backend default { 
 .host = "<IP-des-Webservers>"; 
 .port = "80"; 
    .probe = { 
        .url = "/index.html"; 
        .interval = 5s; 
        .timeout = 10s; 
        .window = 5; 
        .threshold = 3; 
    } 
} 
sub vcl_recv { 
        set req.backend = default; 
        #Falls das Backen nicht erreichbar, liefern wir fuer eine Stunde alten Inhalt aus 
        if (req.backend.healthy) { 
        } 
        else{ 
            set req.grace = 1h; 
        } 
 
...
 
}

apt-get install python-dev mercurial sqlite3 python-virtualenv libapache2-mod-wsgi
cd /opt
mv server-full weave
cd weave
make build

mkdir /opt/weave/data/

chown -R www-data:www-data /opt/weave/data/
chmod 770 /opt/weave/data

chown www-data:www-data /opt/weave/deps/server-reg/syncreg/templates
chmod 770 /opt/weave/deps/server-reg/syncreg/templates

sqluri = sqlite:////tmp/test.db

sqluri = sqlite:////opt/weave/data/ffsync.db

fallback_node = htlp://localhost:5000/

fallback_node = htlp://weave.meinserver.lan

[smtp]
host = localhost
port = 25
sender = admin@weave.meinserver.lan

/etc/apache2/sites-available/weave.meinserver.lan

<VirtualHost *:80>
  ServerName weave.meinserver.lan
  DocumentRoot /opt/weave
  WSGIProcessGroup sync
  WSGIDaemonProcess sync user=www-data group=www-data processes=2 threads=25
  WSGIPassAuthorization On
  WSGIScriptAlias / /opt/weave/sync.wsgi
  CustomLog /var/log/apache2/weave.meinserver.lan-access.log combined
  ErrorLog  /var/log/apache2/weave.meinserver.lan-error.log
</VirtualHost>
<Directory /opt/weave>
  Order deny,allow
  Allow from all
</Directory>
 

apt-get install varnish geoip-bin libnet-ip-perl libgeo-ipfree-perl \
libgeo-ip-perl libgeoip-dev

wget https://www.varnish-cache.org/trac/raw-attachment/wiki/
\GeoipUsingInlineC/GeoIP-plugin-2.tar.gz

tar xf GeoIP-plugin-2.tar.gz
cd GeoIP-plugin/lib/

make

make test

GeoIP plugin loaded successfully.
Testing IPs:
195.110.128.11 => IT (OK)
157.166.224.25 => US (OK)
212.58.224.138 => GB (OK)
80.91.37.210 => NO (OK)
192.168.0.1 => Unknown (OK)
(null) => Unknown (OK)

cp geoip_plugin.so /etc/varnish/

 
# Mobile weiche mithilfe von Varnish und GeoIP
# Lade das Plugin /etc/varnish/geoip_plugin.so
C{
    #include <dlfcn.h>
    #include <stdlib.h>
    #include <stdio.h>
 
    static const char* (*get_country_code)(char* ip) = NULL;
    __attribute__((constructor)) void
    load_module()
    {
    const char* symbol_name = "get_country_code";
    /* Lade unser kompiliertes Plugin*/
    const char* plugin_name = "/etc/varnish/geoip_plugin.so";
    void* handle = NULL; /* Erstelle Dateihandle */
    handle = dlopen( plugin_name, RTLD_NOW );
    if (handle != NULL) { /* Falls die Datei existiert */
        get_country_code = dlsym( handle, symbol_name );
        if (get_country_code == NULL) /*  Plugin funktioniert nicht*/
        fprintf( stderr, "\nError: Could not load GeoIP plugin:\n%s\n\n", dlerror() );
        else /*  Plugin funktioniert */
        printf( "GeoIP plugin loaded successfully.\n");
    }
    else /* Falls die Datei nicht existiert */
        fprintf( stderr, "\nError: Could not load GeoIP plugin:\n%s\n\n", dlerror() );
    }
}C
 
