Linux and Unix cheatsheet

MAC Wireshark packet capture permission error

2020-02-10T17:21:00.002+08:00

You have installed Wireshark on you MAC and when you tried to start a capture, and you are prompted with permission error.

Worry not, all you need to do is to start it with SUDO, assuming you have installed it in the default directory.

sudo /Applications/Wireshark.app/Contents/MacOS/Wireshark

2019-11-25T17:46:00.000+08:00

Cloud Computing

What is Cloud Computing

The NIST definition of Cloud Computing, Special Publication (SP) 800-145, contains the following definition of the five “Essential Characteristics” of cloud computing.

On demand self-service

On-demand self-service is a service available to the consumer without the intervention of the provider. The “consumer” is the individual or organization that purchases the cloud service. Most of the examples in this course assume that an organization is the consumer.

broad network access

Broad network access goes beyond the Internet to include a wide range of client platforms.

resource pooling

Resource pooling allows the provider’s computing resources to be shared in a multi-tenant model with resources assigned and reassigned on demand.

rapid elasticity

Rapid elasticity allows resources to be rapidly and flexibly provisioned and scaled out and in. This provisioning and scaling is performed manually or, in the best case, automatically, either from set parameters or from application logic.

measured service

Measured service leverages metering capabilities to automatically control and optimize resource usage according to service parameters.

Common Threats to Cloud Resources

data breaches
insufficient identity, credential and access management
insecure interface and API
system vulnerability
account hijacking
malicious insider
advance persistent threats
data loss
insufficient due diligent
abuse
DOS
shared technology issues
sensitive data exposure

2018-02-26T17:17:00.001+08:00

what to do when you got a PURPLE SCREEN on the ESX?

Collect these:

A screenshot or photograph of the purple diagnostic screen on the console.
A coredump from the VMkernel placed on disk or sent to the ESXi Dump Collector service. (normally on /var/core)
A vm-support log bundle from the host following a reboot.

https://kb.vmware.com/s/article/1004128

md5 checksum for multiple files

2017-02-10T15:20:00.001+08:00

create the checksum and verify them.
Example: file1.txt file2.txt file3.txt

# Linux
anthony.chin@jump.noc:~$ touch file{1,2,3}.txt
anthony.chin@jump.noc:~$ ll
total 129532
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file1.txt
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file2.txt
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file3.txt
anthony.chin@jump.noc:~$ for i in `ls file?.txt`; do md5sum $i > $i.md5; done
anthony.chin@jump.noc:~$ ll
total 129544
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file1.txt
-rw-r--r-- 1 anthony.chin anthony.chin 44 Feb 10 07:07 file1.txt.md5
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file2.txt
-rw-r--r-- 1 anthony.chin anthony.chin 44 Feb 10 07:07 file2.txt.md5
-rw-r--r-- 1 anthony.chin anthony.chin 0 Feb 10 07:06 file3.txt
-rw-r--r-- 1 anthony.chin anthony.chin 44 Feb 10 07:07 file3.txt.md5
anthony.chin@jump.noc:~$ md5sum -c *.md5
file1.txt: OK
file2.txt: OK
file3.txt: OK

# OSX
$ brew install cfv

$ touch file{1,2,3}.txt
$ ll
total 0
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file1.txt
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file2.txt
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file3.txt

$ for i in `ls file?.txt`; do md5 $i > $i.md5; done
$ ll
total 24
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file1.txt
-rw-r--r-- 1 anthony.chin admin 51 Feb 10 15:13 file1.txt.md5
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file2.txt
-rw-r--r-- 1 anthony.chin admin 51 Feb 10 15:13 file2.txt.md5
-rw-r--r-- 1 anthony.chin admin 0 Feb 10 15:12 file3.txt
-rw-r--r-- 1 anthony.chin admin 51 Feb 10 15:13 file3.txt.md5$ cfv *.txt
file1.txt.md5: 1 files, 1 OK. 0.000 seconds, 11.1K/s
file2.txt.md5: 1 files, 1 OK. 0.000 seconds, 18.8K/s
file3.txt.md5: 1 files, 1 OK. 0.000 seconds, 14.4K/s
3 files, 3 OK. 0.001 seconds, 7.6K/s

