Linux Stuffs

How to install openstack in ubuntu 16.04

2018-01-06T15:09:00.001+05:30

The hardware we’ll be using is based on the following specifications:

1 x MAAS Rack with Region controller: 8GB RAM, 2 CPUs, 1 NIC, 40GB storage
1 x Juju node: 4GB RAM, 2 CPUs, 1 NIC, 40GB storage
4 x OpenStack cloud nodes: 8GB RAM, 2 CPUs, 2 NICs, 80GB storage

Installing MAAS

root@maas:~# add-apt-repository ppa:maas/stable

root@maas:~# apt-get -y update;apt-get -y upgrade;apt-get -y dist-upgrade

root@maas:~# reboot

root@maas:~# cat /etc/lsb-release;uname -r

DISTRIB_ID=Ubuntu

DISTRIB_RELEASE=16.04

DISTRIB_CODENAME=xenial

DISTRIB_DESCRIPTION="Ubuntu 16.04.3 LTS"

4.4.0-101-generic

root@maas:~# apt-get -y update;apt-get -y install maas

NOTE: When asked for the Ubuntu MAAS API address, double check the detected URL uses eth0’s (external) IP address: http://10.10.2.37 /MAAS/. You can later change this by running:

root@maas:~# dpkg-reconfigure maas-rack-controller

Also, double check that running below command shows the IP of management interface same as the MAAS url.

root@maas:~# sudo dpkg-reconfigure maas-region-controller

root@maas:~# maas createadmin --username=maasadmin --password='maas@123' --email=maasadmin@maas

A final question will ask whether you want to import SSH keys. MAAS uses the public SSH key of a user to manage and secure access to deployed nodes, just as you might with managed servers or remote machines. Press Enter to skip this as we’ll do this from the web UI in the next step.

root@maas:~# maas-region apikey --username=admin > api_key

root@maas:~# maas login admin http://10.10.2.37:5240/MAAS/api/2.0 - < api_key

You are now logged in to the MAAS server at

http://10.10.2.37:5240/MAAS/api/2.0/ with the profile name 'admin'.

For help with the available commands, try:

maas admin --help

A handy shell script, say maas-login.sh, is provided:

#!/bin/sh

PROFILE=admin

API_KEY_FILE= /root/api_key

API_SERVER=10.10.2.37

MAAS_URL=http://$API_SERVER/MAAS/api/2.0

maas login $PROFILE $MAAS_URL - < $API_KEY_FILE

Once you are done with the CLI you can log out from the given profile, flushing the stored credentials.

root@maas:~# maas logout admin

Use this url to login to MAAS console. http://10.10.2.37:5240/MAAS

In the intro page enter domain name, dns forwarder for name resolution if required proxy ip for syncing images and then select required ubuntu release.

Keys: You can conveniently import your public SSH key(s) from both Launchpad and Github by entering your user id for these services. To add a local public key file, usually HOME/ssh/id_rsa.pub, select Upload and paste file contents into the box that appears. Click Import to fix the setting.

If you need to generate a local SSH public/private key pair, type ssh-keygen -t rsa from the Linux account you’ll control MAAS from, and when asked, leave the passphrase blank.

maasadmin@maas:~$ cat /home/maasadmin/.ssh/id_rsa.pub

Manually update the above key in the keys field and click import. Adding SSH keys completes this initial MAAS configuration. Click Go to the dashboard to move to the MAAS dashboard and the device discovery process

In subnets tab click on first subnet and provide dhcp range for assigning ip to other nodes for pxe boot.

In settings tab

Global Kernel Parameters field enter below values

net.ifnames=0 biosdevname=0

Proxy:

http://10.10.1.16:8080

DNS:

10.10.2.55

Storage:

LVM layout

Now lets discover the nodes. Select first boot as network boot in remaining server and reboot. The servers will get booted in pxe and adds as node in MAAS server. Rename the nodes as required and select all then give commission. Click the nodes which has 2 nic cards and make sure second interface shows subnet address and ip address as unconfigured.

Now our MAAS is done. Lets fire up confure-up and configure openstack nodes.

My environment is beyond proxy so i have excluded entire subnet in no-proxy so proxy will not be used for internal connectivity.

Take putty session of MAAS server:

#conjure-up --http-proxy "http://10.10.1.16:8080" --apt-proxy "http://10.10.1.16:8080" --apt-https-proxy "http://10.10.1.16:8080" --https-proxy "http://10.10.1.16:8080" --no-proxy "localhost,127.0.0.1,10.10.2.1,10.10.2.2,10.10.2.3,10.10.2.4,10.10.2.5,10.10.2.6,10.10.2.7,10.10.2.8,10.10.2.9,10.10.2.10,10.10.2.11,10.10.2.12,10.10.2.13,10.10.2.14,10.10.2.15,10.10.2.16,10.10.2.17,10.10.2333.18,10.10.2.19,10.10.2.20,10.10.2.21,10.10.2.22,10.10.2.23,10.10.2.24,10.10.2.25,10.10.2.26,10.10.2.27,10.10.2.28,10.10.2.29,10.10.2.30,10.10.2.31,10.10.2.32,10.10.2.33,10.10.2.34,10.10.2.35,10.10.2.36,10.10.2.37,10.10.2.38,10.10.2.39,10.10.2.40,10.10.2.41,10.10.2.42,10.10.2.43,10.10.2.44,10.10.2.45,10.10.2.46,10.10.2.47,10.10.2.48,10.10.2.49,10.10.2.50,10.10.2.51,10.10.2.52,10.10.2.53,10.10.2.54,10.10.2.55,10.10.2.56,10.10.2.57,10.10.2.58,10.10.2.59,10.10.2.60,10.10.2.61,10.10.2.62,10.10.2.63,10.10.2.64,10.10.2.65,10.10.2.66,10.10.2.67,10.10.2.68,10.10.2.69,10.10.2.70,10.10.2.71,10.10.2.72,10.10.2.73,10.10.2.74,10.10.2.75,10.10.2.76,10.10.2.77,10.10.2.78,10.10.2.79,10.10.2.80,10.10.2.81,10.10.2.82,10.10.2.83,10.10.2.84,10.10.2.85,10.10.2.86,10.10.2.87,10.10.2.88,10.10.2.89,10.10.2.90,10.10.2.91,10.10.2.92,10.10.2.93,10.10.2.94,10.10.2.95,10.10.2.96,10.10.2.97,10.10.2.98,10.10.2.99,10.10.2.100,10.10.2.101,10.10.2.102,10.10.2.103,10.10.2.104,10.10.2.105,10.10.2.106,10.10.2.107,10.10.2.108,10.10.2.109,10.10.2.110,10.10.2.111,10.10.2.112,10.10.2.113,10.10.2.114,10.10.2.115,10.10.2.116,10.10.2.117,10.10.2.118,10.10.2.119,10.10.2.120,10.10.2.121,10.10.2.122,10.10.2.123,10.10.2.124,10.10.2.125,10.10.2.126,10.10.2.127,10.10.2.128,10.10.2.129,10.10.2.130,10.10.2.131,10.10.2.132,10.10.2.133,10.10.2.134,10.10.2.135,10.10.2.136,10.10.2.137,10.10.2.138,10.10.2.139,10.10.2.140,10.10.2.141,10.10.2.142,10.10.2.143,10.10.2.144,10.10.2.145,10.10.2.146,10.10.2.147,10.10.2.148,10.10.2.149,10.10.2.150,10.10.2.151,10.10.2.152,10.10.2.153,10.10.2.154,10.10.2.155,10.10.2.156,10.10.2.157,10.10.2.158,10.10.2.159,10.10.2.160,10.10.2.161,10.10.2.162,10.10.2.163,10.10.2.164,10.10.2.165,10.10.2.166,10.10.2.167,10.10.2.168,10.10.2.169,10.10.2.170,10.10.2.171,10.10.2.172,10.10.2.173,10.10.2.174,10.10.2.175,10.10.2.176,10.10.2.177,10.10.2.178,10.10.2.179,10.10.2.180,10.10.2.181,10.10.2.182,10.10.2.183,10.10.2.184,10.10.2.185,10.10.2.186,10.10.2.187,10.10.2.188,10.10.2.189,10.10.2.190,10.10.2.191,10.10.2.192,10.10.2.193,10.10.2.194,10.10.2.195,10.10.2.196,10.10.2.197,10.10.2.198,10.10.2.199,10.10.2.200,10.10.2.201,10.10.2.202,10.10.2.203,10.10.2.204,10.10.2.205,10.10.2.206,10.10.2.207,10.10.2.208,10.10.2.209,10.10.2.210,10.10.2.211,10.10.2.212,10.10.2.213,10.10.2.214,10.10.2.215,10.10.2.216,10.10.2.217,10.10.2.218,10.10.2.219,10.10.2.220,10.10.2.221,10.10.2.222,10.10.2.223,10.10.2.224,10.10.2.225,10.10.2.226,10.10.2.227,10.10.2.228,10.10.2.229,10.10.2.230,10.10.2.231,10.10.2.232,10.10.2.233,10.10.2.234,10.10.2.235,10.10.2.236,10.10.2.237,10.10.2.238,10.10.2.239,10.10.2.240,10.10.2.241,10.10.2.242,10.10.2.243,10.10.2.244,10.10.2.245,10.10.2.246,10.10.2.247,10.10.2.248,10.10.2.249,10.10.2.250,10.10.2.251,10.10.2.252,10.10.2.253,10.10.2.254" openstack

