All posts by bsdman

Currently working as an IT Manager. Worked for an OIT company as a Network Engineer in 2011. Worked for a Medical IT company as the Network Administrator 2009-2011. Worked as the Senior Systems Administrator at a computer reseller from 2005-2009. Worked as a Computer Consultant for several small companies from 2007-2009. Worked as a Computer Technician at a computer reseller from 2002-2004.
Linux

Cloudflare Apache access_log 127.0.0.1

Leave a comment

Running a standard Apache2 website behind a Cloudflare tunnel and I see that any access attempts are logged with:

127.0.0.1 - - [19/May/2026:18:40:18 +0000] "GET / HTTP/1.1" 304 248 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"

We’ll need to enable apache’s remoteip module, configure our apache site’s conf to include the required cloudflare header, change our apache logformat syntax, and then define the trusted cloudflare proxy IP’s. Sounds harder than it really is, so here are the commands.

Enable the Apache remoteip Module
sudo a2enmod remoteip

Update your apache site conf file
nano /etc/apache2/sites-available/000-default.conf

ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ServerName my.awesome.server
RemoteIPHeader CF-Connecting-IP
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

Update the Apache LogFormat Syntax
nano /etc/apache2/apache2.conf
Search for LogFormat “%h %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” combined
Replace with LogFormat “%a %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” combined

Create Remote IP Trusted Proxy File
nano /etc/apache2/conf-available/remoteip.conf

RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/13
RemoteIPTrustedProxy 104.24.0.0/14
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22

You can grab the updated list from https://www.cloudflare.com/ips-v4/# or https://cloudflare.com/ips/

Test Apache Configuration
sudo apache2ctl configtest

Restart Apache Services
sudo apache2ctl restart

Linux

Add swap drive to linux

Leave a comment

My tiny lightsail ubuntu server is running a java-based application along with a MySQL/MariaDB database backend with a small 2GB of RAM allotment. Every 30 or so days the system would lock up and I’d have to force a stop and start from the Lightsail AWS interface.

My workaround was to schedule a monthly reboot. Then it started happening more frequently, so I changed the scheduled reboot to be weekly. But now we’re down to an almost 8 hour maximum uptime before it locks up. Great.

Running free I see that there’s no swap. Probably a RAM usage issue from the database side, so I need to run the following:

fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile && sed -i '$ a\/swapfile swap swap defaults 0 0' /etc/fstab

Linux, Microsoft, Miscellaneous

Schedule WinSCP Folder Sync

Leave a comment

WinSCP is one of those tools that makes my Windows-life much more useful. I was originally planning on using syncthing, but for my purposes this was proving to be not a great match.

I needed to copy files from our Windows/Samba shares over to the paperless-ngx server I recently spun up (side note, this is amazing for saving shipping docs, customer PO’s, and other pdfs the org creates). Unfortunately, paperless-ngx will delete the uploaded PDF (located in the consume directory) once it’s been ingested into the system. This tells syncthing “hey, the file is missing, so re-upload it”. Repeat. The good thing is that paperless will NOT keep adding the files as duplicates. The bad thing is that the files now live in several places, eating up precious disk space.

I also did not want non-PDF’s to appear in paperless. Since this was a new project, I also didn’t want to copy any documents older than 30 days (we have 8+ years of archival data). Enter winscp.com – not the URL, but the CLI application.

I created a batch file with the following – obviously change to fit your needs. I should note that SCP requires the hostkey to be setup; this can be found by using the WinSCP GUI, connecting to the paperless-ngx server, and then right-click on the connection tab and select “Generate session URL/code” (it also provides the basis for the script below).

@echo off

"C:\Program Files (x86)\WinSCP\WinSCP.com" ^
/log="C:\temp\Winscp_ShippingComputer_Sync.log" /ini=nul ^
/command ^
"open scp://USERNAME:PASSWORD@10.101.110.16/ -hostkey=""ssh-ed25519 255 03rzYT4K2ufZ2yY3cG4Z5/thG8/dB3UbTi9F7ja9uHY""" ^
"synchronize remote "Y:\Shipping_Scans" "/home/linuxuser/paperless-ngx/consume" -rawtransfersettings ExcludeHiddenFiles=1 -filemask=""*.pdf>=30D""" ^
"exit"

set WINSCP_RESULT=%ERRORLEVEL%
if %WINSCP_RESULT% equ 0 (
echo Success
) else (
echo Error
)

exit /b %WINSCP_RESULT%

Linux

Add Disk Space Ubuntu Server

Leave a comment

Using Ubuntu 22.04LTS on my proxmox system.

