Linux Worms

Renew k8s certificates

2026-08-10T21:35:50.534+05:30

Check If certificate expires:

amikum@~:03:06:54(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED

admin.conf Jan 12, 2024 03:08 UTC 1y no

apiserver Jun 08, 2023 09:36 UTC 364d ca no

apiserver-etcd-client Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

apiserver-kubelet-client Apr 15, 2022 06:46 UTC <invalid> ca no

controller-manager.conf Apr 15, 2022 06:46 UTC <invalid> no

etcd-healthcheck-client Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

etcd-peer Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

etcd-server Apr 15, 2022 06:46 UTC <invalid> etcd-ca no

front-proxy-client Apr 15, 2022 06:46 UTC <invalid> front-proxy-ca no

scheduler.conf Apr 15, 2022 06:46 UTC <invalid> no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED

ca Apr 13, 2031 06:46 UTC 8y no

etcd-ca Apr 13, 2031 06:46 UTC 8y no

front-proxy-ca Apr 13, 2031 06:46 UTC 8y no

===========================================

renew the certificate

amikum@~:03:07:35(⎈ |local-cluster:default):sudo kubeadm certs renew apiserver-etcd-client

[renew] Reading configuration from the cluster...

[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate the apiserver uses to access etcd renewed

amikum@~:03:09:06(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED

admin.conf Jan 12, 2024 03:08 UTC 1y no

apiserver Jun 08, 2023 09:36 UTC 364d ca no

apiserver-etcd-client Jun 08, 2023 09:37 UTC 364d etcd-ca no

apiserver-kubelet-client Jun 08, 2023 09:38 UTC 364d ca no

controller-manager.conf Jun 08, 2023 09:38 UTC 364d no

etcd-healthcheck-client Jun 08, 2023 09:38 UTC 364d etcd-ca no

etcd-peer Jun 08, 2023 09:38 UTC 364d etcd-ca no

etcd-server Jun 08, 2023 09:38 UTC 364d etcd-ca no

front-proxy-client Jun 08, 2023 09:38 UTC 364d front-proxy-ca no

scheduler.conf Jun 08, 2023 09:38 UTC 364d no

CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED

ca Apr 13, 2031 06:46 UTC 8y no

etcd-ca Apr 13, 2031 06:46 UTC 8y no

front-proxy-ca Apr 13, 2031 06:46 UTC 8y no

=======================

Regenerate new admin kubeconfig

root@NO2ECIVM03:/etc/kubernetes# kubeadm init phase kubeconfig admin

I0608 15:27:16.743911 30150 version.go:254] remote version is much newer: v1.24.1; falling back to: stable-1.21

[kubeconfig] Writing "admin.conf" kubeconfig file

Allow internet access through proxy and ssh port forwarding

2026-08-10T21:35:05.229+05:30

Step 1) install squid on 132.1.16.100 box

dev@kvm2:~$ sudo apt-get install squid3

dev@kvm2:~$ ps ax|grep squid

11700 ? Ss 0:00 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

11704 ? Ss 0:00 (logfile-daemon) /var/log/squid3/access.log

11783 pts/3 S+ 0:00 grep --color=auto squid

dev@kvm2:~$ telnet localhost 3128

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

dev@kvm2:~$ export HTTP_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

[ <=> ] 14,396 --.-K/s in 0.01s

2018-10-19 11:32:09 (1.21 MB/s) - ‘index.html’ saved [14426]

dev@kvm2:~$ export HTTPS_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

[ <=> ] 14,396 --.-K/s in 0.01s

2018-10-19 11:32:26 (1.19 MB/s) - ‘index.html.1’ saved [14396]

root@kvm2:~# grep "http_access allow all" /etc/squid3/squid.conf

http_access allow all

root@kvm2:~#

restart the squid service

root@kvm2:~# ps -ef | grep squid

root 13143 1 0 11:38 ? 00:00:00 sudo /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy 13144 13143 0 11:38 ? 00:00:07 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy 13145 13144 0 11:38 ? 00:00:00 (logfile-daemon) /var/log/squid3/access.log

root 37164 37034 0 16:44 pts/6 00:00:00 grep --color=auto squid

root@kvm2:~#

step 2) ssh port forward on 172.16.30153

C:\Users\opsadmin>ssh -R 9002:132.1.16.100:3128 ansible@172.16.30.153

Last login: Fri Oct 19 11:45:22 2018 from 10.212.134.202

ansible@ubuntuTest:~$ telnet localhost 9002

Trying ::1...

Connected to localhost.

Escape character is '^]'.

ansible@ubuntuTest:~$ export http_proxy="localhost:9002"

ansible@ubuntuTest:~$ export https_proxy="localhost:9002"

ansible@ubuntuTest:~$ wget --proxy=on google.com

--2018-10-19 11:49:20-- http://google.com/

Resolving localhost (localhost)... ::1, 127.0.0.1

Connecting to localhost (localhost)|::1|:9002... connected.

Proxy request sent, awaiting response... 301 Moved Permanently

Location: http://www.google.com/ [following]

--2018-10-19 11:49:21-- http://www.google.com/

Reusing existing connection to [localhost]:9002.

Proxy request sent, awaiting response... 200 OK

Length: unspecified [text/html]

Saving to: ‘index.html’

[ <=> ] 14,393 --.-K/s in 0.03s

2018-10-19 11:49:21 (550 KB/s) - ‘index.html’ saved [14393]

root@ubuntuTest:/var/www/html/zabbix# cat /etc/apt/apt.conf

Acquire::http::Proxy "http://localhost:9002";

Acquire::https::Proxy "https://localhost:9002";

Acquire::ftp::Proxy "ftp://localhost:9002";

root@ubuntuTest:/var/www/html/zabbix#

Apache access control via Ldap

2018-09-19T11:38:00.001+05:30

Friend,

We have an application (Logsniffer) running And We were looking for some access control on it.

Below are config file for Apache access control via ldap.

root@ip-10-101-2-145:/etc/apache2/sites-enabled# cat logsniffer-ssl.conf
Listen 443
<VirtualHost *:443>
  ServerName logsniffer-cme.atpl.com
  ServerAlias logsniffer-cme.atpl.com
  SSLEngine On
  SSLCertificateFile /etc/apache2/ssl/crt/8b47601b81cb83cf.crt
  SSLCertificateKeyFile /etc/apache2/ssl/key/acceletrade.key
  SSLCertificateChainFile /etc/apache2/ssl/key/gd_bundle-g2-g1.crt

  ProxyRequests     Off
  ProxyPass         /  http://localhost:8082/
  ProxyPassReverse  /  http://localhost:8082/
#  ProxyPassReverse  /  http://www.logsniffer.my.domain/
  <Proxy http://localhost:8082/*>
        Order deny,allow
        Deny from All
        AuthName "Valid Ldap Authorisation for LDap Domain"
        AuthType Basic
        AuthBasicProvider ldap
#        AuthzLDAPAuthoritative on
        AuthLDAPUrl "ldap://132.1.16.104:389/cn=users,cn=accounts,dc=atpl,dc=com?uid"
        Require ldap-group cn=cme,cn=groups,cn=accounts,dc=atpl,dc=com
        Satisfy any
</Proxy>
  ProxyPreserveHost on
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Assign fix netwrk interface name

2018-09-03T13:49:00.002+05:30

Hi Friends,

After network hardware or os up-gradation, We normally loose network interface names.