# if the md5 was incorrect:
$ vi file3.txt.md5
$ cfv *.txt
file1.txt.md5: 1 files, 1 OK. 0.000 seconds, 11.3K/s
file2.txt.md5: 1 files, 1 OK. 0.000 seconds, 17.6K/s
file3.txt : crc does not match (b026324c6904b2a9cb4b88d6d61c81d2!=b026324c6904b2a9cb4b88d6d61c81d1)
file3.txt.md5: 1 files, 0 OK, 1 badcrc. 0.000 seconds, 19.4K/s
3 files, 2 OK, 1 badcrc. 0.001 seconds, 7.8K/s

How to check Word Wide Node (WWN) for Fiber Channel HBA card?

2016-12-15T17:46:00.000+08:00

To find the Fibre Channel addresses of the HBAs on the machine, run the following:

# systool -c fc_host -v

(output trimmed for clarity)

Class Device path = "/sys/class/fc_host/host8" (kernel assigned host name/number)

node_name = "0x20000024ff2254bf" (hba wwnn )

port_name = "0x21000024ff2254bf" (hba wwpn )

port_id = "0x030b00" (fabric port id assigned by the san to this HBA)

Class Device path = "/sys/class/fc_host/host9"

node_name = "0x20000024ff2254be"

port_name = "0x21000024ff2254be"

port_id = "0x010c00"

or alternatively

# ls -1c /sys/class/fc_host/host*/*_name 2> /dev/null | xargs -I {} grep -H -v "ZzZz" {} | sort

/sys/class/fc_host/host8/fabric_name:0x100000053367f20d

/sys/class/fc_host/host8/node_name:0x20000024ff2254bf

/sys/class/fc_host/host8/port_name:0x21000024ff2254bf

/sys/class/fc_host/host8/symbolic_name:QLE2562 FW:v5.06.02 DVR:v8.04.00.04.06.3-k

/sys/class/fc_host/host9/fabric_name:0x100000606951c582

/sys/class/fc_host/host9/node_name:0x20000024ff2254be

/sys/class/fc_host/host9/port_name:0x21000024ff2254be

/sys/class/fc_host/host9/symbolic_name:QLE2562 FW:v5.06.02 DVR:v8.04.00.04.06.3-k

# ls -1c /sys/class/fc_host/host*/port_id 2> /dev/null | xargs -I {} grep -H -v "ZzZz" {} | sort

/sys/class/fc_host/host8/port_id:0x030b00

/sys/class/fc_host/host9/port_id:0x010c00

Force a process to coredump

2016-12-15T17:42:00.000+08:00

Ensure “gdb” is installed.

Example to force running "crond" process to coredump.

[root@centos ~]# gcore $(pidof crond)

[Thread debugging using libthread_db enabled]

Using host libthread_db library "/lib64/libthread_db.so.1".

0x00007f8c0f444ee0 in __nanosleep_nocancel () from /lib64/libc.so.6

warning: target file /proc/7011/cmdline contained unexpected null characters

Saved corefile core.7011

[root@centos ~]# ls

core.7011

[root@centos ~]# file core.7011

core.7011: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/sbin/crond'

installing salt-stack: salt-master and salt-minion

2016-11-09T17:17:00.000+08:00

Installation

salt master

$ curl -L https://bootstrap.saltstack.com -o install_salt.sh

$ sudo sh install_salt.sh -P -M

Salt master can manage itself, so a Salt minion is installed along with the Salt master.

If you do not want to install the minion, also pass the -N option.

