How to Install and Configure the Xymon Monitoring Client on CentOS 7 and Debian 9

The Xymon infrastructure monitoring system (formerly Hobbit / Big Brother) provides lightweight, low-overhead system health tracking for servers. While Debian repositories package xymon-client directly via APT, Enterprise Linux distributions like CentOS 7 require building from source.

Supported Platforms: CentOS 7 (Source compilation) • Debian 9 (APT package)

1. Compiling on CentOS 7

# 1. Create dedicated system user
groupadd xymon
useradd -g xymon -m xymon

# 2. Install build dependencies
yum install gcc make fping pcre-devel openssl-devel openldap-devel rrdtool-devel libtirpc-devel -y

# 3. Download and compile client
cd /usr/src
wget https://sourceforge.net/projects/xymon/files/Xymon/4.3.30/xymon-4.3.30.tar.gz
tar -zxf xymon-4.3.30.tar.gz
cd xymon-4.3.30
./configure --client

make && make install

# 4. Install system service script
cp rpm/xymon-client.init /etc/init.d/xymon-client
cp rpm/xymon-client.default /etc/default/xymon-client
chmod +x /etc/init.d/xymon-client

# Configure server IP in /etc/default/xymon-client:
# XYMONSERVERS="YOUR.XYMON.SERVER.IP"

service xymon-client start
chkconfig xymon-client on

2. Installation on Debian 9 / Ubuntu

sudo apt-get update
sudo apt-get install xymon-client -y

Fixing WebM Audio/Video Desync and Import Issues in FFmpeg, Shotcut, and OpenShot

Screen recordings saved in the WebM format (commonly exported by browser extensions like Nimbus Screenshot, Loom, or Screencastify) often use variable frame rates (VFR) and non-standard Opus/Vorbis audio packet chunking. When importing these files into open-source video editors like Shotcut, OpenShot, or processing them directly with FFmpeg, users frequently experience severe audio desynchronization or corrupted frame rendering.

Root Cause: Variable Frame Rate (VFR) container timing drift in libavformat demuxers.

The FFmpeg Solution: Transcode to Constant Frame Rate (CFR) MP4

Rather than relying on proprietary editors, use FFmpeg to normalize the video timeline to a fixed 30 or 60 fps stream with synchronized AAC audio:

ffmpeg -i input_recording.webm   -vsync cfr -r 30   -c:v libx264 -preset slow -crf 20   -c:a aac -b:a 192k -ar 48000   output_fixed.mp4

The resulting MP4 file maintains crystal-clear audio quality and imports into Shotcut, OpenShot, or Premiere Pro with flawless audio-video synchronization.

How to Cleanly Force HTTPS and WWW (or Non-WWW) Canonical Redirects in Nginx

Implementing clean 301 canonical redirects in Nginx prevents duplicate content penalties in search engines and ensures all incoming traffic is encrypted over HTTPS. Instead of convoluted rewrite regex rules, modular Nginx server blocks handle HTTP-to-HTTPS and subdomain canonicalization with maximum performance.

Canonical Best Practice: Always redirect in a single 301 hop to prevent redirect chains.

Scenario A: Force HTTPS with Non-WWW (example.com)

Create /etc/nginx/conf.d/force_ssl_non_www.conf:

# Redirect HTTP and WWW directly to canonical HTTPS non-WWW
server {
    listen 80;
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://example.com$request_uri;
}

server {
    listen 80;
    server_name example.com;
    return 301 https://example.com$request_uri;
}

Scenario B: Force HTTPS with WWW (www.example.com)

Create /etc/nginx/conf.d/force_ssl_www.conf:

server {
    listen 80;
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}

How to Compile and Install the Latest Okular Document Viewer on Ubuntu

Okular is a versatile, feature-rich universal document viewer from KDE supporting PDF, PostScript, DjVu, CHM, and ePub formats with powerful PDF annotation and text-selection tools. Here is how to compile the latest upstream release directly from source on Ubuntu.

