My Linux and Tech Blog

Channel bonding/ IP or Link redundancy in RHEL 6/ 5 or CentOS or Fedora

2014-02-25T14:58:00.000+06:00

Configuration Steps (as root user):
1. cd /etc/sysconfig/network-scripts
2. touch ifcfg-bond0
3. Contents of /etc/sysconfig/network-scripts/ifcfg-bond0 file:

DEVICE=bond0
BONDING_OPTS="mode=1 miimon=500"
ONBOOT=yes
BOOTPROTO=none
IPADDR=192.168.7.196
NETMASK=255.255.255.0
GATEWAY=192.168.7.1
USERCTL=no
DNS1=192.168.7.4
DNS2=182.16.156.5

**Details of bonding options (BONDING_OPTS) given below

4. Edit the existing configuration files for the two NIC that will conform the combined interface. Content of /etc/sysconfig/network-scripts/ifcfg-eth0 file:
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=none
MASTER=bond0
SLAVE=yes

5. Content of /etc/sysconfig/network-scripts/ifcfg-eth1 file:
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=none
MASTER=bond0
SLAVE=yes

6. Here we are using the MASTER and SLAVE and directive to configuring channel bonding. For both interfaces we will use bond0 as the master & each interface will act as slave for bond0 interface. After this point we are done with network configuration file modification. Now we have to add the following line to

/etc/modprobe.d/dist.conf
or, (depending on your distro, in my case, at RHEL6.4, I used above file)
/etc/modprobe.conf

Add the below line:
alias bond0 bonding

7. Then execute the following two commands:
modprobe bond0
service network restart

DONE!!!

*Please stop NetworkManager service before doing this, if required !!!
service NetworkManager stop
chkconfig NetworkManager off

** and also check iptables rules, if required

***BONDING_OPTS(Reference: https://www.centos.org/docs/5/html/5.1/Deployment_Guide/s3-modules-bonding-directives.html )

The following is a list of available parameters for the bonding module:

mode= — Specifies one of four policies allowed for the bonding module. Acceptable values for this parameter are:
0 — Sets a round-robin policy for fault tolerance and load balancing. Transmissions are received and sent out sequentially on each bonded slave interface beginning with the first one available.
1 — Sets an active-backup policy for fault tolerance. Transmissions are received and sent out via the first available bonded slave interface. Another bonded slave interface is only used if the active bonded slave interface fails.
2 — Sets an XOR (exclusive-or) policy for fault tolerance and load balancing. Using this method, the interface matches up the incoming request's MAC address with the MAC address for one of the slave NICs. Once this link is established, transmissions are sent out sequentially beginning with the first available interface.
3 — Sets a broadcast policy for fault tolerance. All transmissions are sent on all slave interfaces.
4 — Sets an IEEE 802.3ad dynamic link aggregation policy. Creates aggregation groups that share the same speed and duplex settings. Transmits and receives on all slaves in the active aggregator. Requires a switch that is 802.3ad compliant.
5 — Sets a Transmit Load Balancing (TLB) policy for fault tolerance and load balancing. The outgoing traffic is distributed according to the current load on each slave interface. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed slave.
6 — Sets an Active Load Balancing (ALB) policy for fault tolerance and load balancing. Includes transmit and receive load balancing for IPV4 traffic. Receive load balancing is achieved through ARP negotiation.
miimon= — Specifies (in milliseconds) how often MII link monitoring occurs. This is useful if high availability is required because MII is used to verify that the NIC is active. To verify that the driver for a particular NIC supports the MII tool, type the following command as root:
ethtool | grep "Link detected:"
In this command, replace with the name of the device interface, such as eth0, not the bond interface. If MII is supported, the command returns:
Link detected: yes
If using a bonded interface for high availability, the module for each NIC must support MII.
Setting the value to 0 (the default), turns this feature off. When configuring this setting, a good starting point for this parameter is 100.
downdelay= — Specifies (in milliseconds) how long to wait after link failure before disabling the link. The value must be a multiple of the value specified in the miimon parameter. The value is set to 0 by default, which disables it.
updelay= — Specifies (in milliseconds) how long to wait before enabling a link. The value must be a multiple of the value specified in the miimon parameter. The value is set to 0 by default, which disables it.
arp_interval= — Specifies (in milliseconds) how often ARP monitoring occurs.
If using this setting while in mode0 or 2 (the two load-balancing modes), the network switch must be configured to distribute packets evenly across the NICs. For more information on how to accomplish this, refer to
/usr/share/doc/kernel-doc-/Documentation/networking/ bonding.txt
The value is set to 0 by default, which disables it.
arp_ip_target= — Specifies the target IP address of ARP requests when the arp_interval parameter is enabled. Up to 16 IP addresses can be specified in a comma separated list.
arp_validate= — validate source/distribution of ARP probes; default is none. Other valid values are active, backup, and all.
lacp_rate= — Specifies the rate at which link partners should transmit LACPDU packets in 802.3ad mode. Possible values are:
- slow or 0 — Default setting. This specifies that partners should transmit LACPDUs every 30 seconds.
- fast or 1 — Specifies that partners should transmit LACPDUs every 1 second.
primary= — Specifies the interface name, such as eth0, of the primary device. The primary device is the first of the bonding interfaces to be used and is not abandoned unless it fails. This setting is particularly useful when one NIC in the bonding interface is faster and, therefore, able to handle a bigger load.
This setting is only valid when the bonding interface is in active-backup mode. Refer to
/usr/share/doc/kernel-doc-/Documentation/networking/ bonding.txt
for more information.
use_carrier= — Specifies whether or not miimon should use MII/ETHTOOL ioctls or netif_carrier_ok() to determine the link state. The netif_carrier_ok() relies on the device driver to maintains its state with netif_carrier_on/off; most device drivers support this function.
The MII/ETHROOL ioctls tools utilize a deprecated calling sequence within the kernel. However, this is still configurable in case your device driver does not support netif_carrier_on/off.
Valid values are:
- 1 — Default setting. Enables the use of netif_carrier_ok().
- 0 — Enables the use of MII/ETHTOOL ioctls.
Tip
If bonding insists that the link is up when it should not be, it is possible that your network device driver does not support netif_carrier_on/off.
xmit_hash_policy — Selects the transmit hash policy used for slave selection in balance-xor and 802.3ad modes. Possible values are:
- 0 or layer2 — Default setting. This option uses the XOR of hardware MAC addresses to generate the hash. The formula used is:
```
(    ) 
```
  This algorithm will place all traffic to a particular network peer on the same slave, and is 802.3ad compliant.
- 1 or layer3+4 — Uses upper layer protocol information (when available) to generate the hash. This allows for traffic to a particular network peer to span multiple slaves, although a single connection will not span multiple slaves.
  The formula for unfragmented TCP and UDP packets used is:
```
((   ) 
 ((    ) AND 0xffff)
  
```
  For fragmented TCP or UDP packets and all other IP protocol traffic, the source and destination port information is omitted. For non-IP traffic, the formula is the same as the layer2 transmit hash policy.
  This policy intends to mimic the behavior of certain switches; particularly, Cisco switches with PFC2 as well as some Foundry and IBM products.
  The algorithm used by this policy is not 802.3ad compliant.

Citycell Zoom Ultra in Linux / Ubuntu / Centos

2011-03-27T18:02:00.001+06:00

Citycell ZOOM ULTRA modem setup in linux ( ubuntu , rhel, centos )

1. Please ensure you have following packages install in your system

usb_modeswitch

wvdial

using google you can find and install those packages easily.

2. Then plug in the Zoom Ultra modem in USB and open a terminal using root user. Then type

# lsusb

Output will be something like the following .

Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 002: ID 19d2:fff5 ONDA Communication S.p.A.

Look at the last line. If the modem detected by your laptop/desktop you can see a line similar to that. Note that 19d2:fff5 is not the product ID of the modem, rather it is the storage device ID integrated with the modem (Where program for WINDOWS reside)

3. Now type :

gedit /etc/usb_modeswitch.conf

This will open usb_modeswitch configuration file in editor.

Delete everything from the page and past the follwinf lines.

DefaultVendor= 0×19d2
DefaultProduct= 0xfff5
TargetVendor= 0×19d2
TargetProduct= 0xfff1
MessageContent=”5553424312345678c00000008000069f030000000000000000000000

4. Now save the page and run the following command:

# usb_modeswitch

5. Now check the device id by typing lsusb command again.

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 008 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 007 Device 005: ID 19d2:fff1 ONDA Communication S.p.A.

Product ID changed.

6. Now:

# gedit /etc/wvdial.conf

Delet everything from the page and past the following lines

[Dialer myzoom]
Username = waps
Stupid Mode = 1
Password = waps
Phone = #777

And save then exit.

7. Now type

# wvdialconf

8. Then type

#wvdial myzoom

Last lines of output will be like this:

--> pppd: �5[18] @,[18]
^CCaught signal 2: Attempting to exit gracefully...
--> Terminating on signal 15
--> pppd: �5[18] @,[18]

Now you are connected. You have to keep open the terminal as long as you want to use the zoom modem. For disconnection simply close the terminal or Press CTRL+C.

For any help please leave a comment.

How to install nagios in RHEL 5 or FEDORA

2011-02-14T13:24:00.000+06:00

Install Nagios on RHEL5

Dependencies

* Install Apache and PHP
* GCC
* GD development lib

Create User Account

/usr/sbin/useradd -m nagios

passwd nagios

/usr/sbin/groupadd nagcmd

/usr/sbin/usermod -a -G nagcmd nagios

/usr/sbin/usermod -a -G nagcmd apache

Build and Install Nagios Core

wget http://prdownloads.sourceforge.net/sourceforge/nagios/nagios-3.2.0.tar.gz

tar zxf nagios-3.2.0.tar.gz

cd nagios-3.2.0

./configure --with-command-group=nagcmd

make all

make install

# Installs the init script in /etc/rc.d/init.d

make install-init

# Installs and configures permissions on the directory for holding the external command file

make install-config

# Installs sample config files in /usr/local/nagios/etc

make install-commandmode

# Set contact email

vi /usr/local/nagios/etc/objects/contacts.cfg

# Install web interface

make install-webconf

# Create web interface account

htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin

# Restart Apache

/usr/local/apache2/bin/apachectl stop

/usr/local/apache2/bin/apachectl start

# Or

/sbin/service httpd restart

Compile and Install Nagios Plugins

wget http://prdownloads.sourceforge.net/sourceforge/nagiosplug/nagios-plugins-1.4.14.tar.gz

tar zxf nagios-plugins-1.4.14.tar.gz

cd nagios-plugins-1.4.14

./configure --with-nagios-user=nagios --with-nagios-group=nagios

make

make install

AutoStart/Start/Stop Nagios

# Auto start Nagios

/sbin/chkconfig --add nagios

/sbin/chkconfig nagios on

# Check config file

/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

# Start/Stop Nagios

/etc/init.d/nagios stop

/etc/init.d/nagios start

Add host/router/switches to nagios

# To add node, uncomment respective cfg_file line in

/usr/local/nagios/etc/nagios.cfg

Example: if you want to monitor a switch then uncomment following line in nagios.cfg

cfg_file=/usr/local/nagios/etc/objects/switch.cfg

# Then go to /usr/local/nagios/etc/objects/

And open switch.cfg

vi /usr/local/nagios/etc/objects/ switch.cfg

There is an example of adding node. You can use that by copy/paste.

Access Web Interface

http://myhost/nagios/index.php

http://your_nagios_server_ip/nagios

References

http://nagios.sourceforge.net/docs/3_0/quickstart-fedora.html

Basic IPTABLES Understanding

2010-10-03T14:59:00.000+06:00

Basic Commands

Typing

# iptables -L

lists your current rules in iptables. If you have just set up your server, you will have no rules, and you should see

Chain INPUT (policy ACCEPT)

target prot opt source destination

Chain FORWARD (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Basic Iptables Options

Here are explanations for some of the iptables options you will see in this tutorial. Don't worry about understanding everything here now, but remember to come back and look at this list as you encounter new options later on.

-A - Append this rule to a rule chain. Valid chains for what we're doing are INPUT, FORWARD and OUTPUT, but we mostly deal with INPUT in this tutorial, which affects only incoming traffic.
-L - List the current filter rules.
-m conntrack - Allow filter rules to match based on connection state. Permits the use of the --ctstate option.
--ctstate - Define the list of states for the rule to match on. Valid states are:

NEW - The connection has not yet been seen.
RELATED - The connection is new, but is related to another connection already permitted.
ESTABLISHED - The connection is already established.
INVALID - The traffic couldn't be identified for some reason.

-m limit - Require the rule to match only a limited number of times. Allows the use of the --limit option. Useful for limiting logging rules.

--limit - The maximum matching rate, given as a number followed by "/second", "/minute", "/hour", or "/day" depending on how often you want the rule to match. If this option is not used and -m limit is used, the default is "3/hour".

-p - The connection protocol used.
--dport - The destination port(s) required for this rule. A single port may be given, or a range may be given as start:end, which will match all ports from start to end, inclusive.
-j - Jump to the specified target. By default, iptables allows four targets:

ACCEPT - Accept the packet and stop processing rules in this chain.
REJECT - Reject the packet and notify the sender that we did so, and stop processing rules in this chain.
DROP - Silently ignore the packet, and stop processing rules in this chain.
LOG - Log the packet, and continue processing more rules in this chain. Allows the use of the --log-prefix and --log-level options.

--log-prefix - When logging, put this text before the log message. Use double quotes around the text to use.
--log-level - Log using the specified syslog level. 7 is a good choice unless you specifically need something else.
-i - Only match if the packet is coming in on the specified interface.
-I - Inserts a rule. Takes two options, the chain to insert the rule into, and the rule number it should be.

-I INPUT 5 would insert the rule into the INPUT chain and make it the 5^th rule in the list.

