Showing posts with label Linux. Show all posts
Showing posts with label Linux. Show all posts

Tuesday, 5 December 2023

Edit, add, or remove ports of an existing Docker container

In some cases you need to assign additional ports to a running Docker container, or change the ports in use. This is completely possible without creating a new docker image or re-running docker run to create a new container. To change the ports of a running Docker Container, follow the instructions below.

Example: we have a container of image php:8.1-apache configured with port mapping 8080->80/tcp. We will edit this container to open port 8081->443/tcp.

Warning! You should back up before editing any files

Step 1: Go to your container configuration directory

Go to the directory where the containers are stored

cd /var/lib/docker/containers

Here you will see folders with names corresponding to container ids. Then access the directory of the corresponding container you need to edit.

The full path will be as follows

/var/lib/docker/containers/your_container_id_hash

You can find the container's hash id via the command

docker ps -a

Step 2: Stop docker service (docker.socket)

systemctl stop docker.socket

Step 3: Edit expose ports config in file config.v2.json

We will declare port 443 on the container

Find json string 

"ExposedPorts":{"80/tcp":{}}

Then add new port

"ExposedPorts":{"80/tcp":{},"443/tcp":{}}

Step 4: Edit ports mapping config in file hostconfig.json

We will map port 8081 on the host computer to the newly created port 443/tcp on the container

Find json string 

"PortBindings":{"80/tcp":[{"HostIp":"","HostPort":"8080"}]}

Then add new port

"PortBindings":{"443/tcp":[{"HostIp":"","HostPort":"8081"}],"80/tcp":[{"HostIp":"","HostPort":"8080"}]}

Step 5: Restart the docker service

systemctl start docker

Done !

Friday, 10 February 2023

How to fix error "system is deadlocked on memory" on Vultr VPS

The error "system is deadlocked on memory" "end Kernel panic - not syncing" usually indicates that the system has run out of available memory and processes are unable to allocate additional memory. This error comes from the VPS kernel, so it can be encountered in both Linux or Windows VPS operating systems. To resolve the issue on your Vultr VPS or any other service provider (Linode, Digitalocean ...) you can try the following steps:

Note: The first thing you need to do when you encounter this error is to quickly backup or snapshot VPS. Because the wrong operations at this time can cause you to lose the data in your VPS. 

Case 1 : Error on startup (can not start VPS)

  1. Restart the server: If the issue persists, you can restart your Vultr VPS to clear the memory and resolve the deadlock.

  2. Turn off the startup scripts with VPS (in VPS management) that you added (if exist)

  3. Upgrading to a VPS droplet with more memory: If other solutions don't work, upgrading to a more configurable VPS plan might solve the situation. Upgrading VPS to a higher droplet at Vultr is easy, safe and does not affect your data or applications.

  4. Contact Vultr for support: The last resort or if you are too worried about the current data in the VPS. Experts from Vultr will be able to help you fix the problem

Case 2: Error during operation (sometimes encounter)

  1. Monitor resource usage: Use the 'top',' htop' command or "Task Manager' to monitor the resource usage of your system. Identify the processes that are consuming large amounts of memory and determine if they can be terminated or if their resource usage can be optimized.

  2. Kill processes: If a specific process is consuming a large amount of memory and is not responding, terminate it.

  3. Increase swap space(Linux): If your system does not have enough physical memory, you can increase the amount of swap space to temporarily address the issue.

  4. Optimize application performance: If the issue recurs frequently, you may need to optimize the performance of your applications

It's important to monitor your system and its resource usage to identify and resolve issues before they become severe. Consider using a system monitoring tool to automatically alert you to any issues.

Thursday, 12 May 2022

[Solved] SSH and Gitlab negotiate error "no matching host key type found"

When using new Linux operating systems like Ubuntu 22.04 you may have trouble with SSH when you want to connect to old Linux servers.

Unable to negotiate with ***.***.***.*** port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

This error can be encountered when you directly access an old server via SSH. Or when you use Git, SVN, or any other software that uses the SSH protocol.