$ sudo sh install_salt.sh -P -M -N

salt minion

- Default minions will use "salt" as the salt master hostname. you can edit this in the minion's /etc/salt/minions "master: x.x.x.x"

- when minion first startup, it will look for "salt" and try to put its key to master

$ curl -L https://bootstrap.saltstack.com -o install_salt.sh

$ sudo sh install_salt.sh -P

accepting keys

You may manually accept the minion key from salt master or you may preseed minion with a key generated from salt master

The key name should always match the minion ID which later on you can find from the minion's /etc/salt/minion_id

From salt master:

$ salt-key --gen-keys=minion1

2 files will be generated:

copy and rename the .pub file into /etc/salt/pki/minions/ folder with the minion ID

$ cp minion.pub /etc/salt/pki/minions/minion1

copy these 2 files to minion before starting the salt-minion service

$ scp minion1.pem minion1.pub root@minion1:/etc/salt/pki/minion/

Start | Stop

$ systemctl start salt-minion

$ systemctl start salt-master

MAC OSX Terminal hostname auto-complete

2016-10-14T11:02:00.002+08:00

The following script uses a function call to autocomplete hostnames dynamically, and fetches hostnames from the ~/.ssh/known_hosts, ~/.ssh/config and system-wide /etc/hosts file.
In MAC OSX, append below into your user's ~/.bash_profile, save and use new login session to take effect

_complete_hosts () {
     COMPREPLY=()
     cur="${COMP_WORDS[COMP_CWORD]}"
     host_list=`{ 
         for c in /etc/ssh_config /etc/ssh/ssh_config ~/.ssh/config
         do [ -r $c ] && sed -n -e 's/^Host[[:space:]]//p' -e 's/^[[:space:]]*HostName[[:space:]]//p' $c
         done
         for k in /etc/ssh_known_hosts /etc/ssh/ssh_known_hosts ~/.ssh/known_hosts
         do [ -r $k ] && egrep -v '^[#\[]' $k|cut -f 1 -d ' '|sed -e 's/[,:].*//g'
         done
         sed -n -e 's/^[0-9][0-9\.]*//p' /etc/hosts; }|tr ' ' '\n'|grep -v '*'`
     COMPREPLY=( $(compgen -W "${host_list}" -- $cur))
     return 0
 }
 complete -F _complete_hosts ssh
 complete -F _complete_hosts host

Mac OSX cmd auto tab completion

2016-10-14T10:35:00.001+08:00

create or edit the ~/.inputrc

set completion-ignore-case on
set show-all-if-ambiguous on
TAB: menu-complete

open a new terminal session, and use tab to try the auto-completion

curl get page load time

2016-09-28T14:47:00.000+08:00

To get the time to load a page

$ curl -o /dev/null -s -w %{time_connect}:%{time_starttransfer}:%{time_total} http://www.google.com

Or save a file curl-format.txt

time_namelookup: %{time_namelookup}\n

time_connect: %{time_connect}\n

time_appconnect: %{time_appconnect}\n

time_pretransfer: %{time_pretransfer}\n

time_redirect: %{time_redirect}\n

time_starttransfer: %{time_starttransfer}\n

----------\n

time_total: %{time_total}\n

And run the curl

$ curl -w "@curl-format.txt" -o /dev/null -s "http://www.google.com/"

time_namelookup: 0.004

time_connect: 0.010

time_appconnect: 0.000

time_pretransfer: 0.010

time_redirect: 0.000

time_starttransfer: 0.018

----------

time_total: 0.018

Validating DNSSEC signed domains

2016-09-21T14:31:00.003+08:00

syntax:

dig @

+dnssec +multi

validating a proper DNSSEC signed domains

look out for Authenticated Data (AD) set in FLAGS.

Requesting DNSSEC signed DNS domain with the DO Flag set (which is DNSSEC OK) should provide an Authenticated answer (AD) flag set in the header.

$ dig +dnssec +multi whitehouse.gov

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> +dnssec +multi whitehouse.gov

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- 8407="" id:="" noerror="" o:p="" opcode:="" query="" status:="">

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags: do; udp: 4096

;; QUESTION SECTION:

;whitehouse.gov. IN A

;; ANSWER SECTION:

whitehouse.gov. 20 IN A 23.200.94.83

whitehouse.gov. 20 IN RRSIG A 7 2 20 20160923132441 (

20160920122441 24695 whitehouse.gov.

