Never been to CodeSnippets before?

Snippets is a public source code repository. Easily build up your personal collection of code snippets, categorize them with tags / keywords, and share them with the world (or not, you can keep them private!)

About this user

Jason Hoffman http://textdrive.com/

Using HTTP conditions and url.access-deny to have Lighttpd block some user agents and referers

# deny access for Indy Library a Tester
$HTTP["useragent"] =~ "Indy" { url.access-deny = ( "" ) }
 
# deny access for a hydrocodone containing refer 
$HTTP["referer"] =~ "hydrocodone" { url.access-deny = ( "" ) }

Lighttpd proxy with Tracd specific example

$HTTP["host"] == "trac.textdrive.com" #the == is to exactly match
{
proxy.server = (
"" => (                               #this is for the root, can be a .extension in other uses
"trac" => (                           #just a name, your choice
"host" => "70.84.29.150", 
"port" => 9000 
           )
       )
                )
}

Upgrading a kernel

Install CVSup

cd /usr/ports/net/cvsup-without-gui
make install distclean


Make and populate the CVSup config file

touch /root/cvsup-stable-src.sup
echo '*default host=cvsup14.us.FreeBSD.org' >> /root/cvsup-stable-src.sup
echo '*default base=/var/db' >> /root/cvsup-stable-src.sup
echo '*default prefix=/usr' >> /root/cvsup-stable-src.sup
echo '*default release=cvs tag=RELENG_5' >> /root/cvsup-stable-src.sup
echo '*default delete use-rel-suffix compress' >> /root/cvsup-stable-src.sup
echo ' src-all' >> /root/cvsup-stable-src.sup


Update the /usr/src/ tree

cvsup /root/cvsup-stable-src.sup


Get rid of any old "worlds" and make a new one

rm -rf /usr/obj/usr
cd /usr/src/
make buildworld


Make changes to /usr/src/sys/i386/conf/GENERIC and name it was what you want.

Build the kernel, install the kernel, verify it and dot.old in /boot/, run mergemaster, and install the new world.

make buildkernel KERNCONF=GENERIC
make installkernel KERNCONF=GENERIC
mergemaster -p
make installworld
mergemaster
ls -l /boot/
shutdown -r now


Note, we often run in a securelevel of 1 and have immutable binaries in the system folders. You'll need to edit rc.conf.

nano /etc/rc.conf

kern_securelevel_enable="NO"
kern_securelevel="1"


Reboot
shutdown -r now


Then make things mutable

chflags noschg /bin/*
chflags noschg /sbin/*
chflags noschg /bin
chflags noschg /sbin
chflags noschg /usr/bin/*
chflags noschg /usr/sbin/*
chflags noschg /usr/bin
chflags noschg /usr/sbin

How to setup NTP on BSD

echo xntpd_enable=\"YES\" >> /etc/rc.conf
echo xntpd_program=\"/usr/sbin/ntpd\" >> /etc/rc.conf
echo xntpd_flags=\"-p /var/run/ntpd.pid\" >> /etc/rc.conf
ntpdate time.nist.gov
ntpdate time.nist.gov
mkdir /etc/ntp
touch /etc/ntp/drift

touch /etc/ntp.conf
echo server time.nist.gov >> /etc/ntp.conf
echo driftfile /etc/ntp/drift  >> /etc/ntp.conf
/etc/rc.d/ntpd start

Using pw to add a group and user in FreeBSD

Using "textdrive" as an example

pw groupadd textdrive
pw useradd textdrive -m -c "Main Textdrive account" -d /home/textdrive -s /bin/tcsh -G textdrive -k /usr/share/skel/


Then set the password:

passwd textdrive

Locking your Rails app to specific gem versions

To lock in a gem, you can modify your environments files, like how

config/environments.rb

has

# Require Rails gems.
require 'rubygems'
require_gem 'activerecord'
require_gem 'actionpack'
require_gem 'actionmailer'
require_gem 'rails'


Change it to the versions you are using, like

# Require Rails gems.
require 'rubygems'
require_gem 'activerecord', '<= 1.30'
require_gem 'actionpack', '<= 1.1.0'
require_gem 'actionmailer', '<= 0.5.0'
require_gem 'rails', '<= 0.9.1'

SSH tunneling for MySQL

No forking in background and verbose

ssh -2 -v -c blowfish -C -N user@servername.textdrive.com -L 3370/127.0.0.1/3306


Forking in background

ssh -2 -f -c blowfish -C -N user@servername.textdrive.com -L 3370/127.0.0.1/3306


Mod_security audit_log analysis

egrep 'Host:'  audit_log | sort | uniq -c | sort -rn | sed "s/mod_security-message\: Access denied with code 412\. //g" > 


egrep 'mod_security-message'  audit_log | sort | uniq -c | sort -rn  | mod_security-message-sort.txt


egrep "^HTTP/" audit_log | sed  "s/HTTP\/[01].[019] //g" | sort | uniq > HTTPcodes-audit.txt


Check out what's being used in the access_log headers

cat httpd-access.log | awk '{print $7}' | sort |  uniq -c | sort -rn | less

View processes, grep out by user and then kill all their PIDs

ps axu | grep user | kill -9 `awk{print $2}’`