Follow below steps in setup screen.

Select openstack with nova-kvm

select maas

Enter maas url and api key use below command to get api-key of admin user.

root@maas:~# maas-region apikey --username=admin

click next

Configure netutron-gateway to use the 2^nd interface which is detected in the server.

In this deployment 2^nd interface is detected as eth3 so rename the data-port: as shown below.

To do this click configure in neutron-gateway

Scroll down to data-port: br-ex:eth3

Save and select deploy all 16 applications.

I hardly takes 30 to 60min to complete.

maasadmin@maas:~$ juju status openstack-dashboard/0|grep openstack-dashboard/0

openstack-dashboard/0* active idle 0/lxd/0 10.10.2.46 80/tcp,443/tcp Unit is ready

maasadmin@maas:~$

Access the openstack url

https://10.10.2.46/horizon/auth/login/?next=/horizon/

Username: admin

Password: openstack

Post configuration

#juju config nova-cloud-controller console-access-protocol=novnc

#juju config nova-compute config-flags="default_ephemeral_format=ext4,block_device_allocate_retries=300,block_device_allocate_retries_interval=10,block_device_creation_timeout=300"

#juju config openstack-dashboard password-retrieve=true

#juju config ntp source=10.10.2.37

Adding new machine

#juju add-machine

#juju add-unit nova-compute --to 4

#juju add-unit ceph-osd --to 4

#juju add-unit --to lxd:4 ceph-mon

Reference:

https://docs.openstack.org/charm-deployment-guide/latest

HTTP TRACE / TRACK Methods Enabled (CVE-2004-2320, CVE-2010-0386, CVE-2003-1567)

2017-07-03T20:44:00.002+05:30

Treat: "The remote Web server supports the TRACE and/or TRACK HTTP methods, which makes it easier for remote attackers to steal cookies and authentication credentials or bypass the HttpOnly protection mechanism.

Track / Trace are required to be disabled to be PCI compliance."

Impact: If this vulnerability is successfully exploited, attackers can potentially steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism.

Solution: Disable these methods in your web server's configuration file.

Fix: echo TraceEnable off >>/etc/httpd/conf/httpd.conf

Restart apache service

Disable TLSv1.0 and enable TLSv1.2 protocol in apache

2017-07-03T20:41:00.001+05:30

Disable the use of TLSv1.0 protocol in favor of a cryptographically stronger protocol such as TLSv1.2.

The following openssl commands can be used to do a manual test:
openssl s_client -connect ip:port -tls1

If the test is successful, then the target support TLSv1

[root@test ~]# grep SSLProtocol /etc/httpd/conf.modules.d/ssl.conf
# SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLProtocol TLSv1.2
[root@test ~]#

CVE-2016-2183: Disable and stop using DES and 3DES ciphers in tomcat

2017-07-03T20:36:00.001+05:30

Title: Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)

CVEID: CVE-2016-2183

Threat: "Legacy block ciphers having block size of 64 bits are vulnerable to a practical collision attack when used in CBC mode.

All versions of SSL/TLS protocol support cipher suites which use DES or 3DES as the symmetric encryption cipher are affected."

Impact: Remote attackers can obtain cleartext data via a birthday attack against a long-duration encrypted session.

Solution: "Disable and stop using DES and 3DES ciphers.

The following openssl commands can be used to do a manual test:

openssl s_client -connect ip:port -cipher ""DES:3DES"" -ssl2

openssl s_client -connect ip:port -cipher ""DES:3DES"" -ssl3

openssl s_client -connect ip:port -cipher ""DES:3DES"" -tls1

openssl s_client -connect ip:port -cipher ""DES:3DES"" -tls1_1

openssl s_client -connect ip:port -cipher ""DES:3DES"" -tls1_2

If any of these tests is successful, then the target is vulnerable to Sweet32."

Fix: In file /etc/tomcat/server.xml remove SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA

Post modifying file should look like below

ciphers="TLS_RSA_WITH_AES_256_CBC_SHA,

TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,

TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"

Disable TLSv1 in java

2017-07-03T19:52:00.001+05:30

Check which Java is currently running

[root@test ~]# java -version
java version "1.7.0_141"
OpenJDK Runtime Environment (rhel-2.6.10.1.el7_3-x86_64 u141-b02)
OpenJDK 64-Bit Server VM (build 24.141-b02, mixed mode)

Make changes in respective java.security file

Look for jdk.tls.disabledAlgorithms

[root@test ~]# grep TLSv1 /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.141-2.6.10.1.el7_3.x86_64/jre/lib/security/java.security
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768, EC keySize < 224

Update like below

[root@test ~]# grep TLSv1 /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.141-2.6.10.1.el7_3.x86_64/jre/lib/security/java.security
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768, EC keySize < 224, TLSv1

Restart respective java service to take effect.

CVE-2016-2183 : Disable and stop using DES and 3DES ciphers in apache

2017-07-03T18:08:00.000+05:30

TITLE: Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)

CVEID: CVE-2016-2183

We need to add DES and 3DES in /etc/httpd/conf.modules.d/ssl.conf file in order to disable it.

Look for SSLCipherSuite line

[root@test ~]# grep SSLCipherSuite /etc/httpd/conf.modules.d/ssl.conf
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4
[root@test ~]#

Modify like below

[root@test ~]# grep SSLCipherSuite /etc/httpd/conf.modules.d/ssl.conf
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4:!DES:!3DES
[root@test ~]#

Restart the required services for the port which u got vulnerability.

