Command Center

Definitions

301 Redirect

 

A function of a web server that redirects the visitor from the current
page or site to another page or site, while returning a response code that
says that the original page or site has been permanently moved to the
new location. Search engines like this information and will readily transfer
link popularity (and PageRank) to the new site quickly and with few issues.
They are also not as likely to cause issues with duplication filters. SEOs
like 301 redirects, and they are usually the preferred way to deal with
multiple domains pointing at one website.

302 Redirect

 

A function of a web server that redirects the visitor from the current
page or site to another page or site, while returning a response code that
says that the original page or site has been temporarily moved to the
new location. Search engines will often interpret these as a park, and take
their time figuring out how to handle the setup. Try to avoid a 302 redirect
on your site if you can (unless it truly is only a temporary redirect), and
never use them as some form of click tracking for your outgoing links, as
they can result in a "website hijacking" under some circumstances.

Microsoft's Internet Information Server ( MS IIS ) is very different from
Apache, and you need to handle redirects on it differently.

Although you can use the popular FrontPage web development software with
Apache + FP extensions, most people who use FrontPage prefer to use IIS. Also,
Microsoft's .NET and ASP development platforms usually work best on MS IIS (no
surprise there).

Definitions for Terms used in
this Article

Detailed Information

Overview

What you are trying to accomplish here is to have one resource (either a page
or an entire site) redirect a visitor to a completely different page or site,
and while doing so tell the visitor's browser that the redirect is either
permanent (301) or temporary (302).

Therefore you need to do three things:

1. Have 2 resources - one source page or website, and one destination page
   or website.
2. When an attempt to access the source resource is made, IIS transfers the
   visitor to the destination instead.
3. During the transfer, IIS reports to the visitor that a redirect is
   happening and it's either temporary or permanent.

The good news is that IIS has always supported this, and you can use it's
control panel to make the redirect.

Administrator Mode - Redirecting a Domain

If you can log into the Windows 2000 (or higher) server and access the
desktop, then choose:

Start > Programs > Administrative Tools > Internet Services Manager

Now choose the server running the site you want to forward. Remember you need
2 sites - one to forward FROM and one to forward TO. These can be on the same,
or separate servers.



Right click on the site you want to redirect FROM and choose Properties > Home
Directory



You will see the following:

The default is the first choice, "A directory located on this computer". Change
it to "A redirection to a URL" and type in the new URL.

If you want it to be a 301, then be sure to check ON
the choice for "A permanent redirection for this resource". If you want it to be
a 302, leave the choice checked OFF.

Administrator Mode - Redirecting an Individual Page

If you can log into the Windows 2000 (or higher) server and access the
desktop, then choose:

Start > Programs > Administrative Tools > Internet Services Manager

Now choose the server running the site you want to forward. Choose the site
with the webpage you want to forward in it, then right click on the it and
choose "Properties".



You will see the following:

The default is the first choice, "The designated file". Change it to "A
redirection to a URL" and type in the new URL.

If you want it to be a 301, then be sure to check ON
the choice for "A permanent redirection for this resource". If you want it to be
a 302, leave the choice checked OFF.

If you don't control the IIS server, ask the admin to do the above. Done.

Passing on Variables or a Query String During IIS Redirects

Let's say that you want to pass on some variables, for example, you wanted to
redirect an ASP site that accepted arguments for some pages and pass those same
arguments on to the same pages at the new site.

In this case, in the "Redirect to:" box, enter the domain you wish to move to
(no trailing slash), plus $S$Q .

For example:

http://www.newdomain.com$S$Q

Next, check the options that state the client will be sent to "The exact
URL entered above", as well as "A permanent redirection for this resource"
(if you want it to be a 301). Done.

What does this $S$Q do? These are tags that IIS will automatically replace -
$S will be replaced with the subdirectory location (such as /shopping/cart.aspx)
and $Q will be replaced with the querystring (such as ?id=Blue).