Added 70GB to my 30GB partition for a total of 100GB – used the Proxmox GUI to handle this change.

Logged into the Ubuntu VM (CLI Only)
Verify my disk (sda) shows 100GB and my partition (sda3) shows 30GB
lsblk

Verify /dev/mapper with df -h (needed for lvextend below, see example)

FDISK
fdisk /dev/sda
p
d
3
n
3
w

p to verify the partitions, although this also shows in lsblk. d to delete, selecting 3. n for new partition, 3, start and end are defaults to fill the disk. w to write the changes. MAKE SURE YOU DON’T SELECT TO DELETE THE LVM SIGNATURE OTHERWISE YOUR DATA MAY BE LOST.

Resize the partition table in LVM
pvresize /dev/sda3

Extend the logical volume in LVM
lvextend -l +100%FREE /dev/mapper/ubuntu–vg-ubuntu–lv

Resize the filesystem for Ubuntu
resize2fs /dev/mapper/ubuntu–vg-ubuntu–lv

Microsoft

Bypass Network Selection Windows 11 Install

Leave a comment

Windows 2000, XP, and even Vista all would install without any need for an active internet connection. Starting with Win7 – and running through 8, 8.1, and 10 – MS was prompting users to connect to the internet in order to a) create a Microsoft online account and b) patch the system before you really start using it. It was an optional step that was easily bypassed (although on 10 they started “hiding” the option). But with Windows 11… not so much.

I should also note that the Pro, Education, and Enterprise variants are not impacted by this problem.

During the installation/configuration steps when setting up your Out Of Box Experience (OOBE comes back in just a few moments), simply follow along once you get to the Network Selection screen options.

Shift + F10
OOBE\BYPASSNRO
<enter>

Shift + F10 will open a command prompt window. OOBE\BYPASSNRO command sets the Out of Box Experience (see, I told you it would come back) to bypass the need for networking and registration options.

The computer will automatically reboot at this point and you’ll be able to continue with the initial setup steps and get to you Win 11 desktop without registering or connecting to a network. Huge benefit when setting up a workstation while not near an active network drop – or when I had a rather lengthy layover at an airport and wanted to pass the time on my dev laptop.

Linux, Networking

U6 Pro Unifi Not Updating

Leave a comment

I’ve had many access points from Unifi over the years. Updating from the controller is generally a painless operation, and only rarely have I ever needed to utilize the CLI to make any changes (mostly set-inform related).

However, when attempting to update the firmware of my Unifi systems (U6-Pro, US-24-250W, US-8-60W, UAP-nanoHD, and U6-Pro), I got stuck on the U6-Pro. I would click on upgrade the firmware and then the access point would get stuck on the blue/white blinking LED for hours. I even let it sit there overnight just to see. For the record, I was attempting to upgrade from 6.0.14 to 6.0.15 at the time, and it was not happy. Unplugging from power and then plugging back in would get me back to the 6.0.14 version, so no harm no foul.

I figured it would get fixed with a new release of the controller as well as a firmware release to 6.0.18. Wrong. Same issue. I even attempted to CLI it by logging in via SSH and running the “upgrade https://dl.ui.com/unifi/firmware/UAP6MP/6.0.18.13660/BZ.ipq50xx_6.0.18+13660.220413.1958.bin” command. No dice. Hard reboot and it’s back on 6.0.14.

Swannman had the same issue posted on the unifi forms, and UI-Glenn gave an updated command for me to try:

curl https://dl.ui.com/unifi/firmware/UAP6MP/6.0.18.13660/BZ.ipq50xx_6.0.18+13660.220413.1958.bin -o /tmp/fwupdate.bin && fwupdate.real -m &

Magically this worked and the controller reads it just fine. Posting for future sake of my sanity.

Linux

OPNSense Booting.. Stuck

Leave a comment

Trying to install OPNSense on an older Alibaba system I had laying around, and I noticed that I couldn’t install due to the system freezing at the “Booting…” prompt (post kernel loading).

When booting, press “3” to Escape to loader prompt.

  • Type set kern.vty=sc
  • Press enter
  • Type boot
  • Press enter

Assuming the system boots and you can install, you’ll have to edit a file in the /boot directory to get the system to boot with future restarts.

  • cd /boot; press enter
  • vi loader.conf.local; press enter
  • i
  • kern.vty=sc
  • Press esc
  • :wq!; press enter

I should note that this fix was permanent between reboots and updates until just recently; patched a remote system of similar specs and it required the creation of the loader.conf.local file again.