualt score.

You can find all rules here:

http://wiki.apache.org/spamassassin/Rules/

Wednesday, June 2, 2010

Monday, May 10, 2010

Chrooted SSH/SFTP

with these settings, works for me in Debian Lenny:

Be sure that this line in /etc/ssh/sshd_config exists:

Subsystem sftp internal-sftp

Chroot the user to his home:

ChrootDirectory %h

The owner of home must be root (mod 755).

These lines are important, otherwise the root user could not login into system:

Match User root
ChrootDirectory /

Restart the ssh process:

/etc/init.d/ssh restart



Thursday, April 8, 2010

Colored output in bash

Use escape sequences:

echo -e '\E[color1;color2mYour Text.'
(color1 is the foreground, color2 the background color)

Shell Scripting Syntax


  1. echo -e '\E[30m black \E[31mred \E[32mgreen \E[33myellow \E[34mblue \E[35mmagenta \E[36mcyan \E[37mwhite'
  2. echo -e '\E[30;41mblack on red'


Shell Scripting Syntax
  1. Color: Foreground: Background:
  2. ---------------------------------------------------------
  3. black 30 40
  4. red 31 41
  5. green 32 42
  6. yellow 33 43
  7. blue 34 44
  8. magenta 35 45
  9. cyan 36 46
  10. white 37 47

Tuesday, March 2, 2010

Ubuntu - If your desktop icons are disappeared, try this

Press Alt+F2 and type gconf-editor in window.

Then apps --> nautilus --> preferences

Make sure "show_desktop" is checked.

If it's checked then double click on it and hit ok.

Wednesday, February 24, 2010

Send test mail from command line with Sendmail

In shell run this command:

( echo subject: test; echo ) | sendmail -v -oi YOUR-EMAIL@ADDRESS.COM

MySQL - debian-sys-maint account

Find your debian-sys-maint password in /etc/mysql/debian.cnf.

Then use this command in Mysql shell:

GRANT ALL PRIVILEGES ON *.* TO 'debian-sys-maint'@'localhost' \
IDENTIFIED BY 'PASSWORD' WITH GRANT OPTION;

Replace PASSWORD with your debian-sys-maint password.