主页 / user-279883

user3783243's questions

Martin Hope
user3783243
Asked: 2020-03-27 10:25:43 +0800 CST
  • 0

我正在尝试从我的错误日志中删除以下通知：

AH01797：客户端被服务器配置拒绝：/var/www/html/example.com/xmlrpc.php

我以前有：

LogLevel notice

阅读后，如何在日志中隐藏“服务器配置拒绝客户端：”错误，我将代码更改为：

#NameVirtualHost example.com:443
<VirtualHost *:443>
       ....
       LogLevel notice access_compat:crit
        ErrorLog /var/log/httpd/example.com/error.log
</VirtualHost>

但是，重新启动 httpd 后通知仍然存在。我怎样才能删除这些通知。

我正在使用Server version: Apache/2.4.34.

我们使用的拒绝规则.htaccess是：

<Files xmlrpc.php>
        Order Deny,Allow
        Deny from all
        Allow from 192.168.0.2
</Files>
logging httpd apache-2.4
Martin Hope
user3783243
Asked: 2020-03-03 06:43:36 +0800 CST
  • 0

我正在使用 AWS 的 Blackboard AMI，但无法让 lighttpd 在其上运行。我不断得到502。

我跑service lighttpd status了，这让我回来了：

● lighttpd.service - Lighttpd Daemon
   Loaded: loaded (/lib/systemd/system/lighttpd.service; disabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2020-03-02 09:33:49 EST; 4min 31s ago
  Process: 4770 ExecStart=/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf (code=exited, status=255)
  Process: 4763 ExecStartPre=/usr/sbin/lighttpd -t -f /etc/lighttpd/lighttpd.conf (code=exited, status=0/SUCCESS)
 Main PID: 4770 (code=exited, status=255)

Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: Stopped Lighttpd Daemon.
Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: Starting Lighttpd Daemon...
Mar 02 09:33:49 ip-172-31-27-103 lighttpd[4763]: Syntax OK
Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: Started Lighttpd Daemon.
Mar 02 09:33:49 ip-172-31-27-103 lighttpd[4770]: 2020-03-02 09:33:49: (network.c.409) can't bind to port:  443 Address already in use
Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: lighttpd.service: Main process exited, code=exited, status=255/n/a
Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: lighttpd.service: Unit entered failed state.
Mar 02 09:33:49 ip-172-31-27-103 systemd[1]: lighttpd.service: Failed with result 'exit-code'.

然后我跑去netstat -tulpn查看正在使用的内容443并返回：

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1134/sshd       
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      1269/postgres   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1895/nginx.conf 
tcp6       0      0 :::22                   :::*                    LISTEN      1134/sshd       
tcp6       0      0 :::9900                 :::*                    LISTEN      1963/node       
udp        0      0 0.0.0.0:68              0.0.0.0:*                           903/dhclient    
udp        0      0 172.31.27.103:123       0.0.0.0:*                           1230/ntpd       
udp        0      0 127.0.0.1:123           0.0.0.0:*                           1230/ntpd       
udp        0      0 0.0.0.0:123             0.0.0.0:*                           1230/ntpd       
udp6       0      0 fe80::cc5:7dff:fee9:123 :::*                                1230/ntpd       
udp6       0      0 ::1:123                 :::*                                1230/ntpd       
udp6       0      0 :::123                  :::*                                1230/ntpd

然后我尝试了各种命令来查看它的状态，nginx但它们都返回它没有在我的机器上运行。

Failed to restart nginx.service: Unit nginx.service not found.
sudo: /usr/sbin/nginx: command not found

可以nginx在另一个服务下运行，或者我怎样才能让我的服务器正常运行？没有为 AMI 提供支持。

更新ps -efl|grep 1895 | grep -v "grep"返回：

4 S root      1895  1864  0  80   0 - 14857 sigsus 08:07 ?        00:00:00 nginx: master process /usr/local/openresty/bin/openresty -c /usr/local/etc/openresty/nginx.conf
5 S nobody    1911  1895  0  80   0 - 15113 ep_pol 08:07 ?        00:00:00 nginx: worker process
5 S nobody    1912  1895  0  80   0 - 15113 ep_pol 08:07 ?        00:00:00 nginx: worker process
nginx lighttpd 502-error amazon-ami
Martin Hope
user3783243
Asked: 2020-01-22 08:54:37 +0800 CST
  • 1

我正在尝试监视到 mysql 数据库的所有传入连接。我用过

tcpdump port 3306 and '(tcp-syn|tcp-ack)!=0'