I5nNZV8jXvWdMt6/MrctYMjL6e0sRWI+LGwkkafKrHS9

++Pum0CQTucJy8Y1BUVhw83ahrNsivkQar3LGA1kZMHp

HbkRWHwtRzhCkO2SOASJjv+j/mblYgSJznu8t2pqq6vs

Q/3cq93exrK8Zy/izs7nEbhOOnhs7ji4xV5ljTw= )

;; Query time: 2 msec

;; SERVER: 192.168.2.1#53(192.168.2.1)

;; WHEN: Wed Sep 21 02:18:12 2016

;; MSG SIZE rcvd: 233

Validate broken DNSSEC or misconfigured domains

domain which has DNSSEC issues should return SERVFAIL as return code in the header.

$ dig dnssec-or-not.org +dnssec +multi

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.6 <<>> @10.180.8.1 dnssec-or-not.org +dnssec +multi

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode:="" query="" span="" status:="">SERVFAIL, id: 23634

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags: do; udp: 4096

;; QUESTION SECTION:

;dnssec-or-not.org. IN A

;; Query time: 334 msec

;; SERVER: 10.180.8.115#53(10.180.8.115)

;; WHEN: Thu Nov 14 16:46:32 2013

;; MSG SIZE rcvd: 46

Validate non-DNSSEC signed domains

domain that is not DNSSEC signed, should resolve normally.

$ dig +dnssec +multi google.com

; <<>> DiG 9.8.3-P1 <<>> +dnssec +multi google.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- 51197="" id:="" noerror="" o:p="" opcode:="" query="" status:="">

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 5

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags: do; udp: 4096

;; QUESTION SECTION:

;google.com. IN A

;; ANSWER SECTION:

google.com. 300 IN A 216.58.196.206

;; AUTHORITY SECTION:

google.com. 131822 IN NS ns3.google.com.

google.com. 131822 IN NS ns1.google.com.

google.com. 131822 IN NS ns4.google.com.

google.com. 131822 IN NS ns2.google.com.

;; ADDITIONAL SECTION:

ns2.google.com. 301984 IN A 216.239.34.10

ns1.google.com. 301984 IN A 216.239.32.10

ns3.google.com. 301984 IN A 216.239.36.10

ns4.google.com. 301984 IN A 216.239.38.10

;; Query time: 305 msec

;; SERVER: 172.28.2.5#53(172.28.2.5)

;; WHEN: Wed Sep 21 13:54:04 2016

;; MSG SIZE rcvd: 191

find files that does not contain a specific string

2016-09-13T15:55:00.002+08:00

Let say you want to know if all the metadata.rb file that DOES NOT contains a string called "name" from start of line.

egrep -L ^name */metadata.rb

find directories that does NOT contain a file

2016-09-13T15:46:00.000+08:00

Let say you have multiple directories, and would like to show those directory that DO NOT contain a specific file:

For example: searching a cookbook that does not has a "metadata.rb" file in it's directory.

find ./ -maxdepth 1 -type d '!' -exec test -e "{}/metadata.rb" ';' -print

setting up a basic chef environment; chef server, chef workstation, nodes

2016-08-30T18:17:00.001+08:00

Info:

setup 3 vm with below info, put these names under the hosts file on each vm.

Server Name	Function	Local user
chef-server	Chef server	anthony
chef-ws	Chef workstation	anthony
chef-client	Chef node	anthony

Setting up chef-server - standalone

Download the required installer file from chef website

$ dpkg -i chef-server-core_12.8.0-1_amd64.deb

$ chef-server-ctl reconfigure

$ cd /etc/chef

$ chef-server-ctl user-create anthony anthony chin anthony.chin@bluecoat.com 'P@ssw0rd' --filename anthony.pem

$ chef-server-ctl org-create abctest 'ABC Test Co.' --association_user anthony --filename abctest-validator.pem