This works for both Site Redirects and Individual Page Redirects.

Common Scenarios

I Just Want To Switch Domains!

This is actually pretty straightforward. You can tweak things to get exactly
what you need with the variables above, but the following will work for the most
common setups:

http://www.newdomain.com$V$Q

Do NOT add a trailing slash "/" at the end of the domain name!

Make sure you check:

• The exact URL entered above
• A permanent redirection for this resource

Done! This will send everything after the old domain name to the new domain
name, including variables. You need to do is make sure that the new website is
set up exactly the same as the old one and that all you are doing is changing
domain names.

Non-WWW to WWW Redirect for IIS

When you set up a site in IIS, usually you set up the site with a domain name
and add the domain name with both versions, www and non-www, to the host headers
for the account. This creates a potential duplication issue, though.

The better way to do this is to actually create 2 accounts - one with the www
version and one without. Then you put the website in your preferred version and
a single page in the other. Normally, you would then treat this as if you were
switching domains (above), with the 2 domains being the www and the non-www
versions.

Another method, for those that don't have direct access to the
control panel (common with many ISP's/ hosts), is to put your entire website in the www account and then a
single page in the non-www account. Then you would put the following code in the
default page in the account with the single page (i.e. the one you are redirecting):

< %@ Language=VBScript %>

< %

Response.Status="301 Moved Permanently"

Response.AddHeader "Location",
http://www.example.com

%>

What about Parameters?

If you do a non-www to www redirect for MS Internet Information Services
(IIS) and have parameters that need to be passed on, then do the following
(Thanks to Chris Hirst for testing
this):

1. Do the above non-WWW to WWW redirect
2. Make double sure that you do NOT have a trailing slash at the end of the
   domain (http://www.newdomain.com$V$Q, NOT http://www.newdomain.com/$V$Q)
3. As with all these redirects, make sure that you check "The exact URL
   entered above"

Don't Have Administrator or Desktop Access?

If possible, ask the Administrator for the site to perform the above steps.
If you can't, you need to use ASP or .NET scripting on-page to do redirects.

Conclusion

IIS is a powerful and easy to use web hosting platform. If you have access to
the Admin panel you can accomplish basic tasks (like simple redirection) easily
and quickly. If you don't have access (and don't want to switch hosts) then you
will have to use redirection scripting to accomplish this. You'll learn more
about that in the Redirects Using On-Page
Scripting and Headers section.

REFERENCE

http://www.mcanerin.com/EN/articles/301-redirect-IIS.asp

When I moved to this site a couple of months ago and redirected the old blog to this one, I experienced the joys and sorrows that we all do when we move sites. I was redirecting at several levels. From the .htaccess file of the old site, I was doing a site-wide redirect. From the .htaccess file of the new site, I was redirecting from the old URL pattern to the new one (and from the non-www version to the www version). Wordpress itself was also redirecting, for instance, from the version of the URL without the slash to the version with it. Within .htaccess, some redirects use RedirectMatch, others use Redirect, and others are really URL rewrites using mod_rewrite.

I also redirected my feed using .htaccess and Feedburner, and am still sorting out how (and if you really can) redirect and consolidate (even if you’re using MyBrand).

There’s a lot going on and I intentionally unleashed it using all kinds of variations to see what would happen. For you. Surely someone will send me a cookie.

The difference between 301s and 302s

I have a whole set of notes that I’m writing up on all the different redirection options and what the pitfalls are, but for now, I wanted to illustrate the difference between a 301 and a 302. I am asked this a lot (“does it really make a difference?). It can get confusing, because although search engines say to use a 301 when moving a site (or page), server software tends to use a 302 as the default when you implement a generic redirect (without specifying if it should be a 301 or 302).

Some of the redirects for my site move were initially implemented as 302s and others as 301s, so I could see how things worked in real time.

