talk.tryitonline.net

Andrew Savinykh

12:29 AM

@Dennis did you happen to find out why apl-ngn runDocTest does not work during the build?

Dennis

I didn't look into it after we taled about it last time.

Andrew Savinykh

@Dennis I thought you might have known it before that just thought it did not matter

Dennis

I'm fairly certain it worked when I installed the older version.

Andrew Savinykh

@Dennis so to recap - you saw the message, it was clearly from tests, it did not affect TIO functionality, so you have not looked at it any further. Correct?

@Dennis ah. I see

Dennis

Yeah. I think it only happened after the update, but since the tests aren't needed...

Andrew Savinykh

12:42 AM

@Dennis so the reason for this is node version

one that comes from f24 repo is 4.7.2 - way to ancient

on your arena what does 'node -v' gives you?

@Dennis I wonder if there will be any ill effect if we install it from the web site...

Dennis

Oh! Well, we already have a node in /opt.

arena:srv# node -v
v4.7.2
arena:srv# /opt/node-v7.2.0-linux-x64/bin/node -v
v7.2.0

Andrew Savinykh

indeed

any idea how to trick the apl build into using that instead?

Dennis

When I set up the next arena, I will be using Fedora 25. Hopefully, is has a newer node.

Andrew Savinykh

@Dennis yeah, testing my setup in fedora 25 is on my todo list

Dennis

PATH=/opt/node-v7.2.0-linux-x64/bin:$PATH ./build

Builds cleanly.

Andrew Savinykh

12:49 AM

@Dennis awesome! thanks

Dennis

2:01 AM

Alright, killing has been implemented in frontend and backend. It seems to work well and should cause no issues. I'll enable it now.

feersum

Killing? Who gets killed?

Dennis

Nobody, hopefully. But cancelling a request should actually kill it on the server.

Live and pushed.

Please report any issues.

I wonder what a reasonable limit for concurrent requests per IP would be. I don't want to affect normal usage, but a single user should also not be able to hog all the resources.

Andrew Savinykh

2:17 AM

@Dennis, when I'm creating a swapfile I'm getting the following warning:

mkswap: /swapfile: insecure permissions 0644, 0600 suggested.

should I be worried about this?

Dennis

Not worried, but you should fix the permissions.

644 makes the swapfule world-readable, so all users can read all swapped out memory, which might contain sensitive data.

Andrew Savinykh

chmod 0600 /swapfile

like this?

Dennis

Yep.

Andrew Savinykh

2:54 AM

@Dennis julia3, what did I do wrong

05 Feb 02:53:27 UTC [99/194] julia3 - FAIL (2 sec)
05 Feb 02:53:27 UTC Expected: Hello, World!
05 Feb 02:53:27 UTC Got:
05 Feb 02:53:27 UTC Debug
signal (11): Segmentation fault
uv_free_interface_addresses at /opt/julia-80aa77986e/bin/../lib/julia/libjulia.so (unknown line)
getipaddr at ./socket.jl:553
init_bind_addr at ./client.jl:182
_start at ./client.jl:352
jlcall__start_17457 at /opt/julia-80aa77986e/bin/../lib/julia/sys.so (unknown line)
jl_apply_generic at /opt/julia-80aa77986e/bin/../lib/julia/libjulia.so (unknown line)

Dennis

24 hours ago, by Dennis

/o\ I installed Julia 0.3 and wrote a wrapper, but never added it to the JSON file.

Yeah, that's not what happened. I didn't add it to languages.json because it segfaults.

Andrew Savinykh

@Dennis, what are you gonna do?

Dennis

Kill it. I have no idea how I could fix that.

Andrew Savinykh

right

Dennis

The fun part is that it works without SELinux.

Andrew Savinykh

3:05 AM

@Dennis don't forget to push when stable ;)

Dennis

Already done.

Andrew Savinykh

Cheers!

Dennis

Syncing the repos became a lot easier when I combined the three of the main server.

Andrew Savinykh

So I more or less had the second pass over arena setup. It now lives here: https://github.com/TryItOnline-Collateral/TioSetup/tree/master/arena

private folder supposed to have information that is different for each setup
that is, swap file size, the ssh pub key and notice about Dyalog APL, that is
where to put the download.

bootstrap script runs scripts in stage1 - set up selinux, set up upon reboot continuation and reboots.

setup-main scrypt are called authomatically upon reboot (runonce) and executes stage2 - which apdates software from various repos

then individual language are set up as per languages folder

Overall execution progress is logged to journalctl -t run-scripts

Everything else is logged into /var/log/tioupd

Log samples can be found in https://github.com/TryItOnline-Collateral/TioSetup/tree/master/arena/logsamples

This is a bit more structured than my first attempt and it's much easier to change now and also much easier to see if anything goes wrong

Now I want to move install scripts for the main server to the same structure. At the same time I'm going to use your httpd config and install stuff to /srv instead of /var/www

And when this is done I'll have to re-write the set up instructions ;)

Dennis

Speaking of httpd: did you test if letencrypt renew is able to renew all certificates?