Reason

To be able to make an ssh connection, the Server and the client need to negotiate a secure connection encryption method. That is to find an encryption method that both the server and the client support. OpenSSH in older OS versions like Centos 6 only supports the old encryption standards ssh-rsa and ssh-dss. These 2 encryption standards are outdated and potentially dangerous. Therefore, the new version of OpenSSH disables these encryptions by default. Newer encryption commonly used is ssh-ed25519, ecdsa-sha2 ...

Solved

To solve this error, you need to configure ssh on the new server to accept the old encryption standards as ssh-rsa or ssh-dss (just 1 is enough). We suggest 2 solutions to do just that.

Solution 1:

Enable dss or rsa encryption for ssh on your new server.

To do so open the file "~/.ssh/config"

vi ~/.ssh/config

Then add the following content to the file (change ssh-rsa to ssh-dss if your old server only support it)

Host *
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedKeyTypes +ssh-rsa

Done ! Now you can connect ssh to old servers via terminal normally. However, if you are using Git over ssh with a privateKey file, this will not work (to solve see solution below).

Tip: you can also restrict opening this encryption method only to a certain ip by substituting that ip in the "Host: oldserverIP" section. This will make your server more secure.

Solution 2:

Enable dss or rsa encryption only when a connection is needed by adding a parameter to the ssh connect statement.

Ex: 

ssh 123.123.123.123

become

ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa 123.123.123.123

Done !

Fix negotiate error for Git/Gitlab via ssh privateKey file

With git or edit the config file as follows

vi yourProjectPath/.git/config

[core]
        repositoryformatversion = 0
        filemode = true
        bare = false
        logallrefupdates = true
sshCommand =  ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa  -oIdentitiesOnly=yes -i /yourPath/privateKeyFile.ppk -F /dev/null
...
Done ! Your Git can now connect to the server normally and it automatically uses the privateKey file to log in instead of having to enter a password.

Friday, 20 August 2021

[Tips] How to use Cloudflare Free SSL for Socket.io Server

Free SSL is a very interesting feature of Cloudflare. Cloudflare SSL has full support for WebSocket protocol. However, if you are using the web in conjunction with a socket.io server on the same server, you may encounter problems with the ssl port. Because the default port for ssl is always 443 but it is already used by the web server.

There are many ways to handle this problem, here I will guide you in a very simple way. That's how to configure Socket.io SSL through a proxy using Apache or Nginx.


Prepare:

NodeJs SocketIO server is listen on port 8088

Webserver (Apache or Nginx) is listen on port 80 and 443

Step 1: SocketServer config

Configure NodeJs SocketIO server to run in long polling mode without ssl on a certain port, eg port 8088.

Eg:

var app = require('express')(); //npm install express
var http = require('http').createServer(app);
var socketServer = require('socket.io')(http, { //npm install socketio
cors: {
origin: "*",
methods: ["GET", "POST"]
},
  transports: ['polling']
});
http.listen(8088, () => {
console.log('listening on port 8088');
});

Configure socket.io client to use 'polling' mode

Eg:

var socket = io('https://subdomain.yourdomain.com', { });
socket.on('connect', function () {
console.log('connected');
});

Step 2: Configure virtualhost proxy for Socket Server

Configure virtual host proxy to forward port 80 from cloudflare to the actual port of our Socket Server (I listen on port 80 because I am using Cloudflare flexible ssl, if you use Cloudflare full ssl or full strict ssl then listen on port 443 like your other virtualhost)

Apache:

<VirtualHost *:80>
    ServerAdmin admin@yourdomain.com
    ProxyPreserveHost On
    ServerName subdomain.yourdomain.com
    ProxyPass / http://127.0.0.1:8088/
    ProxyPassReverse / http://127.0.0.1:8088/
</VirtualHost>

Nginx:

server {
    listen 80;
    server_name subdomain.yourdomain.com;
    location / {
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   Host $http_host;
        proxy_pass         http://127.0.0.1:8088;
    }
}

Done !

