HTTP Basic Authentication and your URL hierarchy
We're big fans of Apache's implementation of HTTP Basic Authentication , but we recently discovered that there aresome subtle implications of how Basic Authentication can interactwith your URL hierarchy within a web application . This is because of when HTTPBasic Authentication is and isn't sent to you ,and specifically that browsers don't preemptively send the Authorization when they are moving up your URL hierarchy (well, for the firsttime). That sounds abstract, so let's give a more concrete example.
Let
Restarting nfs-server on a Linux NFS (v3) server isn't transparent
A while back I wrote an article on enabling NFS v4 on an Ubuntu22.04 fileserver (instead of just NFS v3) ,where one of the final steps was to restart 'nfsd', the NFS serverdaemon (sort of), with ' systemctl restart nfs-server '. In thatarticle I said that as far as I could tell this entire process wastransparent to NFS v3 clients that were talking to the NFS server.Unfortunately I have to take that back. Restarting
How Unix shells used to be used as an access control mechanism
Once upon a time, one of the ways that system administratorscontrolled who could log in to what server was by assigning specialadministrative shells to logins, either on a particular system oracross your entire server fleet. Today, special shells (mostly)aren't an effective mechanism for this any more , so modern Unix peoplemay not have much exposure to this idea. However, vestiges of thislive on in typical Unix configurations, in the form of /sbin/nologin(sometimes in /usr/sbin)
Making a function that defines functions in GNU Emacs ELisp
Suppose that for some reason you're trying to create a number offunctions that follow a fixed template; for example, they shouldall be called 'mh-visit- Once upon a time, if you had a collection of Unix systems, you couldreasonably do a certain amount of access control to your overallenvironment by forcing logins to have specific administrative shells.As a bonus, these administrative shells could print helpful messagesabout why the particular login wasn't being allowed to use your system.This is a quite attractive bundle of features, but unfortunately thisno longer works in a (modern) Unix environment with logins ( such aswe have ). There are two core problems. Suppose, not entirely hypothetically, that you use Apache and havean area of your website protected with Apache's HTTP BasicAuthentication . A user comes to you with aproblem report; while interacting with this area of the site, theyunexpectedly got re-challenged for authentication. In fact, in yourApache logs you can see that they made an authenticated requestthat returned a HTTP redirect and literally moments later theirbrowser's GET of the redirection target was met with a HTTP 401 response, indicating that I recently wrote about my new simple system to open URLs on mydesktop from remote machines ,where a Python client (on the remote server) listens on a Unixdomain socket for URLs that programs (like mail clients) want opened,and reports these URLs to the server on my desktop, which passesthem to my browser. The server and client communicate over SSH; theserver starts by SSH'ing to the remote machine and running theclient. On my desktop, I run the server in a terminal window Suppose, not hypothetically, that for some reason you're trying tocreate a GNU Emacs ELisp macro thatdefines a function, and for your sins you don't want to directlyspecify the name of your new function. In my case, I want to createa bunch of functions with names of the form 'mh-visit- Recently, our IMAP server had unusually high CPU usage and was increasingly close tosaturating its CPU. When I investigated with 'top' it was easy tosee the culprit processes, but when I checked what they were doingwith the I have a long standing setup where I read my email on one of ourLinux login servers , instead of on my desktop. Emailcan include URLs that I want to open, so I need some way of openingthese URLs in my desktop browser. For a long time this has beenthrough one of two options; either I forwarded X over SSH and used Firefox's X-based remote control ,or I was operating purely with text and selected the URLs in theterminal to use with my tools to open
Unix shells are generally not viable access control mechanisms any more
Apache's HTTP Basic Authentication could do with more logging
Insuring that my URL server and client programs exit after problems
An important difference between intern and make-symbol in GNU Emacs ELisp
A user program doing intense IO can manifest as high system CPU time
strace command, they were all busy madly doing IO, infact processing recursive IMAP LIST commands by walking around in thefilesystem. Processes that intensely do IO like this normally windup in "iowait" , not inactive CPU usage (whether user or system CPU usage). Except
My (new) simple system to open URLs on my desktop from remote Linux machines
Menu