-v - Display more information in the output. Useful for if you have rules that look similar without using -v.
-s --source - address[/mask] source specification
-d --destination - address[/mask] destination specification
-o --out-interface - output name[+] network interface name ([+] for wildcard)

Allowing Established Sessions

We can allow established sessions to receive traffic:

# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

The above rule has no spaces either side of the comma in ESTABLISHED,RELATED

If the line above doesn't work, you may be on a VPS that uses OpenVZ or doesn't have some kernel extensions installed. In that case, try this line instead:

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allowing Incoming Traffic on Specific Ports

You could start by blocking traffic, but you might be working over SSH, where you would need to allow SSH before blocking everything else.

To allow incoming traffic on the default SSH port (22), you could tell iptables to allow all TCP traffic on that port to come in.

# iptables -A INPUT -p tcp --dport ssh -j ACCEPT

Referring back to the list above, you can see that this tells iptables:

append this rule to the input chain (-A INPUT) so we look at incoming traffic
check to see if it is TCP (-p tcp).
if so, check to see if the input goes to the SSH port (--dport ssh).
if so, accept the input (-j ACCEPT).

Lets check the rules: (only the first few lines shown, you will see more)

# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

Now, let's allow all incoming web traffic

# iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Checking our rules, we have

# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

ACCEPT tcp -- anywhere anywhere tcp dpt:www

We have specifically allowed tcp traffic to the ssh and web ports, but as we have not blocked anything, all traffic can still come in.

Blocking Traffic

Once a decision is made to accept a packet, no more rules affect it. As our rules allowing ssh and web traffic come first, as long as our rule to block all traffic comes after them, we can still accept the traffic we want. All we need to do is put the rule to block all traffic at the end.

# iptables -A INPUT -j DROP

# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

ACCEPT tcp -- anywhere anywhere tcp dpt:www

DROP all -- anywhere anywhere

Because we didn't specify an interface or a protocol, any traffic for any port on any interface is blocked, except for web and ssh.

Editing iptables

The only problem with our setup so far is that even the loopback port is blocked. We could have written the drop rule for just eth0 by specifying -i eth0, but we could also add a rule for the loopback. If we append this rule, it will come too late - after all the traffic has been dropped. We need to insert this rule before that. Since this is a lot of traffic, we'll insert it as the first rule so it's processed first.

# iptables -I INPUT 1 -i lo -j ACCEPT

# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:ssh

ACCEPT tcp -- anywhere anywhere tcp dpt:www

DROP all -- anywhere anywhere

The first and last lines look nearly the same, so we will list iptables in greater detail.

# iptables -L -v

Chain INPUT (policy ALLOW 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

0 0 ACCEPT all -- lo any anywhere anywhere

0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED

0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh

0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www

0 0 DROP all -- any any anywhere anywhere

You can now see a lot more information. This rule is actually very important, since many programs use the loopback interface to communicate with each other. If you don't allow them to talk, you could break those programs!

Logging

In the above examples none of the traffic will be logged. If you would like to log dropped packets to syslog, this would be the quickest way:

# iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

See Tips section for more ideas on logging.

Saving iptables

If you were to reboot your machine right now, your iptables configuration would disappear. Rather than type this each time you reboot, however, you can save the configuration, and have it start up automatically. To save the configuration, you can use iptables-save and iptables-restore.

I will post more complex example with iptables later.

Thanks.

A-Z Linux Command Index, Linux Commands A to Z

2010-10-03T14:56:00.000+06:00

An A-Z Index of the Bash command line for Linux.

Commands marked • are bash built-ins, these are available under all shells.

adduser Add a user to the system

addgroup Add a group to the system

alias Create an alias •

apropos Search Help manual pages (man -k)

apt-get Search for and install software packages (Debian)

aspell Spell Checker

awk Find and Replace text, database sort/validate/index

basename Strip directory and suffix from filenames

bash GNU Bourne-Again SHell

bc Arbitrary precision calculator language

bg Send to background

break Exit from a loop •

builtin Run a shell builtin

bzip2 Compress or decompress named file(s)

cal Display a calendar

case Conditionally perform a command

cat Display the contents of a file

cd Change Directory

cfdisk Partition table manipulator for Linux

chgrp Change group ownership

chmod Change access permissions

chown Change file owner and group

chroot Run a command with a different root directory

chkconfig System services (runlevel)

cksum Print CRC checksum and byte counts

clear Clear terminal screen

cmp Compare two files

comm Compare two sorted files line by line

command Run a command - ignoring shell functions •

continue Resume the next iteration of a loop •

cp Copy one or more files to another location

cron Daemon to execute scheduled commands

crontab Schedule a command to run at a later time

csplit Split a file into context-determined pieces

cut Divide a file into several parts

date Display or change the date & time

dc Desk Calculator

dd Convert and copy a file, write disk headers, boot records

ddrescue Data recovery tool

declare Declare variables and give them attributes •

df Display free disk space

diff Display the differences between two files

diff3 Show differences among three files

dig DNS lookup

dir Briefly list directory contents

dircolors Colour setup for `ls'

dirname Convert a full pathname to just a path

dirs Display list of remembered directories

dmesg Print kernel & driver messages

du Estimate file space usage

echo Display message on screen •

egrep Search file(s) for lines that match an extended expression

eject Eject removable media

enable Enable and disable builtin shell commands •

env Environment variables

ethtool Ethernet card settings

eval Evaluate several commands/arguments

exec Execute a command

exit Exit the shell

expect Automate arbitrary applications accessed over a terminal

expand Convert tabs to spaces

export Set an environment variable

expr Evaluate expressions

false Do nothing, unsuccessfully

fdformat Low-level format a floppy disk

fdisk Partition table manipulator for Linux

fg Send job to foreground

fgrep Search file(s) for lines that match a fixed string

file Determine file type

find Search for files that meet a desired criteria

fmt Reformat paragraph text

fold Wrap text to fit a specified width.

for Expand words, and execute commands

format Format disks or tapes

free Display memory usage

fsck File system consistency check and repair

ftp File Transfer Protocol

function Define Function Macros

fuser Identify/kill the process that is accessing a file

gawk Find and Replace text within file(s)

getopts Parse positional parameters

grep Search file(s) for lines that match a given pattern

groups Print group names a user is in

gzip Compress or decompress named file(s)

hash Remember the full pathname of a name argument

head Output the first part of file(s)

help Display help for a built-in command •

history Command History

hostname Print or set system name

id Print user and group id's

if Conditionally perform a command

ifconfig Configure a network interface

ifdown Stop a network interface

ifup Start a network interface up

import Capture an X server screen and save the image to file

install Copy files and set attributes

join Join lines on a common field

kill Stop a process from running

killall Kill processes by name

less Display output one screen at a time

let Perform arithmetic on shell variables •

ln Make links between files

local Create variables •

locate Find files

logname Print current login name

logout Exit a login shell •

look Display lines beginning with a given string

lpc Line printer control program

lpr Off line print

lprint Print a file

lprintd Abort a print job

lprintq List the print queue

lprm Remove jobs from the print queue

ls List information about file(s)

lsof List open files

make Recompile a group of programs

man Help manual

mkdir Create new folder(s)

mkfifo Make FIFOs (named pipes)

mkisofs Create an hybrid ISO9660/JOLIET/HFS filesystem

mknod Make block or character special files

more Display output one screen at a time

mount Mount a file system

mtools Manipulate MS-DOS files

mv Move or rename files or directories

mmv Mass Move and rename (files)

netstat Networking information

nice Set the priority of a command or job

nl Number lines and write files

nohup Run a command immune to hangups

nslookup Query Internet name servers interactively

open Open a file in its default application

op Operator access

passwd Modify a user password

paste Merge lines of files

pathchk Check file name portability

ping Test a network connection

pkill Stop processes from running

popd Restore the previous value of the current directory

pr Prepare files for printing

printcap Printer capability database

printenv Print environment variables

printf Format and print data •

ps Process status

pushd Save and then change the current directory

pwd Print Working Directory

quota Display disk usage and limits

quotacheck Scan a file system for disk usage

quotactl Set disk quotas

ram ram disk device

rcp Copy files between two machines

read Read a line from standard input •

readarray Read from stdin into an array variable •

readonly Mark variables/functions as readonly

reboot Reboot the system

rename Rename files

renice Alter priority of running processes

remsync Synchronize remote files via email

return Exit a shell function

rev Reverse lines of a file

rm Remove files

rmdir Remove folder(s)

rsync Remote file copy (Synchronize file trees)

screen Multiplex terminal, run remote shells via ssh

scp Secure copy (remote file copy)

sdiff Merge two files interactively

sed Stream Editor

select Accept keyboard input

seq Print numeric sequences

set Manipulate shell variables and functions

sftp Secure File Transfer Program

shift Shift positional parameters

shopt Shell Options

shutdown Shutdown or restart linux

sleep Delay for a specified time

slocate Find files

sort Sort text files

source Run commands from a file `.'

split Split a file into fixed-size pieces

ssh Secure Shell client (remote login program)

strace Trace system calls and signals

su Substitute user identity

sudo Execute a command as another user

sum Print a checksum for a file

symlink Make a new name for a file

sync Synchronize data on disk with memory

tail Output the last part of files

tar Tape ARchiver

tee Redirect output to multiple files

test Evaluate a conditional expression

time Measure Program running time

times User and system times

touch Change file timestamps

top List processes running on the system

traceroute Trace Route to Host

trap Run a command when a signal is set(bourne)

tr Translate, squeeze, and/or delete characters

true Do nothing, successfully

tsort Topological sort

tty Print filename of terminal on stdin

type Describe a command •

ulimit Limit user resources •

umask Users file creation mask

umount Unmount a device

unalias Remove an alias •

uname Print system information

unexpand Convert spaces to tabs

uniq Uniquify files

units Convert units from one scale to another

unset Remove variable or function names

unshar Unpack shell archive scripts

until Execute commands (until error)

useradd Create new user account

usermod Modify user account

users List users currently logged in

uuencode Encode a binary file

uudecode Decode a file created by uuencode

v Verbosely list directory contents (`ls -l -b')

vdir Verbosely list directory contents (`ls -l -b')

vi Text Editor

vmstat Report virtual memory statistics

watch Execute/display a program periodically

wc Print byte, word, and line counts

whereis Search the user's $path, man pages and source files for a program

which Search the user's $path for a program file

while Execute commands

who Print all usernames currently logged in

whoami Print the current user id and name (`id -un')

Wget Retrieve web pages or files via HTTP, HTTPS or FTP

write Send a message to another user

xargs Execute utility, passing constructed argument list(s)

yes Print a string until interrupted

. Run a command script in the current shell

### Comment / Remark

Understanding of FSTAB in LINUX

2010-10-03T14:52:00.000+06:00

FSTAB

< What is fstab and why it's useful >

fstab is a configuration file that contains information of all the partitions and storage devices in your computer. The file is located under /etc, so the full path to this file is /etc/fstab.
/etc/fstab contains information of where your partitions and storage devices should be mounted and how. If you can't access your Windows partition from Linux, aren't able to mount your CD or write to your floppy as a normal user, or have problems with your CD-RW, you probably have a misconfigured /etc/fstab file. So, you can usually fix your mounting problems by editing your fstab file.
/etc/fstab is just a plain text file, so you can open and edit it with any text editor you're familiar with. However, note that you must have the root privileges before editing fstab. So, in order to edit the file, you must either log in as root or use the su command to become root.

< Overview of the file >

Of course everybody has a bit different /etc/fstab file because the partitions, devices and their properties are different on different systems. But the basic structure of fstab is always the same. Here's an example of the contents of /etc/fstab:

/dev/hda2	/	ext2	defaults	1 1
/dev/hdb1	/home	ext2	defaults	1 2
/dev/cdrom	/media/cdrom	auto	ro,noauto,user,exec	0 0
/dev/fd0	/media/floppy	auto	rw,noauto,user,sync	0 0
proc	/proc	proc	defaults	0 0
/dev/hda1	swap	swap	pri=42	0 0

What does all this gibberish mean? As you see, every line (or row) contains the information of one device or partition. The first column contains the device name, the second one its mount point, third its filesystem type, fourth the mount options, fifth (a number) dump options, and sixth (another number) filesystem check options. Let's take a closer look at this stuff.

< 1st and 2nd columns: Device and default mount point >

The first and second columns should be pretty straightforward. They tell the mount command exactly the same things that you tell mount when you mount stuff manually: what is the device or partition, and what is the mount point. The mount point specified for a device in /etc/fstab is its default mount point. That is the directory where the device will be mounted if you don't specify any other mount point when mounting the device.
Most Linux distros create special directories for mount points. Most distros create them under /mnt, but some (at least SuSE) under /media. As you probably noticed when looking at the example fstab, I use SuSE's mount points as an example.
What does all this mean? If I type the following command:
$ mount /dev/fd0
... my floppy will be mounted in /media/floppy, because that's the default mount point specified in /etc/fstab. If there is no entry for /dev/fd0 in my fstab when I issue the command above, mount gets very confused because it doesn't know where to mount the floppy.
You can freely change the default mount points listed in /etc/fstab if you're not satisfied with the defaults your distro has given you. Just make sure the mount point is a directory that already exists on your system. If it doesn't, simply create it.
Some partitions and devices are also automatically mounted when your Linux system boots up. For example, have a look at the example fstab above. There are lines that look like this:

/dev/hda2 / ext2 defaults 1 1

/dev/hdb1
/home ext2 defaults 1 2

As you've learned, these lines mean that /dev/hda2 will be mounted to / and /dev/hdb1 to /home. This is done automatically when your Linux system boots up... if it wouldn't, you'd have a hard time using your cool Linux system because all the programs you use are in / and you wouldn't be able to run them if / wasn't mounted! But how does the system know where you want to mount /dev/hda2 and /dev/hdb1? By looking at the /etc/fstab file of course.