The following openssl commands can be used to do a manual test:

openssl s_client -connect ip:port -cipher "DES:3DES" -ssl2

openssl s_client -connect ip:port -cipher "DES:3DES" -ssl3

openssl s_client -connect ip:port -cipher "DES:3DES" -tls1

openssl s_client -connect ip:port -cipher "DES:3DES" -tls1_1

openssl s_client -connect ip:port -cipher "DES:3DES" -tls1_2

[root@test ~]# openssl s_client -connect 10.10.10.1:443 -cipher "DES:3DES" -tls1_2

CONNECTED(00000003)

140592171460512:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1275:SSL alert number 40

140592171460512:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:

---

no peer certificate available

---

No client certificate CA names sent

---

SSL handshake has read 7 bytes and written 0 bytes

---

New, (NONE), Cipher is (NONE)

Secure Renegotiation IS NOT supported

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol : TLSv1.2

Cipher : 0000

Session-ID:

Session-ID-ctx:

Master-Key:

Key-Arg : None

Krb5 Principal: None

PSK identity: None

PSK identity hint: None

Start Time: 1499085145

Timeout : 7200 (sec)

Verify return code: 0 (ok)

---

[root@test ~]#

ansible playbook to check selinux status

2017-06-05T16:50:00.003+05:30

# ansible-playbook selinux.yml --user ranjith --extra-vars "host=10.10.10.11"

---
- hosts: "{{ host }}"
become: yes
become_method: sudo
tasks:
- name: getting selinux status
command: getenforce
register: result

- name: removing old status file
local_action: file path={{ playbook_dir }}/{{ inventory_hostname }}-selinux-{{ result.stdout }} state=absent

- name: saving selinux status
local_action: file path={{ playbook_dir }}/{{ inventory_hostname }}-selinux-{{ result.stdout }} state=touch

This playbook creates a file in the playbook directory in name like 10.10.10.11-selinux-Disabled

Ansible playbook to register rhel 6 and rhel 7 clients to satellite 6

2017-06-04T23:05:00.000+05:30

Below playbook can be used to register rhel 6/7 clients to get unregistered from existing satellite 5 and registers it to satellite 6.

The clients gets registered with respective activation key in my case the activation key names are RHEL6 and RHEL7.

# ansible-playbook register.yml --extra-vars "host=givehostip|groupname" --extra-vars "satelliteip=givesatelliteip" --user ranjith

---
- hosts: "{{ host }}"
become: yes
become_method: sudo
tasks:
- name: Download and install a copy of the CA Certificate for the Red Hat Satellite 6 server
yum:
disable_gpg_check: yes
name: http://{{satelliteip}}/pub/katello-ca-consumer-latest.noarch.rpm
state: present
when:
- ansible_distribution_major_version == "6" or ansible_distribution_major_version == "7"
- name: Setting enabled=1 in subscription-manager.conf
lineinfile:
path: /etc/yum/pluginconf.d/subscription-manager.conf
regexp: '^enabled'
line: 'enabled=1'
when:
- ansible_distribution_major_version == "6" or ansible_distribution_major_version == "7"
- name: Setting enabled=0 in rhnplugin.conf
lineinfile:
path: /etc/yum/pluginconf.d/rhnplugin.conf
regexp: '^enabled'
line: 'enabled=0'
when:
- ansible_distribution_major_version == "6" or ansible_distribution_major_version == "7"
- name: delete the rhn registration locally
command: mv /etc/sysconfig/rhn/systemid /etc/sysconfig/rhn/systemid.bak
when:
- ansible_distribution_major_version == "6" or ansible_distribution_major_version == "7"
ignore_errors: True
- name: Register with activationkey matching Red Hat Enterprise Server Version 6
redhat_subscription:
state: present
activationkey: RHEL6
org_id: Default_Organization
when:
- ansible_distribution_major_version == "6"
- name: Register with activationkey matching Red Hat Enterprise Server Version 7
redhat_subscription:
state: present
activationkey: RHEL7
org_id: Default_Organization
when:
- ansible_distribution_major_version == "7"
- name: Skipping server matching Red Hat Enterprise Server Version 5
shell: echo "This certainly is history!"
when:
- ansible_distribution_major_version == "5"
- name: Install katello-agent
yum:
name: katello-agent
state: present
when:
- ansible_distribution_major_version == "6" or ansible_distribution_major_version == "7"

Ansible playbook to patch and reboot RHEL 6 and RHEL 7 servers

2017-06-04T22:59:00.001+05:30

How to run:

If single host give host ip like below in the command else for group patch, update the /etc/ansible/hosts file with server list and give the group name as host variable value. The playbook also collects required information like mount status resolv.conf and ntpstat as per my requirement, you can add your commands in the shell section. The information collected will be stored in the name of serverip-prepatch.txt and serverip-postpatch.txt and saves it in the playbook directory.

# ansible-playbook patchreboot.yml --extra-vars "host=10.10.11.70" --user ranjith

---
- hosts: "{{ host }}"
become: yes
become_method: sudo
tasks:
- name: running prepatch info commands
shell: |
df -hP
cat /etc/resolv.conf
ntpstat
register: prepatch
ignore_errors: True
- name: removing old prepatch info file
local_action: file path={{ playbook_dir }}/{{ inventory_hostname }}-prepatch.txt state=absent
- name: storing prepatch info
local_action: copy content={{ prepatch.stdout }} dest={{ playbook_dir }}/{{ inventory_hostname }}-prepatch.txt
- name: upgrade all packages
yum:
name: '*'
state: latest
- name: restart server
command: /sbin/reboot
async: 0
poll: 0
ignore_errors: true
- name: Pause for 180 seconds
pause: minutes=3
- name: wait for the server to restart
local_action: wait_for host={{ inventory_hostname }}
port=22
delay=15
timeout=300
state=started
connect_timeout=15
- name: restarting ntpserver
service:
name: ntpd
state: restarted
enabled: yes
- name: running postpatch info commands
shell: |
df -hP
cat /etc/resolv.conf
sleep 10
ntpstat
register: postpatch
ignore_errors: True
- name: removing old postpatch info file
local_action: file path={{ playbook_dir }}/{{ inventory_hostname }}-postpatch.txt state=absent
- name: storing postpatch info
local_action: copy content={{ postpatch.stdout }} dest={{ playbook_dir }}/{{ inventory_hostname }}-postpatch.txt

INTRODUCTION TO SYSTEMD

2017-01-29T03:27:00.001+05:30

Systemd is a system and service manager for Linux operating systems. It is designed to be backwards compatible with SysV init scripts, and provides a number of features such as parallel startup of system services at boot time, on-demand activation of daemons, support for system state snapshots, or dependency-based service control logic. In Red Hat Enterprise Linux 7, systemd replaces Upstart as the default init system.

Systemd Unit Locations

Directory Description

/usr/lib/systemd/system/ Systemd units distributed with installed RPM packages.

/run/systemd/system/ Systemd units created at run time. This directory takes precedence over the directory with installed service units.

/etc/systemd/system/ Systemd units created and managed by the system administrator. This directory takes precedence over the directory with runtime units.

MANAGING SYSTEM SERVICES

Previous versions of Red Hat Enterprise Linux, which were distributed with SysV init or Upstart, used init scripts located in the /etc/rc.d/init.d/ directory. These init scripts were typically written in Bash, and allowed the system administrator to control the state of services and daemons in their system. In Red Hat Enterprise Linux 7, these init scripts have been replaced with service units.

Service units end with the .service file extension and serve a similar purpose as init scripts. To view, start, stop, restart, enable, or disable system services, use the systemctl command as described in Table 21.2.1 “Comparison of the service Utility with systemctl ”, Table 21.2.2 “Comparison of the chkconfig Utility with systemctl”, and in the section below. The service and chkconfig commands are still available in the system and work as expected, but are only included for compatibility reasons and should be avoided.

Comparison of the service Utility with systemctl

service	systemctl	Description
service name start	systemctl start name.service	Starts a service.
service name stop	systemctl stop name.service	Stops a service.
service name restart	systemctl restart name.service	Restarts a service.
service name condrestart	systemctl try-restart name.service	Restarts a service only if it is running.
service name reload	systemctl reload name.service	Reloads configuration.
service name status	systemctl status name.service systemctl is-active name.service	Checks if a service is running.
service --status-all	systemctl list-units --type service --all	Displays the status of all services.

Comparison of the chkconfig Utility with systemctl

chkconfig	systemctl	Description
chkconfig name on	systemctl enable name.service	Enables a service.
chkconfig name off	systemctl disable name.service	Disables a service.
chkconfig --list name	systemctl status name.service systemctl is-enabled name.service	Checks if a service is enabled.
chkconfig --list	systemctl list-unit-files --type service	Lists all services and checks if they are enabled.
chkconfig --list	systemctl list-dependencies --after	Lists services that are ordered to start before the specified unit.
chkconfig --list	systemctl list-dependencies --before	Lists services that are ordered to start after the specified unit.

