Squid and password authentication

yum install squid

Example of squid.conf

http_port 10000
hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

acl all src 0.0.0.0/0.0.0.0
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http

acl ncsa_users proxy_auth REQUIRED
http_access deny !Safe_ports
http_access allow ncsa_users
visible_hostname mysite.com
coredump_dir /var/spool/squid

service squid start

Setting proxy for wget:

export http_proxy=http://anton:testinsg@mysite:10000

If you want to make it anonymous add these lines:

forwarded_for off

header_access Allow allow all
header_access Authorization allow all
header_access WWW-Authenticate allow all
header_access Proxy-Authorization allow all
header_access Proxy-Authenticate allow all
header_access Cache-Control allow all
header_access Content-Encoding allow all
header_access Content-Length allow all
header_access Content-Type allow all
header_access Date allow all
header_access Expires allow all
header_access Host allow all
header_access If-Modified-Since allow all
header_access Last-Modified allow all
header_access Location allow all
header_access Pragma allow all
header_access Accept allow all
header_access Accept-Charset allow all
header_access Accept-Encoding allow all
header_access Accept-Language allow all
header_access Content-Language allow all
header_access Mime-Version allow all
header_access Retry-After allow all
header_access Title allow all
header_access Connection allow all
header_access Proxy-Connection allow all
header_access Cookie allow all
header_access Set-Cookie allow all
header_access All deny all

acl ip4 myaclname yourip
tcp_outgoing_address yourip myaclname

Generate acl and tcp_outgoing_address:

for f in {314..372}; do echo “acl ip$((f))” myip aaa.bbb.ccc.$((f-246)) >> “blah1″; done
for f in {314..372}; do echo “tcp_outgoing_address aaa.bbb.ccc.$((f-246))” ip$((f)) >> “blah1″; done

How to redirect my website to be opened through HTTPS?

In order to redirect your website to be opened through HTTPS, you should add the following rewrite rule in your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://www.domain.com/%{REQUEST_URI} [R,L]

This will redirect your domain to https://www.yourdomain.com. If you wish the redirect to work without www, you should remove it from the rewrite rule:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://domain.com/%{REQUEST_URI} [R,L]

Add swap on Linux

[root@host ~]# dd if=/dev/zero of=/swapfile bs=1024 count=1048576
1048576+0 records in
1048576+0 records out
[root@host ~]# sync
[root@host ~]# mkswap /swapfile
Setting up swapspace version 1, size = 1073737 kB
[root@host ~]# swapon /swapfile
[root@host ~]# echo “/swapfile swap swap defaults 0 0″ >> /etc/fstab

Skip i386 packages on a x64_86 system

I have just installed Centos 5.5 by using the Netinstall version. Seems that on my x64_86 system I have a lot of i386 packages installed. To remove them I had to :

yum -C list installed | grep i386 | awk ‘{print $1}’ | xargs yum remove -y

Also edit /etc/yum.conf and add :

exclude=*.i386 *.i486 *.i586 *.i686 *.athlon

Setting a PPTP VPN in CentOS 5.6

Setting a PPTP VPN in Centos. I’m using the following commands in order to set the VPN:

yum remove -y pptpd ppp
iptables --flush POSTROUTING --table nat
iptables --flush FORWARD
rm -rf /etc/pptpd.conf
rm -rf /etc/ppp

rpm -Uvh http://poptop.sourceforge.net/yum/stable/rhel5/pptp-release-current.noarch.rpm
yum --enablerepo=poptop-stable install pptpd

mknod /dev/ppp c 108 0
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "mknod /dev/ppp c 108 0" >> /etc/rc.local
echo "echo 1 > /proc/sys/net/ipv4/ip_forward" >> /etc/rc.local
echo "localip 172.16.36.1" >> /etc/pptpd.conf
echo "remoteip 172.16.36.2-254" >> /etc/pptpd.conf
echo "ms-dns 8.8.8.8" >> /etc/ppp/options.pptpd
echo "ms-dns 8.8.4.4" >> /etc/ppp/options.pptpd

pass=`openssl rand 6 -base64`
if [ "$1" != "" ]
then pass=$1
fi
read -p "User: " user
echo "${user} pptpd ${pass} *" >> /etc/ppp/chap-secrets

iptables -t nat -A POSTROUTING -s 172.16.36.0/24 -j SNAT --to-source `ifconfig | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk 'NR==1 { print $1}'`
iptables -A FORWARD -p tcp --syn -s 172.16.36.0/24 -j TCPMSS --set-mss 1356
service iptables save

chkconfig iptables on
chkconfig pptpd on
service iptables start
service pptpd start

echo "VPN username is ${user}, VPN password is ${pass}"

About exim tutorial

Exim is a mail transfer agent (MTA) used on Unix-like operating systems.

To print a list of the messages in the queue:
# exim -bp

To remove all messages from the queue:
# exim -bp | exiqgrep -i | xargs exim -Mrm

Testing email with exim
# exim -v 'user@domain'
# message here
# ^D ( control D )

This will use exim from the command line to create an email message To: user@domain. After typing the message, use Control+D to send the EOF (end of file) characters to exim. Exim will stop receiving input from the command line and send the message text to user@domain.

How to limit the number of emails sent by each user (prevent spammer) with DA.
http://help.directadmin.com/item.php?id=81

Fix Apache – No space left on device: Couldn’t create accept lock

This issue is related to semaphores. To view how many semaphores you have use:

root@hal [~]# sysctl -a | egrep kernel.sem\|kernel.msgmni
kernel.sem = 250 32000 32 128
kernel.msgmni = 16

You can change this values by adding them in /etc/sysctl.conf and then using sysctl -p to activate them.
There is no need to reboot.

To remove sempahores use either one of these commands:

for i in `ipcs -s | grep nobody | awk ‘{print $2}’`; do ipcrm -s $i; done
/scripts/restartsrv_httpd

or in Perl

ipcs -s | grep nobody | perl -e ‘while () { @a=split(/\s+/); print `ipcrm sem $a[1]`}’

or with xargs

ipcs -s | grep nobody | awk ‘ { print $2 } ‘ | xargs ipcrm

or bash style

for ipsemId in $(ipcs -s | grep nobody | cut -f 2 -d ‘ ‘); do ipcrm $ipsemId;done

Other errors :

Cannot create SSLMutex

add in httpd.conf

SSLMutex sem