< 3rd column: Filesystem type >

The third column in /etc/fstab specifies the filesystem type of the device or partition. Many different filesystems are supported but we'll take a look at the most common ones only.
ext2 and ext3 Very likely your Linux partitions are Ext3. Ext2 used to be the standard filesystem for Linux, but these days, Ext3 and ReiserFS are usually the default filesystems for almost every new Linux distro. Ext3 is a newer filesystem type that differs from Ext2 in that it's journaled, meaning that if you turn the computer off without properly shutting down, you shouldn't lose any data and your system shouldn't spend ages doing filesystem checks the next time you boot up.
reiserfs Your Linux partitions may very well be formatted as ReiserFS. Like Ext3, ReiserFS is a journaled filesystem, but it's much more advanced than Ext3. Many Linux distros (including SuSE) have started using ReiserFS as their default filesystem for Linux partitions.
swap The filesystem name is self-explanatory. The filesystem type "swap" is used in your swap partitions.
vfat and ntfs Your USB stick is most likely formatted as Vfat (more widely known as FAT32). Your Windows partitions are probably either Vfat or NTFS. The 9x series (95, 98, ME) all use Vfat, and the NT series (NT, 2000, XP, Vista, 7) use NTFS but they may be formatted as Vfat, too.
auto No, this isn't a filesystem type :-) The option "auto" simply means that the filesystem type is detected automatically. If you take a look at the example fstab above, you'll see that the floppy and CD-ROM both have "auto" as their filesystem type. Why? Their filesystem type may vary. One floppy might be formatted for Windows and the other for Linux's Ext2. That's why it's wise to let the system automatically detect the filesystem type of media such as floppies and cdroms.

< 4th column: Mount options >

The fourth column in fstab lists all the mount options for the device or partition. This is also the most confusing column in the fstab file, but knowing what some of the most common options mean, saves you from a big headache. Yes, there are many options available, but I'll take a look at the most widely used ones only. For more information, check out the man page of mount.
auto and noauto With the auto option, the device will be mounted automatically (at bootup, just like I told you a bit earlier, or when you issue the mount -a command). auto is the default option. If you don't want the device to be mounted automatically, use the noauto option in /etc/fstab. With noauto, the device can be mounted only explicitly.
user and nouser These are very useful options. The user option allows normal users to mount the device, whereas nouser lets only the root to mount the device. nouser is the default, which is a major cause of headache for new Linux users. If you're not able to mount your cdrom, floppy, Windows partition, or something else as a normal user, add the user option into /etc/fstab.
exec and noexec exec lets you execute binaries that are on that partition, whereas noexec doesn't let you do that. noexec might be useful for a partition that contains binaries you don't want to execute on your system, or that can't even be executed on your system. This might be the case of a Windows partition.
exec is the default option, which is a good thing. Imagine what would happen if you accidentally used the noexec option with your Linux root partition...
ro Mount the filesystem read-only.
rw Mount the filesystem read-write. Again, using this option might cure the headache of many new Linux users who are tearing their hair off because they can't write to their floppies, Windows partitions, or something else.
sync and async How the input and output to the filesystem should be done. sync means it's done synchronously. If you look at the example fstab, you'll notice that this is the option used with the floppy. In plain English, this means that when you, for example, copy a file to the floppy, the changes are physically written to the floppy at the same time you issue the copy command.
However, if you have the async option in /etc/fstab, input and output is done asynchronously. Now when you copy a file to the floppy, the changes may be physically written to it long time after issuing the command. This isn't bad, and may sometimes be favorable, but can cause some nasty accidents: if you just remove the floppy without unmounting it first, the copied file may not physically exist on the floppy yet!
async is the default. However, it may be wise to use sync with the floppy, especially if you're used to the way it's done in Windows and have a tendency to remove floppies before unmounting them first.
defaults Uses the default options that are rw, suid, dev, exec, auto, nouser, and async.

< 5th and 6th columns: Dump and fsck options >

Dump and, uh, what options? Well, dump is a backup utility and fsck is a filesystem check utility. I won't discuss them in great length here, but I'll mention them, because otherwise you'd spend the rest of the day wondering what on God's green Earth do these things mean.
The 5th column in /etc/fstab is the dump option. Dump checks it and uses the number to decide if a filesystem should be backed up. If it's zero, dump will ignore that filesystem. If you take a look at the example fstab, you'll notice that the 5th column is zero in most cases.
The 6th column is a fsck option. fsck looks at the number in the 6th column to determine in which order the filesystems should be checked. If it's zero, fsck won't check the filesystem.

< Example /etc/fstab entries >

As an example, we'll take a look at a couple of fstab entries that have been a source of endless frustration for new Linux users: floppy and CD-ROM (although these days floppies aren't that important anymore).

/dev/fd0 /media/floppy auto rw,noauto,user,sync 0 0

This line means that the floppy is mounted to /media/floppy by default and that its filesystem type is detected automatically. This is useful because the type of the floppy may wary. Note especially the rw and user options: they must be there if you want to be able to mount and write to the floppy as a normal user. If you have trouble with this, check your fstab file to see if these options are there. Also note the sync option. It can be async just as well, but it's sync because of reasons discussed a bit earlier.

/dev/cdrom /media/cdrom auto ro,noauto,user,exec 0 0

Note, again, the user option that enables you to mount the CD as a normal user. The CD-ROM has the ro option because it's no use mounting a CD-ROM read-write because you wouldn't be able to write to it anyway. Also note the exec option. It's especially useful if you'd like to be able to execute something from your CD.
Also note that the noauto option is used with the floppy and CD-ROM. This means that they won't be automatically mounted when your Linux system boots up. This is useful for removable media, because sometimes there won't be any floppy or CD-ROM when you boot up your system, so there isn't any reason to try to mount something that doesn't even exist.

Understanding of INITTAB in LINUX

2010-10-03T14:49:00.000+06:00

INNITTAB

inittab - format of the inittab file used by the sysv-compatible init process

DESCRIPTION

The inittab file describes which processes are started at bootup and during normal operation (e.g. /etc/init.d/boot, /etc/init.d/rc, gettys...). Init(8) distinguishes multiple runlevels, each of which can have its own set of processes that are started. Valid runlevels are 0-6 plus A, B, and C for ondemand entries. An entry in the inittab file has the following format:

id:runlevels:action:process

Lines beginning with `#' are ignored.

is a unique sequence of 1-4 characters which identifies an entry in inittab (for versions of sysvinit compiled with libraries < 5.2.18 or a.out libraries the limit is 2 characters).

Note: For gettys or other login processes, the id field should be the tty suffix of the corresponding tty, e.g. 1 for tty1. Otherwise, the login accounting might not work correctly.

runlevels

lists the runlevels for which the specified action should be taken.

action

describes which action should be taken.

process

specifies the process to be executed. If the process field starts with a `+' character, init will not do utmp and wtmp accounting for that process. This is needed for gettys that insist on doing their own utmp/wtmp housekeeping. This is also a historic bug.

The runlevels field may contain multiple characters for different runlevels. For example, 123 specifies that the process should be started in runlevels 1, 2, and 3. The runlevels for ondemand entries may contain an A, B, or C. The runlevels field of sysinit, boot, and bootwait entries are ignored.

When the system runlevel is changed, any running processes that are not specified for the new runlevel are killed, first with SIGTERM, then with SIGKILL.

Valid actions for the action field are:

respawn

The process will be restarted whenever it terminates (e.g. getty).

wait

The process will be started once when the specified runlevel is entered and init will wait for its termination.

once

The process will be executed once when the specified runlevel is entered.

boot

The process will be executed during system boot. The runlevels field is ignored.

bootwait

The process will be executed during system boot, while init waits for its termination (e.g. /etc/rc). The runlevels field is ignored.

off

This does nothing.

ondemand

A process marked with an ondemand runlevel will be executed whenever the specified ondemand runlevel is called. However, no runlevel change will occur (ondemand runlevels are `a', `b', and `c').

initdefault

An initdefault entry specifies the runlevel which should be entered after system boot. If none exists, init will ask for a runlevel on the console. The process field is ignored.

sysinit

The process will be executed during system boot. It will be executed before any boot or bootwait entries. The runlevels field is ignored.

powerwait

The process will be executed when the power goes down. Init is usually informed about this by a process talking to a UPS connected to the computer. Init will wait for the process to finish before continuing.

powerfail

As for powerwait, except that init does not wait for the process's completion.

powerokwait

This process will be executed as soon as init is informormed that the power has been restored.

powerfailnow

This process will be executed when init is told that the battery of the external UPS is almost empty and the power is failing (provided that the external UPS and the monitoring process are able to detect this condition).

ctrlaltdel

The process will be executed when init receives the SIGINT signal. This means that someone on the system console has pressed the CTRL-ALT-DEL key combination. Typically one wants to execute some sort of shutdown either to get into single-user level or to reboot the machine.

kbrequest

The process will be executed when init receives a signal from the keyboard handler that a special key combination was pressed on the console keyboard.

The documentation for this function is not complete yet; more documentation can be found in the kbd-x.xx packages (most recent was kbd-0.94 at the time of this writing). Basically you want to map some keyboard combination to the "KeyboardSignal" action. For example, to map Alt-Uparrow for this purpose use the following in your keymaps file:

alt keycode 103 = KeyboardSignal

EXAMPLES

This is an example of a inittab which resembles the old Linux inittab:

# inittab for linux

id:1:initdefault:

rc::bootwait:/etc/rc

1:1:respawn:/etc/getty 9600 tty1

2:1:respawn:/etc/getty 9600 tty2

3:1:respawn:/etc/getty 9600 tty3

4:1:respawn:/etc/getty 9600 tty4

This inittab file executes /etc/rc during boot and starts gettys on tty1-tty4.

A more elaborate inittab with different runlevels (see the comments inside):

# Level to run in

id:2:initdefault:

# System initialization before anything else.

si::sysinit:/etc/rc.d/bcheckrc

# Runlevel 0,6 is halt and reboot, 1 is maintenance mode.

l0:0:wait:/etc/rc.d/rc.halt

l1:1:wait:/etc/rc.d/rc.single

l2:2345:wait:/etc/rc.d/rc.multi

l6:6:wait:/etc/rc.d/rc.reboot

# What to do at the "3 finger salute".

ca::ctrlaltdel:/sbin/shutdown -t5 -rf now

# Runlevel 2&3: getty on console, level 3 also getty on modem port.

1:23:respawn:/sbin/getty tty1 VC linux

2:23:respawn:/sbin/getty tty2 VC linux

3:23:respawn:/sbin/getty tty3 VC linux

4:23:respawn:/sbin/getty tty4 VC linux

S2:3:respawn:/sbin/uugetty ttyS2 M19200

FILES

/etc/inittab

DHCP Server and DHCPD in LINUX

2010-10-03T14:14:00.001+06:00

DHCP Server Configuration:

Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and other network configuration information (subnetmask, broadcast address, etc) to computers on a network. A client configured for DHCP will send out a broadcast request to the DHCP server requesting an address. The DHCP server will then issue a "lease" and assign it to that client. The time period of a valid lease can be specified on the server. DHCP reduces the ammount of time required to configure clients and allows one to move a computer to various networks and be configured with the appropriate IP address, gateway and subnet mask. For ISP's it conserves the limited number of IP addresses it may use. DHCP servers may assign a "static" IP address to specified hardware. Microsoft NetBios information is often included in the network information sent by the DHCP server.

DHCP assignment:

1. Lease Request: Client broadcasts request to DHCP server with a source address of 0.0.0.0 and a destination address of 255.255.255.255. The request includes the MAC address which is used to direct the reply.

2. IP lease offer: DHCP server replies with an IP address, subnet mask, network gateway, name of the domain, name servers, duration of the lease and the IP address of the DHCP server.

3. Lease Selection: Client recieves offer and broadcasts to al DHCP servers that will accept given offer so that other DHCP server need not make an offer.

4. The DHCP server then sends an ack to the client. The client is configured to use TCP/IP.

5. Lease Renewal: When half of the lease time has expired, the client will issue a new request to the DHCP server.

Starting DHCP server: service dhcpd start
(or /etc/rc.d/init.d/dhcpd start for Red Hat, Fedora and CentOS Linux distributions)

Sample DHCP server config file: (DHCP v3.0.1) /etc/dhcpd.conf
(See /usr/share/doc/dhcp-3.X/dhcp.conf.sample)

ddns-update-style interim; # Required for dhcp 3.0+ / Red Hat 8.0+

ignore client-updates;

subnet 192.168.1.0 netmask 255.255.255.0 {

range 192.168.1.128 192.168.1.254; # Range of IP addresses to be issued to DHCP clients

option subnet-mask 255.255.255.0; # Default subnet mask to be used by DHCP clients

option broadcast-address 192.168.1.255; # Default broadcastaddress to be used by DHCP clients

option routers 192.168.1.1; # Default gateway to be used by DHCP clients

option domain-name "your-domain.org";

option domain-name-servers 40.175.42.254, 40.175.42.253; # Default DNS to be used by DHCP clients

option netbios-name-servers 192.168.1.100; # Specify a WINS server for MS/Windows clients.