Starting a Service

To start a service unit that corresponds to a system service, type the following at a shell prompt as root:

systemctl start name.service

Replace name with the name of the service unit you want to start (for example, gdm). This command starts the selected service unit in the current session.

Example Starting a Service

The service unit for the Apache HTTP Server is named httpd.service. To activate this service unit and start the httpd daemon in the current session, run the following command as root:

~]# systemctl start httpd.service

Stopping a Service

To stop a service unit that corresponds to a system service, type the following at a shell prompt as root:

systemctl stop name.service

Replace name with the name of the service unit you want to stop (for example, bluetooth). This command stops the selected service unit in the current session.

Example Stopping a Service

The service unit for the bluetoothd daemon is named bluetooth.service. To deactivate this service unit and stop the bluetoothd daemon in the current session, run the following command as root:

~]# systemctl stop bluetooth.service

Restarting a Service

To restart a service unit that corresponds to a system service, type the following at a shell prompt as root:

systemctl restart name.service

Replace name with the name of the service unit you want to restart (for example, httpd). This command stops the selected service unit in the current session and immediately starts it again. Importantly, if the selected service unit is not running, this command starts it too. To tell systemd to restart a service unit only if the corresponding service is already running, run the following command as root:

systemctl try-restart name.service

Certain system services also allow you to reload their configuration without interrupting their execution. To do so, type as root:

systemctl reload name.service

Note that system services that do not support this feature ignore this command altogether. For convenience, the systemctl command also supports the reload-or-restart and reload-or-try-restart commands that restart such services instead.

Example Restarting a Service

In order to prevent users from encountering unnecessary error messages or partially rendered web pages, the Apache HTTP Server allows you to edit and reload its configuration without the need to restart it and interrupt actively processed requests. To do so, type the following at a shell prompt as root:

~]# systemctl reload httpd.service

Enabling a Service

To configure a service unit that corresponds to a system service to be automatically started at boot time, type the following at a shell prompt as root:

systemctl enable name.service

Replace name with the name of the service unit you want to enable (for example, httpd). This command reads the [Install] section of the selected service unit and creates appropriate symbolic links to the /usr/lib/systemd/system/name.service file in the /etc/systemd/system/ directory and its subdirectories. This command does not, however, rewrite links that already exist. If you want to ensure that the symbolic links are re-created, use the following command as root:

systemctl reenable name.service

This command disables the selected service unit and immediately enables it again.

Example Enabling a Service

To configure the Apache HTTP Server to start automatically at boot time, run the following command as root:

~]# systemctl enable httpd.service

ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service'

Disabling a Service

To prevent a service unit that corresponds to a system service from being automatically started at boot time, type the following at a shell prompt as root:

systemctl disable name.service

Replace name with the name of the service unit you want to disable (for example, bluetooth). This command reads the [Install] section of the selected service unit and removes appropriate symbolic links to the /usr/lib/systemd/system/name.service file from the /etc/systemd/system/ directory and its subdirectories. In addition, you can mask any service unit to prevent it from being started manually or by another service. To do so, run the following command as root:

systemctl mask name.service

This command replaces the /etc/systemd/system/name.service file with a symbolic link to /dev/null, rendering the actual unit file inaccessible to systemd. To revert this action and unmask a service unit, type as root:

systemctl unmask name.service

Example Disabling a Service

To prevent this service unit from starting at boot time, type the following at a shell prompt as root:

~]# systemctl disable bluetooth.service

rm '/etc/systemd/system/dbus-org.bluez.service'

rm '/etc/systemd/system/bluetooth.target.wants/bluetooth.service'

Changing the Time Zone in RHEL 7

2017-01-29T03:24:00.005+05:30

To list all available time zones, type the following at a shell prompt:

~]# timedatectl list-timezones

To change the currently used time zone, type as root:

~]# timedatectl set-timezone time_zone

Replace time_zone with any of the values listed by the timedatectl list-timezones command.

Example Changing the Time Zone

To identify which time zone is closest to your present location, use the timedatectl command with the list-timezones command line option. For example, to list all available time zones in Europe, type:

~]# timedatectl list-timezones | grep Europe

Europe/Amsterdam

Europe/Andorra

Europe/Athens

Europe/Belgrade

Europe/Berlin

Europe/Bratislava

…

To change the time zone to Europe/Prague, type as root:

~]# timedatectl set-timezone Europe/Prague

NTP configuration in RHEL 7

2017-01-29T03:23:00.001+05:30

The Network Time Protocol (NTP) enables the accurate dissemination of time and date information in order to keep the time clocks on networked computer systems synchronized to a common reference over the network or the Internet. Many standards bodies around the world have atomic clocks which may be made available as a reference. The satellites that make up the Global Position System contain more than one atomic clock, making their time signals potentially very accurate. Their signals can be deliberately degraded for military reasons. An ideal situation would be where each site has a server, with its own reference clock attached, to act as a site-wide time server. Many devices which obtain the time and date via low frequency radio transmissions or the Global Position System (GPS) exist. However for most situations, a range of publicly accessible time servers connected to the Internet at geographically dispersed locations can be used. These NTP servers provide “Coordinated Universal Time” (UTC). Information about these time servers can found at www.pool.ntp.org.

Accurate time keeping is important for a number of reasons in IT. In networking for example, accurate time stamps in packets and logs are required. Logs are used to investigate service and security issues and so time stamps made on different systems must be made by synchronized clocks to be of real value. As systems and networks become increasingly faster, there is a corresponding need for clocks with greater accuracy and resolution. In some countries there are legal obligations to keep accurately synchronized clocks. Please see www.ntp.org for more information. In Linux systems, NTP is implemented by a daemon running in user space. The default NTP user space daemon in Red Hat Enterprise Linux 7 is chronyd. It must be disabled if you want to use the ntpd daemon.

[root@RHEL7 ~]# systemctl stop chronyd

[root@RHEL7 ~]# systemctl disable chronyd

[root@RHEL7 ~]# yum install ntp

Configure ntp.conf file like shown below

[root@RHEL7 ~]# cat /etc/ntp.conf

tinker panic 0

driftfile /var/lib/ntp/drift

restrict default nomodify notrap nopeer noquery

restrict 127.0.0.1

restrict ::1

server 10.18.17.32 iburst

server 10.18.17.33 iburst

server 10.18.11.30 iburst

server 10.18.11.31 iburst

includefile /etc/ntp/crypto/pw

keys /etc/ntp/keys

disable monitor

[root@RHEL7 ~]# systemctl restart ntpd

[root@RHEL7 ~]# systemctl status ntpd

[root@RHEL7 ~]# systemctl enable ntpd

[root@RHEL7 ~]# ntpq -np

remote refid st t when poll reach delay offset jitter

==============================================================================

10.18.17.32 .INIT. 16 u - 1024 0 0.000 0.000 0.000

10.18.17.33 .INIT. 16 u - 1024 0 0.000 0.000 0.000

*10.18.11.30 10.18.11.30 5 u 261 512 377 0.827 -8.280 10.270

+10.18.11.31 10.18.11.30 5 u 497 512 377 0.720 -23.474 11.101

[root@RHEL7 ~]# ntpstat

synchronised to NTP server (10.18.11.30) at stratum 6

time correct to within 388 ms

polling server every 512 s

[root@RHEL7 ~]#

timedatectl command gives a detailed info about system time and date

[root@RHEL7 ~]# timedatectl

Local time: Thu 2015-12-31 00:27:00 CST

Universal time: Thu 2015-12-31 06:27:00 UTC

RTC time: Thu 2015-12-31 06:27:00

Time zone: America/Chicago (CST, -0600)

NTP enabled: yes

NTP synchronized: yes

RTC in local TZ: no

DST active: no

Last DST change: DST ended at

Sun 2015-11-01 01:59:59 CDT

Sun 2015-11-01 01:00:00 CST

Next DST change: DST begins (the clock jumps one hour forward) at

Sun 2016-03-13 01:59:59 CST

Sun 2016-03-13 03:00:00 CDT

VMware tools in RHEL 7

2017-01-29T03:20:00.000+05:30

The open-vm-tools package is a suite of open source virtualization utilities and drivers which improve performance and user experience when running Red Hat Enterprise Linux 7 as a guest on a VMware vSphere ESX(i) hypervisor. The open-vm-tools package provides a secure and authenticated mechanism for performing various operations on the guest operating system from the hypervisor.