Remember to reload your web server 

Now your NodeJs Socket Server is working perfectly with free ssl from CLoudflare

 

Tuesday, 3 August 2021

Ubuntu - MySQL Can't set password for root account, even though all command are successful

After a fresh install of MySQL or MariaDB on an Ubuntu server, you can run the "mysql" command line without being asked for your password, even if you have successfully changed the password. While you still cannot access root account from other software like Navicat, php ... the error encountered is "Access denied for user 'root'@'localhost' (using password: YES)"

What happened ?

you can run the "mysql" command without any password because by default, the root account is configured to login via the AUTH_SOCKET plugin. So MySQL Command-Line Client can always connect successfully without being asked for a password while other software can't connect even if the correct password is entered.

Security issue?

In a way, the mysql root account should only be accessed from the server, and a person who already has root privileges with Ubuntu can obviously optionally reset the mysql root account password. So this default configuration should not be a problem.
However, if you are a strict person or are familiar with other operating systems like Centos, you will be very uncomfortable with this configuration. If so, bring it back to the same as mysql on Centos by following the steps below.

Solving problems

Access the MySQL command-line. 
mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.21-0ubuntu20.0 (Ubuntu)

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>
Switch to the 'mysql' database
use mysql;
Verify current status
select Host,User,authentication_string,plugin from mysql.user;
You can see: The MySQL ROOT account has no password configured and using the authentication plugin named auth_socket.
Now configure the ROOT account to use mysql_native_password plugin
ALTER USER root@localhost IDENTIFIED WITH mysql_native_password;
Set new password for root account
ALTER USER root@localhost IDENTIFIED BY 'newpassword';
Flush privileges
FLUSH PRIVILEGES;
exit;
Done

Problem solved !

Tuesday, 29 December 2020

Gitlab Error: couldn't deduce an advertise address: no private IP found, explicit advertise addr not provided

Gitlab log view:

gitlab-ctl tail

Something error:

cluster.go:154 component=cluster err="couldn't deduce an advertise address: no private IP found, explicit advertise addr not provided"

How to fix !

edit file gitlab.rb

vi /etc/gitlab/gitlab.rb

Add the following code

alertmanager['flags'] = {

  'cluster.advertise-address' => "127.0.0.1:9093",

}

Then

gitlab-ctl reconfigure

gitlab-ctl restart

Done ! now recheck gitlab log

gitlab-ctl tail alertmanager

Check alertmanager service

netstat -tulpn | grep LISTEN

output 

tcp        0      0 127.0.0.1:9093              0.0.0.0:*                   LISTEN      30633/alertmanager


Monday, 28 December 2020

Centos 6 - Yum Error: Cannot find a valid baseurl for repo base

When using the commands "yum install/update" on Centos 6 you will get an error:

Loaded plugins: fastestmirror, replace
Setting up Update Process
Determining fastest mirrors
YumRepo Error: All mirror URLs are not using ftp, http[s] or file.
 Eg. Invalid release/repo/arch combination/
removing mirrorlist with no valid mirrors: /var/cache/yum/x86_64/6/base/mirrorlist.txt
Error: Cannot find a valid baseurl for repo: base (base/updates/contrib)

Reason: Centos 6 is out of date and is no longer officially supported.

Solution: Manual change CentOS-Base.repo

Step 1:

Open the following files one by one:

/var/cache/yum/x86_64/6/base/mirrorlist.txt
/var/cache/yum/x86_64/6/extras/mirrorlist.txt
/var/cache/yum/x86_64/6/updates/mirrorlist.txt

Add the following line at the end of the files:

https://vault.centos.org/6.10/

Step 2:

Open file "CentOS-Base.repo" and modify all blocks according to the form below 

vi /etc/yum.repos.d/Centos-Base.repo

 [base]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
gpgcheck=1

 

#released updates
[updates]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
gpgcheck=1

 

#additional packages that may be useful
[extras]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
gpgcheck=1

 

#contrib - packages by Centos Users
[contrib]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
baseurl=http://vault.centos.org/6.10/centosplus/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
gpgcheck=1

Step 3: Done ! Solved !

Now on you can continue to use yum normally

Wednesday, 8 July 2020

Fix PHP Mongodb Error: connection refused calling ismaster on 'localhost:27017'


Step by step, Debug and fix PHP Mongodb error "No suitable servers found". This tutorial works with pure php and also popular php frameworks today such as: Laravel, Yii, CodeIgniter ...

