Let's Blog about IT

OpenVPN - FAQ

2013-12-07T23:23:00.004+08:00

Issue: I can establish VPN connection but ping to public IP like 8.8.8.8 is timeout

Fix: Add 2 lines below to OpenVPN server
echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -s 10.66.77.0/24 -o eth0 -j MASQUERADE

Opsview Error code and fixes

2013-11-25T15:54:00.002+08:00

1. (Return code of 13 is out of bounds)

Fixes: Clear /tmp file, some of the files with root permission which nagios couldn't access

2. (Return code of 255 is out of bounds)
Most likely wrong password supplied or password with "!" for MySQL server node

Install S3fs on Amazon Linux/Centos

2013-11-22T14:31:00.003+08:00

S3f3 is FUSE-based file system backed by Amazon S3 which you can mount your S3 bucket to Linux machine.

Use cases:-
- Turn your backup folder to unlimited storage pool
- Serve as centralized media storage location for multiple servers.

Limitation:-

Objects size can only up to of 5GB.
You can't update part of an object. If you want to update 1 byte in a 1GB object you'll have to reupload the entire file.

Here's the installation steps:-
sudo yum groupinstall "Development Tools";
sudo yum install curl-devel libxml2-devel openssl-devel mailcap

cd ~;
wget http://downloads.sourceforge.net/project/fuse/fuse-2.X/2.9.3/fuse-2.9.3.tar.gz;
tar -xzvf fuse-2.9.3.tar.gz;
cd fuse-2.9.3;

./configure --prefix=/usr;
make;
sudo make install;
sudo ldconfig;
export PKG_CONFIG_PATH=/usr/lib/pkgconfig;
#Verify version
#pkg-config --modversion fuse

cd~;
wget http://s3fs.googlecode.com/files/s3fs-1.73.tar.gz;
tar -xzvf s3fs-1.73.tar.gz;
cd s3fs-1.73;
./configure --prefix=/usr;
make;
sudo make install;

vi /etc/passwd-s3fs
chmod 600 /etc/passwd-s3fs

mount s3fs [bucketname] ~/s3bucket
umount: fusermount -u ~/s3bucket

mount on boot

s3fs#s3bucket /mnt/s3bucket fuse allow_other,use_cache=/tmp 0 0

Sources: http://kisdigital.wordpress.com/2011/08/04/installing-s3fs-on-rhelcentos/
http://www.idevelopment.info/data/AWS/AWS_Tips/AWS_Management/AWS_20.shtml
http://www.turnkeylinux.org/blog/exploring-s3-based-filesystems-s3fs-and-s3backer

S3fs Home
Fuse Home

Magento - Shipping Configuration error

2013-08-31T15:31:00.002+08:00

I was setting UPS XML integration over the last 2 weeks and keep banging the wall with this error message:-

This shipping method is currently unavailable. If you would like to ship using this shipping method, please contact us.

As I still new to Magento, It took me 2 weeks to get to the root cause, in the begining I suspect the problem was related to UPS account or access key so I keep testing around them, but turn out to be unit of measure issue.

Some of the test products, I've uom to 200 which turn out to be 200Kg which over 70KG limit after I stumble across this site with advice of turning on debug mode:-
http://www.magentocommerce.com/boards/viewthread/4283/

And the log reveal the cause:-
<RatingServiceSelectionResponse><Response><TransactionReference><CustomerContext>Rating and Service</CustomerContext><XpciVersion>1.0</XpciVersion></TransactionReference><ResponseStatusCode>0</ResponseStatusCode><ResponseStatusDescription>Failure</ResponseStatusDescription><Error><ErrorSeverity>Hard</ErrorSeverity><ErrorCode>111036</ErrorCode><ErrorDescription>The maximum per package weight for the selected service from the selected country is 70.00 kg.</ErrorDescription></Error></Response></RatingServiceSelectionResponse>

I wonder why can't the detail or specify error be shown on front-end site!

VirtualBox Installation error

2013-05-16T09:48:00.001+08:00

If you run into the error message at the first launch from virtualbox on your Linux box with error below:-
================

Kernel driver not installed (rc=-1908)

The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or there is a permission problem with /dev/vboxdrv. Please reinstall the kernel module by executing

'/etc/init.d/vboxdrv setup'

as root. If it is available in your distribution, you should install the DKMS package first. This package keeps track of Linux kernel changes and recompiles the vboxdrv kernel module if necessary.