And If you are working in remote location, It become pain to change interfaces settings (ex- ip, rx-tx settings).

Please use below settings to avoid this:-

1) # In /etc/default/grub - ensures eth0/1/2/x like names


GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"

2) # MAC address can be read using following command

root@abc:~# ls /sys/class/net/ | xargs -IX sh -c 'echo X $(cat /sys/class/net/X/address)'

eth0 88:d7:f6:d4:be:37

eth1 88:d7:f6:d4:be:36

eth2 64:3f:5f:01:5a:dc

eth3 64:3f:5f:01:5a:dd

eth4 64:3f:5f:01:5a:c8

eth5 64:3f:5f:01:5a:c9

lo 00:00:00:00:00:00

3) Create /etc/udev/rules.d/70-persistent-net.rules !! FIX MAC ADDRESSES LIST !!


# Create /etc/udev/rules.d/70-persistent-net.rules !! FIX MAC ADDRESSES LIST !!

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="2c:4d:54:46:60:49", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="2c:4d:54:46:60:4a", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2e:d8", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth2"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2e:d9", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth3"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2d:af", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth4"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2d:ae", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth5"

Keepalived configure for Failover

2018-07-02T21:52:00.000+05:30

Friends,

Today I am showing Haproxy setup along with Keepalived. In this blog I will setup Keep alive. HaProxy setup will be done on my next blog.

Keepalived is used to achieve high availability by assigning a VIP to two or more servers.

Installation:-
I am doing this on two ubuntu servers having ip 172.16.1.209 and 172.16.1.211. The virtual IP will be 172.16.1.210.

Install packages

apt-get install keepalived

Configuring keepalived

Create the config file on the first server (172.16.1.209):


vim /etc/keepalived/keepalived.conf




global_defs {

  router_id NM-PRD-HAPROXY-209

}

vrrp_script haproxy {

script "killall -0 haproxy"

interval 1

weight 2

}

vrrp_instance 50 {

virtual_router_id 50

advert_int 1

priority 101

state MASTER

interface eth0

virtual_ipaddress {

172.16.1.210

  }

  track_script {

haproxy

  }

authentication {

        auth_type PASS

        auth_pass We$,J)Og&

    }

}

Create the config file on the second server (172.16.1.211)


vim /etc/keepalived/keepalived.conf




global_defs {

  router_id NM-PRD-HAPROXY-211

}

vrrp_script haproxy {

  script "killall -0 haproxy"

  interval 1

  weight 2

}

vrrp_instance 50 {

  virtual_router_id 50

  advert_int 1

  priority 102

  state MASTER

  interface eth0

  virtual_ipaddress {

    172.16.1.210

  }

  track_script {

    haproxy

  }

authentication {

        auth_type PASS

        auth_pass We$,J)Og&




    }

}

Note :-

We need to enable sysctl setting for no local ip binding allow on the Kernel.

Temporary:

echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind

Permanent:

Add this to /etc/sysctl.conf:

net.ipv4.ip_nonlocal_bind = 1

Enable with:

sysctl -p

Start service
When our Haproxy setup done, We need to start Keepalived on both servers:

service keepalived start

Run Rsync as daemon

2018-07-02T16:45:00.000+05:30

Friends,

We all know rsync is a good tool to sync files/directories.
Every time your want to sync, you need to run rsync commands. But what if you want to run rsync as a daemon? Every change in the source will be synced to destination location manually?

Below is a small script to do this

On source location


archival@cme103:~$ mkdir rsync-as-daemon ;cd rsync-as-daemon

archival@cme103:~$touch /home/archival/rsync-as-daemon/rsync.lock;touch /home/archival/rsync-as-daemon/rsync.log

archival@cme103:~$ cat rsyncd.conf

pid file = /home/archival/rsync-as-daemon/rsyncd.pid

lock file = /home/archival/rsync-as-daemon/rsync.lock

log file = /home/archival/rsync-as-daemon/rsync.log

use chroot = false

port = 15000

reverse lookup = no

[app_logs]

path = /home/archival/log/

comment = Logs Rsync

read only = true

timeout = 300

Now run rsync as a daemon

archival@cme103:~$ rsync --daemon --config=/home/archival/rsync-as-daemon/rsyncd.conf

On Destination Please configure as below


logmanager@ip-10-101-2-145:~ mkdir rsync-client;cd rsync-client

logmanager@ip-10-101-2-145:~ cat rsync_client.sh

#!/bin/bash
SCRIPT_DIR=$(dirname $0)
cd $SCRIPT_DIR
TARGET_BASE_DIR="/opt/rsync_logs/"
RSYNC_INCLUDES="$SCRIPT_DIR/rsync_includes.cfg"
while true ;
do
    SERVER_URL=($(cat "$SCRIPT_DIR/rsync_url.list" | xargs))
    for URL in "${SERVER_URL[@]}"
    do
        IP=$(echo $URL | cut -d':' -f 1)
        TARGET_DIR="$TARGET_BASE_DIR/$IP"
        if [ ! -f $TARGET_DIR ]; then
            mkdir -p $TARGET_DIR
        fi
        rsync -rtm --append --include-from $RSYNC_INCLUDES --exclude '*' rsync://${URL} ${TARGET_DIR}
    done
done

logmanager@ip-10-101-2-145:~/rsync-client$ cat rsync_includes.cfg
### Directories and file that should be synced  
*/
platform*.log

logmanager@ip-10-101-2-145:~/ rsync-client$ cat rsync_url.list
## URL for Rsync
192.168.201.103:15000/app_logs/

Now run rsync client

logmanager@ip-10-101-2-145:~/rsync-client$/home/logmanager/rsync-client/rsync_client.sh

Bash to save history with time stamp

2018-07-02T14:57:00.004+05:30

Some Useful bashrc stuff

Please put below in /etc/bash.bashrc

## No duplicates in the history

export HISTCONTROL=ignoredups

## for setting history length see HISTSIZE and HISTFILESIZE in bash


export HISTSIZE=100000

export HISTFILESIZE=100000

## Timestamp history

export HISTTIMEFORMAT="%b %d %a %T "

## Don't Overwrite. Append to bash history.

shopt -s histappend

##Adding costume $PATH

export PATH="/usr/local/zabbix/bin:$PATH"

##Adding Vim as default editor

export EDITOR=vim

postgress basic commands

2018-07-02T13:46:00.001+05:30

1) Install Postgress in Ubuntu

airflow@ip-10-1-1-4:~/airflow$ sudo apt-get install postgresql postgresql-contrib

2) Login to postgress DataBase


ansible@ip-10-101-2-142:~$ sudo -u postgres psql

or

ansible@ip-10-101-2-142:~$ psql -h"localhost" -p 5432 -Uairflow airflow -W

Password for user airflow:

psql (9.5.12)

SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)

Type "help" for help.



airflow=#

3) create DataBase


airflow@ip-10-1-1-4:~/airflow$ sudo -u postgres createdb airflow

or

 airflow=# createdb airflow WITH ENCODING='UTF-8';

4) show database


airflow=# \d+

                                List of relations

 Schema |          Name           |   Type   |  Owner  |    Size    | Description

--------+-------------------------+----------+---------+------------+-------------

 public | sqpl_airflow_hosts      | table    | airflow | 16 kB      |

(1 rows)

5) Create user

postgres=# CREATE USER airflow WITH ENCRYPTED PASSWORD 'Ubuntu@123';

6) GRANT Permission to user


postgres=# GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public to airflow;



GRANT

7) connection info


airflow=# \conninfo

You are connected to database "airflow" as user "airflow" via socket in "/var/run/postgresql" at port "5432".