目前哪个正在显示连接，但有没有办法也可以看到它正在发送/接收什么？

目前我看到：

11:45:43.275498 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-21-17.ec2.internal.35522: Flags [.], ack 1780, win 248, options [nop,nop,TS val 2559781727 ecr 625071366], length 0
11:45:43.277761 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-21-17.ec2.internal.35522: Flags [P.], seq 519:538, ack 1780, win 248, options [nop,nop,TS val 2559781729 ecr 625071366], length 19
11:45:43.277799 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-41-109.ec2.internal.60718: Flags [P.], seq 32662:32900, ack 1, win 219, options [nop,nop,TS val 2559781729 ecr 2559505629], length 238
11:45:43.278331 IP ip-10-0-41-109.ec2.internal.60718 > ip-10-0-40-123.ec2.internal.mysql: Flags [.], ack 32900, win 24565, options [nop,nop,TS val 2559505675 ecr 2559781729], length 0
11:45:43.278345 IP ip-10-0-21-17.ec2.internal.35522 > ip-10-0-40-123.ec2.internal.mysql: Flags [P.], seq 1780:1989, ack 538, win 211, options [nop,nop,TS val 625071368 ecr 2559781729], length 209
11:45:43.280364 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-21-17.ec2.internal.35522: Flags [P.], seq 538:596, ack 1989, win 258, options [nop,nop,TS val 2559781732 ecr 625071368], length 58
11:45:43.280375 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-41-109.ec2.internal.60718: Flags [P.], seq 32900:33171, ack 1, win 219, options [nop,nop,TS val 2559781732 ecr 2559505675], length 271
11:45:43.280971 IP ip-10-0-21-17.ec2.internal.35522 > ip-10-0-40-123.ec2.internal.mysql: Flags [P.], seq 1989:1994, ack 596, win 211, options [nop,nop,TS val 625071371 ecr 2559781732], length 5
11:45:43.280983 IP ip-10-0-21-17.ec2.internal.35522 > ip-10-0-40-123.ec2.internal.mysql: Flags [F.], seq 1994, ack 596, win 211, options [nop,nop,TS val 625071371 ecr 2559781732], length 0
11:45:43.281003 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-21-17.ec2.internal.35522: Flags [F.], seq 596, ack 1995, win 258, options [nop,nop,TS val 2559781733 ecr 625071371], length 0
11:45:43.281011 IP ip-10-0-41-109.ec2.internal.60718 > ip-10-0-40-123.ec2.internal.mysql: Flags [.], ack 33171, win 24565, options [nop,nop,TS val 2559505677 ecr 2559781732], length 0
11:45:43.281553 IP ip-10-0-21-17.ec2.internal.35522 > ip-10-0-40-123.ec2.internal.mysql: Flags [.], ack 597, win 211, options [nop,nop,TS val 625071372 ecr 2559781733], length 0

我希望有类似的东西：

11:45:43.281011 IP ip-10-0-41-109.ec2.internal.60718 > ip-10-0-40-123.ec2.internal.mysql: Flags [.], ack 33171, win 24565, options [nop,nop,TS val 2559505677 ecr 2559781732], length 0 'select userid from users where email = '[email protected]''
11:45:43.277799 IP ip-10-0-40-123.ec2.internal.mysql > ip-10-0-41-109.ec2.internal.60718: Flags [P.], seq 32662:32900, ack 1, win 219, options [nop,nop,TS val 2559781729 ecr 2559505629], length 238 '1234'

最后一个值是数据库正在处理/返回的值

mysql
Martin Hope
user3783243
Asked: 2015-08-18 09:00:03 +0800 CST
  • 0

在我们的服务器上运行top给了我们

平均负载：68.67、63.48、60.30

我们怀疑这是由于太多的 httpd 连接造成的。

跑步：

netstat -tun 2>/dev/null | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

给我们（所有 IP 转换为私有地址）：

418 
176 192.168.1.1
 41 192.168.1.2
  8 192.168.1.3
  5 192.168.1.4
  5 192.168.1.5
  4 192.168.1.6
  2 192.168.1.7
  2 192.168.1.8
  2 192.168.1.9
  2 127.0.0.1
  1 servers)
  1 Address
  1 192.168.1.10
  1 192.168.1.11

正如您所看到的192.168.1.1（从 WAN 地址转换而来，仅用于此处），它似乎有 176 个连接到我们的服务器。远程查找此 IP 可将其重新解析为 DDOS 服务。

我们跑了

sudo iptables -I INPUT -m iprange --src-range 192.168.0.0-192.168.0.255 -j DROP

尝试删除与其完整范围相关的所有范围，但在运行 netstat 命令时仍会显示请求。

IPtables 命令或 netstat 命令有问题吗？

我们跑

 sudo service iptables save
 sudo service httpd restart

存储它并使其处于活动状态，然后

sudo iptables --list

确认它已添加，它是。不确定我们是否缺少某些东西。谢谢。

更新

跑步iptables -L -nv节目

pkts bytes target     prot opt in
30179 1793K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           source IP range STARTRANGE-ENDRANGE

这是否意味着30179请求被阻止？

我们的 IPtables 也看起来像这样（STARTRANGE/ENDRANGE 是实际的四字节地址）...

Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            source IP range STARTRANGE-ENDRANGE 
DROP       all  --  anywhere             anywhere            source IP range STARTRANGE-ENDRANGE 
DROP       all  --  anywhere             anywhere            source IP range STARTRANGE-ENDRANGE 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:mysql 
DROP       all  --  anywhere             anywhere            source IP range STARTRANGE-ENDRANGE

缩短的 Netstat 输出（命令运行：）netstat -n | grep '192.168'：

tcp        0      1 OUR_SERVER_IP:44531          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44675          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44600          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44587          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44641          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44578          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44626          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44604          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44541          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44678          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44625          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44661          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44543          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44602          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44644          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44580          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44688          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44683          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44588          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44556          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44681          192.168.1.1:443          SYN_SENT    
tcp        0      1 OUR_SERVER_IP:44631          192.168.1.1:443          SYN_SENT
linux
Martin Hope
user3783243
Asked: 2015-04-04 11:23:12 +0800 CST
  • 2

如何使用正则表达式将字符附加到 linux 中的文件名？我看过这两个帖子

  1. https://stackoverflow.com/questions/6985873/change-names-of-multiple-files-linux
  2. 如何通过替换文件名中的单词来重命名多个文件？

但一直无法得到为我工作的答案。我也不确定这是否属于这里、堆栈溢出或另一个子站点。

我一直在努力

for FILE in \d+_\d+\.png; do echo "$FILE" $(echo "$FILE" | sed 's/\./_t\./'); done

但这似乎无法将正则表达式文件名识别为正则表达式。

所以对于数据样本，我的文件目前是

1111_2222.png

我希望他们成为

1111_2222_t.png

这些文件分散在五个目录中。谢谢。

linux