A 302 is a “temporary” redirect

Search engines tend to interpret a 302 as an instruction to index the old URL but the new content. It keeps the old URL because the server has said that the new one is only “temporary”. You can see that here with a Google search for my name. As you can see, the URL is for the old site, but the title and description in the search result are from the new one.

A 301 is a “permanent” redirect

Search engines interpret a 301as an instruction to replace the old URL with the new one. As you can see, once I changed the redirect to 301, the new URL showed up in the place of the old one.

The new URL is ranking in the same location for the query [vanessa] as the old URL was, which implies that the links and anchor text that pointed to the old URL are now being transferred to the new URL. In addition, you might notice that the URL I’m redirecting my old home page to (www.ninebyblue.com/blog/) has a toolbar PageRank of 6, while the home page of this site (www.ninebyblue.com) has a toolbar PageRank of 4, so at least in terms of visible toolbar PageRank, that credit is passed via the 301 as well.

Should you use a 301 or 302?

As you can see, for a permanent site (or page) move (and to consolidate duplicate pages), a 301 is the way to go, and you should check with the details of your implementation to make sure that your redirect really is happening via 301.

REFERENCE

http://www.ninebyblue.com/blog/a-short-case-study-on-redirects-301s-vs-302s/

How do I restrict the number of connections used by a single IP address to my server for port 80 and 25 using iptables?

You need to use the connection limit modules which allows you to restrict the number of parallel TCP connections to a server per client IP address (or address block). This is useful to protect your server or vps box against flooding, spamming or content scraping.

Syntax

The syntax is as follows:

# /sbin/iptables -A INPUT -p tcp –syn –dport $port -m connlimit –connlimit-above N -j REJECT –reject-with tcp-reset

save the changes see iptables-save man page, the following is redhat and friends specific command service iptables save

Example: Limit SSH Connections Per IP / Host

Only allow 3 ssh connections per client host:

# /sbin/iptables  -A INPUT -p tcp –syn –dport 22 -m connlimit –connlimit-above 3 -j REJECT

save the changes see iptables-save man page, the following is redhat and friends specific command service iptables save

Example: Limit HTTP Connections Per IP / Host

Only allow 20 http connections per IP (MaxClients is set to 60 in httpd.conf):

# /sbin/iptables -A INPUT -p tcp –syn –dport 80 -m connlimit –connlimit-above 20 -j REJECT –reject-with tcp-reset

save the changes see iptables-save man page, the following is redhat and friends specific command service iptables save

Skip proxy server IP 1.2.3.4 from this kind of limitations:

# /sbin/iptables -A INPUT -p tcp –syn –dport 80 -d ! 1.2.3.4 -m connlimit-above 20 -j REJECT –reject-with tcp-reset

Enjoy it….

REFERENCE

http://www.hackadmin.com/2010/02/18/how-to-create-connection-limits-with-iptables/

Mastering iptables could take a while, but if you have a few rules to cover the basic security needs, you’ll be well on your way to protecting your Linux system. Jack Wallen explains some key rules to get you started.

The iptables tool is a magnificent means of securing a Linux box. But it can be rather overwhelming. Even after you gain a solid understanding of the command structure and know what to lock down and how to lock it down, iptables can be confusing. But the nice thing about iptables is that it’s fairly universal in its protection. So having a few iptables rules to put together into a script can make this job much easier.

With that in mind, let’s take a look at 10 such commands. Some of these rules will be more server oriented, whereas some will be more desktop oriented. For the purpose of this article, I’m not going to explain all of the various arguments and flags for iptables. Instead, I’ll just give you the rule and explain what it does. For more information on the specifics of the rule, you can read the man page for iptables, which will outline the arguments and flags for you.

Note: This article is also available as a PDF download.

