Trying to figure out exactly what services should be restarted after  against Heartbleed. At least one post mentions restarting:     sshd, apache, nginx, postfix, dovecot, courier, pure-ftpd, bind, mysql    Is there a command that can be run to see what running services are dependent on openssl? Is there a command to run against apache/nginx to see if the patch is active so the service doesn't need to be restarted? Should we just schedule downtime and reboot every server entirely?   EDIT:  suggests using: lsof -n | grep ssl | grep DEL to display processes still using the old version of OpenSSL marked for deletion
2204
This is a  about understanding and remediating the Heartbleed security issue.   What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are vulnerable, what are the symptoms, are there any methods to detect a successful exploit?   How can I check to see if my system is affected? How can this vulnerability be mitigated? Should I be concerned that my keys or other private data have been compromised? What other side effects should I be concerned about?
96398
Im an intermediate Linux user and got assigned the task to make Apache run https connections. Currently running centOS 6 and my problem is following:  installed mod_ssl and tried to set up  paths correctly but not sure if i used the right files. I have class2-root.crt and root-2-int.cer also i was given a wildcard.ssl.pfx. i have realized that there is a variable that has to point to ".key" file which i don't have. So generated that using:  openssl req -new -keyout server.key -out server.csr  there are plenty of sources showing how to do this online and tried many times but no luck. I just need someone who would help according to my case to tell me what files i only need to touch and configure. Also if the key has to be from the same source as the certs i have? and what certs i need from what i was given?  what i did exactly is this in httpd.conf:  &lt;VirtualHost *:443&gt; DocumentRoot /var/www/html ServerName MyServer_Ip_Adress SSLEngine on SSLCertificateFile /etc/ssl/crt/class-root.crt SSLCertificateKeyFile /etc/ssl/crt/server.key SSLCertificateChainFile /etc/ssl/crt/root-2int.cer &lt;/VirtualHost&gt;   after this couldn't stop Apache nor restart it. Stopping will always fail.
70867
... but still be required for applications that need admin privilegies?  In order to allow the following:  $ apache2ctl restart httpd not running, trying to start (13)Permission denied: make_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down Unable to open logs  $ sudo !! sudo apache2ctl restart             #no password asked $                                   #works!   For reference I've seen this setup on amazon's e3 instances  Any idea?
54789
It seems weird here while running  service --status-all | grep mysql   why I get so many wrong result?  It works fine on Centos where i am getting:  mysql is running xxxxxxx   This is what i am getting on Ubuntu:
2444
This is a  about DoS and DDoS mitigation.   I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all 100Mbps of my available bandwidth.  Nobody can access my site because all the requests time out, and I can't even log into the server because SSH times out too!  This has happened a couple times before, and each time it's lasted a couple hours and gone away on its own.  Occasionally, my website has another distinct but related problem: my server's load average (which is usually around .25) rockets up to 20 or more and nobody can access my site just the same as the other case.  It also goes away after a few hours.  Restarting my server doesn't help; what can I do to make my site accessible again, and what is happening?  Relatedly, I found once that for a day or two, every time I started my service, it got a connection from a particular IP address and then crashed.  As soon as I started it up again, this happened again and it crashed again.  How is that similar, and what can I do about it?
24887
NFS mounts recently automatically got un-mounted. When I checked, the NFS service status it was shown to be running.  [root@hsluasrepo]# service nfs status rpc.svcgssd is stopped rpc.mountd (pid 4083) is running... nfsd (pid 4148 4147 4146 4145 4144 4143 4142 4141) is running... rpc.rquotad (pid 4079) is running...  [root@hsluasrepo]# service rpcbind status rpcbind (pid  4203) is running...  [root@hsluasrepo common]# rpcinfo -p 10.80.3.154    program vers proto   port  service     100000    4   tcp    111  portmapper     100000    3   tcp    111  portmapper     100000    2   tcp    111  portmapper     100000    4   udp    111  portmapper     100000    3   udp    111  portmapper     100000    2   udp    111  portmapper   But showmount output was showing an error.  [root@hsluasrepo ]# showmount -e 10.80.3.154 clnt_create: RPC: Program not registered   After restarting the NFS service, showmount output displayed the NFS server's export list.  Can anyone tell me the root cause of this issue and How to avoid this problem in future?  /var/log/messages:  Jul 7 03:22:01 hsluasrepo rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1188" x-info="rsyslog.com"] rsyslogd was HUPed Jul 7 03:22:02 hsluasrepo rhsmd: In order for Subscription Manager to provide your system with updates, your system must be registered with RHN. Please enter your Red Hat login to ensure your system is up-to-date. Jul 8 03:22:01 hsluasrepo rhsmd: In order for Subscription Manager to provide your system with updates, your system must be registered with RHN. Please enter your Red Hat login to ensure your system is up-to-date. Jul 8 16:36:55 hsluasrepo kernel: nfsd: last server has exited, flushing export cache Jul 8 16:36:55 hsluasrepo rpc.mountd[4083]: Caught signal 15, un-registering and exiting. Jul 8 16:36:55 hsluasrepo rpc.mountd[24463]: Version 1.2.3 starting Jul 8 16:36:55 hsluasrepo kernel: NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory Jul 8 16:36:55 hsluasrepo kernel: NFSD: starting 90-second grace period Jul 8 16:37:32 hsluasrepo rpc.mountd[24463]: authenticated mount request from 10.60.5.208:1004 for /common/PROD (/common/PROD) Jul 8 16:38:09 hsluasrepo rpc.mountd[24463]: authenticated mount request from 10.60.5.181:869 for /common/PROD (/common/PROD)  Jul 8 16:38:43 hsluasrepo rpc.mountd[24463]: authenticated mount request from 10.60.5.180:825 for /common/PROD (/common/PROD) Jul 8 16:39:12 hsluasrepo rpc.mountd[24463]: authenticated mount request from 10.60.5.176:688 for /common/PROD (/common/PROD)
82125
I really miss the graphical "Services" tool from older versions of Ubuntu, but I understand why it had to go. I always have terminals open anyway, so I use (because I have to now, I guess) service --status-all to see what services are running. This would be ok except that the command produces output like the following:   [ + ]  winbind  [ ? ]  wpa-ifupdown  [ - ]  x11-common   I'm guessing that those symbols mean something like listening, blocked, or stopped, but which is which? More importantly, why doesn't the man page say?