Red Hat Enterprise Linux 7 includes the latest stable release of open-vm-tools. Updates to the open-vm-tools package are provided with the operating system maintenance updates and patches.

[root@RHEL7 ~]# rpm -qa |grep open-vm

open-vm-tools-9.10.2-4.el7.x86_64

open-vm-tools-desktop-9.10.2-4.el7.x86_64

[root@RHEL7 ~]#

To interact with open-vm-tools , issue commands to the vmtoolsd service from a guest with the systemctl command, for example:

To query whether open-vm-tools is running:

# systemctl status vmtoolsd.service

To start open-vm-tools:

# systemctl start vmtoolsd.service

To start open-vm-tools on boot, enable the vmtoolsd service:

# systemctl enable vmtoolsd.service

To restart open-vm-tools:

# systemctl restart vmtoolsd.service

To stop open-vm-tools:

# systemctl stop vmtoolsd.service

To disable the vmtoolsd service from running at boot:

# systemctl disable vmtoolsd.service

For additional help with the vmtoolsd and other commands, run:

# systemctl help vmtoolsd

CONFIGURE NIC (NETWORK INTERFACE CARD) BONDING in RHEL 7

2017-01-29T03:18:00.000+05:30

NIC (Network Interface Card) bonding is also known as Network bonding. It can be defined as the aggregation or combination of multiple NIC into a single bond interface. Its main purpose is to provide high availability and redundancy.

Policy Details
Ploicy Name	Code	Description
balance-rr	0	Round-Robin policy for fault tolerance
active-backup	1	Active-Backup policy for fault tolerance
balance-xor	2	Exclusive-OR policy for fault tolerance
broadcast	3	All transmissions are sent on all slave interfaces.
802.3ad	4	Dynamic link aggregation policy
balance-tlb	5	Transmit Load Balancing policy for fault tolerance
balance-alb	6	Active Load Balancing policy for fault tolerance

Prerequisite:

If bonding module is not loaded on your linux box then use the below command to load.

# modprobe bonding

To list the bonding module info, use following command.

# modinfo bonding

[root@localhost ~]# modinfo bonding

filename: /lib/modules/3.10.0-229.el7.x86_64/kernel/drivers/net/bonding/bonding.ko

alias: rtnl-link-bond

author: Thomas Davis, tadavis@lbl.gov and many others

description: Ethernet Channel Bonding Driver, v3.7.1

version: 3.7.1

license: GPL

rhelversion: 7.1

create a file bonding.conf in /etc/modprobe.d/

[root@localhost ~]# vi /etc/modprobe.d/bonding.conf

alias bond0 bonding

[root@localhost ~]#

Create a bond interface file. In my case its bond0

[root@localhost ~]# cd /etc/sysconfig/network-scripts/

[root@localhost network-scripts]# vi ifcfg-bond0

DEVICE=bond0

TYPE=Bond

NAME=bond0

BONDING_MASTER=yes

BOOTPROTO=none

ONBOOT=yes

IPADDR=x.x.x.x

NETMASK=x.x.x.x

GATEWAY=x.x.x.x

DNS1=x.x.x.x

BONDING_OPTS="mode=1 miimon=100"

[root@localhost network-scripts]#

Choose desired bond policy and make changes in BONDING_OPTS field. In my case I have chosen mode 1 which is active backup.

Configure the existing interfaces as slave to bond0

[root@localhost network-scripts]# cat ifcfg-eth0

TYPE=Ethernet

BOOTPROTO=none

DEVICE=eth0

ONBOOT=yes

HWADDR="00:50:56:96:64:9d"

MASTER=bond0

SLAVE=yes

[root@localhost network-scripts]# cat ifcfg-eth1

TYPE=Ethernet

BOOTPROTO=none

DEVICE=eth1

ONBOOT=yes

HWADDR="00:50:56:96:18:a6"

MASTER=bond0

SLAVE=yes

[root@localhost network-scripts]# systemctl restart network

[root@localhost network-scripts]# cat /proc/net/bonding/bond0

Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: fault-tolerance (active-backup)

Primary Slave: None

Currently Active Slave: eth0

MII Status: up

MII Polling Interval (ms): 100

Up Delay (ms): 0

Down Delay (ms): 0

Slave Interface: eth0

MII Status: up

Speed: 10000 Mbps

Duplex: full

Link Failure Count: 0

Permanent HW addr: 00:50:56:96:64:9d

Slave queue ID: 0

Slave Interface: eth1

MII Status: up

Speed: 10000 Mbps

Duplex: full

Link Failure Count: 0

Permanent HW addr: 00:50:56:96:18:a6

Slave queue ID: 0

[root@localhost ~]#

We have successfully configured nic bonding with Bonding Mode: fault-tolerance (active-backup)

HOW TO DISABLE CTRL-ALT-DEL IN RHEL7

2017-01-29T03:14:00.003+05:30

Disable the ctrl + Alt + delete key combination, one need to mask a service. This is like disabling a service,

Run the following command:

[root@RHEL7 ~]# ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target

[root@RHEL7 ~]# systemctl mask ctrl-alt-del.target

Created symlink from /etc/systemd/system/ctrl-alt-del.target to /dev/null.

NOTE: systemd will recognize units symlinked to /dev/null and show them as masked. If one try to send key combination, this will fail with following similar error.

However above steps will not disable ctrl + Alt + delete key combination, in GUI mode. To disable it in GUI change keyboard settings.

Navigate to Applications -> System Tools -> Settings -> Keyboard -> Shortcuts -> System

Set value of `Logout` as Disabled

Deny user direct login via ssh but allow login in between servers using match method

2017-01-29T03:13:00.000+05:30

To Deny user direct login via ssh but allow login in between servers we can user below “Match” method, This will Allow Ranjith_P04 user to login only from 10.18.43.69/10.18.43.70/10.18.43.71 servers and the same user is denied to login from entire network 10.18.*.*

This needs to be added in last line of /etc/ssh/sshd_config file with same order in all 3 servers and restart sshd service

Also need to remove “DenyUsers Ranjith_P04” line from /etc/ssh/sshd_config in order allow the user to login via ssh in between the given servers.

Match User Ranjith_P04 Address 10.18.43.69

PasswordAuthentication yes

Match User Ranjith_P04 Address 10.18.43.70

PasswordAuthentication yes

Match User Ranjith_P04 Address 10.18.43.71

PasswordAuthentication yes

Match User Ranjith_P04 Address 10.18.*.*

PasswordAuthentication no

Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory Unable to get Chassis Power Status

2017-01-29T03:08:00.002+05:30

You might of faced below error while executing “ipmitool lan print” command to find ILO IP.

Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory Unable to get Chassis Power Status

To overcome this we need to load two modules.

#modprobe ipmi_si

#modprobe ipmi_devintf

Authentication failure (Clock skew too great)

2017-01-29T03:07:00.002+05:30

I’ve faced a ACCESS DENIED issue when trying to login after vmware tools update. While checking on /var/log/secure I found (Clock skew too great) error.

To overcome this I re-synchronized ntp and authentication worked successfully.