Raw Error:
No suitable servers found (`serverSelectionTryOnce` set): 
[connection refused calling ismaster on 'localhost:27017']
[connection refused calling ismaster on '127.0.0.1:27017']
Debug Step by Step !

1. Check if mongodb is working or not:
netstat -tulpn | grep LISTEN
Please check if the mongodb process is working or not, the correct port or not. If the mongodb server is not working properly please resolve that issue.

2. Check that the php-mongodb extension is installed correctly (Unrelated, but I think it is useful)
Create a php file with content:
<?php
phpinfo();
?>
If no Mongodb found in the results page means you are missing this ext. Please install it according to the following tutorial: https://www.codesiri.com/2020/07/install-php-mongodb-extension-for-php7.html

3. Can you connect to the mongodb server via the Command line (CLI)?
mongo
4. Check SELinux Permission (Very important)
If you've debugged through steps 1 - 3 and haven't found the problem yet, SELinux is probably the problem that caused your error.
For added security, SELinux is enabled by default on newer server versions. By default SELinux will not allow apache, PHP is automatically opened to the new socket to connect out (or local). Meanwhile, php-mongodb ext needs to initialize the socket to connect to the mongodb server. So you will encounter the error as seen.
To fix this issue grant SELinux permission to apache to freely open the socket.
setsebool -P httpd_can_network_connect 1
Note: Some other php libraries that use sockets may have similar problems with SELinux, for example: php-redis, curl ...

Done !

Saturday, 4 July 2020

[Linux] Install PHP mongodb extension for PHP 7.2 and higher

This article will guide you to install php mongodb extension for PHP7 on linux operating system platform. The operating system we use is Centos, but it is also true for other linux distributions like Ubuntu, Redhat, Fedora ....

When upgrading to PHP7 we often encounter problems when we cannot install the php-mongo extension. You may encounter the following error message:

Package: php-pecl-mongo-1.6.14-1.el7.remi.5.4.x86_64 (remi)
Requires: php(zend-abi) = 20100525-64
* Reason: 
We have 2 mongo extensions for PHP: php-mongo and php-mongodb. Php-mongo only supports php 5.6, but php-mongodb supports the latest version 7.4. That's why you have an error when trying to install php-mongo for PHP7.
php-mongo is older and has been discontinued, but it is currently available as a library in remi repos. And php-mongodb is Pecl's latest library but it is not available and you have to install it yourself via php-pear.

* Solving problems: install php-mongodb extension for PHP7 

Step 1: Install apache(httpd) and php 7
Step 2: Install php-pear
install gcc php-pear php-devel
Step 3: Install mongodb extension 
pecl install mongodb
Step 4: Enable php-mongodb extension 
open php.ini file, then add the following line
;;;;;;;;;;;;;;;;;;;;;;
; Dynamic Extensions ;
;;;;;;;;;;;;;;;;;;;;;;
extension=mongodb

Step 5: Verify PHP Mongodb extension is enabled
php -m
Done !

* Note: The syntax used in previous PHP versions ('extension=<ext>.so' and 'extension='php_<ext>.dll') is supported for legacy reasons and may be deprecated in a future PHP major version. So, when it is possible, please move to the new ('extension=<ext>) syntax.

* Refer: https://blog.remirepo.net/pages/PECL-extensions-RPM-status



Thursday, 14 May 2020

Git: How to fix Error Pulling is not possible because you have unmerged files



If you try to pull new code while some local files have been changed without commit, you will get this error.

Error Pulling is not possible because you have unmerged files.
or
Error: Your local changes to the following files would be overwritten by merge
To fix it you have 2 options:

* Method 1: Commit the changes, then pull the new code
- Add new files if available
git add filename1.xyz folder/filename2.xyz  
or (add all new file)
git add -A    
- Commit new changes

git commit -m "Add new file or something need to noted"
* Method 2: Remove all local changes to update new code
(We often encounter this situation on the server)
To do so, run the following command:

git reset --hard origin/master
- note: 'master' is the name of the branch you want to update new code from that.