8) Show config file


airflow=# SHOW hba_file;

hba_file

--------------------------------------

/etc/postgresql/9.5/main/pg_hba.conf

(1 row)

9) Create Table


CREATE TABLE sqpl_airflow_hosts(

   ip character varying(15) NOT NULL,

   logical_group  character varying(200) NOT NULL,

   queue_name character varying(100) NOT NULL,

   param_kwargs character varying(1000) NOT NULL,

   host_state host_state_enum,

   primary key (logical_group,param_kwargs)

);

10) Describe table


airflow-# \d+ sqpl_airflow_hosts

 ip                     | character varying(15)     | not null  | extended |              |

 logical_group  | character varying(200)    | not null  | extended |              |

 queue_name     | character varying(100)   | not null  | extended |              |

 param_kwargs  | character varying(1000) | not null  | extended |              |

 host_state          | host_state_enum            |                | plain    |                 |

11) select query


airflow=# select * from sqpl_airflow_hosts;

 ip | logical_group | queue_name | param_kwargs | host_state

----+---------------+------------+--------------+------------

(0 rows)

12) Insert Query


airflow=# insert into sqpl_airflow_hosts values ('xxx','cme_engines','10.101.2.253_queue','--ip 192.168.201.105 --engine_id 12','RUNNING');

INSERT 0 1

airflow=# select * from sqpl_airflow_hosts;

 ip  | logical_group |     queue_name     |            param_kwargs             | host_state

-----+---------------+--------------------+-------------------------------------+------------

 xxx | cme_engines   | 10.101.2.253_queue | --ip 192.168.201.105 --engine_id 12 | RUNNING

(1 row)

13) Alter Table

airflow=# alter table sqpl_airflow_hosts add column params character varying[];


airflow=# \d+ sqpl_airflow_hosts

                              Table "public.sqpl_airflow_hosts"

    Column     |          Type           | Modifiers | Storage  | Stats target | Description

---------------+-------------------------+-----------+----------+--------------+-------------

 ip            | character varying(15)   | not null  | extended |              |

 logical_group | character varying(200)  | not null  | extended |              |

 queue_name    | character varying(100)  | not null  | extended |              |

 param_kwargs  | character varying(1000) | not null  | extended |              |

 host_state    | host_state_enum         |           | plain    |              |

 command       | character varying       |           | extended |              |

 params        | character varying[]     |           | extended |              |

Indexes:

    "sqpl_airflow_hosts_pkey" PRIMARY KEY, btree (logical_group, param_kwargs)



airflow=# alter table sqpl_airflow_hosts drop column param_kwargs;

airflow=# alter table sqpl_airflow_hosts add constraint pkey unique(logical_group, command, params);

ALTER TABLE

airflow=# \d+ sqpl_airflow_hosts

                             Table "public.sqpl_airflow_hosts"

    Column     |          Type          | Modifiers | Storage  | Stats target | Description

---------------+------------------------+-----------+----------+--------------+-------------

 logical_group | character varying(200) | not null  | extended |              |

 queue_name    | character varying(100) | not null  | extended |              |

 host_state    | host_state_enum        |           | plain    |              |

 command       | character varying      |           | extended |              |

 params        | character varying[]    |           | extended |              |

Indexes:

    "pkey" UNIQUE CONSTRAINT, btree (logical_group, command, params)

ALTER TABLE  sqpl_airflow_hosts ALTER COLUMN logical_group TYPE character varying(100);

14) Update table

airflow=# update sqpl_airflow_hosts set command = 'start.sh', params = {'--ip = 192.168.201.105', '--engine_id 12'} ;

15) Getting Size of DB



airflow=# select pg_relation_size('sqpl_airflow_hosts');
 pg_relation_size
------------------
             8192
(1 row)




airflow=# select pg_size_pretty(pg_database_size(current_database()));

 pg_size_pretty

----------------

 11 MB

(1 row)

16) Know who is connected


airflow=# SELECT datname,usename,client_addr,client_port FROM pg_stat_activity ;

 datname | usename | client_addr  | client_port

---------+---------+--------------+-------------

 airflow | airflow | 127.0.0.1    |       46896

 airflow | airflow | 127.0.0.1    |       37942

 airflow | airflow | 127.0.0.1    |       45694

 airflow | airflow | 10.101.2.82  |       52146

 airflow | airflow | 10.101.2.105 |       35482

 airflow | airflow | 10.101.2.253 |       38740

 airflow | airflow | 127.0.0.1    |       52116

 airflow | airflow | 127.0.0.1    |       40694

 airflow | airflow | 127.0.0.1    |       53752

 airflow | airflow | 127.0.0.1    |       53454

 airflow | airflow | 127.0.0.1    |       40546

 airflow | airflow | 127.0.0.1    |       35432

 airflow | airflow | 127.0.0.1    |       40392

 airflow | airflow | 127.0.0.1    |       40848

 airflow | airflow | 127.0.0.1    |       37928

(15 rows)

17 ) Reload postgress configuration file

select pg_reload_conf();

18 ) Show DataBase directory

airflow=# SHOW data_directory;
        data_directory
------------------------------
 /var/lib/postgresql/9.5/main
(1 row)

19) Insert into table

insert into sqpl_airflow_hosts values ('cme_engines','10.101.2.253_queue','RUNNING','cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py', '{"--ip=192.168.201.105", "--engine_id=28"}');

20) Some Select examples


airflow=# select concat(command, ' ', array_to_string(params, ' ')) from sqpl_airflow_hosts ;
                                                   concat
-------------------------------------------------------------------------------------------------------------
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=12
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=13
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=15
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=17
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=19
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=21
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=22
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=23
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=24
 cd /home/deployment && /home/deployment/airflow_scripts/start_engine.py --ip=192.168.201.105 --engine_id=28
(10 rows)

SUDO COMMANDS EXAMPLES

2018-07-02T11:28:00.003+05:30

Syntax for sudoers file is as below

USER_ALIAS HOST_ALIAS=EFECTIVE_USER) COMMAND_ALIAS

Now Let's understand the components.

USER_ALIAS : User aliases are used to specify users, groups or netgroups.

examples:


User_Alias ADMINS = %admin

User_Alias WEBMASTERS = tom,rob

User_Alias LIMITED_USERS = !WEBMASTERS, !ADMINS

HOST_ALIAS: list of hostname, ip addresses, networks and netgroups

examples:


Host_Alias SERVERS = 192.168.0.1, 192.168.0.2, server1

Host_Alias WORKSTATIONS = 192.168.0.0/255.255.255.0, !SERVERS

EFECTIVE_USER : Who can run what as who

examples:

User_Alias EFECTIVE_USER = sam,rob

COMMAND_ALIAS: Lists of commands ( full path of commands) and directories

examples


Cmnd_Alias        SBIN_CMDS = /sbin

Cmnd_Alias        APP_CMDS =  /usr/bin/passwd, /sbin/service httpd *, /sbin/ifconfig : DB_CMDS = /bin/su – admin, /home/admin/zabbix_server : ADMIN_CMDS = /sbin/, /usr/sbin/

Now let's try some usecase

1) user rob to run /bin/su command with root privileges. Same time it restricts using any options/argument and login to root.

rob          ALL = (root)        /bin/su [!-]*[!root]*

2) This lets the admins run all the admin commands on the servers

ADMINS SERVERS= ADMIN_CMDS

3) This lets "rob" shutdown his own machine without a password

rob rob-machine= NOPASSWD: SHUTDOWN_CMDS

4) rob should run command hwclock only ( without any arguments)

rob        ALL = (ALL)          /sbin/hwclock “”

Restrict ssh-key to rsync only

2018-06-28T12:33:00.000+05:30

Friends,

In this blog I am sharing how to restrict your ssh-key. Just take an example for below ssh key

example 1)

from="192.168.101.221",command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa ....