Because mine wasn't; had to modify config file.

Andrew Savinykh

3:18 AM

@Dennis oh right. It only works if you have a config per domain

Won't work the way you set it up

@Dennis I actually had no problem at all using apache certbot on fedora

@Dennis it works as long as you do not confuse it with your custom setup

Dennis

Works peachy if you edit letsencrypt's files, but if you use webroot, backend.tryitonline.net tries to execute the token letsencrypt place in one of its folders as a CGI script.

Andrew Savinykh

you mean webroot certbot pluging?

I did not try that one, I used apache one

Dennis

Something like that.

Andrew Savinykh

@Dennis I did not have to edit letsencrypt files

Dennis

    <Directory /srv/backend.tryitonline.net/.well-known/acme-challenge>
        SetHandler send-as-is
    </Directory>

@AndrewSavinykh Might have been my mistake when I set it up. I hadn't used letsencrypt before.

Andrew Savinykh

3:23 AM

Here is what I've observed

I created non-ssl configs one per site. Like this:

<VirtualHost *:80>
ScriptAlias "/" "/var/www/backend.tryitonline.net/"
<Directory /var/www/backend.tryitonline.net/>
Options FollowSymLinks
AllowOverride All
Order allow,deny
allow from all
</Directory>
TimeOut 70
ServerName backend.tryitonline.nz
DocumentRoot /var/www/backend.tryitonline.net
ErrorLog /var/log/backend.tryitonline.error.log
CustomLog /var/log/backend.tryitonline.access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =backend.tryitonline.nz
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]

I ran certbot on it and choose the "secure" option (or --redirect command line switch)

certbot generated configs like this:

<IfModule mod_ssl.c>
<VirtualHost *:443>
ScriptAlias "/" "/var/www/backend.tryitonline.net/"
<Directory /var/www/backend.tryitonline.net/>
Options FollowSymLinks
AllowOverride All
Order allow,deny
allow from all
</Directory>
TimeOut 70
ServerName backend.tryitonline.nz
DocumentRoot /var/www/backend.tryitonline.net
ErrorLog /var/log/backend.tryitonline.error.log
CustomLog /var/log/backend.tryitonline.access.log combined
SSLCertificateFile /etc/letsencrypt/live/tryitonline.nz/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/tryitonline.nz/privkey.pem

and there is a folder structure under /etc/letencrypt

which is crucial for the renewal to work

Dennis

# cat /etc/letsencrypt/renewal/tryitonline.net.conf
version = 0.9.3
cert = /etc/letsencrypt/live/tryitonline.net/cert.pem
privkey = /etc/letsencrypt/live/tryitonline.net/privkey.pem
chain = /etc/letsencrypt/live/tryitonline.net/chain.pem
fullchain = /etc/letsencrypt/live/tryitonline.net/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = None
account = <REDACTED>
webroot_path = /srv/tryitonline.net,
[[webroot_map]]
tryitonline.net = /srv/tryitonline.net

That's what I used eventually.

But if having separate files for the virtual hosts lets the certbot do everything automatically, great.

Andrew Savinykh

those /etc/letsencrypt/live/tryitonline.net/cert.pem are supposed to be symlinks

mine has

Dennis

@AndrewSavinykh Wow, that is really detailed.

Andrew Savinykh

[renewalparams]
authenticator = apache
installer = apache

and no webroot_map stuff

Dennis

Yeah, it didn't let me use apache because of my config file, so I used webroot.

Do you happen to know if the apache options has to restart the apache service?

Andrew Savinykh

3:34 AM

@Dennis yes of course. How else would it work?

Dennis

For renewal, I mean.

Andrew Savinykh

@Dennis oh. sorry no idea

Andrew Savinykh

3:53 AM

@Dennis do you think it's possible to pull all the domain names that are used in .js and in .html to a single include file? (for the main site)

I'm not really asking you to do that, I know you are busy, I'm more asking about if you'd accept such pull request. It would be a bummer if I implement it in a way that does not agree with you at all

Dennis

4:13 AM

That would require serving the HTML files with a CGI script, which seems overkill for replacing a handful of domain names with others.

Is there a problem with the sed approach you were using?

@AndrewSavinykh (Not saying no, just trying to understand the problem.)

Andrew Savinykh

4:32 AM

@Dennis I agree that it's cumbersome. You won't need a CGI script you can do all you want client-side with javascript, but since you are not using a template engine it's not going to look very clean.

@Dennis It's a nuicance to pull, need to re-apply sed every time

@Dennis similar, not insisting, just trying to figure out the best way

Dennis

Well, maybe pulling directly to /srv (or pushing from there) maybe isn't the best idea after all. If we integrate your setup script into the official repos, the pulled version could live somewhere else and executing ./build would update the content of /srv.