# (Optional. Specify if used on your network)

# DHCP requests are not forwarded. Applies when there is more than one ethernet device and forwarding is configured.

# option ipforwarding off;

default-lease-time 21600; # Amount of time in seconds that a client may keep the IP address

max-lease-time 43200;

option time-offset -18000; # Eastern Standard Time

# option ntp-servers 192.168.1.1; # Default NTP server to be used by DHCP clients

# option netbios-name-servers 192.168.1.1;

# --- Selects point-to-point node (default is hybrid). Don't change this unless you understand Netbios very well

# option netbios-node-type 2;

        # We want the nameserver "ns2" to appear at a fixed address.
        # Name server with this specified MAC address will recieve this IP.

        host ns2 {
                next-server ns2.your-domain.com;
                hardware ethernet 00:02:c3:d0:e5:83;
                fixed-address 40.175.42.254;
        }

        # Laser printer obtains IP address via DHCP. This assures that the
        # printer with this MAC address will get this IP address every time.

        host laser-printer-lex1 {
                hardware ethernet 08:00:2b:4c:a3:82;
                fixed-address 192.168.1.120;
        }
}

Test configuration file for errors with the following command: /etc/rc.d/init.d/dhcpd configtest
(Other distributions may use: /usr/sbin/dhcpd -f)

Note: The MAC addresses for the static address name server (ns2.your-domain.com),
can be obtained with the command /sbin/ifconfig:

eth0 Link encap:Ethernet HWaddr 00:02:C3:D0:E5:83

inet addr:40.175.42.254 Bcast:40.175.42.255 Mask:255.255.255.0

inet6 addr: fe80::202:b3ff:fef0:e484/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:4070 errors:0 dropped:0 overruns:0 frame:0

TX packets:3878 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:3406445 (3.2 MiB) TX bytes:439612 (429.3 KiB)

When dhcpd is running it will generate entries in the file: /var/lib/dhcp/dhcpd.leases

lease 192.168.1.128 {
starts 2 2004/12/01 20:07:05;
ends 3 2004/12/02 08:07:05;
hardware ethernet 00:00:e8:4a:2c:5c;
uid 01:00:00:e8:4c:5d:31;
client-hostname "Node1";
}

LANs separated by routers: In order to have your DHCP broadcast pass through a router on the the next network, one must configure the router to allow DHCP relay. (Cisco: ip-helper address, Juniper: dhcp-relay) The local lan subnet{ } configuration must come before the configuration directives of the remote LANs.

Time Server and NTP in LINUX

2010-10-03T14:11:00.000+06:00

Setup an NTP Server for Time Synchronization

It is a very good idea to set up your system so that it keeps its clock synchronized to the correct time. If you have multiple systems, including an HA configuration, it can be essential. If clocks are not synchronized, correlating events on different systems can make diagnosing any problem very difficult.
You should run an ntp daemon on each of your servers as described below; you can also use those servers to provide a local time source to your phones and other systems within your network; this will be more accurate and less burden on your external network links than each internal system using the external time sources individually.

Installation & Configuration of the NTP Time Server

To install the ntp daemon package:

yum install ntp

To enable it to run by default:

chkconfig ntpd on

Configuring time sources

If you are using a system that has X windows running, you can use the command system-config-date, system-config-time, or dateconfig at a shell prompt (as root) to guide you through setting up the time.
The full documentation is available in man pages

man ntp

and at The Network Time Protocol (NTP) Distribution web site.
You should select from 2 to 4 time sources for your servers. You can get help finding servers at The Public NTP Servers List; a simple approach is to use the NTP Pool Servers (this is what the sipX ISO images use).
Essentially, you just need to add server lines to your /etc/ntp.conf configuration file. If your distribution has one, it's a good idea to configure the same servers in the /etc/ntp/step-tickers file (that is used to set the clock at boot time).

Using a local clock

If you do not have any access to a real NTP server and can't get one, you can still use NTP to synchronize your clocks locally. Pick one system to be your local time source, and install the ntp server there as above. Then look at that documentation in /usr/share/doc/ntp-*/drivers/driver1.html and set the "stratum number" on your chosen system to a lower number than your other systems (a lower number indicates a more precise clock). THen configure that system as the server for the others; even if that time is not strictly correct, at least all your systems will have the same incorrect time, which is better than having many different incorrect times.

To allow your system to be a server for others

Add the line as shown below to the standard /etc/ntp.conf configuration file. It allows access to the time source for other clients on the local LAN segment (here 192.168.5).

File: /etc/ntp.conf

# -- CLIENT NETWORK -------

# Permit systems on this network to synchronize with this

# time service.  Do not permit those systems to modify the

# configuration of this service.  Also, do not use those

# systems as peers for synchronization.

restrict 192.168.5.0 mask 255.255.255.0 nomodify notrap

Start the daemon

/sbin/service ntpd start

Important: After starting the ntp deamon it will be some time before its clock is sufficiently synchronized to provide a clock to the other clients on your network. If everything is properly configured, this will resolve itself. If you try to use the ntpdate command to set the time from some other system before the servers clock is sufficiently synchronized, you will see the error "ntpdate[10560]: no server suitable for synchronization found"

How to update the TimeZone files

Assuming you have ntpd installed and working properly...

 1. Login to the server as root.

 2. Stop ntpd: service ntpd stop

 3. Get the latest time zone files: wget ftp://elsie.nci.nih.gov/pub/tzdata2008a.tar.gz

       You might want to check the pub folder on elsie.nci.nih.gov for the most current timezone file.

 4. Expand: tar xzf tzdata2008a.tar.gz

 5. Remove the old localtime link: rm -f /etc/localtime

 6. Link to the proper timezone file (for me): ln -s /usr/share/zoneinfo/America/New_York /etc/localtime

 7. Restart ntpd: service ntpd start

How to Configure Clients

Phone Clients

SIP phones can be synchronized with an NTP server, but usually do not pick up the server address through DHCP. For sipX ConfigServer managed phones (i.e. Polycom, Snom, Cisco, Grandstream, and others) the NTP server address is configured as part of the phone's profile. Best practice is to create a device group for which the NTP server is set, so that it does not have to be set for every phone individually.

Windows NTP Clients

You can add your new NTP server to your Windows client. Here's how:

Click on the time at the bottom right hand side of your screen.
Click on the "Internet Time" tab of the dialog box
Click the check box labeled "Automatically synchronize with an Internet time server" and enter the name or IP address in the box underneath it.
Click on the "Update Now" button

You will get a message saying "Your time has been successfully synchronized" when the operation is complete.
Note: If your Windows 2000 or Windows XP system is part of a Windows Domain, then time synchronization is provided through the Windows domain controller and therefore the tab "Internet Time" is not available in the time dialog box.

DHCP Distribution of NTP Server Information

An NTP server address can be distributed as an option with the DHCP server. Some clients will pick it up automatically then when obtaining an IP address:

File: /etc/dhcpd.conf

 option ntp-servers            192.168.5.145;

Troubleshooting

The ntpq utility program is used to query NTP servers. You can use the following two commands to print a status of the server if executed on the ntpd host. Refer to the man pages of ntpq.

ntpq -p

echo rv | ntpq

This command can be executed on a Linux client to print the status of its clocks without actually updating the time (-q option).

ntpdate -q sipx.domain.com

date

FTP and VSFTPD in LINUX

2010-10-03T14:06:00.000+06:00

Introduction

The File Transfer Protocol (FTP) is used as one of the most common means of copying files between servers over the Internet. Most web based download sites use the built in FTP capabilities of web browsers and therefore most server oriented operating systems usually include an FTP server application as part of the software suite. Linux is no exception.

This chapter will show you how to convert your Linux box into an FTP server using the default Very Secure FTP Daemon (VSFTPD) package included in Fedora.

FTP Overview

FTP relies on a pair of TCP ports to get the job done. It operates in two connection channels as I'll explain:

FTP Control Channel, TCP Port 21: All commands you send and the ftp server's responses to those commands will go over the control connection, but any data sent back (such as "ls" directory lists or actual file data in either direction) will go over the data connection.

FTP Data Channel, TCP Port 20: This port is used for all subsequent data transfers between the client and server.

In addition to these channels, there are several varieties of FTP.

Types of FTP

From a networking perspective, the two main types of FTP are active and passive. In active FTP, the FTP server initiates a data transfer connection back to the client. For passive FTP, the connection is initiated from the FTP client. These are illustrated in Figure 15-1.

Figure 15-1 Active And Passive FTP Illustrated

From a user management perspective there are also two types of FTP: regular FTP in which files are transferred using the username and password of a regular user FTP server, and anonymous FTP in which general access is provided to the FTP server using a well known universal login method.

Take a closer look at each type.

Active FTP

The sequence of events for active FTP is:

1. Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as 'ls' and 'get' are sent over this connection.

2. Whenever the client requests data over the control connection, the server initiates data transfer connections back to the client. The source port of these data transfer connections is always port 20 on the server, and the destination port is a high port (greater than 1024) on the client.

3. Thus the ls listing that you asked for comes back over the port 20 to high port connection, not the port 21 control connection.

FTP active mode therefore transfers data in a counter intuitive way to the TCP standard, as it selects port 20 as it's source port (not a random high port that's greater than 1024) and connects back to the client on a random high port that has been pre-negotiated on the port 21 control connection.

Active FTP may fail in cases where the client is protected from the Internet via many to one NAT (masquerading). This is because the firewall will not know which of the many servers behind it should receive the return connection.

Passive FTP

Passive FTP works differently:

1. Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as ls and get are sent over that connection.

2. Whenever the client requests data over the control connection, the client initiates the data transfer connections to the server. The source port of these data transfer connections is always a high port on the client with a destination port of a high port on the server.

Passive FTP should be viewed as the server never making an active attempt to connect to the client for FTP data transfers. Because client always initiates the required connections, passive FTP works better for clients protected by a firewall.

As Windows defaults to active FTP, and Linux defaults to passive, you'll probably have to accommodate both forms when deciding upon a security policy for your FTP server.

Regular FTP

By default, the VSFTPD package allows regular Linux users to copy files to and from their home directories with an FTP client using their Linux usernames and passwords as their login credentials.

VSFTPD also has the option of allowing this type of access to only a group of Linux users, enabling you to restrict the addition of new files to your system to authorized personnel.

The disadvantage of regular FTP is that it isn't suitable for general download distribution of software as everyone either has to get a unique Linux user account or has to use a shared username and password. Anonymous FTP allows you to avoid this difficulty.

Anonymous FTP

Anonymous FTP is the choice of Web sites that need to exchange files with numerous unknown remote users. Common uses include downloading software updates and MP3s and uploading diagnostic information for a technical support engineers' attention. Unlike regular FTP where you login with a preconfigured Linux username and password, anonymous FTP requires only a username of anonymous and your email address for the password. Once logged in to a VSFTPD server, you automatically have access to only the default anonymous FTP directory (/var/ftp in the case of VSFTPD) and all its subdirectories.

Using anonymous FTP as a remote user is fairly straight forward. VSFTPD can be configured to support user-based and or anonymous FTP in its configuration file which you'll see later.

How To Download And Install VSFTPD

Most Linux software products are available in a precompiled package format. Downloading and installing packages isn't hard. It is best to use the latest version of VSFTPD.

When searching for the file, remember that the VSFTPD packages' filename usually starts with the word vsftpd followed by a version number, as in vsftpd-1.2.1-5.i386.rpm for Redhat/Fedora or vsftpd_2.0.4-0ubuntu4_i386.deb for Ubuntu.

How To Get VSFTPD Started

With Fedora, Redhat, Ubunbtu and Debian You can start, stop, or restart VSFTPD after booting by using these commands:

[root@bigboy tmp]# /etc/init.d/vsftpd start

[root@bigboy tmp]# /etc/init.d/vsftpd stop

[root@bigboy tmp]# /etc/init.d/vsftpd restart

With Redhat / Fedora you can configure VSFTPD to start at boot you can use the chkconfig command.

[root@bigboy tmp]# chkconfig vsftpd on

With Ubuntu / Debian the sysv-rc-conf command can be used like this:

root@u-bigboy:/tmp# sysv-rc-conf on

Testing the Status of VSFTPD

You can always test whether the VSFTPD process is running by using the netstat -a command which lists all the TCP and UDP ports on which the server is listening for traffic. This example shows the expected output.

[root@bigboy root]# netstat -a | grep ftp

tcp 0 0 *:ftp *:* LISTEN

[root@bigboy root]#

If VSFTPD wasn't running, there would be no output at all.

The vsftpd.conf File

VSFTPD only reads the contents of its vsftpd.conf configuration file only when it starts, so you'll have to restart VSFTPD each time you edit the file in order for the changes to take effect. The file may be located in either the /etc or the /etc/vsftpd directories depending on your Linux distribution.

This file uses a number of default settings you need to know about.

VSFTPD runs as an anonymous FTP server. Unless you want any remote user to log into to your default FTP directory using a username of anonymous and a password that's the same as their email address, I would suggest turning this off. The configuration file's anonymous_enable directive can be set to no to disable this feature. You'll also need to simultaneously enable local users to be able to log in by removing the comment symbol (#) before the local_enable instruction.
If you enable anonymous FTP with VSFTPD, remember to define the root directory that visitors will visit. This is done with the anon_root directive.

anon_root=/data/directory

VSFTPD allows only anonymous FTP downloads to remote users, not uploads from them. This can be changed by modifying the anon_upload_enable directive shown later.
VSFTPD doesn't allow anonymous users to create directories on your FTP server. You can change this by modifying the anon_mkdir_write_enable directive.
VSFTPD logs FTP access to the /var/log/vsftpd.log log file. You can change this by modifying the xferlog_file directive.
By default VSFTPD expects files for anonymous FTP to be placed in the /var/ftp directory. You can change this by modifying the anon_root directive. There is always the risk with anonymous FTP that users will discover a way to write files to your anonymous FTP directory. You run the risk of filling up your /var partition if you use the default setting. It is best to make the anonymous FTP directory reside in its own dedicated partition.

The configuration file is fairly straight forward as you can see in the snippet below where we enable anonymous FTP and individual accounts simultaneously.

# Allow anonymous FTP?

anonymous_enable=YES

...

# The directory which vsftpd will try to change

# into after an anonymous login. (Default = /var/ftp)

anon_root=/data/directory

...

# Uncomment this to allow local users to log in.

local_enable=YES

...

# Uncomment this to enable any form of FTP write command.

# (Needed even if you want local users to be able to upload files)

write_enable=YES

...

# Uncomment to allow the anonymous FTP user to upload files. This only

# has an effect if global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

...

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

...

# Activate logging of uploads/downloads.

xferlog_enable=YES

...

# You may override where the log file goes if you like.

# The default is shown below.

xferlog_file=/var/log/vsftpd.log

...