Details are below,
from= Restrict from specific host
command=Specifies that the command is executed whenever this key is used for authentication
no-port-forwarding= Forbids TCP forwarding
no-agent-forwarding=Forbids authentication agent forwarding
no-X11-forwarding=Forbids X11 forwarding

So basically this key can use for having scp-only access from particular host.

example 2 )
command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/home/user/data/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa ....

Above will restrict user to scp only for /home/user/data/ folder

Example 3) Now take a example to allow only rsync.

cat /home/$USERNAME/rsync-check.sh

#!/bin/sh
case "$SSH_ORIGINAL_COMMAND" in 
*\&*) 
echo "Rejected" 
;; 
*\(*) 
echo "Rejected" 
;; 
*\{*) 
echo "Rejected" 
;; 
*\;*) 
echo "Rejected" 
;; 
*\<*) 
echo "Rejected" 
;; 
*\>*) 
echo "Rejected" 
;; 
*\`*) 
echo "Rejected" 
;; 
*\|*) 
echo "Rejected" 
;; 
rsync\ --server*) 
$SSH_ORIGINAL_COMMAND 
;; 
*) 
echo "Rejected" 
;; 
esac

Now change your authorized_keys file as below

command="/home/$USERNAME/rsync-check.sh" ssh-rsa....

example 4) Just take an example of authorized_keys file for aws server.

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ubuntu\" rather than the user \"root\".';echo;sleep 10" ssh-rsa ...

Now you can understand how we were getting warning to use right user name error while connecting aws boxes.

Note: Just check man page of sshd and make your own use case.

Interrupts and CPU SMP Affinity

2016-09-30T13:33:00.002+05:30

Interrupts:

Interrupts are signal that are sent across IRQ (Interrupt Request Line) by a hardware or software. Interrupts allow devices like keyboard, serial cards and parallel ports to indicate that it needs CPU attention.

On a Linux machine, the file /proc/interrupts contains information about the interrupts in use and how many times processor has been interrupted.

SMP_AFFINITY:

Symmetric multiprocessing is the processing of programs by multiple processors.

smp_affinity file holds interrupt affinity value for a IRQ number. The smp_affinity file associated with each IRQ number is stored in /proc/irq/IRQ_NUMBER/smp_affinity file. The value in the file is stored in hexadecimal bit-mask representing all CPU cores in the system. smp_affinity works for device that has IO-APIC enabled device drivers.

For example, smp_affinity entry for Ethernet driver is shown below:

root@test007:grep eth0 /proc/interrupts
CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 CPU6 CPU7

67: 0 23834931 0 0 0 0 0 0 IO-APIC-level eth0

IRQ number for eth0 is 67 and corresponding smp_affinity file will be located at:

root@test007: cat /proc/irq/67/smp_affinity
10

The decimal equivalent for hexadecimal value ‘10’ is ‘2’. ie All the interrupt related to Ethernet driver will be serviced by 2nd cpu (CPU1)

============

"10" is the hexadecimal representation for the decimal number 2
and the binary pattern of "0010". Each of the places in the binary pattern
corresponds to a CPU in the server, which means we can use the following
chart to represent the CPU bit patterns:

Binary Hex
CPU 0 0001 1
CPU 1 0010 2
CPU 2 0100 4
CPU 3 1000 8

By combining these bit patterns (basically, just adding the Hex values), we
can address more than one processor at a time. For example, if I wanted
to talk to both CPU0 and CPU2 at the same time, the result is:

Binary Hex
CPU 0 0001 1
+ CPU 2 0100 4
-----------------------
both 0101 5

If I want to address all four of the processors at once, then the result is:

Binary Hex
CPU 0 0001 1
CPU 1 0010 2
CPU 2 0100 4
+ CPU 3 1000 8
-----------------------
both 1111 f

Given that, we now know that if we have a eight processor system, we can
assign any different CPU combinations to an IRQ.

example:

echo "01" > /proc/irq/67/smp_affinity for 1st core
echo "03" > /proc/irq/67/smp_affinity for assign on 1st and 2nd core
echo "05" > /proc/irq/67/smp_affinity for assigning 1st and 3rd core
echo "f0" > /proc/irq/67/smp_affinity for assigning 5th to 8th core
====================
Note : If you are not good in hex to bin conversion, please use this site.

IRQ Balance

Irqbalance is a utility that distributes interrupts over the processor cores in your computer system. which helps to improve performance.

It's goal is to find a balance between power saving and optimal performance.

Irqbalance is especially useful on systems with multi-core processors, as interrupts will typically only be serviced by the first core.

Run a program on specific CPU core

2016-09-24T20:23:00.000+05:30

Run a particular process with cpu cores 4 and 5
taskset -cp 4,5 <process_id>

Example:
[root@masterDNS ~]# taskset 03 /usr/bin/watch -n1 w

Now check if it's really working

[root@masterDNS ~]# ps -ef | grep watch
root 14590 14365 0 20:00 pts/0 00:00:00 /usr/bin/watch -n1 w
root 14644 14609 0 20:00 pts/1 00:00:00 grep watch

[root@masterDNS ~]# taskset -p 14590
pid 14590's current affinity mask: 3

If We want to dedicate a whole CPU core to a particular program and no other then your process should use this core.
Then use "isolcpus" kernel parameter in grub option.

GRUB_CMDLINE_LINUX_DEFAULT="cpuidle.off=1 idle=poll isolcpus=5 nohz_full=5 maxcpus=6"

update-grub

Note: below are meaning

cpuidle.off=1 (Do not make cpu idle)
isolcpus=5 (Isolate cpu core 5)
maxcpus=6 (Use only 6 core (out of 8 cores of system) for )
idle=poll (Poll forces a polling idle loop)

Mac binding in DHCP along with mobile phone restriction

2016-08-25T10:45:00.000+05:30

As we have setup TSIG along with master-slave of bind DNS. Now we are configuring dhcp setup.
Below are the steps.