1: iptables -A INPUT -p tcp -syn -j DROP

This is a desktop-centric rule that will do two things: First it will allow you to actually work normally on your desktop. All network traffic going out of your machine will be allowed out, but all TCP/IP traffic coming into your machine will simply be dropped. This makes for a solid Linux desktop that does not need any incoming traffic. What if you want to allow specific networking traffic in — for example, ssh for remote management? To do this, you’ll need to add an iptables rule for the service and make sure that service rule is run before rule to drop all incoming traffic.

2: iptables -A INPUT -p tcp –syn –destination-port 22 -j ACCEPT

Let’s build on our first command. To allow traffic to reach port 22 (secure shell), you will add this line. Understand that this line will allow any incoming traffic into port 22. This is not the most secure setup alone. To make it more secure, you’ll want to limit which machines can actually connect to port 22 on the machine. Fortunately, you can do this with iptables as well. If you know the IP address of the source machine, you can add the -s SOURCE_ADDRESS option (Where SOURCE_ADDRESS is the actual address of the source machine) before the –destination-port portion of the line.

3: /sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

This will allow all previously initiated and accepted exchanges to bypass rule checking. The ESTABLISHED and RELATED arguments belong to the –state switch. The ESTABLISHED argument says, “Any packet that belongs to an existing connection,” and the RELATED argument says, “Any packet that does not belong to an already existing connection but is related to an existing connection.” The “state machine” of iptables is a means for iptables to track connections with the help of the kernel level “conntrack” module. By tracking connections, iptables knows what connections can be allowed and what can’t. This reduces the amount of work the administrator has to do.

Here’s how state works. If the local user initiates a connection, that packet (to that connection) is set as NEW in the prerouting chain. When the local user gets a return packet, the state is changed to ESTABLISHED in the prerouting chain. So when a state is set as ESTABLISHED, it can be allowed with the right iptables rule.

4: iptables -N LOGDROP

With this handy chain, iptables will log all dropped packets. Of course, this is only part of the chain. To complete it, you need to add the follow two rules: iptables -A logdrop -J LOG and iptables -A logdrop -J DROP. Now all matching packets (in this case, anything that has been dropped) will be added to the logdrop chain which will log them and then drop them.

5: iptables -t nat -A PREROUTING -i WLAN_INTERFACE -p tcp –dportPORTNUMBERS -j DNAT –to-destination DESTINATION_IP

When you need to route packets from external sources to specific ports on specific internal machines, this is what you want to do. This rule takes advantage of network address translation to route packets properly. To suit your needs, the WLAN_INTERFACE must be changed to the WLAN interface that bridges the external network to the internal network, the PORTNUMBERS must be changed, and DESTINATION_IP must be changed to match the IP address of the destination machine.

6: iptables -A INPUT -p tcp –syn –dport 25 -j ACCEPT

This is the beginning of a SYN flood protection rule. This portion of the rule blocks DoS attacks on a mail server port. (You can change this to suit your mail server needs.) There are three more portions of this rule set. The first is to add the same rule but modify the port to whatever is being served up by whatever ports you have open. The next portion is iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 4 -j ACCEPT, which is the actual SYN flood protection. Finally, iptables -A INPUT -p tcp –syn -j DROP will drop all SYN flood packets.

7: iptables -A INPUT -p tcp -m tcp -s MALICIOUS_ADDRESS -j DROP

This is where you can take care of malicious source IP addresses. For this to work properly, you must make sure you know the offending source IP address and that, in fact, it’s one you want to block. The biggest problem with this occurs when the offending address has been spoofed. If that’s the case, you can wind up blocking legitimate traffic from reaching your network. Do your research on this address.