# PC Clients allgemein
backend default {
    .host = "127.0.0.1";
    .port = "80";
}
# Mobile Clients die keine Deutsche Sprache sprechen
backend mobile_lang_en {
    .host = "127.0.0.1";
    .port = "81";
}
# Mobile Clients, welche Deutsch sprechen
backend mobile_lang_de {
    .host = "127.0.0.1";
    .port = "82";
}
 
sub vcl_recv {
    # GeoIP Herkunftsland ermitteln und HTTP Header X-Country-Code setzen. 
    C{
    VRT_SetHdr(sp, HDR_REQ, "\017X-Country-Code:", (*get_country_code)( VRT_IP_string
(sp, VRT_r_client_ip(sp)) ), vrt_magic_string_end);
    }C
    #No-Cache nur verarbeiten wenn die Seite nicht über einen Proxy und nicht
    #vom MSN-Bot aufgerufen wird
    if (req.http.Cache-Control ~ "no-cache") {
        if (! (req.http.Via || req.http.User-Agent ~ "bot|MSIE")) {
            purge_url(req.url);
        }
    }
    # Herausfinden ob mobile oder pc User
    call detect_device;
    # Das Backend anhand von HTTP Header X-Device sowie X-Country-Code bestimmen
    call routing;
}
# Entscheidung welches Backend verwendet werden muss.
sub routing {
    # Falls ein nicht Mobile User verbindet, verwende default backend.
    if (req.http.X-Device == "pc") {
        return(pass);
    }
    if (req.http.X-Device == "mobile") {
    # Falls Herkunftsland DE, CH oder AT, schicke Traffic auf Mobile Deutsche Weiche
    if (req.http.X-Country-Code == "DE" || req.http.X-Country-Code == "AT" || 
    req.http.X-Country-Code == "CH") {
        set req.backend = mobile_lang_de;
    }
    # Fall nicht Herkunftsland DE oder AT, schicke Traffic auf Mobile Englische Weiche
        else {
            set req.backend = mobile_lang_en;
        }
    }
}
# Setze Header X-Device je nach Browseragent
# Der Browseragent verrät uns ob es sich um ein Mobile User handelt.
sub detect_device {
    # Gehe davon ersteinmal aus, dass es ein normaler PC User ist
    set req.http.X-Device = "pc";
    # LG Handys enthalten LG- im Agentenstring
    if (req.http.User-Agent ~ "LG-"){
        set req.http.X-Device = "mobile";
    }
    # Dies hier sind die populärsten Agentenstrings
    if (req.http.User-Agent ~ "iPhone" || req.http.User-Agent ~ "Android" ||
req.http.User-Agent ~ "Symbian" || req.http.User-Agent ~ "^BlackBerry" ||
req.http.User-Agent ~ "^SonyEricsson" || req.http.User-Agent ~ "^Nokia" || 
req.http.User-Agent ~ "^SAMSUNG" ||
req.http.User-Agent ~ "^LG" || req.http.User-Agent ~ "   webOS" ||
req.http.User-Agent ~ "Windows Phone") {
        set req.http.X-Device = "mobile";
    }
    # Palm Telefon Useragent string
    if (req.http.User-Agent ~ "^PalmSource"){
        set req.http.X-Device = "mobile";
    }
    # Andere bekannte Handy Browseragenten
    if ( req.http.user-agent ~
"(.*Blackberry.*|.*BlackBerry.*|.*Blazer.*|.*Ericsson.*|.*htc.*|.*Huawei.*
|.*iPhone.*|.*iPod.*|.*MobilePhone.*|.*Motorola.*|.*nokia.*|.*Novarra.*
|.*O2.*|.*Palm.*|.*Samsung.*|.*Sanyo.*|.*Smartphone.*
|.*SonyEricsson.*|.*Symbian.*|.*Toshiba.*|.*Treo.*|.*vodafone.*
|.*Xda.*|^Alcatel.*|^Amoi.*|^ASUS.*|^Audiovox.*|^AU-MIC.*
|^BenQ.*|^Bird.*|^CDM.*|^DoCoMo.*|^dopod.*|^Fly.*|^Haier.*
|^HP.*iPAQ.*|^i-mobile.*|^KDDI.*|^KONKA.*|^KWC.*|^Lenovo.*|^LG.*
|^NEWGEN.*|^Panasonic.*|^PANTECH.*|^PG.*|^Philips.*|^portalmmm.*
|^PPC.*|^PT.*|^Qtek.*|^Sagem.*|^SCH.*|^SEC.*|^Sendo.*|^SGH.*|^Sharp.*
|^SIE.*|^SoftBank.*|^SPH.*|^UTS.*|^Vertu.*|.*Opera.Mobi.*|.*Windows.CE.*
|^ZTE.*|.*LG.*|.*SAMSUNG.*|.*webOS|^Nokia*)"){
        set req.http.X-Device = "mobile";
    }
    # Falls es sich um Tablets handelt, verwende das normale Backend
    if (req.http.User-Agent ~ "(.*GT-P1000M.*|.*Xoom.*
|.*GT-P7100 Build/HRI83.*|.*A500 Build/HRI66.*
|.*iPad.*|.*iPod.*)") {
        set req.http.X-Device = "pc";
    }
}