================

[root@localhost ~]# /etc/init.d/vboxdrv setup
Stopping VirtualBox kernel modules [ OK ]
Recompiling VirtualBox kernel modules [FAILED]
(Look at /var/log/vbox-install.log to find out what went wrong)

leads you to another error:-

unable to find the sources of your current Linux kernel. Specify KERN_DIR=<directory> and run Make again

Solution:-
[root@localhost ~]# yum install kernel-devel kernel-headers gcc

AWS - S3 - Apply bucket policy for public read and office IP read and write

2013-04-09T10:00:00.002+08:00

Here's the sample S3 Bucket policy when you have a pulic read bucket but only restrict write/update access to office network

If you enable everyone list your bucket from permission menu, everyone could grep the whole list of our bucket object by browsing your root domain url

{
"Id": "Policy1346919974114",
"Statement": [
    {
      "Sid": "Stmt1346917860156",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::origin-pdf.domain.com/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "110.174.240.29/26",
            "175.143.152.282/32"
          ]
        }
      },
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    },
    {
      "Sid": "Stmt1346919900506",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::origin-pdf.domain.com/*",
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    }
]
}

DevOps Toolbox - Mount New volume to EC2

2013-04-06T00:23:00.001+08:00

This should be a piece of coke for a most sysadmin, but if you only do it once in a blue moon(or start aging like me), you would probably spend 30mins googling. So I decided to write it down.

1. Attach the new EBS volume to your instance from console

2. Login into your instance on the command line and do and run (# represents the command prompt):
# ls /dev
You should see that /dev/sdf has been created for you

3. Format /dev/sdf by running:
# mkfs.ext3 or mkfs.ext4 /dev/sdf
It will warn you that this an entire device. You should type y to allow the process to continue unless you want to create specific partitions on this device

4. Create a directory to mount your new drive as on the filesystem, for example we’ll use /var:
# mkdir /var (first mv var to var.bk)

5. Add a reference in the fstab file to mount the newly formatted drive onto the /files directory by running the following command:
# echo “/dev/sdb /files ext4 noatime 0 0″ >> /etc/fstab

6. Mount the drive by running:
# mount /var

7. Check your drive has mounted correctly with the expected amount of file space by running:
# df -h /var

It really is that simple, within a few cli commands you can simply add 1GB to 1TB of storage at the drop of a hat!

Source: http://www.digitaltactics.co.uk/linux/how-to-mount-an-amazon-ebs-disk-as-a-drive-in-linux-centos/

Windows file sharing fix

2012-09-03T09:54:00.001+08:00

And now you have successfully configured your Linux server to get authenticated via AD, Hooray!

Wait a minute, why can't I connect to my \\ files on Linux from Windows?

Here's the changes you need to make on your Windows Server local policy:-
1.Open the Run command and type "secpol.msc".

2. Click on "Local Policies" --> "Security Options"

3. Navigate to the policy "Network Security: LAN Manager authentication level" and open it.

4. Change the policy to "Send LM and NTLM – use NTLMV2 session security if negotiated".

Linux - how to show the memory usage per process

2012-08-16T10:02:00.001+08:00

Top is a very useful command to show real time overall system health like CPU,memory and swap status

But when come to memory leak detection, we will need more detail information like which process consumes how much memory

Command below comes handy:-

ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS

Disable Auto-Restart after Windows Update

2012-08-02T21:55:00.000+08:00

If you often receive alert at 3 in the morning about your lovely Windows servers restart by itself.

Chances are Auto-restart has been set to on on Windows Update configuration and Windows Update is normally scheduled to restart at 3:00a.m. by default.

To disable Auto Restart after Windows Update. You can set it from Group Policy.

Run gpedit.msc

Computer Configuration-> Admin Template->Windows Component-> Windows Update
Enable - No auto-restart with...

You can now have a good night sleep. Zz.zz..

Authenticating Linux against Active Directory

2012-08-02T00:01:00.001+08:00

When you only have few Linux machines and sysadmins, a simple local machine authentication would do a fairy good job.

Imaging if you have 64 Linux box(and growing) and 4 sysadmins. To keep and maintain sudo access up-to-update would be a daunting task.

Why not get Linux and Windows talk to each other if you already have Active Directory on your environment?