Done ! Now we can update new code by git pull command.

git pull




Sunday, 26 October 2014

[MySql] Reset MySQL root password on Linux

1. Login to server as root/su

2. Stop the MySQL service
service mysqld stop
* Note : Be carefully, all your application will be temporarily unable to use mysql.
3. Start MySQL Safe mode with skip grant tables option
mysqld_safe --skip-grant-tables & 
(press ctrl+C to exit, if required)

4. Start the MySQL service
service mysqld start

5. Log into the MySQL server without any password
mysql -u root -p mysql

6. Reset the password for ‘root’ user
UPDATE user SET password=PASSWORD('new-password') where user='root';

7. Flush privileges
flush privileges;

8. Stop MySQL Safe mode
killall mysqld

9. Start the MySQL service again
service mysqld start

10. Try to Log-in with the new password
mysql -u root -p 
<enter new password when prompted>

Friday, 19 September 2014

MySQL: Allowed to remote connect to MySQL server

MySQL Error : Host 'xxx.xx.xxx.xxx' is not allowed to connect to this MySQL server
How to fix it ?

STEP 1: Change mysql config :

vi /etc/mysql/my.cnf
Comment out following lines or edit to your client ip :
#bind-address           = 127.0.0.1
#skip-networking
Restart mysql server:
service mysql restart
STEP 2: Change GRANT privilege :

Login MySQL using command line .
Then run a command like below to grant access for user. Replace 'username' and 'password' with your username and password.
CREATE USER 'username'@'%' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON *.* TO 'username'@'%' WITH GRANT OPTION;
* '%' mean you can remote access from any ip address, You can replace it with a specified ip address.

Then flush MySQL :
FLUSH PRIVILEGES;

If it's still not working. Let's check your server firewall (iptables ...) and client firewall (windows firewall, antivirus software)


Tuesday, 1 April 2014

Linux: Delete all contents of file by only a command in vi editor

To clear the contents of a file is opening. Let's try folow the following command.

           :1,$d

Other basic useful command :
* Create a file
vi filename
* To exit vi and save changes:
         ZZ   or  :wq
* To exit vi without saving changes:
         :q!
* To edit file content :
         i
* Deleting Text :

*xdelete single character under cursor
 Nxdelete N characters, starting with character under cursor
 dwdelete the single word beginning with character under cursor
 dNwdelete N words beginning with character under cursor;
  e.g., d5w deletes 5 words
 Ddelete the remainder of the line, starting with current cursor position
*dddelete entire current line
 Ndd or dNddelete N lines, beginning with the current line;
  e.g., 5dd deletes 5 lines

* Searching Text:

 /stringsearch forward for occurrence of string in text
 ?stringsearch backward for occurrence of string in text
 nmove to next occurrence of search string
 Nmove to next occurrence of search string in opposite direction
* Screen Manipulation:

 ^fmove forward one screen
 ^bmove backward one screen
 ^dmove down (forward) one half screen
 ^umove up (back) one half screen
 ^lredraws the screen
 ^rredraws the screen, removing deleted lines

Saturday, 7 December 2013

Linux-vsftpd : restrict user to root directory

To avoid security issues or restrict user to root directory you have to limit users of vsftp to only their home directory. So how to do it ? 

Open vsftpd configuration file - /etc/vsftpd/vsftpd.conf :

Make sure following line exists and uncommented (add if not exists):

chroot_local_user=YES 

Save and close the file. Restart vsftpd service.

/etc/init.d/vsftpd restart 

 Done. Using a ftp client to check with some acccount.

Friday, 4 October 2013

Linux: how to find OS name and version

There are three way to show your linux server infomation :

 #1 
        $ cat /etc/*-release 

 #2 
        $ lsb_release -a 

 #3 
        $ cat /proc/version 

 Output example : 

 Linux version 2.6.32-358.11.1.el6.x86_64 (mockbuild@c6b7.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) ) #1 SMP Wed Jun 12 03:34:52 UTC 2013

Thursday, 19 September 2013

Linux: show apache version

In most Linux system (Redhat, Centos, Ubuntu ....) you can try follow command to find out apache version.

# httpd -V
This will not list dynamically loaded modules included using the LoadModule directive. To dump a list of loaded Static and Shared Modules:
# httpd -M