backend default {
     .host = "xxx.xxx.xxx.xxx";
     .port = "80";
 }
 
 backend default2 {
     .host = "xxx.xxx.xxx.xxx";
     .port = "80";
 }
 
backend local {
     .host = "127.0.0.1";
     .port = "8080";
 }
 
sub vcl_recv {
 
    ##No-Cache nur verarbeiten wenn die Seite nicht über einen Proxy und nicht 
    #vom MSN-Bot aufgerufen wird
    if (req.http.Cache-Control ~ "no-cache") {
        if (! (req.http.Via || req.http.User-Agent ~ "bot|MSIE")) {
            ban (req.url);
        }
    }
 
    ##TYPO3-Backend nicht cachen
    if (req.http.cookie ~ "be_typo_user"){
        return (pass);
    }
    else if (req.http.host ~ "domain.tld"){
    }
    else{
     ##Cookies von TYPO3-Seiten löschen
     unset req.http.Cookie;
    }
 
     if (req.http.x-forwarded-for) {
        set req.http.X-Forwarded-For =
            req.http.X-Forwarded-For + ", " + client.ip;
     } else {
        set req.http.X-Forwarded-For = client.ip;
     }
 
    ##Richtiges Backend wählen
    if (req.http.host ~ "domain.tld") {
          set req.backend = default2;
    }
    else if (req.http.host ~ "lb1.lamp-solutions.de") {
          set req.backend = local;
    }
    else {
          set req.backend = default;
    }
     if (req.request != "GET" &&
       req.request != "HEAD" &&
       req.request != "PUT" &&
       req.request != "POST" &&
       req.request != "TRACE" &&
       req.request != "OPTIONS" &&
       req.request != "DELETE") {
#         /* Non-RFC2616 or CONNECT which is weird. */
         return (pipe);
     }
     if (req.request != "GET" && req.request != "HEAD") {
#         /* We only deal with GET and HEAD by default */
         return (pass);
     }
     if (req.http.Authorization || req.http.Cookie) {
#         /* Not cacheable by default */
         return (pass);
     }
     return (lookup);
}
 
#Wenn Seite vom Server geholt wird
sub vcl_fetch {
 
    ##No-Cache vom Server auswerten damit Varnish kapiert wenn TYPO3-Cache geleert wird
    if (beresp.http.Pragma ~ "nocache") {
        if (! (req.http.Via || req.http.User-Agent ~ "bot|MSIE")) {
            return (hit_for_pass);
        }
    }
}
 
# Wenn Anfrage aus dem Cache geholt wird
sub vcl_hit {
 
    if (req.http.Cache-Control ~ "no-cache") {
        if (! (req.http.Via || req.http.User-Agent ~ "bot|MSIE")) {
            set obj.ttl = 0s;
            return (restart);
        }
    }
    return(deliver);
}

req.http.X-Forwarded-For  ", " client.ip;

req.http.X-Forwarded-For + ", " + client.ip;

#!/bin/bash
 IFS="
 "
 # Status fuer Nagios bereitstellen
 LOGFILE=/usr/lib/nagios/plugins/raid.txt
 
 if [ -f $LOGFILE ];then
     rm $LOGFILE
 fi
 touch $LOGFILE
 
 # Abfrage des Status
 CHECKRAID=$(megasasctl | grep 'DEGRADED\|failure')
 
 # Status ok
 if (( $? != 0 ))
 then
     echo "0" | cat >> $LOGFILE
 else
     # Status Fehler - E-Mail senden
     echo -e "$(megasasctl)" | mail admin@deinedom.tld -s"$(hostname) RAID Fehler"
     # Status Rebuild ?
     RAIDDETAILS=$(megasasctl | grep rebuild)
     if (( $? == 0 ))
     then
         echo "1" | cat >> $LOGFILE
     else
         # Falls kein Rebuild - kritisch
         echo "2" | cat >> $LOGFILE
     fi
 fi

#!/bin/bash
 
 STATE_OK=0
 STATE_WARNING=1
 STATE_CRITICAL=2
 host=$(hostname)
 