- First you will need to ensure Linux machine A record added to AD DNS server

- create a AD group called linixadmin and add admin user to the group

- Next run the following command on Linux client box

yum install samba-common samba-winbind pam_krb5 sudo authconfig;
chkconfig winbind on;
mkdir /home/[your domain name-mycompany];
chmod 0777 /home/mycompany;
echo "%linuxadmin ALL=(ALL) ALL" >> /etc/sudoers;

authconfig \
--disablecache \
--enablewinbind \
--enablewinbindauth \
--smbsecurity=ads \
--smbworkgroup=MYCOMPANY \
--smbrealm=MYCOMPANY.LOCAL \
--enablewinbindusedefaultdomain \
--winbindtemplatehomedir=/home//%U \
--winbindtemplateshell=/bin/bash \
--enablekrb5 \
--krb5realm=MYCOMPANY.LOCAL \
--enablekrb5kdcdns \
--enablekrb5realmdns \
--enablelocauthorize \
--enablemkhomedir \
--enablepamaccess \
--updateall \

net ads join -U "AD Admin account i.e. joesoh";

service winbind restart

===

Note: MYCOMPANY.LOCAL is your AD domain name

Try logon using you Windows ID and password.

Now who say Windows and Linux don't talk?

php installation

2012-01-17T17:19:00.000+08:00

Steps to install php APC

# yum install pcre-devel
# pecl install apc

Build process completed successfully
Installing '/usr/lib64/php/modules/apc.so'
Installing '/usr/include/php/ext/apc/apc_serializer.h'
install ok: channel://pecl.php.net/APC-3.1.9
configuration option "php_ini" is not set to php.ini location
You should add "extension=apc.so" to php.ini
 

Opsview

2012-01-09T15:23:00.000+08:00

Install solr_check with sudo cpan -i XML::XPath fail

which make

cpan> o conf make /usr/bin/make
    make               /usr/bin/make

cpan> o conf commit
commit: wrote /etc/perl/CPAN/Config.pm

https://github.com/rbramley/Opsview-solr-checks
http://johnbokma.com/mexit/2010/09/22/cpan-writing-makefile-not-ok.html

How to start Tomcat at boot time on CentOS

2011-09-30T10:10:00.000+08:00

If you use Tomcat for you Java app, you will most probably encouter a situation where Tomcat doesn't load after reboot.

This due to, as at the time of writing ,Tomcat doesn't have its built-in or default startup script included.
As usual, after some googling, found out the script below creates a custom Tomcat service and load tomcat automatically at startup.

#!/bin/bash
#
# Tomcat Server
#
# chkconfig: 345 96 30
# description: Start up the Tomcat servlet engine.

# Source function library.
. /etc/init.d/functions

RETVAL=$?
CATALINA_HOME="/opt/tomcat"

start() {
        if [ -f $CATALINA_HOME/bin/startup.sh ];
          then
            echo $"Starting Tomcat"
            /bin/su tomcat $CATALINA_HOME/bin/startup.sh
        fi
        sleep 2
}
stop() {
        if [ -f $CATALINA_HOME/bin/shutdown.sh ];
          then
            echo $"Stopping Tomcat"
            /bin/su tomcat $CATALINA_HOME/bin/shutdown.sh
        fi

}

case "$1" in
start)
        start
        ;;
stop)
        stop
        ;;
restart)
        stop
        sleep 2
        start
        ;;

*)
        echo $"Usage: $0 {start|stop|restart}"
        exit 1
        ;;
esac

exit $RETVAL

In order to support chkconfig, an init script must:
1. Be located in /etc/rc.d/init.d (which /etc/init.d is a symlink to)
2. Have a commented out line that contains “chkconfig: <default runlevels for this service> <start priority> <stop priority>”
3. Have a commented out line that contains “description: <a description of the service>”
4. Upon successful service startup, place a lock file in /var/lock/subsys that matches the name of the service script. Upon successful service shutdown, the lockfile must be removed.

5. If the avove doesn't wotk. Add symbolic link for /etc/init.d/tomcat to etc/rc.d/rc2.d/S96tomcat, /etc/rc.d/rc1.d/K99tomcat

Reference:
http://adityo.blog.binusian.org/?tag=redhat-run-level-and-how-to-make-tomcat-service-to-run-on-boot-time-in-centos

Update: If you install Tomcat from Yum, init script is already included, just run /etc/init.d/tomcat7 start/stop/restart

Windows Active Directory (AD)

2011-09-29T15:36:00.000+08:00

Port 389 and 3289 need to be opened.