Setting up chef-workstation

In Ubuntu 16.04 workstation, download the chef-dk from chef website

$ dpkg -i chefdk_0.17.17-1_amd64.deb

$ mkdir -p ~/learn-chef/.chef

$ vi knife.rb

# See http://docs.chef.io/config_rb_knife.html for more information on knife configuration options

current_dir = File.dirname(__FILE__)

log_level :info

log_location STDOUT

node_name "anthony"

client_key "#{current_dir}/anthony.pem"

chef_server_url "https://chef-server/organizations/abctest"

cookbook_path ["#{current_dir}/../cookbooks"]

$ scp anthony@chef-server:/etc/chef/anthony.pem ./

$ knife ssl fetch ß this will get the server certificate from chef-server when the server cert is self-sign.

$ knife ssl check

$ knife node list ß if you are able to run this without any error, thus you have successfully authenticated with the chef-server

Setting up a cookbook

Download a test cookbook from https://supermarket.chef.io/cookbooks/learn_chef_apache2

Extract and save the files under ~/learn-chef/cookbooks/

$ cd ~/learn-chef/cookbooks

$ knife cookbook list

$ knife cookbook upload learn_chef_apache2

$ knife cookbook list

Setting up chef-client (bootstrap from chef-workstation)

From chef-workstation

$ knife node list

$ knife bootstrap chef-client --ssh-user anthony --ssh-password 'P@ssw0rd' --sudo --use-sudo-password --node-name chef-client --run-list 'recipe[learn_chef_apache2]'

$ knife node list ß you will have a “chef-client” node being added with a recipe associated

$ knife node show chef-client

By now, you have installed a chef server, chef workstation, and bootstrapped a node with a recipe associated with it.

Try load the http://chef-client from web browser and you shall get a “hello word” page.

setting up a GIT repo

2016-08-26T18:57:00.000+08:00

# on the git server
yum install git
groupadd git
useradd user1 -G git
useradd user2 -G git
mkdir /opt/git/repo1.git
chgrp -R git /opt/git/repo1.git
chmod -R 2775 /opt/git/repo1.git
cd /opt/git/repo1.git
git init --bare

# on the workstation (when creating an entirely new repo only)
yum install git
mkdir ~/repo1
cd ~/repo1
git init
git remote add origin ssh://user1@10.137.7.175/opt/git/repo1.git
git branch --set-upstream-to=origin/master master
touch abc.txt
git add .
git commit -m "first commit"
git push

# on the subsequent workstation (that works on the same repo)
cd ~
git clone ssh://user2@10.137.7.175/opt/git/repo1.git
git pull
touch cde.txt
git add .
git commit -m "my commit'
git push

reading dpkg -l output; what is ii what is rc ?

2016-08-26T17:29:00.001+08:00

First letter -> desired package state ("selection state"):

u ... unknown
i ... install
r ... remove/deinstall
p ... purge (remove including config files)
h ... hold

Second letter -> current package state:

n ... not-installed
i ... installed
c ... config-files (only the config files are installed)
u ... unpacked
f ... half-configured (configuration failed for some reason)
h ... half-installed (installation failed for some reason)
w ... triggers-awaited (package is waiting for a trigger from another package)
t ... triggers-pending (package has been triggered)

Third letter -> error state (you normally shouldn't see a thrid letter):

r ... reinst-required (package broken, reinstallation required)

When to use old-release.ubuntu.com and when to use archive.ubuntu.com

2016-08-26T17:11:00.000+08:00

If you are running a old version of Ubuntu, probably you will need to amend your /etc/apt/sources.list file to have "old-release" as the URL. As those older versions of packages may have been moved over to here.

deb http://old-releases.ubuntu.com/ubuntu/ lucid main restricted universe multiverse

deb-src http://old-releases.ubuntu.com/ubuntu/ lucid main restricted universe multiverse

deb http://old-releases.ubuntu.com/ubuntu/ lucid-updates main restricted universe multiverse

deb-src http://old-releases.ubuntu.com/ubuntu/ lucid-updates main restricted universe multiverse

deb http://old-releases.ubuntu.com/ubuntu/ lucid-security main restricted universe multiverse

deb-src http://old-releases.ubuntu.com/ubuntu/ lucid-security main restricted universe multiverse