[root@dlp ~]# yum -y install dhcp

[root@dlp ~]# vi /etc/dhcp/dhcpd.conf
================
#
# DHCP Server Configuration file.
# see /usr/share/doc/dhcp*/dhcpd.conf.sample
# see 'man 5 dhcpd.conf'
#
# atpl-subnet
ddns-updates on;
ddns-update-style interim;

set vendor-string = option vendor-class-identifier;

class "android" {
match if substring (option vendor-class-identifier,0,6) = "dhcpcd";
}

class "android-1" {
match if substring (option vendor-class-identifier,0,7) = "android";
}

class "BlackBerry" {
match if substring (option vendor-class-identifier,0,10) = "BlackBerry";
}

class "iPhones" {
match if suffix (option host-name,6) = "iPhone";
}
key rndc-key {
algorithm hmac-md5;
secret e511iZsuCmKS4BPfBje7hQ==;
};

allow client-updates;
authoritative;
#update-optimization off;

subnet 172.24.40.0 netmask 255.255.255.0 {
interface eth0;
pool {
deny members of "android";
deny members of "android-1";
deny members of "BlackBerry";
deny members of "iPhones";
range 172.24.40.1 172.24.40.200;
option broadcast-address 172.24.40.255;
option subnet-mask 255.255.255.0;
option routers 172.24.40.253;
option domain-name "domain40.example.com";
option domain-name-servers 172.24.40.100;
default-lease-time 900;
max-lease-time 900;
}
}

host station-x.domain40.example.com. {
hardware ethernet 00:8e:f2:5d:07:17;
fixed-address 172.24.40.100;
}
host station-y.domain40.example.com. {
hardware ethernet 00:26:b9:86:02:73;
fixed-address 172.24.40.101;
}
zone domain40.example.com. {
primary localhost;
key rndc-key;
}
zone 40.24.192.in-addr.arpa. {
primary localhost;
key rndc-key;
}
====================================

Bind with TSIG Transfer key

2016-08-25T10:29:00.000+05:30

As we have configured master slave DNS on my previous link. Lets have replication with TSIG.

Step 1) On system-x
# cd /var/named/chroot/etc
# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST station-x-station-y.

Now two files will be create

# cat Kstation-x-station-y.+157+01233.private (copy the key from here)

# cp -p rndc.key transfer.key
# vim transfer.key
key "station-x-station-y." {
algorithm hmac-md5;
secret "e511iZsuCmKS4BPfBje7hQ==";
};

# vim named.conf

include "/etc/transfer.key";
acl mylan {172.24.40.0/24;};

allow-transfer {key station-x-station-y.; };
allow-query { localhost; mylan; any; };
allow-query-cache { localhost; mylan; any; };

(save)

# ln -s transfer.key /etc/transfer.key
#service named restart
#named-checkconf named.conf

#scp transfer.key station-y:/var/named/chroot/etc/

# vi domain40.example.com.forward (add one more record)

secret-x.domain40.example.com. IN A 172.24.40.100

(save)

# /etc/init.d/named restart

On system -y
# chgrp named transfer.key

# vim named.conf

include "/etc/transfer.key";
acl mylan {172.24.40.0/24;};
server 172.24.40.100 {
keys {station-x-station-y.; };
};

# rndc refresh domain40.example.com

# grep -i tsig /var/log/messages --color

# /etc/init.d/named restart

2015-03-08T20:20:00.000+05:30

404 (NOT FOUND) error redirection to your custom page in nginx.

Hi Friends,

As per my company requirement I had to configure redirection for 404 error to our custom page "404.html" in nginx.

Follow below steps :-

Step #1. Make your custom page 404.html which you want to display.

Step #2. Keep 404.html at any location my location is

"/var/www/web1/domains/www.example.com/web/error/".

Step #3. Edit your nginx config file.

[root@ip ~]# vim /etc/nginx/conf.d/example.com.conf

server {

server_name marriage.com;

rewrite ^ $scheme://www.example$request_uri redirect;

}

server {

server_name www.example.com;

root /var/www/web1/domains/www.example.com/web;

index index.php index.html index.htm;

access_log /var/log/nginx/example.com_access.log upstream;

error_log /var/log/nginx/example.com_error.log;

## Below code redirect all page not found error to 404.thml page

error_page 404 /404.html;

location = /404.html {

root /var/www/web1/domains/www.example.com/web/error/;

}

Save and Exit.

Step #4 Reload nginx

#service nginx reload

2015-02-21T20:30:00.000+05:30

Install Memcached Caching System on Redhat/CentOs

Linux man page :-
Memcached is a flexible memory object caching daemon designed to alleviate database load in dynamic web applications by storing objects in memory. It's based on libevent to scale to any size needed, and is specifically optimized to avoid swapping and always use non-blocking I/O.

Step #1 : Download and install EPEL Repo
rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-3.noarch.rpm

Step 2# : Install memcached

yum --enablerepo=epel,remi install memcached php-pecl-memcache

Step #3 : Configure memcached

[root@app02 web]# vim /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="1024"
# listen to loopback ip 127.0.0.1, for network connection use real ip e.g., 10.0.0.4
OPTIONS="-l 127.0.0.1"

The above using 1GB of memory, and listening on IP 127.0.0.1, port 11211. Save and close the file

Step #4 : Restart memcached services
[root@app02 web]#service memcached start
[root@app02 web]#chkconfig memcached on

Note :- If you want to run memcached on socket please make below changes in /etc/sysconfig/memcached

[root@app02 web]# vim /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="1024"
# listen to loopback ip 127.0.0.1, for network connection use real ip e.g., 10.0.0.4
#OPTIONS="-l 127.0.0.1" (Uncomment)
OPTIONS="-s /var/run/memcached/memcached.sock -a 0666"

[root@app02 web]#service memcached start
[root@app02 web]#chkconfig memcached on

Check mamcached Listening on socket:--

[root@vsrv02 /]# netstat -nlp | grep memcached
unix 2 [ ACC ] STREAM LISTENING 2782009389 23554/memcached /var/run/memcached/memcached.sock

Note:- Unix Socket can only be accessed localy.

Password Protecting GRUB

2014-01-16T14:52:00.000+05:30

Hello Friends,

We could configure boot loader password for preventing unauthorised access of grub menu.

But this solution does not prevent an attacker from booting into an insecure operating

system in a dual-boot environment.

So we could use lock directive for such prevention.

Below are steps for the same.

Step 1) Generate md5 encrypted password

=============================

[root@station-x ~]# grub-md5-crypt

Password:

Retype password:

$1$pgjiX1$PVxHe8rI0a1S.Cgh4AKzB.

==================================

Step 2) Edit grub.conf as shown below

=================================

title Red Hat Enterprise Linux (2.6.32-220.el6.x86_64)

lock

password --md5 $1$pgjiX1$PVxHe8rI0a1S.Cgh4AKzB.

root (hd0,0)

kernel /vmlinuz-2.6.32-220.el6.x86_64 ro root=UUID=224b3aa3-6cd2-4634-a409-1a834c46fa9c rd_NO_LUKS rd_NO_LVM LANG=en_US.UTF-8 rd_NO_MD quiet SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM

initrd /initramfs-2.6.32-220.el6.x86_64.img

===============================================

Configure Master Slave bind replication in RHEL6

2014-01-09T10:28:00.001+05:30

Hi friends,

Lets learn bind DNS master-slave configuration in chrooted jail environment.

We have DNS Master server (station-x.domain40.example.com/172.24.40.100) and slave server (station-y.domain40.example.com/172.24.40.110)

Step1) Install bind packages on master server.

