December 20, 2019 in Tips and Tricks, Ubuntu

How to Setup Varnish HTTP Cache on an Ubuntu

Varnish Cache is a web application accelerator that can be used as a proxy to your Apache web server. The open-source software sits in front of your web server to serve web traffic very fast. If you are running multiple servers, Varnish Cache can also be used as a load balancer.

Varnish works by caching regularly requested web content on the system memory, and this ensures faster information retrieval if the same information is asked for several times.

$ sudo apt-get install varnish

By default, Apache listens on port 80 for HTTP traffic. We need to make some changes here. Instead of the default settings, Varnish will instead listen on port 80  and forward all traffic to Apache web server which we will configure to listen on port 8080.

$ sudo nano /etc/apache2/ports.conf

Listen 8080
<IfModule ssl_module>
        Listen 443
</IfModule>
<IfModule mod_gnutls.c>
        Listen 443
</IfModule>

Press CTRL + X, Y and hit Enter to save the file once you make the changes.
Next, edit the default Apache Virtual Host to listen to port 8080 too:

$ sudo service apache2 restart

 Configure Varnish HTTP Cache to listen on port 80

Next we will configure Varnish to listen on port 80 and forward all requests to our Apache web server.

We can do this by editing Varnish configuration file ‘/etc/default/varnish’

$ sudo nano  /etc/default/varnish

DAEMON_OPTS="-a :80 \
             -T localhost:6082 \
             -f /etc/varnish/default.vcl \
             -S /etc/varnish/secret \
             -s malloc,256m"

Then, press CTRL + X, Y and hit Enter to save the file.

Next, check the file ‘/etc/varnish/default.vcl’ using a nano text editor. You should see the below content and this means Varnish will forward http traffic to port 8080:

$ sudo nano /etc/varnish/default.vcl

File contents:

# Default backend definition. Set this to point to your content server.
backend default {
.host = "127.0.0.1";
.port = "8080";
}

We also need to edit the port on the file ‘/lib/systemd/system/varnish.service’ file. To do so, type the command below:

$ sudo nano /lib/systemd/system/varnish.service

Change the default port from 6081 to 80 as shown below

[Unit]
Description=Varnish HTTP accelerator
Documentation=https://www.varnish-cache.org/docs/4.1/ man:varnishd
[Service]
Type=simple
LimitNOFILE=131072
LimitMEMLOCK=82000
ExecStart=/usr/sbin/varnishd -j unix,user=vcache -F -a :80 -T localhost:6082 -f$
ExecReload=/usr/share/varnish/varnishreload
ProtectSystem=full
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
[Install]
WantedBy=multi-user.target

Then, press CTRL + X, Y and hit Enter to save the file.

Restart Apache, Varnish, and the Systemd Daemon

$ sudo systemctl restart apache2
$ sudo systemctl daemon-reload
$ sudo systemctl restart varnish

If the setup was successful, Varnish will now be the default HTTP Listener on port 80.

Testing the Setup

You can now try visiting your server one more time on a web browser:

http://public_ip_adress
or
http://example.com

The server traffic should now be handled by Varnish HTTP Cache software and forwarded to Apache.

To make sure that Varnish is working, use the curl command for verification purposes:

$ curl -I server_ip_address

You should get an output similar to the below text. If you see the line ‘Via: 1.1 varnish (Varnish/5.2)’, then Varnish is working like expected.

HTTP/1.1 200 OK
Date: Thu, 05 Jul 2018 20:56:11 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 29 Jun 2018 07:19:34 GMT
Vary: Accept-Encoding
Content-Type: text/html
X-Varnish: 7
Age: 0
Via: 1.1 varnish (Varnish/5.2)
ETag: W/"2aa6-56fc2ab77545d-gzip"
Accept-Ranges: bytes
Connection: keep-alive

December 11, 2019 in Tips and Tricks, Ubuntu

How To Set Up/Enable a Firewall with UFW on Ubuntu

UFW, or Uncomplicated Firewall, is an interface to iptables

Prerequisites

To follow this tutorial, you will need:

UFW is installed by default on Ubuntu. If it has been uninstalled for some reason, you can install it with sudo apt install ufw.

$ sudo nano /etc/default/ufw

Then make sure the value of IPV6 is yes.

$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing

$ sudo ufw allow ssh

$ sudo ufw allow 22

$ sudo ufw enable

$ sudo ufw allow 80

$ sudo ufw allow 443

$ sudo ufw allow 6000:6007/tcp
$ sudo ufw allow 6000:6007/udp

$ sudo ufw allow from 203.0.113.4

$ sudo ufw allow from 203.0.113.4 to any port 22

$ sudo ufw allow from 203.0.113.0/24

$ sudo ufw allow from 203.0.113.0/24 to any port 22

$ sudo ufw deny http

$ sudo ufw deny from 203.0.113.4

$ sudo ufw status numbered

$ sudo ufw delete 2

$ sudo ufw delete allow http

$ sudo ufw delete allow 80

$ sudo ufw status verbose

$ sudo ufw disable

$ sudo ufw reset

November 13, 2019 in Tips and Tricks, Ubuntu

Reduce system reboots and improve kernel security.

Canonical Livepatch Service

Apply critical kernel patches without rebooting.

• Fixes are applied automatically, without restarting your system
• Reduces downtime, keeping your Ubuntu LTS systems secure
  and compliant
• Included as part of all Ubuntu Advantage for Infrastructure
  support packages

Livepatch is like a dream come true, both from a technical and a business standpoint. Our Ubuntu systems now rarely or never have to be rebooted. Service is continuous. That makes a big difference for user and customer satisfaction and loyalty.Masaaki Hirose, IT Platform Department, DeNA

Free for personal use

All you need is an Ubuntu One account. Free for 3 machines.

Get Livepatch

how to remove live patch from ubuntu

$ sudo snap remove canonical-livepatch