How to restart natd remotely

Be careful, when you want to make changes to natd.conf, and then restart from a remote console. If you just kill -9 natd, then you will get locked out immediately, without chance to start it again. Needless to say, this would lead to jumping in a car and rushing down to the office.

So, first, let's have a backup plan.

ipfw add 10 allow all from [myIpAddress] to me

Second, run

kill -9 [natd_pid] && /sbin/natd -f /etc/natd.conf -a [natd_external_address]

Of course, your natd flags may vary.

How to delete user configured options for a port in FreeBSD

Sometimes, you get a nice ncurses menu, when you run make install, make reinstall on a port. You make a mistake, port install crashes, you try to run make install one more time just to discover that the menu isn't there any more, and it just runs install one more time with your compiled options.

Q: How do I delete configured options for a port in FreeBSD?
A: A quick look at man ports reveals a comand 'make rmconfig'.

BIND zone forwarding problems

Since we will be implementing AD domain controller in our enterprise, I decided it was time to test out the water with a real installation. All said n'done, I ended up with a test box with brand new Windows 2008 Server installation. It looks nice, I like the interface. Mac OS X is better though. :)

Let's get to business.

I needed to have a FQDN on that box, since it was going to be the first DC in the forest and will be running DNS server. I chose one that is delegated, of course, to our FreeBSD/BIND nameservers, and instead of delegating a subdomain, I decided just to forward the whole domain name to that box.

I added the following configuration directives to /etc/namedb/named.conf.

zone "domain.com" {
type forward;
forward only;
forwarders {
99.99.99.99;
};
};


rndc reload, and one would think that's it. No. When dig'ing, it would work. On a plain resolve - no.

The solution was to add the nameserver itself in its /etc/resolv.conf, and everything started to work.

nmbclusters

Today I had to compile a new FreeBSD kernel for a fresh installed machine. I looked up my trusty (and pretty old) kernel config file, and, being a real man I am, didn't looked at any NOTES, LINT and other girly stuff, and proceeded to config. So, much to my surprise, I received an error:

unknown option NMBCLUSTERS

Fast glance into FreeBSD manual revealed, that

"kern.ipc.nmbclusters loader tunable should be used to tune this at boot time. Only older versions of FreeBSD will require you to use the NMBCLUSTERS kernel config(8) option."

Oh well. :)

http://www.freebsd.org/doc/en/books/handbook/configtuning-kernel-limits.html

First FreeBSD 7.0 install

Today, I got my first 7.0 FreeBSD server to install. Everything went normal, only one quirk while installing linuxthreads, but managed to do without them.

Zend Optimizer 3.3.0a, though, greeted me with
/libexec/ld-elf.so.1: Shared object "libm.so.4" not found, required by "php"

So, the solution was to
cd /usr/ports/misc/compat6x
make install clean

Excluding directories from rsync backup

The thing is, some a**hole clients of hours don't mind keeping a lot of useless data on their servers. Basically I don't mind either, but this one time I had to discover, that because of this, the backup server ran out of space on one of its HDDs.

So I set to investigate the options, and the useful thing I discovered was how to exclude directories in rsyncd.conf.

Here's an example.

[hosts]
path = /home/hosts
comment = serv1
hosts allow = x.x.x.x
exclude = www.domain1.com/ www.domain2.com/


This will exclude directories named domain1.com and domain2.com. More on the syntax of the exclude command can be found at

http://www.ss64.com/bash/rsync.html

Dealing with ports

Recently I came across of a more "posh", if you will, way to deal with ports. Instead of trusty old cvsup I was recommended to try out portsnap, which cames in FreeBSD base system for a while already - specifically, since 6.0. Older than that, just use ports-mgmt/portsnap port.

It is very easy to use - in fact, I find it easier than cvsupdate.

First, you need to fetch a compressed snapshot of the ports tree.
# portsnap fetch

Next, a live copy of ports tree should be extracted in /usr/ports - the manual mentions you should do this regardless even if there is one created with cvsup.
# portsnap extract

That was for the first time. After that, it's just update
# portsnap fetch update


Next thing I found very handy was http://www.freshports.org/ports-mgmt/portupgrade/. Now unlike the vanilla cd /usr/ports/portdir && make install clean, it can actually update dependencies as well. Nice. Comes with a set of handy utilities - portinstall, pkg_deinstall etc.

pkg_add and an old FreeBSD 5.4 installation

Hellllo.

Just before the New Years, I got this need to upgrade our software on one of our servers. It requires some packages, and so I went to install them.

As I already knew, I was out of luck with pkg_add -r, since the files for FreeBSD 5.4 aren't on FreeBSD's FTP server anymore for a while already.

Minutes later, aunt Google came to help, suggesting that I read FreeBSD manual
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/packages-using.html

shortly, the solution was:
setenv PACKAGESITE ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-5-stable/Latest/

:)

nginx could not build the server_names_hash hash

When restarting nginx, suddenly I came accross this error message:

could not build the server_names_hash hash, you should increase server_names_hash_bucket_size: 32

Now, that's solved pretty easily - by increasing server_names_hash_bucket in config file to a bigger value. According to author, Igor Sysoev, even p4 can easily handle value of a 128.

So I put
server_names_hash_bucket_size 128;
in nginx.conf, and everything works fine.

Pass real IP for backend webserver

The problem: when nginx is serving front end in two layer webserver, with apache on backend, apache doesn't see clients ip address, just 127.0.0.1 for everybody.

The solution: install either mod_realip (apache 1.3.x only) or mod_rpaf (both apache 1.3.x and 2).

http://sysoev.ru/mod_realip/ - mod_realip
http://stderr.net/apache/rpaf/ - mod_rpaf

http://nginx.info/index.pl/ru/articles