Jul 25 06:34:13 RHEL7 sshd[16099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=domain.platforms.com user=Ranjith_P04

Jul 25 06:34:13 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)

Jul 25 06:34:15 RHEL7 sshd[16099]: Failed password for Ranjith_P04 from 10.81.11.250 port 50457 ssh2

Jul 25 06:34:20 RHEL7 sshd[16099]: pam_krb5[16099]: authentication fails for 'Ranjith_P04' (Ranjith_P04@PLATFORMS.COM): Authentication failure (Clock skew too great)

How to set grub password in rhel 7

2017-01-29T02:51:00.000+05:30

Set grub password in rhel 7

GRUB 2 supports both plain-text and encrypted passwords in the GRUB 2 template files. To enable the use of passwords, specify a superuser who can reach the protected entries. Other users can be specified to access these entries as well. Menu entries can be password-protected for booting by adding one or more users to the menu entry as described below

Use grub2-mkpasswd-pbkdf2 command as superuser and generate hash of your password

[root@RHEL7 ~]# grub2-mkpasswd-pbkdf2

Enter password:

Reenter password:

PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.94B202970DD3C124AF25AC9F05B504C6CAFBDEB976821E5D8247A938D3DBC0D9678B62E9519EEBC8A01DA479666578DC87B8CD0A8AF45A2D27285E76A1810F27.C8C6F75E5B6F9063271FEBB8294CA1276F4E87848632D30A95E29471F9AD43D845903B98CFE547C08B272E37E441768786BDC9899239CAC6599A8522D845F3A6

When the users and passwords are set up, specify the menu entries that should be password-protected in the /etc/grub.d/40_custom file in a similar fashion to the following:

[root@RHEL7 ~]# cat /etc/grub.d/40_custom

#!/bin/sh

exec tail -n +3 $0

set superusers="root"

password_pbkdf2 root grub.pbkdf2.sha512.10000.94B202970DD3C124AF25AC9F05B504C6CAFBDEB976821E5D8247A938D3DBC0D9678B62E9519EEBC8A01DA479666578DC87B8CD0A8AF45A2D27285E76A1810F27.C8C6F75E5B6F9063271FEBB8294CA1276F4E87848632D30A95E29471F9AD43D845903B98CFE547C08B272E37E441768786BDC9899239CAC6599A8522D845F3A6

# This file provides an easy way to add custom menu entries. Simply type the

# menu entries you want to add after this comment. Be careful not to change

# the 'exec tail' line above.

NOTE: the line below "set superusers" is a single line it should be password_pbkdf2 root followed by the encrypted password.

[root@RHEL7 ~]#

Run

grub2-mkconfig
-o /boot/grub2/grub.cfg

to import the changes into the main configuration file.

[root@RHEL7 ~]# grub2-mkconfig -o /boot/grub2/grub.cfg

Generating grub configuration file ...

Found linux image: /boot/vmlinuz-3.10.0-327.3.1.el7.x86_64

Found initrd image: /boot/initramfs-3.10.0-327.3.1.el7.x86_64.img

Found linux image: /boot/vmlinuz-3.10.0-229.el7.x86_64

Found initrd image: /boot/initramfs-3.10.0-229.el7.x86_64.img

Found linux image: /boot/vmlinuz-0-rescue-aed9495c9fa84bfbb71646105626f6c3

Found initrd image: /boot/initramfs-0-rescue-aed9495c9fa84bfbb71646105626f6c3.img

done

How to install wordpress in rhel 6.x / Centos 6.x

2013-10-05T16:51:00.000+05:30

[root@upload2 ~]# rpm -Uvh http://mirror.webtatic.com/yum/el6/latest.rpm
[root@upload2 ~]# yum install yum-plugin-replace
[root@upload2 ~]# yum install php-enchant
root@upload2 ~]# yum replace php-common --replace-with=php54w-common
[root@upload2 ~]# yum install wordpress
Installed:
wordpress.noarch 0:3.6.1-1.el6

Dependency Installed:
php-IDNA_Convert.noarch 0:0.8.0-1.el6   php-PHPMailer.noarch 0:5.2.2-1.el6
php-simplepie.noarch 0:1.3.1-3.el6      php54w-process.x86_64 0:5.4.19-1.w6

Complete!
[root@upload2 ~]# mysql -u root -ppassword
mysql> create database wordpress character set utf8 collate utf8_bin;
mysql> grant all privileges on wordpress.* to wordpress@'localhost' identified by 'password';
mysql> flush privileges;
mysql> exit
Bye
[root@upload2 ~]# vim /etc/wordpress/wp-config.php
19 define('DB_NAME', 'wordpress');
20
21 /** MySQL database username */
22 define('DB_USER', 'wordpress');
23
24 /** MySQL database password */
25 define('DB_PASSWORD', 'password');

[root@upload2 ~]# mkdir /usr/share/wordpress/wp-content/languages
[root@upload2 ~]# wget -P /usr/share/wordpress/wp-content/languages http://svn.automattic.com/wordpress-i18n/ja/tags/3.1.2/messages/ja.mo http://svn.automattic.com/wordpress-i18n/ja/tags/3.1.2/messages/continents-cities-ja.m
[root@upload2 ~]# ls /usr/share/wordpress/wp-content/languages/
continents-cities-ja.mo ja.mo
[root@upload2 ~]# /etc/init.d/httpd restart
Stopping httpd:                                            [ OK ]
Starting httpd:                                            [ OK ]

How to configure webdev

2013-10-05T15:10:00.002+05:30

[root@upload ~]# vim /etc/httpd/conf.d/webdav.conf
alias /share /imagedata1/3rdparty_packages/
<Location /share>
   DAV On
   SSLRequireSSL
   Options None
   AuthType Basic
   AuthName WebDAV
   AuthUserFile /etc/httpd/conf/.htpasswd
   <LimitExcept GET OPTIONS>
      Order allow,deny
      Allow from all
# IP address you allow

      Require valid-user
   </LimitExcept>
</Location>

[root@upload ~]# chmod 755 -R /imagedata1/3rdparty_packages/
[root@upload ~]# htpasswd -c /etc/httpd/conf/.htpasswd bala
New password:
Re-type new password:
Updating password for user bala
[root@upload ~]# service httpd restart
Stopping httpd:                                            [ OK ]
Starting httpd:                                           [ OK ]

Windows does not have webdav function, so Use free software for webdav client. Download 'CarotDAV' for free from following site.

http://rei.to/carotdav_en.html

Download and install in windows pc

The waring is shown like follows, it's SSL certificates is not installed on your PC, it's no ploblem, Click 'Ignore' and go next.

How to configure slave dns server

2013-10-04T18:44:00.000+05:30

Configuration on Master DNS

[root@upload named]# cat /etc/named.conf

options {
        listen-on port 53 { 127.0.0.1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; any; };
        allow-transfer { localhost; 10.66.191.221; };
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
        managed-keys-directory "/var/named/dynamic";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};
zone "zumi.com." {
       type master;
       file "zumi.com.zone";
       allow-update { none; };
};

zone "191.66.10.in-addr.arpa." {
      type master;
      file "191.66.10.in-addr.arpa.zone";
      allow-update { none; };
};

include "/etc/named.rfc1912.zones";

[root@upload named]# cat /var/named/zumi.com.zone
$TTL    86400
@    IN      SOA   upload.zumi.com. root.zumi.com. (
                                      1997022700 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      3600000    ; Expire
                                      86400 )    ; Minimum
             IN    NS             upload.zumi.com.
             IN    NS             upload2.zumi.com.
         IN       A        10.66.191.230
         IN       MX    1    upload.zumi.com
upload       IN    A              10.66.191.230
upload2         IN    A              10.66.191.221

[root@upload named]# rndc reload

Configuration on Slave DNS

[root@upload2 named]# cat /etc/named.conf

options {
    listen-on port 53 { 127.0.0.1; };
    #listen-on-v6 port 53 { ::1; };
    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; any; };
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};
    zone "zumi.com" IN {
        type slave;
        masters { 10.66.191.230; };
        file "slaves/zumi.com.zone";
        notify no;
    };
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

[root@upload2 etc]# service named start
Generating /etc/rndc.key:                                  [ OK ]
Starting named:                                            [ OK ]
[root@upload2 etc]# rndc reload
server reload successful
[root@upload2 etc]# ls /var/named/slaves/
zumi.com.zone