I could add you to the Try It Online organization to give you write access to the repos.

Andrew Savinykh

@Dennis right. okay, I'll think about it, sounds workable

Andrew Savinykh

4:55 AM

@Dennis thank you for this. you know, I once accidentally git commit; git push in a wrong directory, and the only thing that saved your repo is that I did not have access to it. But yeah, it could be useful in a longer run

on the other hand no living soul is probably looking there anyway except you and I

Dennis

As long as I have a local copy, everything's fixable.

Andrew Savinykh

yes there is also git revert

you probably get this all the time but I was amused to see in my logs some one trying to read /etc/shadow with java. it was not you was it?

Dennis

Definitely not me.

Andrew Savinykh

thought so

Dennis

I assume that was some script kiddie fishing for idiots. /etc/shadow can only be read by root, the passwords are hashed, and (at least as far as I'm concerned) having a root password is a security flaw anyway.

Andrew Savinykh

5:02 AM

the very first attempt to install it all by me though did not include selinux - I did not even know about it back then. Luckily you told me soon ;)

Dennis

SELinux is probably the sole reason my server isn't on fire by now. :P

Btw are you using SELinux on the main server now?

Andrew Savinykh

@Dennis not at all. I thought you said there is no point doing that

did I misinterpret?

Dennis

It's not strictly required, but it's still nice to have. SELinux severely limits what a CGI script is able to do, so if somebody finds a security flaw, killing or overtaking the entire server will prove to be difficult.

Pavel

@Dennis Is it possible to remove the password from root?

Andrew Savinykh

@Pavel yes

Pavel

5:07 AM

I might have added one literally seconds before seeing your message

Dennis

@AndrewSavinykh Unlike the arena (which absolute needs SELinux or some other kind of sandboxing), it's just an extra layer of security though.

@Pavel Having a root password is a security flaw.

Andrew Savinykh

@Dennis would you like to tell me what's involved? Just setting to enforced and that's it? Or anything in addition to that?

Pavel

@Dennis Well, unless there's a password by default, I have one now, but didn't have one a minute ago.

Dennis

You need a module to allow CGI scripts to create SSH connections and set the proper contexts of everything /srv, but that's about it.

@Pavel Note that no password is different from empty password. If there's no password, it cannot be cracked. You simply cannot login as the root user.

Andrew Savinykh

@Dennis cannot login with a password that is.

Dennis

5:10 AM

Well, yes.

Pavel

I think no password is the default, because I could not access su without first setting one.

Dennis

But a traditional login (nothing SSH etc.) has no other auth methods as far as I know.

@AndrewSavinykh Here's the module:

tryitonline:~# cat arena.te
policy_module(arena, 1.0);

require {
        type httpd_sys_script_t;
        type ssh_home_t;
        type ssh_port_t;
    type user_home_dir_t;
        type unconfined_t;
        class dir { getatrr search };
        class fifo_file read;
        class tcp_socket name_connect;
        class unix_stream_socket connectto;
        class file { getattr open read };
        class sock_file write;
}

allow httpd_sys_script_t user_home_dir_t:dir { getattr search };
allow httpd_sys_script_t ssh_port_t:tcp_socket name_connect;

Andrew Savinykh

@Dennis well you can logins as someone else and then sudo to root shell. Without root password. Does it qualify as logging as a root?

of course if you set it up this way

Dennis

It's pretty much the same for all practical reasons, but it's not logging in as root.

Of course, once you do that, you can give root a password.

But if you know the root password and manage to compromise the web server, you can become root from a CGI script. That's not possible if root doesn't have a password.

Unless you take the route though ssh, that is.

Andrew Savinykh

@Dennis thank you I took a note of it

Conor O'Brien

5:16 AM

@Dennis could you please pull stacked?

Dennis

@ConorO'Brien Popped stacked.

Conor O'Brien

XD

tyvm

Dennis

@AndrewSavinykh These are the custom contexts required for /srv.

/srv/backend.tryitonline.net(/.*)?                 all files          system_u:object_r:httpd_sys_script_exec_t:s0
/srv/bin(/.*)?                                     all files          system_u:object_r:bin_t:s0
/srv/cache(/.*)?                                   all files          system_u:object_r:httpd_sys_rw_content_t:s0
/srv/store(/.*)?                                   all files          system_u:object_r:httpd_sys_rw_content_t:s0
/srv/tio.run(/.*)?                                 all files          system_u:object_r:httpd_sys_content_t:s0

Andrew Savinykh

@Dennis are there languages where you are requested to "pull" from time to time that do not come from github?

Dennis

Mainly Cheddar.

Andrew Savinykh

5:28 AM

@Dennis dnf update ?

Dennis

npm

Cheddar isn't packaged for any particular system yet, afaik.

Andrew Savinykh

right