[root@station-x ~]#yum install bind-* caching-nameserver -y

Step 2) copy and configure named.conf file

[root@station-x ~]#cp -p /etc/named.conf /var/named/chroot/etc/

[root@station-x ~]#vim /var/named/chroot/etc/named.conf

==================================

acl mylan {172.24.40.0/24; };

options {

listen-on port 53 { 127.0.0.1; 172.24.40.100; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { localhost; mylan; any; };

allow-transfer {172.24.40.110; };

recursion no;

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

===================================

[root@station-x ~]#cp -p /etc/named.rfc1912.zones /var/named/chroot/etc/named.rfc1912.zones

[root@station-x ~]#vim /var/named/chroot/etc/named.rfc1912.zones

==================================================

zone "localhost.localdomain" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "localhost" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "1.0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.empty";

allow-update { none; };

};

zone "domain40.example.com" IN {

type master;

file "domain40.example.com.forward";

allow-update { none; };

};

zone "40.24.172.in-addr.arpa" IN {

type master;

file "domain40.example.com.reverse";

allow-update { none; };

};

====================================================

step 3) create and configure zone files.

[root@station-x ~]#vi /var/named/chroot/var/named/domain40.example.com.forward

===========================================

$TTL 86400

@ IN SOA station-x.domain40.example.com. root.station-x.domain40.example.com. (

51 ; serial (d. adams)

3H ; refresh

15M ; retry

1W ; expiry

1D ) ; minimum

IN NS station-x.domain40.example.com.

IN MX 10 mail.domain40.example.com.

station-x IN A 172.24.40.100

station-y IN A 172.24.40.110

www.station-x IN A 172.24.40.100

mail IN A 172.24.40.100

ftp IN A 172.24.40.100

=============================

[root@station-x ~]#vim /var/named/chroot/var/named/domain40.example.com.reverse

====================================

$TTL 86400

@ IN SOA station-x.domain40.example.com. root.station-x.domain40.example.com. (

1997022703 ; Serial

28800 ; Refresh

14400 ; Retry

3600000 ; Expire

86400 ) ; Minimum

IN NS station-x.domain40.example.com.

100 IN PTR station-x.domain40.example.com.

110 IN PTR station-y.domain40.example.com.

============================

Step 4) check syntex of zone/config files and restart named service.

[root@station-x ~]# named-checkconf /var/named/chroot/etc/named.conf

[root@station-x ~]# named-checkconf /var/named/chroot/etc/named.rfc1912.zones

[root@station-x ~]# named-checkzone "40.24.172.in-addr.arpa" /var/named/chroot/var/named/domain40.example.com.reverse

zone 40.24.172.in-addr.arpa/IN: loaded serial 1997022703

[root@station-x ~]# named-checkzone domain40.example.com /var/named/chroot/var/named/domain40.example.com.forward

zone domain40.example.com/IN: loaded serial 51

[root@station-x ~]# /etc/init.d/named restart;chkconfig named on

Stopping named: . [ OK ]

Starting named: [ OK ]

step 5) entry in resolve.conf and query for zone records

[root@station-x ~]# vi /etc/resolve.conf

search domain40.example.com

nameserver 172.24.40.100

nameserver172.24.40.110

dig station-x.domain40.example.com +short

dig -x 172.24.40.100 +short

Step 6) Install and configure bind packages in Slave server

[root@station-y ~]# yum -y install bind-* caching-nameserver

[root@station-y ~]# vi "/var/named/chroot/etc/named.conf"

======================================

acl mylan {172.24.40.0/24; };

options {

listen-on port 53 { 127.0.0.1; 172.24.40.110; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { localhost; mylan; any; };

recursion no;

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

include "/etc/named.rfc1912.zones";

==============================

[root@station-y ~]# vi /var/named/chroot/etc/named.rfc1912.zones

===========================

zone "localhost.localdomain" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "localhost" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "1.0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.empty";

allow-update { none; };

};

zone "domain40.example.com" IN {

type slave;

masters {172.24.40.100;};

file "slaves/domain40.example.com.forward";

allow-update { none; };

};

zone "40.24.172.in-addr.arpa" IN {

type slave;

masters {172.24.40.100;};

file "slaves/domain40.example.com.reverse";

allow-update { none; };

};zone "localhost.localdomain" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "localhost" IN {

type master;

file "named.localhost";

allow-update { none; };

};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "1.0.0.127.in-addr.arpa" IN {

type master;

file "named.loopback";

allow-update { none; };

};

zone "0.in-addr.arpa" IN {

type master;

file "named.empty";

allow-update { none; };

};

zone "domain40.example.com" IN {

type slave;

masters {172.24.40.100;};

file "slaves/domain40.example.com.forward";

allow-update { none; };

};

zone "40.24.172.in-addr.arpa" IN {

type slave;

masters {172.24.40.100;};

file "slaves/domain40.example.com.reverse";

allow-update { none; };

};

=====================================

[root@station-y ~]# vi /etc/resolve.conf

================

search domain40.example.com

nameserver 172.24.40.110

nameserver172.24.40.100

==========================

[root@station-y ~]# /etc/init.d/named restart;chkconfig named on

[root@station-y ~]# dig station-x.domain40.example.com @172.24.40.110 +short

[root@station-y ~]# dig -x 172.24.40.100 @172.24.40.110 +short

Note :- For basic troubleshooting please keep points to remember.

1) Please check server Selinux status.

2) Please check both system should have same time.

3) Please check proper permission and ownership of all config and zone files.

4)For replicating zone files over master and slaves, please use below command on slave

[root@station-y ~]# rndc reload domain40.example.com

[root@station-y ~]# rndc refresh edomain40.example.com

Compiling Latest Linux Kernel

2013-06-28T22:33:00.000+05:30

Hi Friends,

As per requirement of our client, recently I compiled latest stable Linux kernel (linux-3.9.7) on my CentOS-6.3.
So as usual I wanna share steps for compiling the kernel :)

Below are the steps. Please follow if you also want to do the same.

Step 1) Download latest stable Linux Kernel from http://kernel.org/ and untar the package.

[root@localhost ~]# cd /usr/src/

[root@localhost src]# wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.9.7.tar.xz

[root@localhost src]#tar -xvf linux-3.9.7.tar.xz

step 2) Choose appropriate Module

[root@localhost src]# cd linux-3.9.7

[root@localhost linux-3.9.7 ]# make menuconfig

Note: This will show kernel configuration screen . Navigate and deselect things (drivers) you do not need. In case of doubt just leave the initial option/selection. Save the configuration and exit the menu.

After saving your configuration (it is stored in the ".config" file) exit from screen.

Step 3) compile the kernel

[root@localhost linux-3.9.7 ]#make

Note: This is time consuming task and will take more then hr's depending on your hardware.

Step 4) copy all the modules to a new directory, "/lib/modules/3.9.7"

[root@localhost linux-3.9.7 ]#make modules_install

Step 5) copy compiled files into appropriate locations

[root@localhost linux-3.9.7 ]#make install

Step 6) Remove all generated files + config + various backup files

[root@localhost linux-3.9.7 ]#make mrproper

That's all about Kernel compiling. And Please don't forget to edit grub.conf to change default boot option with new kernel.

Enjoy !!!!!!!

SSH Port Forwarding

2013-06-27T16:01:00.001+05:30

Hi Friends,

Let’s understand SSH Port forwarding concept with below examples.

I have two machine station-y (172.24.40.110) and station-z(172.24.40.120)

Example 1)

[root@station-z ~]# ssh -L 8080:yahoo.com:80 -N root@172.24.40.110

(I, SSH Client will listen for traffic on my host's port 8080 and send it to you, SSHD on 172.24.40.110.