8: iptables -N port-scan

This is the beginning of a rule to block furtive port scanning. A furtive port scan is a scan that detects closed ports to deduce open ports. Two more lines are needed to complete this rule:

iptables -A port-scan -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j RETURN

iptables -A port-scan -j DROP

Notice that the above rule set is adding a new chain called “port-scan”. You don’t have to name it such; it’s just easier to keep things organized. You can also add timeouts to the above rule set like so:

iptables -A specific-rule-set -p tcp --syn -j syn-flood

iptables -A specific-rule-set -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j port-scan

9: iptables -A INPUT -i eth0 -p tcp -m state –state NEW -m multiport –dports ssh,smtp,http,https -j ACCEPT

What you see here is a chain making use of the multiport argument, which will allow you to set up multiple ports. Using the multiport argument lets you write one chain instead of multiple chains. This single rule saves you from writing out four separate rules, one each for ssh, smtp, http, and https. Naturally, you can apply this to ACCEPT, DENY, REJECT.

10: iptables -A PREROUTING -i eth0 -p tcp –dport 80 -m state –state NEW -m nth –counter 0 –every 4 –packet 0 -j DNAT –to-destination 192.168.1.10:80

If you’re looking to load balance between multiple mirrored servers (in the example case, load balancing a Web server at 192.168.1.10), this rule is what you want. At the heart of this rule is the nth extension, which tells iptables to act on every “nth” packet. In the example, iptables uses counter 0 and acts upon every 4th packet. You can extend this to balance out your mirrored sites this way. Say you have four mirrored servers up and you want to balance the load between them. You could have one line for each server like so:

<code>iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 0 -j DNAT --to-destination 192.168.1.10:80</code>

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 1 -j DNAT --to-destination 192.168.1.20:80

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 2 -j DNAT --to-destination 192.168.1.30:80

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 3 -j DNAT --to-destination 192.168.1.40:80

As you can see the server on .10 will be routed every 0 packet, the server on .20 will be routed every 1st packet, the server on .30 will be routed every 2nd packet, and the server on .40 will be routed every 3rd packet.

REFERENCE

http://blogs.techrepublic.com.com/10things/?p=539

Logging ALL incomming and outgoing traffic

A Customized Logging Chain to Log all ssh connections

#!/bin/bash
  iptables -N LOGIT # special chain to log all except fragments

  iptables -A LOGIT -m state --state ESTABLISHED -j RETURN # don't log frags
  iptables -A LOGIT -j LOG
  iptables -A LOGIT -j RETURN

  iptables -A INPUT -p tcp --dport 22 -j LOGIT
#end

#!/bin/bash<br /><br />  iptables -D LOGIT -m state --state ESTABLISHED -j RETURN <br />  iptables -D LOGIT -j LOG<br />  iptables -D LOGIT -j RETURN<br /><br />  iptables -D INPUT -p tcp --dport 22 -j LOGIT<br />  iptables -X LOGIT <br /><br /><br />#end<br /><br />

Blocking an IP (Drop connection)

Blocking an IP (Rejecting connection)

Blocking access of an ip to a certain port

Blocking All Incomming Traffic at a port

Blocking Incomming Pings

Blocking access to an external ip from within your server

Blocking access to an external port of an external ip

Redirecting a tcp port to another port

Redirecting traffic from specific ip at a tcp port to another port

Routing traffic from specific port to another server

The problem

Duplicate content, link juice etc

The 301 redirect

Time delays

Loss of rankings

Pagerank

Updating old links

Cleaning up URLs

The bottom line

1. Login to your mail server
   http://mail.comentum.com/mail/
   - Enter your user name (your email address)
   - Enter your password
2. Delete the corrupt/damaged message that is creating the duplicates
   (You may want to delete all messages on the server, after you have downloaded them to your Outlook.)

Generally, all Linux distributions needs a scheduled reboot once to stay up to date with important kernel security updates. RHN (or other distro vendors) provides Linux kernel security updates. You can apply kernel updates using yum command or apt-get command line options. After each upgrade you need to reboot the server. Ksplice service allows you to skip reboot step and apply hotfixes to kernel without rebooting the server. In this post I will cover a quick installation of Ksplice for RHEL 5.x and try to find out if service is worth every penny.



The technology and hack behind this looks pretty cool. This is useful if you've a small number of Linux based servers and/or you want avoid unscheduled reboot just to apply hotfix to Linux kernel.

