However, when a client is blocked, it will keep on using resources on your server. Even if the request will result in a 403 error, it’s still a connection that needs to be handled. In some cases, it might require spawning a new process for no good reason.

It’s quite easy to configure mod_evasive so that the evil IPs are blocked via the machine firewall, though:

You could put an iptables command there, but I prefer to use a small script because it’s easier to maintain. Also I don’t want to block the IP until the end of time So, I use this:

Don’t forget to grant the permission to run the script to the account used by apache. My sudoers config contains:

And here’s the result, on a busy server victim of some abuse:

Red means “system time”, blue is “user time”. The green arrow marks the time when I configured it to use iptables.

Anyway, if you just upgraded your system to Lion, then downloaded the new Xcode from the App Store, tried to run it just to get welcomed by a sparkling crash along the lines of

UNCAUGHT EXCEPTION (NSInternalInconsistencyException): Couldn’t load plug-in ‘com.apple.dt.IDE.IDEiPhoneSupport’ while firing fault for extension ‘Xcode.Device.iPhoneSimulator’

Don’t panic!

Simply go to your Applications folder and re-run the Xcode installer. The second time it’ll get it right, or at least it did for me.

Anyway, AdBlock comes to rescue. Just add a filter blocking http://*.i.com.com/*.js and the problem vanishes.

Among these missing features, attributes are what I needed in order to solve a certain problem in an elegant way.

Looking at what the reflection API was offering, I came up with a simple way to decorate my properties/methods/classes with attributes: through the documentation comments!

Let’s see an example:

Running the above script you’ll see the following output, confirming that everything works as desired:

Test A:
Array
(
    [0] => attr
    [1] => attr2
)
Test B:
Array ( [0] => attr3 )

If you’re using the /** */ comments for real documentation, you might want to use another escape character rather than @, to avoid problems.

Happy coding

One of my Linux box hard drives decided to fail this morning. Luckily, it’s not totally failed, but the superblock is gone AWOL. Let’s recap what I did to revive it until a replacement can be mounted.

1. The first thing I’ve noticed was that my /storage partition had been re-mounted as read-only when the kernel intercepted an error. So I simply umount’ed it and tried a fsck.ext3 /dev/hda1. Too bad it couldn’t read the superblock, thus it failed…
2. So I ran mke2fs -n /dev/hda1: the -n switch means “don’t create a filesystem, just tell me where the superblock backups will be stored”. As long as the other parameters are the same as those used when creating the filesystem, this will correctly locate the superblock backups. The first one reported in my case was at block 32768.
3. At this point I’ve been able to repair the filesystem using fsck.ext3 -b 32768 /dev/hda1.
4. Finally, I tried to remount the partition with mount /storage, but obviously it would have been too easy… the first superblock is currently sitting on a Really Dead Sector (TM)
5. Knowing that the backup at block 32768 was working, I’ve finally been able to finish the job with mount -t ext3 -o sb=131072 /dev/hda1 /storage (where 131072 is 32768 * 4, as the filesystem uses 4k blocks, while mount uses 1k units)

Phew! Everything looked good at this point. Good enough to backup a lot of data, anyway.

Know the feeling?

Sadly, in version 3.0 they removed this useful tool. Too bad that the disk image format has changed as well since v2.5, thus you can’t even downgrade just to do the resizing if you started your virtual OS with the new version.

Well, yesterday a certain Randyp posted an easy solution to this problem, which does the trick while the Parallels team works on the next update (which should provide a new ImageTool). Even if it requires a lot of space, it works flawlessly.

Kudos to Randyp!

• it’s more secure: rsync is tunnelled through an SSH connection. My previous hoster only supported plain FTP, meaning that everything was in cleartext, including username and password.
• it’s waaay more comfortable: I can do any change I wish on my local copy of the site and when everything is ready I can just launch a mini-script to go live. I don’t have to worry about forgetting something anymore

So how do I do it?

I’ve created a simple sync_my_site.sh script like this:

1 2 3 4 5

#!/bin/sh rsync -rltuO \n          --progress \n          --delay-updates \n          --delete --delete-after \n          -e 'ssh -i /home/wiz/.ssh/my_hosting_id' \n          --exclude-from=/www/site/.rsyncignore \n          /www/site/ user@host:/home/user/site/ ssh -i /home/wiz/.ssh/my_hosting_id user@host 'chmod -R o+r site'

The first parameters (rltuO) tell rsync to recursively update the site, preserving file times and symbolic links and skipping files newer than the local copy.

–delay-updates is useful to replace all the files when the upload is complete, to minimize the probabilities of breaking the site while some users are browsing on it

–delete tells rsync to remove files on the remote host that are not present on your local system

-e is needed in my case to specify the identity I wish to use for the SSH connection.

–exclude-from points to a text file which contains a list of files that rsync should not consider. It’s useful to avoid it from uploading your local configuration files overwriting the production values

Finally, after rsync completes its job, I launch another command on the remote server to fix the file permissions so that the webserver can read all the files. If your production and development servers have the same configuration, you can also skip that line and add -p on rsync’s command line, so that it will preserve the file permissions as well.