 LOGFILE=/usr/lib/nagios/plugins/raid.txt
 STATUS=$(cat $LOGFILE)
 
 if [ $STATUS = "1" ]; then
     echo "WARNING - $host - RAID rebuilding"
     exit $STATE_WARNING;
 fi
 if [ $STATUS = "2" ]; then
     echo "CRITICAL - $host - RAID critical"
     exit $STATE_CRITICAL;
 fi
 
 if [ $STATUS = "Null" ]; then
     echo CRITICAL - $host -  RAID unknown
     exit $STATE_UNKNOWN;
 fi
 
 if [ $STATUS = "0" ]; then
     echo OK - $host -  RAID OK
     exit $STATE_OK;
 fi

wget foobar.lamp-solutions.de/uploads/media/varnishncsa-vhost_0.1-1_ubuntu.deb
dpkg -i varnishncsa-vhost_0.1-1_ubuntu.deb
vi /etc/default/varnishncsa-vhost
VARNISHNCSA_ENABLED=1 setzen
vi /etc/default/varnishncsa 
VARNISHNCSA_ENABLED=0 setzen

apt-get install varnish heartbeat

auth 2 
2 sha1 <passwort>

#!/bin/bash 
 case $1 in 
    start) 
        /etc/init.d/varnish restart 
    ;; 
    stop) 
        /etc/init.d/varnish restart 
    ;; 
    status) 
    ;; 
esac

backend node0 { 
  .host = "<hostip1>"; 
  .port = "80"; 
  .probe = { 
           .url = "/test.html"; 
           .timeout = 50 ms; 
           .interval = 1s; 
           .window = 10; 
           .threshold = 8; 
  } 
} 
 
backend node1 { 
  .host = "<hostip2>"; 
  .port = "80"; 
  .probe = { 
           .url = "/test.html"; 
           .timeout = 100 ms; 
           .interval = 1s; 
           .window = 10; 
           .threshold = 8; 
  } 
} 
 
director back1 random { 
    { .backend = node0; .weight = 1; } 
    { .backend = node1; .weight = 1; } 
} 
 
sub vcl_recv { 
 
   if (req.http.x-forwarded-for) { 
        set req.http.X-Forwarded-For = 
            req.http.X-Forwarded-For ", " client.ip; 
     } else { 
        set req.http.X-Forwarded-For = client.ip; 
     } 
 
      set req.backend = back1; 
 
     if (req.request != "GET" && 
       req.request != "HEAD" && 
       req.request != "PUT" && 
       req.request != "POST" && 
       req.request != "TRACE" && 
       req.request != "OPTIONS" && 
       req.request != "DELETE") { 
         return (pipe); 
     } 
     if (req.request != "GET" && req.request != "HEAD") { 
         return (pass); 
     } 
     if (req.http.Authorization || req.http.Cookie) { 
         return (pass); 
     } 
     return (lookup); 
}

//server> show
 
 Ctl   Model        (V)Ports  Drives   Units   NotOpt  RRate   VRate  BBU
 ------------------------------------------------------------------------
 c4    9650SE-2LP   2         2        1       0       1       1      - 

//server> /c4 show
 
 Unit  UnitType  Status         %RCmpl  %V/I/M  Stripe  Size(GB)  Cache  AVrfy
 ------------------------------------------------------------------------------
 u0    RAID-1    OK             -       -       -       1862.63   Ri     OFF    
 
 VPort Status         Unit Size      Type  Phy Encl-Slot    Model
 ------------------------------------------------------------------------------
 p0    OK             u0   1.82 TB   SATA  0   -            SAMSUNG HD204UI     
 p1    OK             u0   1.82 TB   SATA  1   -            SAMSUNG HD204UI

//server> /c4 show all
 
 /c4 Driver Version = 2.26.02.012
 ...
 ...
 /c4 Firmware Version = FE9X 4.10.00.007
 /c4 Bios Version = BE9X 4.08.00.002
 /c4 Boot Loader Version = BL9X 3.08.00.001
 ...
 ...
 /c4 Controller Bus Type = PCIe
 
 Unit  UnitType  Status         %RCmpl  %V/I/M  Stripe  Size(GB)  Cache  AVrfy
 ------------------------------------------------------------------------------
 u0    RAID-1    OK             -       -       -       1862.63   Ri     OFF    
 
 VPort Status         Unit Size      Type  Phy Encl-Slot    Model
 ------------------------------------------------------------------------------
 p0    OK             u0   1.82 TB   SATA  0   -            SAMSUNG HD204UI     
 p1    OK             u0   1.82 TB   SATA  1   -            SAMSUNG HD204UI