To activate or deactivate a feature, remove or add the # at the beginning of the appropriate line.

Other vsftpd.conf Options

There are many other options you can add to this file:

Limiting the maximum number of client connections (max_clients)
Limiting the number of connections by source IP address (max_per_ip)
The maximum rate of data transfer per anonymous login. (anon_max_rate)
The maximum rate of data transfer per non-anonymous login. (local_max_rate)

Descriptions on this and more can be found in the vsftpd.conf man pages.

FTP Security Issues

FTP has a number of security drawbacks, but you can overcome them in some cases. You can restrict an individual Linux user's access to non-anonymous FTP, and you can change the configuration to not display the FTP server's software version information, but unfortunately, though very convenient, FTP logins and data transfers are not encrypted.

The /etc/vsftpd.ftpusers File

For added security, you may restrict FTP access to certain users by adding them to the list of users in the /etc/vsftpd.ftpusers file. The VSFTPD package creates this file with a number of entries for privileged users that normally shouldn't have FTP access. As FTP doesn't encrypt passwords, thereby increasing the risk of data or passwords being compromised, it is a good idea to let these entries remain and add new entries for additional security.

Anonymous Upload

If you want remote users to write data to your FTP server, then you should create a write-only directory within /var/ftp/pub. This will allow your users to upload but not access other files uploaded by other users. The commands you need are:

[root@bigboy tmp]# mkdir /var/ftp/pub/upload

[root@bigboy tmp]# chmod 722 /var/ftp/pub/upload

FTP Greeting Banner

Change the default greeting banner in the vsftpd.conf file to make it harder for malicious users to determine the type of system you have. The directive in this file is.

ftpd_banner= New Banner Here

Using SCP As Secure Alternative To FTP

One of the disadvantages of FTP is that it does not encrypt your username and password. This could make your user account vulnerable to an unauthorized attack from a person eavesdropping on the network connection. Secure Copy (SCP) and Secure FTP (SFTP) provide encryption and could be considered as an alternative to FTP for trusted users. SCP does not support anonymous services, however, a feature that FTP does support.

Troubleshooting FTP

You should always test your FTP installation by attempting to use an FTP client to log in to your FTP server to transfer sample files.

The most common sources of day-to-day failures are incorrect usernames and passwords.

Initial setup failures could be caused by firewalls along the path between the client and server blocking some or all types of FTP traffic. Typical symptoms of this are either connection timeouts or the ability to use the ls command to view the contents of a directory without the ability to either upload or download files. Follow the firewall rule guidelines to help overcome this problem.

Tutorial

FTP has many uses, one of which is allowing numerous unknown users to download files. You have to be careful, because you run the risk of accidentally allowing unknown persons to upload files to your server. This sort of unintended activity can quickly fill up your hard drive with illegal software, images, and music for the world to download, which in turn can clog your server's Internet access and drive up your bandwidth charges.

FTP Users with Only Read Access to a Shared Directory

In this example, anonymous FTP is not desired, but a group of trusted users need to have read only access to a directory for downloading files. Here are the steps:

1) Disable anonymous FTP. Comment out the anonymous_enable line in the vsftpd.conf file like this:

# Allow anonymous FTP?

anonymous_enable=NO

2) Enable individual logins by making sure you have the local_enable line uncommented in the vsftpd.conf file like this:

# Uncomment this to allow local users to log in.

local_enable=YES

3) Start VSFTP.

[root@bigboy tmp]# service vsftpd start

4) Create a user group and shared directory. In this case, use /home/ftp-users and a user group name of ftp-users for the remote users

[root@bigboy tmp]# groupadd ftp-users

[root@bigboy tmp]# mkdir /home/ftp-docs

5) Make the directory accessible to the ftp-users group.

[root@bigboy tmp]# chmod 750 /home/ftp-docs

[root@bigboy tmp]# chown root:ftp-users /home/ftp-docs

6) Add users, and make their default directory /home/ftp-docs

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs user1

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs user2

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs user3

[root@bigboy tmp]# useradd -g ftp-users -d /home/ftp-docs user4

[root@bigboy tmp]# passwd user1

[root@bigboy tmp]# passwd user2

[root@bigboy tmp]# passwd user3

[root@bigboy tmp]# passwd user4

7) Copy files to be downloaded by your users into the /home/ftp-docs directory

8) Change the permissions of the files in the /home/ftp-docs directory for read only access by the group

[root@bigboy tmp]# chown root:ftp-users /home/ftp-docs/*

[root@bigboy tmp]# chmod 740 /home/ftp-docs/*

Users should now be able to log in via FTP to the server using their new usernames and passwords. If you absolutely don't want any FTP users to be able to write to any directory, then you should set the write_enable line in your vsftpd.conf file to no:

write_enable = NO

Remember, you must restart VSFTPD for the configuration file changes to take effect.

Sample Login Session To Test Functionality

Here is a simple test procedure you can use to make sure everything is working correctly:

1) Check for the presence of a test file on the ftp client server.

[root@smallfry tmp]# ll

total 1

-rw-r--r-- 1 root root 0 Jan 4 09:08 testfile

[root@smallfry tmp]#

2) Connect to bigboy via FTP

[root@smallfry tmp]# ftp 192.168.1.100

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100:root): user1

331 Please specify the password.

Password:

230 Login successful. Have fun.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

As expected, we can't do an upload transfer of testfile to bigboy.

ftp> put testfile

local: testfile remote: testfile

227 Entering Passive Mode (192,168,1,100,181,210)

553 Could not create file.

ftp>

But we can view and download a copy of the VSFTPD RPM located on the FTP server bigboy.

ftp> ls

227 Entering Passive Mode (192,168,1,100,35,173)

150 Here comes the directory listing.

-rwxr----- 1 0 502 76288 Jan 04 17:06 vsftpd-1.1.0-1.i386.rpm

226 Directory send OK.

ftp> get vsftpd-1.1.0-1.i386.rpm vsftpd-1.1.0-1.i386.rpm.tmp

local: vsftpd-1.1.0-1.i386.rpm.tmp remote: vsftpd-1.1.0-1.i386.rpm

227 Entering Passive Mode (192,168,1,100,44,156)

150 Opening BINARY mode data connection for vsftpd-1.1.0-1.i386.rpm (76288 bytes).

226 File send OK.

76288 bytes received in 0.499 secs (1.5e+02 Kbytes/sec)

ftp> exit

221 Goodbye.

[root@smallfry tmp]#

As expected, anonymous FTP fails.

[root@smallfry tmp]# ftp 192.168.1.100

Connected to 192.168.1.100 (192.168.1.100)

220 ready, dude (vsFTPd 1.1.0: beat me, break me)

Name (192.168.1.100:root): anonymous

331 Please specify the password.

Password:

530 Login incorrect.

ftp> quit

221 Goodbye.

[root@smallfry tmp]#

Now that testing is complete, you can make this a regular part of your FTP server's operation.

Conclusion

FTP is a very useful software application that can have enormous benefit to a Web site or to collaborative computing in which files need to be shared between business partners. Although insecure, it is universally accessible, because FTP clients are a part of all operating systems and Web browsers. If data encryption security is of great importance to you, then you should probably consider SCP as a possible alternative.

RAID in LINUX

2010-10-03T13:55:00.001+06:00

Introduction

The main goals of using redundant arrays of inexpensive disks (RAID) are to improve disk data performance and provide data redundancy.

RAID can be handled either by the operating system software or it may be implemented via a purpose built RAID disk controller card without having to configure the operating system at all. This chapter will explain how to configure the software RAID schemes supported by RedHat/Fedora Linux.

For the sake of simplicity, the chapter focuses on using RAID for partitions that include neither the /boot or the root (/) filesystems.

RAID Types

Whether hardware- or software-based, RAID can be configured using a variety of standards. Take a look at the most popular.

Linear Mode RAID

In the Linear RAID, the RAID controller views the RAID set as a chain of disks. Data is written to the next device in the chain only after the previous one is filled.

The aim of Linear RAID is to accommodate large filesystems spread over multiple devices with no data redundancy. A drive failure will corrupt your data.

Linear mode RAID is not supported by Fedora Linux.

RAID 0

With RAID 0, the RAID controller tries to evenly distribute data across all disks in the RAID set.

Envision a disk as if it were a plate, and think of the data as a cake. You have four cakes- chocolate, vanilla, cherry and strawberry-and four plates. The initialization process of RAID 0, divides the cakes and distributes the slices across all the plates. The RAID 0 drivers make the operating system feel that the cakes are intact and placed on one large plate. For example, four 9GB hard disks configured in a RAID 0 set are seen by the operating system to be one 36GB disk.

Like Linear RAID, RAID 0 aims to accommodate large filesystems spread over multiple devices with no data redundancy. The advantage of RAID 0 is data access speed. A file that is spread over four disks can be read four times as fast. You should also be aware that RAID 0 is often called striping.

RAID 0 can accommodate disks of unequal sizes. When RAID runs out of striping space on the smallest device, it then continues the striping using the available space on the remaining drives. When this occurs, the data access speed is lower for this portion of data, because the total number of RAID drives available is reduced. For this reason, RAID 0 is best used with drives of equal size.

RAID 0 is supported by Fedora Linux. Figure 26.1 illustrates the data allocation process in RAID 0.

RAID 1

With RAID 1, data is cloned on a duplicate disk. This RAID method is therefore frequently called disk mirroring. Think of telling two people the same story so that if one forgets some of the details you can ask the other one to remind you.

When one of the disks in the RAID set fails, the other one continues to function. When the failed disk is replaced, the data is automatically cloned to the new disk from the surviving disk. RAID 1 also offers the possibility of using a hot standby spare disk that will be automatically cloned in the event of a disk failure on any of the primary RAID devices.

RAID 1 offers data redundancy, without the speed advantages of RAID 0. A disadvantage of software-based RAID 1 is that the server has to send data twice to be written to each of the mirror disks. This can saturate data busses and CPU use. With a hardware-based solution, the server CPU sends the data to the RAID disk controller once, and the disk controller then duplicates the data to the mirror disks. This makes RAID-capable disk controllers the preferred solution when implementing RAID 1.

A limitation of RAID 1 is that the total RAID size in gigabytes is equal to that of the smallest disk in the RAID set. Unlike RAID 0, the extra space on the larger device isn't used.

RAID 1 is supported by Fedora Linux. Figure 26.1 illustrates the data allocation process in RAID 1.

Figure 26-1 RAID 0 And RAID 1 Operation

RAID 4

RAID 4 operates likes RAID 0 but inserts a special error-correcting or parity chunk on an additional disk dedicated to this purpose.

RAID 4 requires at least three disks in the RAID set and can survive the loss of a single drive only. When this occurs, the data in it can be recreated on the fly with the aid of the information on the RAID set's parity disk. When the failed disk is replaced, it is repopulated with the lost data with the help of the parity disk's information.

RAID 4 combines the high speed provided of RAID 0 with the redundancy of RAID 1. Its major disadvantage is that the data is striped, but the parity information is not. In other words, any data written to any section of the data portion of the RAID set must be followed by an update of the parity disk. The parity disk can therefore act as a bottleneck. For this reason, RAID 4 isn't used very frequently.

RAID 4 is not supported by Fedora Linux.

RAID 5

RAID 5 improves on RAID 4 by striping the parity data between all the disks in the RAID set. This avoids the parity disk bottleneck, while maintaining many of the speed features of RAID 0 and the redundancy of RAID 1. Like RAID 4, RAID 5 can survive the loss of a single disk only.

RAID 5 is supported by Fedora Linux. Figure 26.2 illustrates the data allocation process in RAID 5.

Linux RAID 5 requires a minimum of three disks or partitions.

Figure 26-2 RAID 5 Operation

Before You Start

Specially built hardware-based RAID disk controllers are available for both IDE and SCSI drives. They usually have their own BIOS, so you can configure them right after your system's the power on self test (POST). Hardware-based RAID is transparent to your operating system; the hardware does all the work.

If hardware RAID isn't available, then you should be aware of these basic guidelines to follow when setting up software RAID.

IDE Drives

To save costs, many small business systems will probably use IDE disks, but they do have some limitations.

The total length of an IDE cable can be only a few feet long, which generally limits IDE drives to small home systems.
IDE drives do not hot swap. You cannot replace them while your system is running.
Only two devices can be attached per controller.
The performance of the IDE bus can be degraded by the presence of a second device on the cable.
The failure of one drive on an IDE bus often causes the malfunctioning of the second device. This can be fatal if you have two IDE drives of the same RAID set attached to the same cable.

For these reasons, I recommend you use only one IDE drive per controller when using RAID, especially in a corporate environment. In a home or SOHO setting, IDE-based software RAID may be adequate.

Serial ATA Drives

Serial ATA type drives are rapidly replacing IDE, or Ultra ATA, drives as the preferred entry level disk storage option because of a number of advantages:

The drive data cable can be as long as 1 meter in length versus IDE's 18 inches.
Serial ATA has better error checking than IDE.
There is only one drive per cable which makes hot swapping, or the capability to replace components while the system is still running, possible without the fear of affecting other devices on the data cable.
There are no jumpers to set on Serial ATA drives to make it a master or slave which makes them simpler to configure.
IDE drives have a 133Mbytes/s data rate whereas the Serial ATA specification starts at 150 Mbytes/sec with a goal of reaching 600 Mbytes/s over the expected ten year life of the specification.

If you can't afford more expensive and faster SCSI drives, Serial ATA would be the preferred device for software and hardware RAID

SCSI Drives

SCSI hard disks have a number of features that make them more attractive for RAID use than either IDE or Serial ATA drives.

SCSI controllers are more tolerant of disk failures. The failure of a single drive is less likely to disrupt the remaining drives on the bus.
SCSI cables can be up to 25 meters long, making them suitable for data center applications.
Much more than two devices may be connected to a SCSI cable bus. It can accommodate 7 (single-ended SCSI) or 15 (all other SCSI types) devices.
Some models of SCSI devices support "hot swapping" which allows you to replace them while the system is running.
SCSI currently supports data rates of up to 640 Mbytes/s making them highly desirable for installations where rapid data access is imperative.

