@scottalanmiller said in Bind Linux Process to Well Known Web Ports When Not Root:

If you have ever tried to run a user space program on Linux with a port below 1024 you know that this is a security problem and you are not allowed to do so. There is a simple fix for this, but it is not well known.

Once you know the binary that you will be using to open the low number (well known) port you can use this command to grant it permission to use these ports without otherwise compromising security.

setcap cap_net_bind_service+ep /my/binary/file

Now you can run your application. This is most commonly used for user space web applications that want to use port 80 or 443 without requiring that you run a reverse proxy in front of them.

Good to know!

I found this as an example of how to use it and also commands to remove the permission:
https://cwiki.apache.org/confluence/display/HTTPD/NonRootPortBinding

The setcap utility seems to be available in the libcap2-bin package on debian distros.

I haven't checked if it's installed by default.

Everything in the home lab is being upgraded tonight.

@jaredbusch said in beyond bash shell scripting, what language should I use:

@scottalanmiller said in beyond bash shell scripting, what language should I use:

@jaredbusch said in beyond bash shell scripting, what language should I use:

@stacksofplates said in beyond bash shell scripting, what language should I use:

@jaredbusch said in beyond bash shell scripting, what language should I use:

@scottalanmiller said in beyond bash shell scripting, what language should I use:

Go is great as a language. But like Ruby, not installed generally. And fewer resources. If it was a greenfield new OS, yeah, Go for sure. But for practical reasons, Python I think.

As these are systems that I control, there is no reason Go cannot be installed.

Between your comments and prior ones from @stacksofplates I think I might try Go in order to learn it.

You normally wouldn't install it anyway as it's not a scripting language. You'd just compile your binary and ship that to your systems.

I completely misunderstood that about Go. Okay, I will do a bit of checking and decide what I want to do.

oh sorry, I figured you knew. That's why I never look at it, I don't want to deal with binaries in that way. But nothing wrong with that. Write it on your machine at home, compile, ship binary. Works just fine.

As fixed tasks, this is not a bad solution. So I will keep it in mind.

Right, no big deal in this case.

@jaredbusch said in Upgrading to Fedora 34:

@stacksofplates said in Upgrading to Fedora 34:

I don't care for the new Windows-esque "installing updates don't power off your computer" screen on a reboot that was introduced in 34.

It was in 33 also if you did a clean install.

Ah I haven't used it in a while. I just saw it mentioned the other day.

@black3dynamite works.

Thanks. I was looking for this article long time. Cheers.

@DustinB3403 said in Oracle Linux Installation and performance seems insanely bad:

@Obsolesce CentOS as a product is dead, the alternatives are RHEL or CentOS Stream.

CentOS Stream is a totally different thing. Not what people consider alternatives. It is an alternative in the same way that Ubuntu or Windows is.

The real alternatives that are drop in replacements that work exactly the same and cost the same are Oracle Linux, AlamLinux and Rocky Linux.

@black3dynamite said in BTRFS is not default on Fedora 33 Server Minimal:

@scottalanmiller said in BTRFS is not default on Fedora 33 Server Minimal:

Stratis is just an automation and communication layer for XFS and LVM

I did not know that.

I didn't either, was just researching it, lol. It makes it a lot more valuable, it is essentially taking the "one filesystem" advantages of ZFS or BtrFS and making them happen with traditional, mature technologies. Kind of a best of both worlds approach. Actually quite nice, if it works well.

@gotwf said in Setup NodeBB on Fedora 33 with PostgreSQL and Nginx with HTTPS only:

@JaredBusch So... now that you've had this up and running for a while, care to report on how that is going? Inquiring minds are curious. Particularly w.r.t. resource utilization comparison, performance differences, etc. comparatively. I think you were on Mongo previously, correct? Cuz I am right there with you on the license bullshit. All it takes is one bump in the road, merger, and wham, history repeats and next major version changes license again - only this time to something closed. Have no interest in betting on community to fork and continue. Need a safer bet. It would appear that percona may have already done so w/their percona mongodb offering but I wonder if that would continue as a full fork if/when upstream became closed source.

TIA-- o/

Well 2 years in, i do not run any NobeBB instances with heavy traffic so performance is not even something I look at. I have like 5 of these running for tiny personal projects that people I know have asked for my help with.

@Dashrender said in ScreenConnect Unable to Start on Fedora 33:

@scottalanmiller said in ScreenConnect Unable to Start on Fedora 33:

You can use an RDP client if you want for Windows users.

I've read that - I need to figure how how that works.

We have some customers using them, but we don't use them internally AFAIK.

Upgrading servers today.

Still works on Fedora 37....

@Pete-S said in How to use firewall-cmd to verify that tcp 80 & 443 is open?:

One thing that would be nice to have, something that I've used on hardware firewalls, is a command that will simulate packets through the firewall rules to see if they will pass or not.
I've not seen something like that for iptables/netfilter.

Not sure about simulating, but you can always send packets at it and use iptables -v to see the counters.

@warren-stanley said in Asus ZenBook UX334FLC-AH79 with Linux:

@scottalanmiller How's the Aspire Linux support working out ?

So far, it's been great. Really liking it.

I was setting up dnf-automatic on a new system today and recalled this post. I changed the reboot option and it made the systemd file as noted, which is what you report. So are you sure someone did not change your config from never to when-changed?

b4aef492-0dfb-4496-a1b4-23aaafa0299f-image.png

So, no idea what I had installed that required python2-lxml

I removed it and the upgrade is proceeding as normal.

This is the SSL score.
76a95c9d-98c9-4017-b1a5-9241f011403e-image.png

I assume this is why the A rating and not A+
c8606068-aa33-4e47-ac08-12495d504b90-image.png

But not much to do about that since it is Cloudflare that is terminating.

@JaredBusch yeah, it's annoying that WP-CLI struggles with that.

@black3dynamite said in Remote PowerShell from Fedora to Windows:

@stacksofplates said in Remote PowerShell from Fedora to Windows:

Sssd works with multiple domains.

If sssd is installed will I be able to use -Authentication Kerberos without needing to join to a domain or when accessing Windows machines that isn’t joined to a domain?

No it only works for domains.