49706
I'm trying to find a reliable way of finding which process on my machine is changing a configuration file (/etc/hosts to be specific).  I know I can use lsof /etc/hosts to find out what processes currently have the file open, but this doesn't help because the process is obviously opening the file, writing to it, and then closing it again.  I also looked at lsof's repeat option (-r), but it seems to only go as fast as once a second, which probably won't ever capture the write in progress.  I know of a couple tools for monitoring changes to the filesystem, but in this case I want to know which process is responsible, which means catching it in the act.
53850
When I try to start Steam nothing happens. Reinstall doesn't help.  $ steam Running Steam on ubuntu 13.04 64-bit STEAM_RUNTIME is enabled automatically Installing breakpad exception handler for appid(steam)/version(1378500910_client) Installing breakpad exception handler for appid(steam)/version(1378500910_client) Installing breakpad exception handler for appid(steam)/version(1378500910_client) unlinked 0 orphaned pipes removing stale semaphore last operated on by process 7278 with name 0eBlobRegistryMutex_DC7EBB4AEA41D3C6C74E5EFFD6757CEC removing stale semaphore last operated on by process 7278 with name 0eBlobRegistrySignal_DC7EBB4AEA41D3C6C74E5EFFD6757CEC removing stale semaphore last operated on by process 7278 with name 0emSteamEngineInstance removing stale semaphore last operated on by process 7278 with name 0eSteamEngineLock Gtk-Message: Failed to load module "overlay-scrollbar" Installing breakpad exception handler for appid(steam)/version(1378500910_client) [0913/182910:WARNING:proxy_service.cc(958)] PAC support disabled because there is no system implementation   How to fix it?
10234
My problem:  I'm writing a bash script and in it I'd like to check if a given service is running.  I know how to do this manually, with $ service [service_name] status.  But (especially since the move to systemd) that prints a whole bunch of text that's a little messy to parse. I assumed there's a command made for scripts with simple output or a return value I can check.  But Googling around only yields a ton of "Oh, just ps aux | grep -v grep | grep [service_name]" results. That can't be the best practice, is it? What if another instance of that command is running, but not one started by the SysV init script?  Or should I just shut up and get my hands dirty with a little pgrep?
15059
I am investigating the vulnerability to  and I think I understand how and why this sort of attack works.  What I don't understand is why Lighttpd and NginX are not affected (according to the same article as linked above). What do they make so different?
41470
I have installed the pimd service by means of apt. This comes with an upstream systemd unit file (/lib/systemd/system/pimd.service).  I want the service to be restarted when for some reason it gets killed, hence I wish to add the line Restart = always in the unit file.   However, I don’t want to modify the upstream unit file.  Is there any workaround for this?
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
42220
XBMC occasionally crashes on my media server.  It's a pain to bring down the media server because I have to manually restart a number of services each time.  I'd like to be ablle to start XBMC from an SSH session and have it continue to run after I disconnect.  How can this be achieved?
111311
I disabled all services in services using msconfig and restarted.  Now - my login details no longer work. I have no network access and the forgot my password option doesn't do anything.  I have restarted using shift+restart to try get into safe mode but this just brings me to the same logon page.  Does anybody know what caused this or how I can resolve the issue?
16489
I setup wildcard SSL certificate from Godaddy on Apache2. Whenever the server restarts it asks for the passphrase for the SSL certificate's private key.    What's the best way to remove this obstacle to restarts, because when logfile rotation restart occurs in the middle of the night, the server doesn't come back up, and I get an unhappy client call in the morning, as it is a shared server.
85453
We are using LogMeIn Hamachi to link two remote sites together by VPN.  This is working perfectly, the only problem is that the DHCP service on our SBS 2003 server shuts itself down after an hour or so of Hamachi being enabled, as it identifies the virtual DHCP server on the Hamachi gateway PC and believes it is a rogue DHCP server.  Hamachi is not installed on the SBS server, but on a regular Windows XP machine on the same LAN.  As far as I can see, the Hamachi virtual DHCP server is not really a rogue DHCP server in this scenario. No client on the LAN will ever get an IP address from Hamachi (same subnet but different, non-overlapping DHCP scopes) however, it's obviously not doing something right because the server's DHCP service does not want to coexist with it.  Does anyone know of a way to prevent the DHCP service on the SBS 2003 server from shutting down if it believes it sees other DHCP servers on the network? I want to treat this as a false positive and see what happens if we ignore it- there is no way for IP conflicts to happen due to the non-overlapping IP scopes.    I don't quite understand how a DHCP server with IP 192.168.1.50 can conflict with one on 1.0.254.169..... that's not even the same subnet!