SCSI drives tend to be more expensive than IDE drives, however, which may make them less attractive for home use.

Should I Use Software RAID Partitions Or Entire Disks?

It is generally a not a good idea to share RAID-configured partitions with non-RAID partitions. The reason for this is obvious: A disk failure could still incapacitate a system.

If you decide to use RAID, all the partitions on each RAID disk should be part of a RAID set. Many people simplify this problem by filling each disk of a RAID set with only one partition.

Backup Your System First

Software RAID creates the equivalent of a single RAID virtual disk drive made up of all the underlying regular partitions used to create it. You have to format this new RAID device before your Linux system can store files on it. Formatting, however, causes all the old data on the underlying RAID partitions to be lost. It is best to backup the data on these and any other partitions on the disk drive on which you want implement RAID. A mistake could unintentionally corrupt valid data.

Configure RAID In Single User Mode

As you will be modifying the disk structure of your system, you should also consider configuring RAID while your system is running in single-user mode from the VGA console. This makes sure that most applications and networking are shutdown and that no other users can access the system, reducing the risk of data corruption during the exercise.

[root@bigboy tmp]# init 1

Once finished, issue the exit command, and your system will boot in the default runlevel provided in the /etc/inittab file.

Configuring Software RAID

Configuring RAID using Fedora Linux requires a number of steps that need to be followed carefully. In the tutorial example, you'll be configuring RAID 5 using a system with three pre-partitioned hard disks. The partitions to be used are:

/dev/hde1

/dev/hdf2

/dev/hdg1

Be sure to adapt the various stages outlined below to your particular environment.

RAID Partitioning

You first need to identify two or more partitions, each on a separate disk. If you are doing RAID 0 or RAID 5, the partitions should be of approximately the same size, as in this scenario. RAID limits the extent of data access on each partition to an area no larger than that of the smallest partition in the RAID set.

Determining Available Partitions

First use the fdisk -l command to view all the mounted and unmounted filesystems available on your system. You may then also want to use the df -k command, which shows only mounted filesystems but has the big advantage of giving you the mount points too.

These two commands should help you to easily identify the partitions you want to use. Here is some sample output of these commands.

[root@bigboy tmp]# fdisk -l

Disk /dev/hda: 12.0 GB, 12072517632 bytes

255 heads, 63 sectors/track, 1467 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System

/dev/hda1 * 1 13 104391 83 Linux

/dev/hda2 14 144 1052257+ 83 Linux

/dev/hda3 145 209 522112+ 82 Linux swap

/dev/hda4 210 1467 10104885 5 Extended

/dev/hda5 210 655 3582463+ 83 Linux

...

/dev/hda15 1455 1467 104391 83 Linux

[root@bigboy tmp]#

[root@bigboy tmp]# df -k

Filesystem 1K-blocks Used Available Use% Mounted on

/dev/hda2 1035692 163916 819164 17% /

/dev/hda1 101086 8357 87510 9% /boot

/dev/hda15 101086 4127 91740 5% /data1

...

/dev/hda7 5336664 464228 4601344 10% /var

[root@bigboy tmp]#

Unmount the Partitions

You don't want anyone else accessing these partitions while you are creating the RAID set, so you need to make sure they are unmounted.

[root@bigboy tmp]# umount /dev/hde1

[root@bigboy tmp]# umount /dev/hdf2

[root@bigboy tmp]# umount /dev/hdg1

Prepare The Partitions With FDISK

You have to change each partition in the RAID set to be of type FD (Linux raid autodetect), and you can do this with fdisk. Here is an example using /dev/hde1.

[root@bigboy tmp]# fdisk /dev/hde

The number of cylinders for this disk is set to 8355.

There is nothing wrong with that, but this is larger than 1024,

and could in certain setups cause problems with:

1) software that runs at boot time (e.g., old versions of LILO)

2) booting and partitioning software from other OSs

(e.g., DOS FDISK, OS/2 FDISK)

Command (m for help):

Use FDISK Help

Now use the fdisk m command to get some help:

Command (m for help): m

...

p print the partition table

q quit without saving changes

s create a new empty Sun disklabel

t change a partition's system id

...

Command (m for help):

Set The ID Type

Partition /dev/hde1 is the first partition on disk /dev/hde. Modify its type using the t command, and specify the partition number and type code. You also should use the L command to get a full listing of ID types in case you forget. In this case, RAID uses type fd, it may be different for your version of Linux.

Command (m for help): t

Partition number (1-5): 1

Hex code (type L to list codes): L

...

16 Hidden FAT16 61 SpeedStor f2 DOS secondary

17 Hidden HPFS/NTF 63 GNU HURD or Sys fd Linux raid auto

18 AST SmartSleep 64 Novell Netware fe LANstep

1b Hidden Win95 FA 65 Novell Netware ff BBT

Hex code (type L to list codes): fd

Changed system type of partition 1 to fd (Linux raid autodetect)

Command (m for help):

Make Sure The Change Occurred

Use the p command to get the new proposed partition table:

Command (m for help): p

Disk /dev/hde: 4311 MB, 4311982080 bytes

16 heads, 63 sectors/track, 8355 cylinders

Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System

/dev/hde1 1 4088 2060320+ fd Linux raid autodetect

/dev/hde2 4089 5713 819000 83 Linux

/dev/hde4 6608 8355 880992 5 Extended

/dev/hde5 6608 7500 450040+ 83 Linux

/dev/hde6 7501 8355 430888+ 83 Linux

Command (m for help):

Save The Changes

Use the w command to permanently save the changes to disk /dev/hde:

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table.

The new table will be used at the next reboot.

Syncing disks.

[root@bigboy tmp]#

The error above will occur if any of the other partitions on the disk is mounted.

Repeat For The Other Partitions

For the sake of brevity, I won't show the process for the other partitions. It's enough to know that the steps for changing the IDs for /dev/hdf2 and /dev/hdg1 are very similar.

Preparing the RAID Set

Now that the partitions have been prepared, we have to merge them into a new RAID partition that we'll then have to format and mount. Here's how it's done.

Create the RAID Set

You use the mdadm command with the --create option to create the RAID set. In this example we use the --level option to specify RAID 5, and the --raid-devices option to define the number of partitions to use.

[root@bigboy tmp]# mdadm --create --verbose /dev/md0 --level=5 \

--raid-devices=3 /dev/hde1 /dev/hdf2 /dev/hdg1

mdadm: layout defaults to left-symmetric

mdadm: chunk size defaults to 64K

mdadm: /dev/hde1 appears to contain an ext2fs file system

size=48160K mtime=Sat Jan 27 23:11:39 2007

mdadm: /dev/hdf2 appears to contain an ext2fs file system

size=48160K mtime=Sat Jan 27 23:11:39 2007

mdadm: /dev/hdg1 appears to contain an ext2fs file system

size=48160K mtime=Sat Jan 27 23:11:39 2007

mdadm: size set to 48064K

Continue creating array? y

mdadm: array /dev/md0 started.

[root@bigboy tmp]#

Confirm RAID Is Correctly Inititalized

The /proc/mdstat file provides the current status of all RAID devices. Confirm that the initialization is finished by inspecting the file and making sure that there are no initialization related messages. If there are, then wait until there are none.

[root@bigboy tmp]# cat /proc/mdstat

Personalities : [raid5]

read_ahead 1024 sectors

md0 : active raid5 hdg1[2] hde1[1] hdf2[0]

4120448 blocks level 5, 32k chunk, algorithm 3 [3/3] [UUU]

unused devices:

[root@bigboy tmp]#

Notice that the new RAID device is called /dev/md0. This information will be required for the next step.

Format The New RAID Set

Your new RAID partition now has to be formatted. The mkfs.ext3 command is used to do this.

[root@bigboy tmp]# mkfs.ext3 /dev/md0

mke2fs 1.39 (29-May-2006)

Filesystem label=

OS type: Linux

Block size=1024 (log=0)

Fragment size=1024 (log=0)

36144 inodes, 144192 blocks

7209 blocks (5.00%) reserved for the super user

First data block=1

Maximum filesystem blocks=67371008

18 block groups

8192 blocks per group, 8192 fragments per group

2008 inodes per group

Superblock backups stored on blocks:

8193, 24577, 40961, 57345, 73729

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 33 mounts or

180 days, whichever comes first. Use tune2fs -c or -i to override.

[root@bigboy tmp]#

Create the mdadm.conf Configuration File

Your system doesn't automatically remember all the component partitions of your RAID set. This information has to be kept in the mdadm.conf file. The formatting can be tricky, but fortunately the output of the mdadm --detail --scan --verbose command provides you with it. Here we see the output sent to the screen.

[root@bigboy tmp]# mdadm --detail --scan --verbose

ARRAY /dev/md0 level=raid5 num-devices=4

UUID=77b695c4:32e5dd46:63dd7d16:17696e09

devices=/dev/hde1,/dev/hdf2,/dev/hdg1

[root@bigboy tmp]#

Here we export the screen output to create the configuration file.

[root@bigboy tmp]# mdadm --detail --scan --verbose > /etc/mdadm.conf

Create A Mount Point For The RAID Set

The next step is to create a mount point for /dev/md0. In this case we'll create one called /mnt/raid

[root@bigboy mnt]# mkdir /mnt/raid

Edit The /etc/fstab File

The /etc/fstab file lists all the partitions that need to mount when the system boots. Add an Entry for the RAID set, the /dev/md0 device.

/dev/md0 /mnt/raid ext3 defaults 1 2

Do not use labels in the /etc/fstab file for RAID devices; just use the real device name, such as /dev/md0. In older Linux versions, the /etc/rc.d/rc.sysinit script would check the /etc/fstab file for device entries that matched RAID set names listed in the now unused /etc/raidtab configuration file. The script would not automatically start the RAID set driver for the RAID set if it didn't find a match. Device mounting would then occur later on in the boot process. Mounting a RAID device that doesn't have a loaded driver can corrupt your data and produce this error.

Starting up RAID devices: md0(skipped)

Checking filesystems

/raiddata: Superblock has a bad ext3 journal(inode8)

CLEARED.

***journal has been deleted - file system is now ext 2 only***

/raiddata: The filesystem size (according to the superblock) is 2688072 blocks.

The physical size of the device is 8960245 blocks.

Either the superblock or the partition table is likely to be corrupt!

/boot: clean, 41/26104 files, 12755/104391 blocks

/raiddata: UNEXPECTED INCONSISTENCY; Run fsck manually (ie without -a or -p options).

If you are not familiar with the /etc/fstab file use the man fstab command to get a comprehensive explanation of each data column it contains.

The /dev/hde1, /dev/hdf2, and /dev/hdg1 partitions were replaced by the combined /dev/md0 partition. You therefore don't want the old partitions to be mounted again. Make sure that all references to them in this file are commented with a # at the beginning of the line or deleted entirely.

#/dev/hde1 /data1 ext3 defaults 1 2

#/dev/hdf2 /data2 ext3 defaults 1 2

#/dev/hdg1 /data3 ext3 defaults 1 2

Mount The New RAID Set

Use the mount command to mount the RAID set. You have your choice of methods:

The mount command's -a flag causes Linux to mount all the devices in the /etc/fstab file that have automounting enabled (default) and that are also not already mounted.

[root@bigboy tmp]# mount -a

You can also mount the device manually.

[root@bigboy tmp]# mount /dev/md0 /mnt/raid

Check The Status Of The New RAID

The /proc/mdstat file provides the current status of all the devices.

[root@bigboy tmp]# raidstart /dev/md0

[root@bigboy tmp]# cat /proc/mdstat

Personalities : [raid5]

read_ahead 1024 sectors

md0 : active raid5 hdg1[2] hde1[1] hdf2[0]

4120448 blocks level 5, 32k chunk, algorithm 3 [3/3] [UUU]

unused devices:

[root@bigboy tmp]#

Conclusion

Linux software RAID provides redundancy across partitions and hard disks, but it tends to be slower and less reliable than RAID provided by a hardware-based RAID disk controller.

Hardware RAID configuration is usually done via the system BIOS when the server boots up, and once configured, it is absolutely transparent to Linux. Unlike software RAID, hardware RAID requires entire disks to be dedicated to the purpose and when combined with the fact that it usually requires faster SCSI hard disks and an additional controller card, it tends to be expensive.

Remember to take these factors into consideration when determining the right solution for your needs and research the topic thoroughly before proceeding. Weighing cost versus reliability is always a difficult choice in systems administration.

LVM in Linux ( RHEL CENTOS UBUNTU DEBIAN )

2010-10-03T13:42:00.001+06:00

Make four partitions of size 100M, 50M, 75M and 150M with partition ID 8e. 8e is the ID of LVM type partition.

Suppose the newly created partitions are: /dev/hda10, /dev/hda11, /dev/hda12, /dev/hda13.