Dependencies: Poppler Qt5 • Libzip • CMake • Extra CMake Modules (ECM)

Build and Installation Commands

# 1. Fetch build dependencies
sudo apt-get build-dep okular -y
sudo apt-get install libpoppler-qt5-dev libzip-dev cmake extra-cmake-modules -y

# 2. Clone and compile latest source
mkdir -p ~/src && cd ~/src
git clone git://anongit.kde.org/okular.git
cd okular
mkdir build && cd build
cmake -DCMAKE_INSTALL_PREFIX=/usr/local ..
make -j$(nproc)
sudo make install

How to Disable CSF Blocked IP Email Alerts and Reduce Notification Noise

On busy production web servers running ConfigServer Security & Firewall (CSF) with Login Failure Daemon (LFD), automated brute-force attempts can trigger dozens of automated alert emails per hour. Even after disabling LF_PERMBLOCK_ALERT and LF_NETBLOCK_ALERT in /etc/csf/csf.conf, CSF often continues sending notification messages.

The Culprit: LF_EMAIL_ALERT acts as a global master override that dispatches email notifications regardless of individual sub-alert flags.

Configuration Solution

Open /etc/csf/csf.conf and ensure all three alert directives are disabled:

# Disable automated IP block email notifications
LF_PERMBLOCK_ALERT = "0"
LF_NETBLOCK_ALERT = "0"
LF_EMAIL_ALERT = "0"

Reload CSF and LFD for the settings to take effect:

csf -r
service lfd restart

How to Transparently Route All Traffic Through a SOCKS/SSH Proxy on Linux and macOS (sshuttle)

Standard application-level SOCKS or HTTP proxy settings in Linux desktop environments (GNOME/KDE) frequently fail for stubborn proprietary applications (such as TeamViewer, VoIP tools, or CLI utilities) that ignore desktop proxy environment variables. sshuttle acts as a transparent, poor-man's VPN over standard SSH, routing all TCP traffic (and optionally DNS queries) without requiring root administrator privileges or TUN/TAP kernel modules on the remote host.

Advantages: No remote root required • Auto-routes TCP connections • Completely transparent to all running applications

1. Installation

# On Ubuntu / Debian:
sudo apt-get install sshuttle -y

# On macOS (Homebrew):
brew install sshuttle

# Or via Python pip:
sudo pip install sshuttle

2. Routing Global Traffic

To forward all client internet traffic (excluding your local LAN subnets) through your remote SSH server:

# Transparently route all default IPv4 subnets and DNS:
sshuttle --dns -r username@remote-server-ip:22 0/0 -x 192.168.0.0/16 -x 10.0.0.0/8

Every running program on your workstation—including apps with broken native proxy settings—will instantly route traffic through the encrypted SSH tunnel.

How to Build a Dynamic PowerDNS Pipe Backend in Python

The PowerDNS Pipe Backend allows developers to attach custom external scripts (written in Python, Perl, Bash, or Go) to resolve DNS queries dynamically over standard I/O streams. This approach is ideal for dynamically serving CNAME aliases, geo-routing records, or integrating DNS responses with external APIs without rebuilding PowerDNS.

Environment: PowerDNS 3.x / 4.x • pdns-backend-pipe • Python IPC

1. Installing PowerDNS Pipe Backend (CentOS / RHEL)

yum install pdns pdns-backend-pipe -y

Configure /etc/pdns/pdns.conf to launch the pipe backend alongside standard zone providers:

launch=bind,pipe
pipe-command=/etc/pdns/pdns-backend.py

2. The Python Backend Script (/etc/pdns/pdns-backend.py)

The script communicates with PowerDNS via tab-delimited protocol over stdin/stdout. Note the -u flag on Python to ensure unbuffered I/O:

#!/usr/bin/python -u
from sys import stdin, stdout

# Handshake initialization
data = stdin.readline()
stdout.write("OK	My Dynamic Python Backend
")
stdout.flush()

TARGET_CNAME = 'cname-target.example.com'

while True:
    line = stdin.readline()
    if not line:
        break
    data = line.strip()
    kind, qname, qclass, qtype, qid, ip = data.split('	')
    
    if kind == 'Q' and qname not in TARGET_CNAME:
        # Provide SOA record for authoritative delegation
        soa_resp = f"DATA	{qname}	{qclass}	SOA	86400	-1	support.{qname} ns1.example.org 2026010100 1800 3600 604800 3600
"
        stdout.write(soa_resp)
        
        # Respond to ANY or CNAME queries
        if qtype in ('ANY', 'CNAME'):
            cname_resp = f"DATA	{qname}	{qclass}	CNAME	86400	{qid}	{TARGET_CNAME}
"
            stdout.write(cname_resp)
            
    stdout.write("END
")
    stdout.flush()

Make the script executable and restart PowerDNS:

chmod +x /etc/pdns/pdns-backend.py
systemctl restart pdns