fio: Linux hard drive benchmark

I’m always on a lookout for good hard drive benchmark tools. fio is pretty good, especially because it’s easy to setup and execution is pretty self-explanatory:

fio --randrepeat=1 --ioengine=libaio --direct=1 --gtod_reduce=1 --name=test --filename=test --bs=4k --iodepth=64 --size=1G --readwrite=randrw --rwmixread=0

The only parameter that does need bit of explanation is –rwmixread parameter:

  • 0 means 0 read, 100 write.
  • 100 means 100 read, 0 write.
  • 50 is half and half

PHP URL include vulnerability detection and workaround

Some exploits never get old.  One such example is an exploit that takes advantage of PHP URL include vulnerability.   It’s particularly nasty because it lets the attackers execute arbitrary PHP code without leaving any trace on the server it self.  The whole exploit executes in memory and vanishes once the attacker got what they were after.    With no back doors left behind, there are only two ways to find out.  You can either spot the suspicious entry in your log files, or you can run a script that checks whether your server is vulnerable to the attack in the first place.


if [ -z "$1" ]; then

        echo "Error, must specify domain name"

        exit 0


#do not change this is one of the rare cases, when it serves an actual function.

wget -q -O test http://$1/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D

grep "This domain is established to be used for illustrative examples" test > /dev/null

if [ $? -eq 0 ]; then


        echo "$1 is VULNERABLE add the following to .htaccess file and retry"


        echo "RewriteEngine on"

        echo "RewriteCond %{QUERY_STRING} ^[^=]*$"

        echo "RewriteCond %{QUERY_STRING} %2d|- [NC]"

        echo "RewriteRule .? – [F,L]"




        echo "$1 is OK"


When you run this tool, you will see this if the web site you are scanning is vulnerable:

# ./ is VULNERABLE add the following to .htaccess file and retry

RewriteEngine on
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|- [NC]
RewriteRule .? – [F,L]

I should add that the proper way is to patch PHP to a version that doesn’t have the vulnerability. The .htaccess fix works, but as you can imagine, it’s a bandaid solution. If you have this vulnerability, chances are you also have many more like it.

Safe Ceph Utilization Calculator

The only way I’ve managed to ever break Ceph is by not giving it enough raw storage to work with. You can abuse ceph in all kinds of ways and it will recover, but when it runs out of storage really bad things happen. It’s surprisingly easy to get into trouble. Mainly because the default safety mechanisms (nearfull and full ratios) assume that you are running a cluster with at least 7 nodes. For smaller clusters the defaults are too risky. For that reason I created this calculator. It calculates how much storage you can safely consume.