You will decrypt it and forward that traffic to port 80 on yahoo.com)

So after executing above command on station-z, when station-z tries to access http://localhost it will redirect to yahoo.com

Example 2)

[root@station-z ~]# ssh -R 8080:127.0.0.1:25 -N 172.24.40.110

(You the SSHD on 172.24.40.110 will listen for the traffic on your port 8080 and send it to me. I, ssh client will decrypt it and forward that traffic to port 25 on me as if it came from me.)

So after executing above command on station-z, when station-y tries to access their local port 8080 ([root@station-y ~]# telnet 0 8080) it will redirect to port 25 of station-z

Firewall Port Redirection through Iptables

2013-06-26T20:42:00.002+05:30

Friends,

Recently I implemented firewall rule for incoming traffic on port 80 on firewall (10.10.0.100) will redirect to port 8080 of internal webserver(172.24.40.110).

Below is the command that I executed on my Linux based Firewall

[root@station-z ]#iptables -t nat -I PREROUTING-p tcp --dport 80 -d 10.10.0.100 -j DNAT --to 172.24.40.110:8080

IPTABLES NAT Rule Implementation

2013-06-26T20:00:00.002+05:30

Friend,

Recently my network Admin has blocked Facebook access to all our Desktop-PC.

But fortunately I have access of one of Linux system where then haven’t implemented firewall rule.

So I MASQUERADE my outgoing traffic from my PC to that Linux System to get Facebook Access. J

It’s Very easy & if you want you could also test this on your Lab.

Example: - My PC (eth0: 172.24.40.110)

Linux PC [eth0: 172.24.40.120 (Lan Interface) eth1: 10.10.20.1 (Wan Interface)]

Step 1) On My PC (eth0: 172.24.40.110) set “Default Gatway to Linux machine(eth0: 172.24.40.120)

Step 2) On Linux machine set IP Forwarding

[root@station-y ]#vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

Step 3) Apply NAT rule to MASQUERADE all traffic to eth1 (Wan Interface)

[root@station-y ]# iptables -t nat -I POSTROUTING -s 172.24.40.0/24 -o eth1 -j MASQUERADE

Installing Zabbix with postgresql in CentOS6

2013-06-21T18:33:00.001+05:30

Friend , recently I configured Zabbix with postgresql in my office infrastructure.

We have one zabbix master server (192.168.0.1) and one pgsql database server (192.168.0.2)

Below are the step that I performs on configuring zabbix.

Step 1) Download and install RPM’s for postgresql in database server (192.168.0.2)

[root@localhost ~]#wget http://yum.postgresql.org/9.1/redhat/rhel-6-x86_64/pgdg-redhat91-9.1-5.noarch.rpm

[root@localhost ~]#rpm -ivh pgdg-redhat91-9.1-5.noarch.rpm

[root@localhost ~]#yum install postgresql91-server postgresql91-contrib

[root@localhost ~]#/etc/init.d/postgresql-9.1 restart

[root@localhost ~]#service postgresql-9.1 initdb

Step 2) Configure Postgresql on (192.168.0.2)

[root@localhost ~]# su – postgres

-bash-4.1$ psql

postgres=# CREATE DATABASE zabbix WITH ENCODING='UTF-8';

postgres=# CREATE USER zabbix WITH PASSWORD 'zabbix';

postgres=# GRANT ALL ON DATABASE zabbix TO zabbix;

postgres=# GRANT ALL PRIVILEGES ON DATABASE zabbix to postgres;

postgres=# ALTER USER Postgres WITH PASSWORD 'redhat';

postgres=# \q

-bash-4.1$

-bash-4.1$ logout

[root@localhost ~]#vi /var/lib/pgsql/9.1/data/pg_hba.conf

****************

# "local" is for Unix domain socket connections only

local all all md5

# IPv4 local connections:

host all all 127.0.0.1/32 md5

host all all 10.10.2.0/16 md5

******************

[root@localhost ~]#vi /var/lib/pgsql/9.1/data/ postgresql.conf

**************

listen_addresses = '192.168.0.2' # what IP address(es) to listen on;

# comma-separated list of addresses;

# defaults to 'localhost', '*' = all

# (change requires restart)

port = 5432

**************

[root@localhost ~]#/etc/init.d/postgresql-9.1 restart

Step 3) Configure php.ini in Zabbix server (192.168.0.1)

[root@localhost ~]#yum -y install gcc net-snmp-devel curl-devel gcc make curl-devel httpd php php-pgsql php-bcmath php-gd php-mbstring net-snmp-devel fping e2fsprogs-devel zlib-devel libgssapi-devel krb5-devel openssl-devel libidn-devel iksemel-devel libXpm openssh-clients php-xmlrpc sharutils OpenIPMI-devel libssh2-devel php-xml

[root@localhost ~]#vi /etc/php.ini

*******

max_execution_time = 300

memory_limit = 128M

post_max_size = 16M

upload_max_filesize = 2M

max_input_time = 300

date.timezone = Asia/Kolkata

*******

Step 4) Download and install zabbix from source code for zabbix frontend (192.168.0.1)

[root@localhost ~]#groupadd zabbix

[root@localhost ~]#useradd -g zabbix –s /sbin/nologin zabbix

[root@localhost ~]#wget http://sourceforge.net/projects/zabbix/files/ZABBIX%20Latest%20Stable/2.0.6/zabbix-2.0.6.tar.gz

[root@localhost ~]#mv zabbix-2.0.6.tar.gz /opt/;cd /opt

[root@localhost ~]#tar -xvzf /opt/zabbix-2.0.6.tar.gz

[root@localhost ]#cd zabbix-2.0.0.6

[root@localhost ]#./configure --prefix=/opt/zabbix --enable-server --enable-agent --with-net-snmp --with-postgresql=/usr/pgsql-9.1/bin/pg_config --with-ssh2 --with-openipmi --with-libcurl

[root@localhost ]#make;make install

Step 5) Configure frontend

[root@localhost ~]#cp -R /opt/zabbix-2.0.6/frontends/php /var/www/html/zabbix

[root@localhost ~]#Service httpd restart

Step 5) Configure zabbix config files (192.168.0.1)

[root@localhost ]#vi /opt/zabbix/etc/zabbix_server.conf

*********

ListenPort=10051

LogFile=/opt/zabbix/log/zabbix_server.log

PidFile=/opt/zabbix/log/zabbix_server.pid

DBHost=192.168.0.2

DBName=zabbix

DBUser=zabbix

DBPassword=zabbix

StartPollers=10

DisableHousekeeping=1

CacheSize=128M

HistoryCacheSize=128M

TrendCacheSize=64M

HistoryTextCacheSize=128M

Timeout=30

***********

[root@localhost ]#vi /opt/zabbix/etc/zabbix_agentd.conf

************

LogFile=/tmp/zabbix_agentd.log

Server=127.0.0.1

ServerActive=127.0.0.1

Hostname=Zabbix server

************

Step 6) Import zabbix database to postgresql server

[root@localhost ]#cd /opt/zabbix-2.0.6/database/postgresql

[root@localhost ]# psql -U zabbix -h 192.168.0.2 -d zabbix -f schema.sql

[root@localhost ]#psql -U zabbix -h 192.168.0.2 -d zabbix -f images.sql

[root@localhost ]#psql -U zabbix -h 192.168.0.2 -d zabbix -f data.sql

Step 7) Installing Zabbix through web

Go to web browser and type below link

http://192.168.0.1/zabbix

Download the config file and paste it to the location /var/www/html/zabbix/conf/zabbix.conf.php