# tw_cli binary location
 TWCLI=/usr/local/3ware/tw_cli
 
 ADMIN="admin@email.de"
 
 # controller name
 CONTROLLER=c4
 
 # server-name
 SERVERNAME=sever-mit-wichtigem-RAID
 
 # get complete status
 STATUS_CONTROLLER=`$TWCLI /$CONTROLLER show`
 
 # check for RAID status
 STATUS_RAID=`echo "$STATUS_CONTROLLER" | grep "^u0" | awk '{ print $3; }'`
 
 [[ $STATUS_RAID != "OK" ]] && {
     echo "RAID ERROR DETECTED:"
     echo "===================="
     echo " "
     echo "Server : $SERVERNAME"
     echo "Time   : `date`"
     echo " "
     echo "$STATUS_CONTROLLER"
     echo " "
     echo "$STATUS_CONTROLLER" | mail $ADMIN -s"($SERVERNAME) RAID ERROR DETECTED!!"
     exit 1
 }
 
 # check for disk status
 STATUS_DISKS=`echo "$STATUS_CONTROLLER" | grep "^p[[:digit:]]" | awk '{ print $2; }'`
 
 [[ -z `echo "$STATUS_DISKS" | grep -v "^OK$"` ]] || {
     echo "#################################################"
     echo "#             DISK ERROR DETECTED:              #"
     echo "#################################################"
     echo "$STATUS_CONTROLLER"
     echo "$STATUS_CONTROLLER" | mail $ADMIN -s"($SERVERNAME) DISK ERROR DETECTED!!"
     exit 2
 }
 
 exit 0

//server> /c4 update fw=absoluter_Pfad_zur_Firmware-Datei

vi /etc/varnish/default.vcl

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

vi /etc/default/varnish

DAEMON_OPTS="-a :80 \
             -f /etc/varnish/default.vcl \
             -S /etc/varnish/secret \
             -s file,/data/varnish/$INSTANCE/varnish_storage.bin,1G"

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" \
%>s %b \"%{Referer}i\" \"%{User-Agent}i\"" varnishcombined
CustomLog /var/log/apache2/www.domain.tld-access.log varnishcombined

<Location />
    ProxyPass  htlp://www.domain.tld/?id=test/
    ProxyPassReverse  htlp://www.domain.tld/
</Location>

 
<Proxy *>
    RewriteEngine On
    RewriteRule \/$ /?id=test [L,NE]
</Proxy>

#!/bin/bash
IPBLACKLIST=/var/spool/ipblacklist.txt
for i in $(grep '"-" "-"' /var/log/apache2/www.domain-des-kunden.net-access.log \
| cut -d "-" -f1| sort -n | uniq);do
    if !( grep $i $IPBLACKLIST);then
        echo $i | cat >> $IPBLACKLIST
        iptables -A INPUT -i eth0 -p tcp -s $i --dport 80 -j DROP
        echo blacklisting:$i
    fi
done

#!/bin/bash
 
IPBLACKLIST=/var/spool/ipblacklist.txt
LOGFILE=/www/www.domain-des-kunden.de/ipblacklist.log
WHITELIST=/usr/local/bin/whitelist.txt
 
function blacklist {
    for i in $(netstat -tuna | grep :$PORT | grep SYN_RECV | awk -F' ' '{ print $5}' \
| awk -F':' '{ print $1}' | sort | uniq);do
        anzahl=$(netstat -tuna | grep :$PORT | grep SYN_RECV | grep $i | wc -l)
        echo $i:$PORT:$anzahl
        if [ $anzahl -gt 15 ];then
            if !(grep $i $WHITELIST);then
                if !(grep $i $IPBLACKLIST);then
                    echo $i | cat >> $IPBLACKLIST
                    echo $(date)";"$i";"$PORT";"$anzahl | cat >> $LOGFILE
                    iptables -A INPUT -i eth0 -p tcp -s $i --dport 80 -j DROP
                    iptables -A INPUT -i eth0 -p tcp -s $i --dport 443 -j DROP
                    iptables -A INPUT -i eth0 -p tcp -s $i --dport 22 -j DROP
                    iptables -A INPUT -i eth0 -p tcp -s $i --dport 25 -j DROP
                    echo blacklisting:$i
                fi
            fi
        fi
    done
}
 
#Webserver
PORT=80
blacklist
 
#ssh
PORT=22
blacklist