Now create Physical Volume:

#pvcreate /dev/hda10

#pvcreate /dev/hda11

#pvcreate /dev/hda12

#pvcreate /dev/hda13

To check status of pv:

#pvscan

#pvdisplay

Now create volume group:

#vgcreate vg01 /dev/hda10 /dev/hda11

#vgcreate vg02 /dev/hda12 /dev/hda13

To check status of vg:

#vgscan

#vgdisplay

Now create logical volume:

#lvcreate --name lv1 --size 110M vg01

#lvcreate --name lv2 --size 170M vg02

To check status of lv:

#lvscan

#lvdisplay

Now need to format these newly created logical volume with ext3 filesystem

#mkfs.ext3 /dev/vg01/lv1

#mkfs.ext3 /dev/vg02/lv2

Now mount the logical volumes to folder:

#mkdir /raidtest1

#mkdir /raidtest2

# mount /dev/vg01/lv1 /raidtest1

#mount /dev/vg02/lv2 /raidtest2

#df –h

Now we will extend or reduce our volume size: (Unmount first)

For extending:

#umount /raidtest1

#lvextend -L +15M /dev/vg01/lv1

#e2fsck -f /dev/vg01/lv1

#resize2fs /dev/vg01/lv1

For reducing:

#umount /raidtest2

#dumpefs /dev/vg02/lv2 | grep –I ‘Block size’

#e2fsck -f /dev/vg02/lv2

#resize2fs /dev/vg02/lv2 143360

#lvreduce -L -140M /dev/vg02/lv2

Other commands(need to delete associated lv first to do something on vg, need to delete associated vg fisrt to do something on pv):

#lvrename vg01 lv1 lv3

#lvrename vg02 lv2 lv4

#lvremove /dev/vg01/lv3

#lvremove /dev/vg02/lv4

#vgrename vg01 vg03

#vgrename vg02 vg04

#vgremove vg03

#vgremove vg04

#pvremove /dev/hda10

#pvremove /dev/hda11

#pvremove /dev/hda12

#pvremove /dev/hda14

RHCE EXAM PART 3 (IP FORWARDING & LINUX ROUTER)

2010-01-21T17:15:00.000+06:00

You will be asked to make your machine able to forward IP and act like a router.
To do this:

# cat /proc/sys/net/ipv4/ip_forward

If the returned value is 0 that means IP forwarding is disabled.

Then

# echo 1 > /proc/sys/net/ipv4/ip_forward

This will make IP forwarding active temporarily

To make it permanent
# vim /etc/sysctl.conf
net.ipv4.ip_forward=1

And done.

RHCE EXAM PART 2 (NETWORK SETUP)

2010-01-20T18:50:00.001+06:00

AT the beginning your exam pc will get IP from DHCP server.

But for the exam you have to change the IP manually and set to the static mode.

Example:

# ifconfig –a

This command will show your current IP configuration

Now to change

1^st Method

# cd /etc/sysconfig/network-scripts/

# vim ifcfg-eth0

Initially this file will be look like this:

DEVICE=eth0

BOOTPROTO=dhcp

HWADDR=00:1E:68:9B:30:CB

ONBOOT=yes

But you have to change as per the exam requirement.

DEVICE=eth0

BOOTPROTO=static

HWADDR=00:1E:68:9B:30:CB

ONBOOT=yes

IPADDR=172.24.0.10

NETMASK=255.255.0.0

NETWORK=172.24.0.0

BROADCAST=172.0.255.255

To change DNS info

# vim /etc/resolv.conf

Add/change this line

nameserver 172.24.0.254

Remember initially you may get an IP of class A but the examiner may give an IP of class B.

2^nd Method

# system-config-network

And give the IP information.

To check your hostname

# hostname –fqdn

To change hostname temporarily

# hostname station10.example.com

To change hostname permanently

# vim /etc/hosts

Add/change this line

172.24.0.10 station10.example.com station10

# vim /etc/sysconfig/network

Add/change this line

HOSTNAME=station10.example.com

Thanks and don't forget to click some adds.

RHCE EXAM PART 1 (root password and single user mode)

2010-01-20T16:16:00.001+06:00

At the very beginning examiner will give you a work station with rhel-5.3 installed.
He will not tell you the password of root account.
To access your work station you have to login in single user mode and change the password of your own.
Which, you will have to change afterward.

After seat for the exam reboot your machine and when the first boot screen appears press 'b' before countdown goes to 0 seconds.
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot1stpage.jpg

Then the another screen will appear and select the line stated “Redhat Enterprize Linux Server –(xxxx)”
Select that line and press 'e'.
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot2ndpage.jpg

Then the following screen will appear select the “Kernel /vmlinuz ---XXX” line and press 'e'.
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot3rdpage.jpg

Then write the word 'single' after a space at the end of the line
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot4thpage.jpg

Then press 'enter' button of your keyboard.
Then press 'b'
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot4thpage.jpg

Machine will now booted into single user mode
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot5thpage.jpg

Now type:
Sh-3.1# passwd
And give your password twice
And type 'reboot'
http://i1020.photobucket.com/albums/af322/rajronju/RHCE%20EXAM/boot6thpage.jpg

Then press enter

Now machine will boot normally and you can login with the password that you have just given.
After login you will see a page where you have to put your name
(please check the name as exactly waht you want to see on your RHCE certificate) and email id.
Then a password will be generated automatically in a text file at your desktop.
Where, you will find the root password for the exam. Just change the root password as told in the file. Example:
Suppose you have set a password redhat by using single user mode.
But the file says your password will be hatred.

#passwd
And type 'hatred' twice.

Note: In redhat linux e means edit, b means boot. Your should give your valid email id on the user form. Please try to use gmail cause sometimes yahoo and hotmail bounce the mail from redhat or put it to junk folder. Cause you pass or fail redhat will send you a mail. And also check the spelling of your name. I think you wont like to get a online certificate with misspelled name.

And last, please click some of the adds on my blog. This will generate some money for me via adsense.

That is the first part of the RHCE. Next I will post about network setup of RHCE exam.

Thanks.

RHCT and RHCE Exam questions and answer

2010-01-19T10:42:00.001+06:00

From now on i will try to post some RHCT and RHCE questions, their answers and related configuration.

Wait for the first post.

Thanks

RHEL / Fedora BIND DNS - Primary Slave Howto

2010-01-13T14:17:00.003+06:00

Introduction:

================================================

Berkeley Internet Name Domain is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. Supported by Internet Systems Consortium. BIND was originally created by four graduate students with CSRG at the University of California, Berkeley and first released with 4.3BSD. Paul Vixie started maintaining it in 1988 while working for DEC.

History:

================================================

BIND was originally written in the early 1980s under a DARPA grant. In the mid-1980s, DEC employees took over BIND development. One of these employees was Paul Vixie, who continued to work on BIND after leaving DEC. He eventually helped start the ISC, which became the entity responsible for maintaining BIND.

The development of BIND 9 was done with a combination of commercial and military contracts. Most of the features of BIND 9 were funded by UNIX vendors who wanted to ensure that BIND stayed competitive with Microsoft's DNS offerings; the DNSSEC features were funded by the US military who felt that DNS security was important.

Things Covered:

================================================

• Two DNS Servers (Master and Slave) [Internal External]

• Internal DNS server exists on private non-routable network (192.168.X.X)

• External DNS server is visible to the internet (142.25.97.X)

• Internal DNS server has three private computer A record entries (mythical)

• Internal DNS server receives updates from external master server (every 3 hours)

• External DNS server does not contain internal A record entries

• Internal Server is not to be visible/routable on the internet

• External DNS server contains all entries for Apache Sites #1 - #7 (site1, site2)

• Restrict recursive queries from people not within the 142 network

• The DNS server must run in a chroot environment where it is secure

• External DNS server is configured to update slave (internal server)

• A veritas backup of your DNS server

Network Configuration:

================================================

-1 Linksys run of the mill router

-2 RHEL 5 machines that will act as primary and secondary DNS

-2 Optional machines that will act as end users or apache servers on the primary network and the secondary.(142.25.97.90 and 10.0.0.20 respectively)

Primary DNS servers IP is 142.25.97.89 and has the fully qualified domain name of ns.orangespike.ca

Secondary DNS servers IP is 10.0.0.10 and has the fully qualified domain name of slave.orangespike.ca

The gateway for the router is 142.25.97.40 and is port forwarding 53 UDP/TCP to the secondary DNS.

Installation:

================================================

yum install bind*
yum install caching-nameserver

(If you do not know how to yum , that is a different issueJ)

vi etc/hosts and add the following entry ( IP and qualified domain name of that server ):

142.25.97.89 ns.orangespike.ca

Next, set the static IP with utility setup from terminal and check the following file:

vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

HWADDR=MAC address of adapter

ONBOOT=yes

NETMASK=255.255.255.0

IPADDR=142.25.97.89

GATEWAY=142.25.97.254

TYPE=Ethernet

Now go to /var/named/chroot/etc/ and do a ls -la

You should see about three or four files: localtime, named.conf, named.rfc1912.zones, rndc.key

Note if there is no named.conf, and you have a named.caching-nameserver.conf use cp to create a named.conf in the terminal by:

cp named.caching-nameserver.conf named.conf

Goto /var/named/chroot/var/named/ and touch the following files:

touch orangespike.com.zone
touch orangespike.com.rev.zone

Do a ls -la notice that they are owned by the wrong user. Correct this:

chown root:named orangespike*

Zone Record Creation:

================================================

Lets enter and create the zone file:

vi /var/named/chroot/var/named/orangespike.com.zone

$ORIGIN orangespike.com.

$TTL 3600 @ IN SOA ns.orangespike.ca. root.localhost. (

2008020403 ; Serial 4char year 2mm 2dd 2vv

10800 ; REFRESH

10800 ; retry after 3 hours which forces it on the slave

604800 ; expire after 1 week

86400 ) ; minimum TTL of 1 day orangespike.com. IN NS ns.orangespike.ca. ;note orangespike.com. IN A 142.25.97.90

www IN A 142.25.97.90

site1.orangespike.com. IN A 142.25.97.90

site2.orangespike.com. IN A 142.25.97.90

localhost A 127.0.0.1

Reverse Zone Record Creation:

================================================

Enter and create the reverse zone file:

vi /var/named/chroot/var/named/orangespike.com.rev.zone

$ORIGIN 97.25.142.in-addr.arpa. ;

$TTL 86400 @ IN SOA ns.orangespike.ca. root.localhost. (

2008020402 ; serial

10800 ; REFRESH 3 hour

10800 ; retry after 3 hours

604800 ; expire after 1 week

86400) ; Min TTL of 1 day 97.25.142.in-addr.arpa. NS ns.orangespike.ca.

90.97.25.142.in-addr.arpa. IN PTR orangespike.com.

Edit The Primary named.conf File:

================================================

vi /var/named/chroot/etc/named.conf

//DNS PRIMARY SERVER

acl good-hosts {

142.25.97.0/24;

10.0.0.0/24;

127.0.0.0/8;

};

options {

listen-on port 53 {142.25.97.89; 127.0.0.1; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

listen-on { 142.25.97.89; 127.0.0.1; };

allow-transfer { 10.0.0.10; 142.25.97.40; 127.0.0.1; };

allow-recursion { 10.0.0.10/24; 142.25.97.0/24; 127.0.0.1; };

forwarders { 142.25.97.254; 142.25.115.12; 142.25.115.1; 127.0.0.1; };

};

controls {

inet 127.0.0.1 allow { localhost; } keys { rndckey; };

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

zone "." IN {

type hint;

file "named.ca";

};

zone "orangespike.com." IN {

type master;

notify no;

allow-query { any; };

file "orangespike.com.zone";

allow-transfer {142.25.115.12; 142.25.97.40; 127.0.0.1; };

allow-update { 142.25.115.12; 142.25.97.40; 127.0.0.1; };

};

zone "97.25.142.in-addr.arpa." IN {

type master;

notify no;

file "orangespike.com.rev.zone";

allow-transfer {142.25.115.12; 142.25.97.40; 127.0.0.1; };

allow-update {142.25.115.12; 142.25.97.40; 127.0.0.1; };

};

include "/etc/named.rfc1912.zones";

include "/etc/rndc.key";

Testing:

================================================

On another machine on the same network as the Primary the output for nslookup should look similar to below:

orangespike.com

Server: 142.25.97.254

Address: 142.25.97.254#53

Non-authoritative answer:

Name: orangespike.com

Address: 142.25.97.90

The output of dig should look similar to this:

; <<>> DiG 9.3.3rc2 <<>> orangespike.com

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23820

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;orangespike.com. IN A

;; ANSWER SECTION:

orangespike.com. 3047 IN A 142.25.97.90

;; Query time: 3 msec

;; SERVER: 142.25.97.254#53(142.25.97.254)

;; WHEN: Tue Feb 5 15:33:45 2008

;; MSG SIZE rcvd: 49

On the actual Primary server if you use those two commands they may not work correctly, except for nslookup within reason. It will use its loopback address or localhost address.

NOTE::: this is not great for testing on the secondary slave server.

Secondary Slave Name Server Configuration And named.conf:

================================================

On a second machine on the private network install bind and packages like the above primary server and prepare named.conf again like previous.

Set the static IP with the setup command again, but to an IP that is behind and on that LAN.

Continuing on, make the following simple changes. Its pretty self explanitory, but one major note is the bottom of this conf file. The masters, and slave keywords establish the relationship with the master server.

//==========================================================

//DNS named.conf file for DNS slave:

//==========================================================

options {

listen-on port 53 {10.0.0.10; 127.0.0.1; };

listen-on-v6 port 53 { ::1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

allow-query { any; };

allow-transfer{ 192.168.1.3; 142.25.97.40; 127.0.0.1;};

allow-recursion{142.25.97.0/24; 10.0.0.0/24; };

forwarders{ 142.25.97.40; 10.0.0.1; 127.0.0.1; };

recursion yes;

};

controls {

inet 127.0.0.1 allow { localhost; } keys { rndckey; };

};

logging {

channel default_debug {

file "data/named.run";

severity dynamic;

};

view "internal" {

match-clients { 10.0.0/24; 127.0.0.1/30; };

zone "." IN {

type hint;

file "named.ca";

};

zone "sub.orangespike.com" {

type master;

file "inside/sub.orangespike.com";

};

zone "0.0.10.in-addr.arpa." IN {

type master;

file "inside/sub.orangespike.com.rev.zone";

};

view "outside" {

match-clients{ any; };

zone "." IN {

type hint;

file "named.ca";

};

zone "orangespike.com" in {

type slave;

file "slaves/orangespike.com.zone";

masters{ 142.25.97.89; };

};

include "/etc/rndc.key";

Further On The Slave:

================================================

Create the directories outside and inside:

cd /var/named/chroot/var

mkdir inside

mkdir outside

chown root:named outside

chown root:named inside

Create the zone and rev zone files for the slave:

================================================

In the folder you just created: (inside ) I created the zone file sub.orangespike.com -

The point of this file is to act as a subdomain for the internal/private network.