If you are running the later version of Ubuntu, probably you will be getting as below, which is correct.

root@ubuntu:/home/anthony# egrep -v '^#|^$' /etc/apt/sources.list

deb http://us.archive.ubuntu.com/ubuntu/ xenial main restricted

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main restricted

deb http://us.archive.ubuntu.com/ubuntu/ xenial universe

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates universe

deb http://us.archive.ubuntu.com/ubuntu/ xenial multiverse

deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates multiverse

deb http://us.archive.ubuntu.com/ubuntu/ xenial-backports main restricted universe multiverse

deb http://security.ubuntu.com/ubuntu xenial-security main restricted

deb http://security.ubuntu.com/ubuntu xenial-security universe

deb http://security.ubuntu.com/ubuntu xenial-security multiverse

After you have done so, do an update on the index files.

root@ubuntu:/home/anthony# apt-get update

How do I telnet/check UDP ports whether it is open or not?

2016-05-14T15:55:00.001+08:00

How do I telnet/check UDP ports whether it is open or not?

Use nmap as below, port UDP 123 is the common ntp daemon port.

$ nmap -p 123 -sU -P0 192.168.0.0

$ nc -zu 192.168.0.0 123

You may to look for “nc”, “iperf” tools as well.

Disabling IPv6 support in Red Hat Enterprise Linux

2016-05-14T15:52:00.000+08:00

source from: https://access.redhat.com/solutions/8709

Disabling IPv6 support in Red Hat Enterprise Linux 7

Disable ipv6 built-in kernel module.

Edit /etc/default/grub and append ipv6.disable=1 to GRUB_CMDLINE_LINUX like the following sample:
Raw
```
GRUB_CMDLINE_LINUX="rd.lvm.lv=rhel/swap crashkernel=auto rd.lvm.lv=rhel/root ipv6.disable=1"
```

Run the grub2-mkconfig command to regenerate the grub.cfg file:

# grub2-mkconfig -o /boot/grub2/grub.cfg

Alternatively, on UEFI systems, run the following:        
# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Reboot the system to disable IPv6 support.

Alternatively, this can be done via sysctl settings. Please be aware that this breaks SSH Xforwarding unless sshd_config containsAddressFamily inet.

Create a new file named /etc/sysctl.d/ipv6.conf and add the following options:

# To disable for all interfaces
net.ipv6.conf.all.disable_ipv6 = 1
# the protocol can be disabled for specific interfaces as well.
net.ipv6.conf..disable_ipv6 = 1

The new settings would then need to be reloaded with:
Raw
```
# sysctl -p /etc/sysctl.d/ipv6.conf
```

Disabling IPv6 support in Red Hat Enterprise Linux 6

Create a file /etc/modprobe.d/ipv6.conf with the following contents:
Raw
```
options ipv6 disable=1
```
For completeness, it is a good idea to configure the ip6tables service not to start at boot by issuing the following command:
Raw
```
# chkconfig ip6tables off
```

Alternatively, the IPv6 support can also be disabled in the kernel through /etc/sysctl.conf by setting following parameter:

# IPv6 support in the kernel, set to 0 by default
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Please be aware that this breaks SSH Xforwarding unless AddressFamily inet is set in sshd_config.

Comment out any IPv6 addresses found in /etc/hosts, including ::1 localhost address

# cp -p /etc/hosts /etc/hosts.disableipv6
# sed -i 's/^[[:space:]]*::/#::/' /etc/hosts

Optionally to prevent rpc.nfsd setting up IPv6 sockets while NFS server is running, edit /etc/netconfig for the lines starting with udp6 and tcp6; change the "v" in the third column to "-"(hyphen/dash)
Reboot the system to disable IPv6 support.