How to configure NTP Server

2013-10-04T17:57:00.002+05:30

[root@upload2 ~]# yum -y install ntp
[root@upload2 ~]# vim /etc/ntp.conf

# line 19: add the network range you allow to receive requests

restrict 10.0.0.0 mask 255.255.255.0 nomodify notrap

# change servers for synchronization

#server 0.rhel.pool.ntp.org

#server 1.rhel.pool.ntp.org

#server 2.rhel.pool.ntp.org

server ntp1.jst.mfeed.ad.jp

server ntp2.jst.mfeed.ad.jp

server ntp3.jst.mfeed.ad.jp

[root@upload2 ~]# /etc/rc.d/init.d/ntpd start
Starting ntpd:                                             [ OK ]
[root@upload2 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset jitter
==============================================================================
ntp1.jst.mfeed. 172.29.3.50      2 u   11   64    1 209.194 -112312   0.000
ntp2.jst.mfeed. 172.29.2.50      2 u   11   64    1 191.529 -112304   0.000
ntp3.jst.mfeed. 172.29.3.50      2 u   12   64    1 185.499 -112319   0.000
[root@upload2 ~]#

How to install zabbix in rhel 6.X / Centos 6.X

2013-10-03T17:11:00.001+05:30

Information about my system:-

Linux upload2.zumi.com 2.6.32-358.el6.x86_64 #1 SMP Fri Feb 22 00:31:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

[root@upload2 ~]# rpm -ivh epel-release-6-8.noarch.rpm

[root@upload2 ~]# rpm -ivh rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm

[root@upload2 ~]# rpm -ivh http://repo.zabbix.com/zabbix/2.0/rhel/6/x86_64/zabbix-release-2.0-1.el6.noarch.rpm

[root@upload2 ~]# yum install httpd php php-mysql mysql-server

[root@upload2 ~]# service mysqld start

[root@upload2 ~]# mysqladmin -u root password password

[root@upload2 ~]# mysql -u root -ppassword

mysql> use mysql;

mysql> DELETE FROM mysql.user WHERE user = '';

mysql> flush privileges;

mysql> quit

[root@upload2 ~]# yum install zabbix-server-mysql zabbix-agent zabbix-web-mysql

[root@upload2 ~]# mysql -u root -ppassword

mysql> create database zabbix character set utf8;

mysql> grant all privileges on zabbix.* to zabbix@localhost identified by 'zabbix';

mysql> quit

[root@upload2 ~]# cd /usr/share/doc/zabbix-server-mysql-2.0.8/create/

[root@upload2 create]# mysql -u root -ppassword zabbix < schema.sql

[root@upload2 create]# mysql -u root -ppassword zabbix < images.sql

[root@upload2 create]# mysql -u root -ppassword zabbix < data.sql

[root@upload2 create]# vi /etc/zabbix/zabbix_server.conf

81 DBHost=localhost

91 DBName=zabbix

107 DBUser=zabbix

115 DBPassword=zabbix

[root@upload2 create]# vi /etc/zabbix/zabbix_agentd.conf

136 Hostname=upload2.zumi.com
137
138 #Hostname=Zabbix server

[root@upload2 create]# vim /etc/php.ini

# line 440: change to Zabbix recomended

max_execution_time = 600

# line 449: change to Zabbix recomended

max_input_time = 600

# line 457: change to Zabbix recomended

memory_limit = 256M

# line 729: change to Zabbix recomended

post_max_size = 32M

# line 878: change to Zabbix recomended

upload_max_filesize = 16M

# line 946: uncomment and add your timezone

date.timezone = Asia/Calcutta

[root@upload2 create]# vi /etc/httpd/conf.d/zabbix.conf

Alias /zabbix /usr/share/zabbix

<Directory "/usr/share/zabbix">
    Options FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all   ------- > if u need specify particular ip range here.

    php_value max_execution_time 600
    php_value memory_limit 256M
    php_value post_max_size 32M
    php_value upload_max_filesize 16M
    php_value max_input_time 600
    php_value date.timezone Asia/Calcutta
</Directory>

[root@upload2 create]# vim /etc/httpd/conf/httpd.conf

276 ServerName upload2.zumi.com:80

[root@upload2 create]# service zabbix-server start
[root@upload2 create]# service zabbix-agent restar

[root@upload2 create]# service httpd restart

Change to "zabbix in "User" field and input the password. Next, click "Test Connection" and id it's "OK" like follows, go next

Input ZABBIX server's hostname and so on like follows

Make sure settings and if it's Ok all, go next

Default username/password is Admin/zabbix.

How to check hard disk failure in linux

2013-06-06T10:51:00.003+05:30

smartctl is a command line utility designed to perform SMART tasks such as printing the SMART self-test and error logs, enabling and disabling SMART automatic testing, and initiating device self-tests. First, make sure S.M.A.R.T. support is enabled in the BIOS. Next, run the following command to see if your hard disks support S.M.A.R.T technology or not:

[root@vellore ~]# smartctl -i /dev/sda
smartctl 5.42 2011-10-20 r3458 [x86_64-linux-2.6.32-279.el6.x86_64] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Barracuda 7200.12
Device Model:     ST3250318AS
Serial Number:    9VM8EC2E
LU WWN Device Id: 5 000c50 01a4a684d
Firmware Version: CC38
User Capacity:    250,058,268,160 bytes [250 GB]
Sector Size:      512 bytes logical/physical
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   8
ATA Standard is: ATA-8-ACS revision 4
Local Time is:    Thu Jun 6 10:19:02 2013 IST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

If not enabled by default, To enable SMART, run:

[root@vellore ~]# smartctl -s on -d ata /dev/sda
smartctl 5.42 2011-10-20 r3458 [x86_64-linux-2.6.32-279.el6.x86_64] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF ENABLE/DISABLE COMMANDS SECTION ===
SMART Enabled.

Run overall-health self-assessment test, enter:

[root@vellore ~]# smartctl -d ata -H /dev/sda
smartctl 5.42 2011-10-20 r3458 [x86_64-linux-2.6.32-279.el6.x86_64] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

A sample output from failing hard disk:

smartctl version 5.38 [i686-pc-linux-gnu] Copyright (C) 2002-8 Bruce Allen
Home page is http://smartmontools.sourceforge.net/
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Please note the following marginal Attributes:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
190 Airflow_Temperature_Cel 0x0022   044   033   045    Old_age   Always   FAILING_NOW 56 (96 110 58 25)

The following will provide even more information about failing hard disk:

[root@vellore ~]# smartctl --attributes --log=selftest /dev/sda
smartctl 5.42 2011-10-20 r3458 [x86_64-linux-2.6.32-279.el6.x86_64] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate     0x000f   119   099   006    Pre-fail Always       -       221288423
3 Spin_Up_Time            0x0003   097   097   000    Pre-fail Always       -       0
4 Start_Stop_Count        0x0032   093   093   020    Old_age   Always       -       7332
5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail Always       -       0
7 Seek_Error_Rate         0x000f   083   060   030    Pre-fail Always       -       205719784
9 Power_On_Hours          0x0032   091   091   000    Old_age   Always       -       8550
10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail Always       -       0
12 Power_Cycle_Count       0x0032   097   097   020    Old_age   Always       -       3611
183 Runtime_Bad_Block       0x0032   100   100   000    Old_age   Always       -       0
184 End-to-End_Error        0x0032   100   100   099    Old_age   Always       -       0
187 Reported_Uncorrect      0x0032   046   046   000    Old_age   Always       -       54
188 Command_Timeout         0x0032   100   092   000    Old_age   Always       -       68720526384
189 High_Fly_Writes         0x003a   095   095   000    Old_age   Always       -       5
190 Airflow_Temperature_Cel 0x0022   066   048   045    Old_age   Always       -       34 (Min/Max 20/37)
194 Temperature_Celsius     0x0022   034   052   000    Old_age   Always       -       34 (0 18 0 0 0)
195 Hardware_ECC_Recovered 0x001a   038   032   000    Old_age   Always       -       221288423
197 Current_Pending_Sector 0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   192   000    Old_age   Always       -       2109
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       269139830654254
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       1152744560
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       177103330

SMART Self-test log structure revision number 1
Num Test_Description    Status                  Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline       Completed without error       00%      8550         -
# 2 Short offline       Completed without error       00%      8550         -

