zomo technology

Logging client IP of reverse proxied web traffic

Thursday, 05. 18. 2006  –  Category: all, sw

‘Cos I always forget:

LogFormat       "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy

This just makes Apache log the IP in the X-F-F HTTP header instead of %h in reverse-proxy scenarios.

Onboard RAID

Wednesday, 05. 17. 2006  –  Category: all, vague

Poor old zest.lemonia.org dropped off air, apparently with a dead CPU or motherboard. Its standby box,
juice.lemonia.org was brought up with 15 hour old data (the backup sync cron’d at 0300, the failure happened at ~1800), but not before attempting to stick one half of zest’s mirror into juice. The root fs at /dev/ad1s1a was fine, but the main data fs wasn’t:

[root@ /var]# fsck /dev/ad1s1d
** /dev/ad1s1d
CANNOT READ BLK: 204735648
CONTINUE? [yn] y
THE FOLLOWING DISK SECTORS COULD NOT BE READ: 204735648, 204735649, 204735650, 204735651,
/dev/ad1s1d: INCOMPLETE LABEL: type 4.2BSD fsize 0, frag 0, cpg 0, size 205012094
[root@ /var]# mount -o ro /mnt/ark
WARNING: /mnt/ark was not properly dismounted
[root@ /var]# cd /mnt/ark
[root@ /mnt/ark]# ls
.snap   home    old
[root@ /mnt/ark]# ls -l
panic: vrele: negative ref cnt
Uptime: 28m42s
Cannot dump. No dump device defined.
Automatic reboot in 15 seconds - press a key on the console to abort

Is this the BIOS-y raid storing its metadata where it shouldn’t? Chipset is a Promise PDC20276.

Of course, there could be a genuine problem with this disk, but I won’t know till I’ve found a replacement CPU / mobo.

Lazy checking website’s SSL certs

Thursday, 05. 11. 2006  –  Category: all, stash

I wanted to avoid RSI checking the browser’s padlock on every site I’d just updated a SSL cert for:

[lemon@core ~ ] 0 $ for z in 4 5 6 7 8 9 10 11 12 ; do echo 'GET /' | openssl s_client -connect devgateway${z}.foo.co.uk:443 2>&1 | openssl x509 -text | grep -i 'Not Before' ; done
            Not Before: May  9 11:24:00 2006 GMT
            Not Before: May  9 11:54:05 2006 GMT
            Not Before: May  9 11:54:05 2006 GMT
            Not Before: May  9 11:24:00 2006 GMT
            Not Before: May  9 11:24:01 2006 GMT
            Not Before: May  9 11:24:01 2006 GMT
            Not Before: May  9 11:54:06 2006 GMT
            Not Before: May  9 11:24:01 2006 GMT
            Not Before: May  9 11:24:01 2006 GMT

Ugly, but it works. the ssl_client(1) man page contains this apology:

<strong>BUGS</strong>
       Because this program has a lot of options and also because some of the
       techniques used are rather old, the C source of s_client is rather hard
       to read and not a model of how things should be done. A typical SSL
       client program would be much simpler.