Do check firewall outbound rule, spent more than a week to configure a remote office to join domain.
Endup discovered that remote office firewal blocked outgoing traffic for those ports!

Linux - mySQL

2011-09-23T09:09:00.001+08:00

Grant Remote Access
CREATE USER 'joe.soh'@'%' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON *.* TO 'joe.soh'@'%' WITH GRANT OPTION;

update user set password=PASSWORD("NEW-PASSWORD-HERE") where User='tom';

Linux - Apache

2011-09-15T12:30:00.000+08:00

Passworded Apache site

Password file location - /var/httpd/conf/.htpasswd
command - htpasswd -c /home/doe/public_html/.htpasswd jane

http://httpd.apache.org/docs/2.0/programs/htpasswd.html

# add password on access
AuthUserFile conf/.htpasswd
AuthGroupFile /dev/null
AuthName "Authorization Required"
Authtype Basic
require valid-user
or any other location as you want

Windows Server - grant the Logon as a batch job privilege

2010-11-23T12:37:00.000+08:00

Question: How do I grant the Logon as a batch job privilege to my user account?
Answer: On Windows, this privilege is granted through the Local or Domain Security Policy. To do this using the Local Security Policy, follow these steps.

In the Control Panel, open Administrative Tools, then Local Security Policy.
Beneath Security Settings, open Local Policies and highlight User Rights Assignment.
Locate Log on as a batch job. Open the properties and add any users that need this right.
When finished, save your changes and close the Local Security Settings window.

Your changes should take effect immediately. To make changes to the Domain Security Policy, on a domain controller, use the Domain Security Policy utility in the Control Panel.

Source: http://www.brooksnet.com/faq/117-02.html

Sendmail

2010-11-12T09:17:00.001+08:00

resend deferred mail immediately
sendmail -OTimeout.hoststatus=0m -q -v

Linux - Ksplice Uptrack Installation

2010-09-20T17:13:00.000+08:00

Installing Ksplice Uptrack on CentOS

Please use the same access key on all of your systems. If you don't remember it, you can get it from the web interface.

Download the Ksplice Uptrack repository installation RPM package and run the following commands as root:

wget https://www.ksplice.com/yum/uptrack/centos/ksplice-uptrack-release.noarch.rpm

rpm -i ksplice-uptrack-release.noarch.rpm
yum -y install uptrack

Edit /etc/uptrack/uptrack.conf and insert your access key.

Please use the same access key for all of your systems. Once you've done that, please run the following command as root to bring your kernel up to date:

uptrack-upgrade -y

WEB Admin

2010-09-08T15:09:00.001+08:00

Site to test page compression

http://www.gidnetwork.com/tools/gzip-test.php

Windows issues

2010-09-07T17:51:00.000+08:00

Windows Keep Check Disk at startup

"fsutil dirty query d: ". This queries the drive, and more than likely it will tell you that it is dirty.

"CHKNTFS /X D:". The X tells Windows to NOT check that particular drive on the next reboot. At this time, manually reboot your computer, it should not do a Chkdsk and take you directly to Windows.

Once Windows has fully loaded, bring up another CMD prompt and type and now you want to do a Chkdsk manually by typing "Chkdsk /f /r d:".
This should take you through 5 stages of the scan and will unset that dirty bit.

Finally, type "fsutil dirty query d:" and Windows will confirm that the dirty bit is not set on that drive.

source: http://forums.cnet.com/5208-10149_102-0.html?threadID=113089

Installing Wordpress

2010-09-07T17:46:00.000+08:00

Download wordpress from its website

Install MYsql and create a database

$ mysql -u adminusername -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 5340 to server version: 3.23.54
 
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
 
mysql> CREATE DATABASE databasename;
Query OK, 1 row affected (0.00 sec)
 
mysql> GRANT ALL PRIVILEGES ON databasename.* TO "wordpressusername"@"hostname"
    -> IDENTIFIED BY "password";
Query OK, 0 rows affected (0.00 sec)
  
mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.01 sec)

mysql> EXIT
Bye
$

DNS

2010-09-07T14:01:00.000+08:00

#Refresh Interval

The refresh interval is the number of seconds at which the secondary domain name
server will try to synchronize its records with the primary domain name server.

Varnish - HTTP Accelerator

2010-09-07T10:20:00.000+08:00

Start Varnish
varnishd -f /usr/local/etc/varnish/default.vcl -s malloc,1G -T 127.0.0.1:2000