Step 7) Copy init script for zabbix_server and zabbix_agentd

[root@localhost ]#cp /root/zabbix.2.0.6/misc/init.d/fedora/core/zabbix_server /etc/init.d/

[root@localhost ]#cp /root/zabbix.2.0.6/misc/init.d/fedora/core/zabbix_agentd /etc/init.d/

[root@localhost ]#vi /etc/init.d/ zabbix_server

**************

# Zabbix-Directory

BASEDIR=/opt/zabbix

# Binary File

BINARY_NAME=zabbix_server

# Full Binary File Call

FULLPATH=$BASEDIR/sbin/$BINARY_NAME

# PID file

PIDFILE=/opt/zabbix/log/$BINARY_NAME.pid

******************

[root@localhost ]#vi /etc/init.d/ zabbix_agentd

*****************

# Zabbix-Directory

BASEDIR=/opt/zabbix

# Binary File

BINARY_NAME=zabbix_agentd

# Full Binary File Call

FULLPATH=$BASEDIR/sbin/$BINARY_NAME

# PID file

PIDFILE=/tmp/$BINARY_NAME.pid

************

[root@localhost ]# service zabbix_server restart

[root@localhost ]# service zabbix_agentd restart

Now You have done your installation part. Try to login with credentials

URL: http://192.168.0.1/zabbix

User: Admin

Password: zabbix

sshpass, A great tool for non-interactive ssh login

2013-06-12T17:22:00.000+05:30

Friend,

Recently I needed to perform some maintenance activity on some of my Linux machines.

I got a list of 100 Linux machine.

Problem was that, We haven't configured password-less SSH but the good point is that all Linux machine have same root password. :)

So First I installed "sshpass" command and wrapped ssh over ssh pass on a script.

Below is the sample script to get Uptime of all hosts
================
#!/bin/bash
for i in `cat /tmp/data.txt`
do
sshpass -p 'password' ssh -o StrictHostKeyChecking=no root@$i "hostname;uptime|awk '{print $3,$4}'" >>/tmp/uptime_detail_txt
done
===========================

Where StrictHostKeyChecking is for disable host key checking

Installation and configuration HAproxy on CentOS

2013-06-04T16:25:00.001+05:30

Step1) Linux server has a development environment set up

yum update

yum -y groupinstall 'Development Tools'

Step 2) Download and uncompress haproxy from source code.

wget http://haproxy.1wt.eu/download/1.4/src/haproxy-1.4.23.tar.gz

tar xzf haproxy-1.4.23.tar.gz

cd haproxy-1.4.23

make TARGET=linux26

step3) copy the configuration files

mkdir /etc/haproxy

cp haproxy /usr/sbin/haproxy

step 4) configure haproxy.cfg file according to your need.

vi /etc/haproxy.cfg

*********************

global

maxconn 4096

pidfile /var/run/haproxy.pid

daemon

defaults

log global

option dontlognull

balance leastconn

clitimeout 60000

srvtimeout 60000

contimeout 5000

retries 3

option redispatch

listen exchange-http 10.10.3.156:80

mode http

stats enable

stats uri /haproxy-stats

balance source

option forwardfor

server cas1 10.10.3.145:80 check port 80 inter 20 rise 1 fall 1

server cas2 10.10.3.146:80 check port 80 inter 20 rise 1 fall 1 backup

listen exchange-https-tr 10.10.3.156:444

mode tcp

balance source

maxconn 10000

server webserver1 10.10.3.145:444 check port 444 inter 20 rise 1 fall 1

server webserver2 10.10.3.146:444 check port 444 inter 20 rise 1 fall 1 backup

listen exchange-https 10.10.3.156:443

mode tcp

balance source

maxconn 10000

server webserver1 10.10.3.145:443 check port 443 inter 20 rise 1 fall 1

server webserver2 10.10.3.146:443 check port 443 inter 20 rise 1 fall 1 backup

listen exchange-https 10.10.3.156:25

mode tcp

balance source

maxconn 10000

server webserver1 10.10.3.145:25 check port 25 inter 20 rise 1 fall 1

server webserver2 10.10.3.146:25 check port 25 inter 20 rise 1 fall 1 backup

Step 5) Start HAproxy as daemon

/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg –d

Step 6) If all goes well the create a init script for HAproxy

Vi /etc/init.d/haproxy

****************

#!/bin/sh

# chkconfig: - 85 15

# description: HA-Proxy is a TCP/HTTP reverse proxy which is particularly suited \

# for high availability environments.

# processname: haproxy

# config: /etc/haproxy/haproxy.cfg

# pidfile: /var/run/haproxy.pid

# Script Author: Simon Matter <simon.matter@invoca.ch>

# Version: 2004060600

# Source function library.

if [ -f /etc/init.d/functions ]; then

. /etc/init.d/functions

elif [ -f /etc/rc.d/init.d/functions ] ; then

. /etc/rc.d/init.d/functions

else

exit 0

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

[ ${NETWORKING} = "no" ] && exit 0

# This is our service name

BASENAME=`basename $0`

if [ -L $0 ]; then

BASENAME=`find $0 -name $BASENAME -printf %l`

BASENAME=`basename $BASENAME`

[ -f /etc/$BASENAME/$BASENAME.cfg ] || exit 1

RETVAL=0

start() {

/usr/sbin/$BASENAME -c -q -f /etc/$BASENAME/$BASENAME.cfg

if [ $? -ne 0 ]; then

echo "Errors found in configuration file, check it with '$BASENAME check'."

return 1

echo -n "Starting $BASENAME: "

daemon /usr/sbin/$BASENAME -D -f /etc/$BASENAME/$BASENAME.cfg -p /var/run/$BASENAME.pid

RETVAL=$?

echo

[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$BASENAME

return $RETVAL

}

stop() {

echo -n "Shutting down $BASENAME: "

killproc $BASENAME -USR1

RETVAL=$?

echo

[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$BASENAME

[ $RETVAL -eq 0 ] && rm -f /var/run/$BASENAME.pid

return $RETVAL

}

restart() {

/usr/sbin/$BASENAME -c -q -f /etc/$BASENAME/$BASENAME.cfg

if [ $? -ne 0 ]; then

echo "Errors found in configuration file, check it with '$BASENAME check'."

return 1

stop

start

}

reload() {

/usr/sbin/$BASENAME -c -q -f /etc/$BASENAME/$BASENAME.cfg

if [ $? -ne 0 ]; then

echo "Errors found in configuration file, check it with '$BASENAME check'."

return 1

/usr/sbin/$BASENAME -D -f /etc/$BASENAME/$BASENAME.cfg -p /var/run/$BASENAME.pid -sf $(cat /var/run/$BASENAME.pid)

}

check() {

/usr/sbin/$BASENAME -c -q -V -f /etc/$BASENAME/$BASENAME.cfg

}

rhstatus() {

status $BASENAME

}

condrestart() {

[ -e /var/lock/subsys/$BASENAME ] && restart || :

}

# See how we were called.

case "$1" in

start)

start

;;

stop)

stop

;;

restart)

restart

;;

reload)

reload

;;

condrestart)

condrestart

;;

status)

rhstatus

;;

check)

check

;;

echo $"Usage: $BASENAME {start|stop|restart|reload|condrestart|status|check}"

exit 1

esac

exit $?

chmod 755 /etc/init.d/haproxy

service haproxy restart

chkconfig haproxy on