The outside cannot see this nameserver, nor can the big brother nameserver (ns.orangespike.ca)

$ORIGIN sub.orangespike.com.

$TTL 3600 ; 1 hr

@ IN SOA slave.orangespike.ca. root.localhost. (

2008020502 ; serial

3600 ; refresh 1 hr

3600 ; retry 1 hr

1209600 ; expire 2 weeks

3600) ; minimum 1 hr

sub.orangespike.com. IN NS slave.orangespike.ca.

test.sub.orangespike.com. IN A 10.0.0.20

test2.sub.orangespike.com. IN A 10.0.0.20

test3.sub.orangespike.com. IN A 10.0.0.20

Now create the rev zone file which I called sub.orangespike.com.rev.zone in the same directory that you had made the previous file.

$ORIGIN 0.0.10.in-addr.arpa. ;

$TTL 86400

@ IN SOA slave.orangespike.ca. root.localhost. (

2008020503 ; serial

3600 ; refresh after 1 hour

3600 ; retry after 1 hour

604800 ; expire after 1 week

86400) ; Min TTL of 1 day

0.0.10.in-addr.arpa. NS slave.orangespike.ca.

20.0.0.10.in-addr.arpa. IN PTR test.sub.orangespike.com.

20.0.0.10.in-addr.arpa. IN PTR test2.sub.orangespike.com.

20.0.0.10.in-addr.arpa. IN PTR test3.sub.orangespike.com.

One final change before you restart the slave named service is to edit the slave hosts resolve file.

The reason for this is that we want it to use the big brother ( ns.orangespike.ca ) as its DNS.

vi /etc/resolv.conf

; generated by /sbin/dhclient-script

nameserver 142.25.97.89

search orangespike.ca

Now restart named with the following command and hopefully you get no errors:

service named restart

Additional Private Network Configuration:

================================================

On that router that we had previously configured, we want it to use the DNS server wejust made. I gave mine a static IP address of 10.0.0.10 just to clarify again and told the router to use my DNS server.

Also on the other box, we want it to use DNS of the slave so change /etc/resolv.conf to use 10.0.0.10 and presto we are almost done :)

On another machine use dig and nslookup like you had previously to test the primary nameserver and the output should look similar.

dig test.sub.orangespike.com

; <<>> DiG 9.3.3rc2 <<>> test.sub.orangespike.com

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37578

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:

;test.sub.orangespike.com. IN A

;; ANSWER SECTION:

test.sub.orangespike.com. 3600 IN A 10.0.0.20

;; AUTHORITY SECTION:

sub.orangespike.com. 3600 IN NS slave.orangespike.ca.

;; Query time: 24 msec

;; SERVER: 10.0.0.10#53(10.0.0.10)

;; WHEN: Sat Oct 27 04:29:30 2007

;; MSG SIZE rcvd: 92

Backing Up The DNS Servers:

================================================

The easiest way to backup the DNS servers is to just backup their conf files and zones with a simple bash script to another location. Then putting that script into the CHRON and scheduling it every so often if needed.

Example script:

#====================================================

#!/bin/sh

mkdir /backupdirectory

cp /var/named/chroot/etc/ /backupdirectory

#====================================================

Run bind in chroot:

#====================================================

1.) Check and see if bind-chroot is installed with the command rpm -qa | grep bind-chroot

-If it is great if not, yum install it.

2.) In the terminal: usermod -d /var/named/chroot named

-In /etc/sysconfig/named and if you see the following line then your done:) If not change it to the following:

ROOTDIR=/var/named/chroot

Troubleshooting:

#====================================================

String used to troubleshoot errors when trying to start named:

/usr/sbin/named -g -u named -t /var/named/chroot

Note:: must grep for this command and kill all named processes. They will continue to run unless the machine is restarted or the processes are killed.

#====================================================

Resources:

#====================================================

http://www.linuxhomenetworking.com/

http://www.zytrax.com/books/dns/ch7/xfer.html

http://www.faqs.org/docs/securing/chap21sec166.html

Linux Set Date

2010-01-03T11:23:00.001+06:00

Q. How can I set the system date and time from the command prompt (bash shell)? I don't have GUI installed and I am login over ssh session. How can I set date?

A. Use date command to display the current date and time or set the system date / time over ssh session.
This is useful if the Linux server time and/or date is wrong, and you need to set it to new values from the shell prompt.

You must login as root user to use date command.

Use the following syntax to set new data and time:

date set="STRING"

For example, set new data to 2 Oct 2006 18:00:00, type the following command as root user:

# date -s "2 OCT 2006 18:00:00"

# date set="2 OCT 2006 18:00:00"

You can also simplify format using following syntax:

# date +%Y%m%d -s "20081128"

Linux Set Time

To set time use the following syntax:

# date +%T -s "10:13:13"

Where,

10: Hour (hh)
13: Minute (mm)
30: Second (ss)

Use %p locale’s equivalent of either AM or PM, enter:

# date +%T%p -s "6:10:30AM"

# date +%T%p -s "12:10:30PM"

Do check and sync hardware clock with:

# hwclock --show
# hwclock --systohc

To get sync time with a remote time server(Do this atleast 3 times, check the offset value to minimum):

# ntpdate -u ip/timeserver

example:

# ntpdate -u 114.130.13.37

OR

# ntpdate -u ntp1.ubuntu.com

THANKS TO VIVEK GITE

How Do I Disable/Enable Firewall?

2009-12-22T17:39:00.001+07:00

Next enter the following three commands to disable firewall.

# service iptables save
# service iptables stop
# chkconfig iptables off

If you are using IPv6 firewall, enter:

# service ip6tables save
# service ip6tables stop
# chkconfig ip6tables off

To Enable Firewall

# service iptables start

# chkconfig iptables on

And

# service ip6tables start

# chkconfig ip6tables on

THANKS

How to Disable SELinux

2009-12-22T16:54:00.003+07:00

Steps to check if SELinux is enabled or disabled in RHEL 5 :

Try running command getenforce from command prompt in Red hat enterprise Linux :

[root@rhel 5 ~]# getenforce

Disabled

[root@rhel 5 ~]# grep SELINUX /etc/selinux/config

# SELINUX= can take one of these three values:

SELINUX=disabled

Steps to disabled SElinux in RHEL 5

There is file called config in /etc/selinux which is used to enable/disable SElinux in RHEL5:

[root@rhel 5#cat /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - SELinux is fully disabled.

SELINUX=disabled

# SELINUXTYPE= type of policy in use. Possible values are:

# targeted - Only targeted network daemons are protected.

# strict - Full SELinux protection.

SELINUXTYPE=targeted

# SETLOCALDEFS= Check local definition changes

SETLOCALDEFS=0

While installing RHEL 5 linux if you haven't paid much attention then chances are, you probably have missed reading one of the installation window where installation program ask you to enable/disable SElinux. SElinux can run as enforcing or in permissive mode. If in /etc/selinux/config file selinux is set as permissive or enforcing then change it to disabled. You would need to reboot your RHEL 5 server to disable selinux. This change wouldn't work without rebooting your linux box.

Installing X Window on Debian

2009-12-17T18:41:00.000+07:00

Installing X Window X-Server and Window Managers

To install X-window, lets first update our resource lists with

apt-get update

Then, to install X-window

apt-get install x-window-system

I started using the XFCE window manager and its one of the most lightweight WMs on Linux. It has the look of Gnome and the lightweight of IceWM and X.

To install XFCE 4,

apt-get install xfce4 xfce4-themes

To install other window managers like IceWM, Fluxbox, GNOME)

apt-get install icewm fluxbox gnome

I like gdm (Gnome Desktop Manager) as my graphical login program, so

apt-get install gdm

However you can also try xdm (X Desktop Manager) or kdm (KDE Desktop Manager)

apt-get install xdm kdm

Changing your screen resolution

dpkg-reconfigure xserver-xfree86

Choose your resolution and restart your X with either

/etc/init.d/gdm restart

startx

Removing graphical login

You are finally tired of graphical logins. To turn off the graphical logins (default in Sarge), you have to remove X startup from all run levels.

update-rc.d xdm remove

X won't start again when your computer boots up. You'll be greeted by the console.

sudo and sudoers

2009-12-17T15:40:00.001+07:00

apt-get install sudo

Do not edit directly the file

To edit it, use the command

# visudo

You will see a file more or less like this.

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL

As you can see there is basically one line

root ALL=(ALL) ALL

This lines means that the user root can execute from ALL terminals, acting as ALL (any) users, and run ALL (any) command.

So the first part is the user, the second is the terminal from where the user can use sudo, the third is as which user he may act, and the last one, is which commands he may run.

Let's see some other examples.

operator ALL= /sbin/poweroff

This makes that users operator can from any terminal, run the command poweroff.

You can also create aliases for: users -> User_Alias, run comands as other users -> Runas_Alias, host -> Host_Alias and command-> Cmnd_Alias

These are some examples:

User_Alias OPERATORS = joe, mike, jude
Runas_Alias OP = root, operator
Host_Alias OFNET = 10.1.2.0/255.255.255.0
Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm

As you can see the alias OPERATORS includes the users joe, mike and jude, the alias OP includes the users root and operator, alias OFNET includes the network 10.1.2.0 (all the C class), and the command alias PRINTING includes the commands lpc and lprm.

So a typical sudoers file may look like this.

User_Alias     OPERATORS = joe, mike, jude
 Runas_Alias    OP = root, operator
 Host_Alias     OFNET = 10.1.2.0/255.255.255.0
 Cmnd_Alias     PRINTING = /usr/sbin/lpc, /usr/bin/lprm

OPERATORS ALL=ALL

#The users in the OPERATORS group can run any command from any terminal.

linus ALL=(OP) ALL

# The user linus can run any command from any terminal as any user in the OP group (root or operator).

user2 OFNET=(ALL) ALL

# user user2 may run any command from any machine in the OFNET network, as any user.

user3 ALL= PRINTING

# user user3 may run lpc and lprm from any machine.

go2linux ALL=(ALL) ALL

# user go2linux may run any command from any machine acting as any user. (like Ubuntu)

You may want to read sudoers man page

LVM SCENARIO for RHEL5

2009-12-07T10:39:00.000+07:00

LVM

I have a 13.9 GB harddisk (/dev/sda). Initially it just had one
partition /dev/sda1 of size 5766 MB. To demonstrate LVM, using fdisk
utility I partitioned my harddisk in following manner:

PARTITION          SIZE (MB)            TYPE                      FILESYSTEM
/dev/sda1           5766                       PRIMARY             ext3
/dev/sda2           1653                       PRIMARY
/dev/sda3           1653                       PRIMARY
/dev/sda4           4886                       EXTENDED

To use /dev/sda2 & /dev/sda3 for Logical Volume Manager, follow the
following steps:

1.] Using fdisk utility change the partition id of /dev/sda2 and
/dev/sd3 to lvm (8e)

fdisk /dev/sda
m
p
l
m
t
Partition number: 2
Hex Code: 8e
p
w

fdisk /dev/sda
p
l
t
Partition Number: 3
Hex Code: 8e
p
w

#partprobe

#pvdisplay
#pvcreate /dev/sda2
#pvdisplay
#pvscan

#vgdisplay
#vgscan
#vgcreate Volgroup001 /dev/sda2
#vgscan
#vgdisplay

#lvdisplay
#lvscan
#lvcreate -L 788.48m -n cdrive /dev/Volgroup001
#lvdisplay
#lvscan

#lvdisplay
#lvscan
#lvcreate -l 196 -n ddrive /dev/Volgroup001
#lvdisplay
#lvscan

#pvdisplay
#vgdisplay
#vgscan
#vgextend /dev/Volgroup001 /dev/sda3
#vgscan
#vgdisplay

#lvscan
#lvdisplay
#lvextend -L +788.48m /dev/Volgroup001/cdrive
#lvscan
#lvdisplay

#mke2fs -j /dev/Volgroup001/ddrive
#mount /dev/Volgroup001/ddrive /var2
#dd if=/dev/null /var2/file1 count=780MB
#lvextend -l +196 /dev/Volgroup001/ddrive
#resize2fs /dev/Volgroup001/ddrive
#dd if=/dev/null /var2/file1 count=780MB

Mounting NTFS partition on DEBIAN in RW mode

2009-12-07T10:30:00.001+07:00

FIRST METHOD

The first and the best method to mount a NTFS partition on DEBIAN in

RW mode is to use the application called "ntfs-3g"

All you need to follow the steps prescribed below:

1.] First download the following two binaries:

ntfs-3g

libntfs-3g

2.] Then install the dependencies if at all there are using following command:

#sudo apt-get install fuse-utils libfuse2

P.S: There should not be any dependency in Debian 4.0 (Etch) but to be

on the safer side verify it using above command .

3.] Finally you can install ntfs-3g (using the 2 Debian packages you

just downloaded) using:

#sudo dpkg -i libntfs-3g0_0.0.0+20061031-6_i386.deb

#sudo dpkg -i ntfs-3g_0.0.0+20061031-6_i386.deb

4.] To use the utility ntfs-3g, execute #man ntfs-3g and understand

the command and it's options.

SECOND METHOD

You can also mount the NTFS partition by placing following entry in /etc/fstab:

/dev/sda1 /windows ntfs rw,users,umask=022 0 0

However I am not being able to write over the NTFS partition from

Linux box using second method

Enabling "root" user account in Ubuntu

2009-12-07T10:27:00.000+07:00

In Ubuntu, you can change the root password or activate the root
account with this command :

$ sudo passwd root

But still GDM will not allow you to log on as root in the GUI.

If you still want to do it (bad idea), you have to allow "root login"
(or something similar) in "gdmsetup" :

$ gksu gdmsetup