You can read more data from hard disk by typing the following command:

[root@vellore ~]# smartctl -d ata -a /dev/sda
smartctl 5.42 2011-10-20 r3458 [x86_64-linux-2.6.32-279.el6.x86_64] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Barracuda 7200.12
Device Model:     ST3250318AS
Serial Number:    9VM8EC2E
LU WWN Device Id: 5 000c50 01a4a684d
Firmware Version: CC38
User Capacity:    250,058,268,160 bytes [250 GB]
Sector Size:      512 bytes logical/physical
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   8
ATA Standard is: ATA-8-ACS revision 4
Local Time is:    Thu Jun 6 10:25:54 2013 IST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status: (0x82)    Offline data collection activity
                    was completed without error.
                    Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0)    The previous self-test routine completed
                    without error or no self-test has ever
                    been run.
Total time to complete Offline
data collection:         ( 634) seconds.
Offline data collection
capabilities:             (0x7b) SMART execute Offline immediate.
                    Auto Offline data collection on/off support.
                    Suspend Offline collection upon new
                    command.
                    Offline surface scan supported.
                    Self-test supported.
                    Conveyance Self-test supported.
                    Selective Self-test supported.
SMART capabilities:            (0x0003)    Saves SMART data before entering
                    power-saving mode.
                    Supports SMART auto save timer.
Error logging capability:        (0x01)    Error logging supported.
                    General Purpose Logging supported.
Short self-test routine
recommended polling time:     (   1) minutes.
Extended self-test routine
recommended polling time:     ( 49) minutes.
Conveyance self-test routine
recommended polling time:     (   2) minutes.
SCT capabilities:            (0x103f)    SCT Status supported.
                    SCT Error Recovery Control supported.
                    SCT Feature Control supported.
                    SCT Data Table supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate     0x000f   119   099   006    Pre-fail Always       -       221291036
3 Spin_Up_Time            0x0003   097   097   000    Pre-fail Always       -       0
4 Start_Stop_Count        0x0032   093   093   020    Old_age   Always       -       7332
5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail Always       -       0
7 Seek_Error_Rate         0x000f   083   060   030    Pre-fail Always       -       205719881
9 Power_On_Hours          0x0032   091   091   000    Old_age   Always       -       8550
10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail Always       -       0
12 Power_Cycle_Count       0x0032   097   097   020    Old_age   Always       -       3611
183 Runtime_Bad_Block       0x0032   100   100   000    Old_age   Always       -       0
184 End-to-End_Error        0x0032   100   100   099    Old_age   Always       -       0
187 Reported_Uncorrect      0x0032   046   046   000    Old_age   Always       -       54
188 Command_Timeout         0x0032   100   092   000    Old_age   Always       -       68720526384
189 High_Fly_Writes         0x003a   095   095   000    Old_age   Always       -       5
190 Airflow_Temperature_Cel 0x0022   067   048   045    Old_age   Always       -       33 (Min/Max 20/37)
194 Temperature_Celsius     0x0022   033   052   000    Old_age   Always       -       33 (0 18 0 0 0)
195 Hardware_ECC_Recovered 0x001a   038   032   000    Old_age   Always       -       221291036
197 Current_Pending_Sector 0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   192   000    Old_age   Always       -       2109
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       251745213105454
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       1152748352
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       177103394

SMART Error Log Version: 1
ATA Error Count: 53 (device log contains only the most recent five errors)
    CR = Command Register [HEX]
    FR = Features Register [HEX]
    SC = Sector Count Register [HEX]
    SN = Sector Number Register [HEX]
    CL = Cylinder Low Register [HEX]
    CH = Cylinder High Register [HEX]
    DH = Device/Head Register [HEX]
    DC = Device Command Register [HEX]
    ER = Error register [HEX]
    ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 53 occurred at disk power-on lifetime: 2271 hours (94 days + 15 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 2a 68 f4 00 Error: UNC at LBA = 0x00f4682a = 16017450

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC   Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 18 18 68 f4 e0 00      00:05:05.081 READ DMA EXT
25 00 1d 7a 5f 21 e0 00      00:05:05.072 READ DMA EXT
25 00 12 27 ba 0b e0 00      00:05:05.065 READ DMA EXT
25 00 40 fb 2c 1b e0 00      00:05:05.058 READ DMA EXT
35 00 08 a8 84 6f e1 00      00:05:05.053 WRITE DMA EXT

Error 52 occurred at disk power-on lifetime: 2271 hours (94 days + 15 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 2a 68 f4 00 Error: UNC at LBA = 0x00f4682a = 16017450

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC   Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 18 18 68 f4 e0 00      00:04:59.057 READ DMA EXT
35 00 08 c8 b2 63 e0 00      00:04:59.057 WRITE DMA EXT
35 00 08 d8 1b 63 e0 00      00:04:59.056 WRITE DMA EXT
35 00 08 90 1b 5f e0 00      00:04:59.056 WRITE DMA EXT
35 00 05 48 dd 2a e0 00      00:04:59.055 WRITE DMA EXT

Error 51 occurred at disk power-on lifetime: 2271 hours (94 days + 15 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 2a 68 f4 00 Error: UNC at LBA = 0x00f4682a = 16017450

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC   Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 08 28 68 f4 e0 00      00:04:55.718 READ DMA EXT
35 00 00 70 8e c7 e0 00      00:04:55.717 WRITE DMA EXT
35 00 00 70 8d c7 e0 00      00:04:55.716 WRITE DMA EXT
35 00 00 70 8c c7 e0 00      00:04:55.716 WRITE DMA EXT
35 00 00 70 8b c7 e0 00      00:04:55.715 WRITE DMA EXT

Error 50 occurred at disk power-on lifetime: 2271 hours (94 days + 15 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 2a 68 f4 00 Error: UNC at LBA = 0x00f4682a = 16017450

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC   Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 80 28 68 f4 e0 00      00:04:52.682 READ DMA EXT
35 00 10 e8 3d 63 e0 00      00:04:52.681 WRITE DMA EXT
35 00 08 48 22 63 e0 00      00:04:52.681 WRITE DMA EXT
35 00 08 68 2c 16 e0 00      00:04:52.681 WRITE DMA EXT
35 00 08 e0 36 04 e0 00      00:04:52.680 WRITE DMA EXT

Error 49 occurred at disk power-on lifetime: 2271 hours (94 days + 15 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 00 2a 68 f4 00 Error: UNC at LBA = 0x00f4682a = 16017450

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC   Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 80 20 68 f4 e0 00      00:04:49.433 READ DMA EXT
35 00 08 88 1b 5f e0 00      00:04:49.433 WRITE DMA EXT
35 00 08 40 29 16 e0 00      00:04:49.433 WRITE DMA EXT
35 00 08 90 3b 07 e0 00      00:04:49.433 WRITE DMA EXT
35 00 06 88 83 f4 e0 00      00:04:49.432 WRITE DMA EXT

SMART Self-test log structure revision number 1
Num Test_Description    Status                  Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline       Completed without error       00%      8550         -
# 2 Short offline       Completed without error       00%      8550         -

SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
    1        0        0 Not_testing
    2        0        0 Not_testing
    3        0        0 Not_testing
    4        0        0 Not_testing
    5        0        0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

Say hello to GSmartControl

GSmartControl is hard disk drive health inspection tool and a graphical user interface for smartctl command. This tool has the following features:

Automatically reports and highlights any anomalies;
Allows enabling/disabling SMART;
Allows enabling/disabling Automatic Offline Data Collection - a short self-check that the drive will perform automatically every four hours with no impact on performance;
Supports configuration of global and per-drive options for smartctl;
Performs SMART self-tests;
Displays drive identity information, capabilities, attributes, and self-test/error logs;
Can read in smartctl output from a saved file, interpreting it as a read-only virtual device;
Works on most smartctl-supported operating systems like *BSD and various Linux distros;
Has extensive help information.

[root@vellore ~]# yum install gsmartcontrol