How Do I Install Ksplice?

First, you need to register with Ksplice. Type the following command to install rpm repo under RHEL 5:

# rpm -ivh https://www.ksplice.com/yum/uptrack/centos/ksplice-uptrack-release.noarch.rpm

To install Ksplice, enter:

# yum install uptrack

Edit /etc/uptrack/uptrack.conf, enter:

# vi /etc/uptrack/uptrack.conf

Update it as follows (input your access key):

[Auth]
accesskey = ADD-YOUR-ACCESS-KEY-HERE

[Network]
# Proxy to use when accessing the Uptrack server, of the form
# [protocol://]<host>[:port]

# The proxy must support making HTTPS connections. If this is unset,
# Uptrack will look for the https_proxy, HTTPS_PROXY, and http_proxy
# environment variables in that order, and then finally look for a
# proxy setting in the system-wide GConf database, if available.
https_proxy =

[Settings]
# Automatically install updates at boot time. If this is set, on
# reboot into the same kernel, Uptrack will re-install the same set of
# updates that were present before the reboot.
install_on_reboot = yes

# Options configuring the Uptrack cron job.
#
# GUI users will get all notices via the GUI and likely want to set
# the following cron options to "no".

# Cron job will install updates automatically
autoinstall = no

# Cron job will print a message when new updates are installed.
# This option is only relevant if autoinstall = yes
cron_output_install = no

# Cron job will print a message when new updates are available
cron_output_available = no

# Cron job will print a message when it encounters errors
cron_output_error = no</host>

Save and close the file.

How Do I Apply Rebootless Kernel Updates?

You need to first download and apply updates via RHN:

# yum -y update

OR

# yum update kernel kernel-headers kernel-devel

Don't reboot the box, simply type the following command to apply hotfix:

# uptrack-upgrade

To see a list of updates that are currently installed, enter:

# uptrack-show -y

Sample Email Notification

You will get an email as follows when updates are available:

Fig.01: Ksplice Update Notification

Fig.02: Uptrack Web Interface

Conclusion

The pricing is as follows:

• Monthly price per system First 20 servers : $3.95
• Beyond 20 servers: $2.95
• Currently it is free for all Ubuntu users.

Ksplice is a pretty good and stable software. This is useful for Linux admin or business who can not accept downtime for patching. A few business comes in my mind:

• Small shop, say 8-12 Linux based servers.
• Pro-blogging or webmaster servers (a typical setup included one web server and one db server). Avoiding downtime means more ad revenue for webmasters.
• Hosting companies - again avoiding downtime means good customer satisfactions and less work for sys admins. If you run VM based hosting (OpenVZ or XEN based vps) you can avoid downtime too.
• Small cluster of Linux system, say 6 system - If cluster is using 80% of capacity and if one of node rebooted for kernel upgrade, load will up for rest of 5 systems. In such case, this service can help to keep load under control without rebooting the box. However, this is NOT very useful for very large Linux based cluster redundant load-balanced servers, routers, switches, firewalls etc. Since your cluster is so large that 4-5 servers failing makes no difference to the remaining nodes. In some cases it is possible to do geo load balancing too.

But I've HA Failover Solution In Place...

100% uptime depends upon lots of factors and and HA solution handles hardware or other failures very well. However, Ksplice service is not all about 100% uptime, it is about not rebooting your server for a Linux kernel upgrade. You can easily combine Ksplice with HA solution (such as keepalived+nginx reverse proxy) and try to get perfect five 9s. I highly recommend this service for small to medium size business or professional webmasters.

Further readings:

• Ksplice Uptrack frequently asked questions
• http://www.cyberciti.biz/tips/debian-centos-redhat-hotfix-patch-linux-kernel.html
  

This document attempts to answer the commonly-asked questions about
setting up virtual hosts. These scenarios are those involving multiple
web sites running on a single server, via name-based or IP-based virtual hosts.