Note: The solution above only disables(unhooks all of the calls) the ipv6 module, but doesn't prevent it from loading. Unloading the module isn't recommended due to the dependency factors it has with other modules(for example: bonding) and services. To prevent the module from loading, modify/etc/modprobe.d/ipv6.conf with the following only:

install ipv6 /bin/true

Disabling ipv6 in the sysctl.conf will ensure ipv6 isn't used even if the ipv6 module is loaded and can work as a short term solution (until a full reboot)
There is a special case where this might not work, please see The "ipv6 disable=1" option does not seem to work on Red Hat Enterprise Linux 6 system.

Re-enabling IPv6 support in Red Hat Enterprise Linux 6

Review the files under /etc/modprobe.d/ and remove (or comment out) any of the following lines:
Raw
```
options ipv6 disable=1
install ipv6 /bin/true
blacklist ipv6
alias ipv6 off
```
Configure the ip6tables service to start at boot by issuing the following command:
Raw
```
# chkconfig ip6tables on
```

Make sure the following options to your /etc/sysctl.conf are

# ipv6 support in the kernel, set to 0 by default
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0

Make sure the following line exists in /etc/hosts, and is not commented out.

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Edit /etc/netconfig for the lines starting with udp6 and tcp6; change the "-"(hyphen/dash) in the third column to "v"
Reboot the system to activate IPv6 support.

Disabling IPv6 support in Red Hat Enterprise Linux 5

Remove the following line (if present) from the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 ipv6
```
Add the following line to the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 off
```
In versions of Red Hat Enterprise Linux before 5.4, add the following line to the /etc/modprobe.conf file:
Raw
```
alias ipv6 off
```
In Red Hat Enterprise Linux 5.4 and later, add the following line to the /etc/modprobe.conf file:
Raw
```
options ipv6 disable=1
```
To prevent errors during the network initscript start routine, change the NETWORKING_IPV6 parameter in the /etc/sysconfig/network file to the following:
Raw
```
NETWORKING_IPV6=no
```

Comment out any IPv6 addresses found in /etc/hosts, including ::1 localhost address

# cp -p /etc/hosts /etc/hosts.disableipv6
# sed -i 's/^[[:space:]]*::/#::/' /etc/hosts

For completeness, it is a good idea to configure the ip6tables service not to start at boot by issuing the following command:
Raw
```
# chkconfig ip6tables off
```
Reboot the system to disable IPv6 support.

Re-enabling IPv6 support in Red Hat Enterprise Linux 5

Remove the following lines (if present) from the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 off
alias ipv6 off
options ipv6 disable=1
```
Add the following line to the /etc/modprobe.conf file (if not present already):
Raw
```
alias net-pf-10 ipv6
```
Change the NETWORKING_IPV6 parameter in the /etc/sysconfig/network file to the following:
Raw
```
NETWORKING_IPV6=yes
```

Make sure the following line exists in /etc/hosts, and is not commented out.

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

For completeness, it is a good idea to configure the ip6tables service to start at boot by issuing the following command:
Raw
```
# chkconfig ip6tables on
```
Reboot the system to re-enable IPv6 support.

Disabling IPv6 support in Red Hat Enterprise Linux 4

Remove the following line (if present) from the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 ipv6
```
Add the following line to the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 off
```

Comment out any IPv6 addresses found in /etc/hosts, including ::1 localhost address

# cp -p /etc/hosts /etc/hosts.disableipv6
# sed -i 's/^[[:space:]]*::/#::/' /etc/hosts

Reboot the system to disable IPv6 support.

Re-enabling IPv6 support in Red Hat Enterprise Linux 4

Remove the following line from the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 off
```
Add the following line to the /etc/modprobe.conf file:
Raw
```
alias net-pf-10 ipv6
```

Make sure the following line exists in /etc/hosts, and is not commented out.

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Reboot the system to re-enable IPv6 support.

Additional notes

Disabling IPv6 by blacklisting the module invalidates bonding in the system.

can I use the same ssh keys for different users to login to destination host?

2016-04-12T16:22:00.000+08:00

Yes, you can do that!

You will only need to generate once the ssh keys for userA, and duplicate the same private key to userB's directory. And add the public key to the Destination host’s userC.

Now you can use userA and userB to access destination host userC without password.

-rw------- 1 userA userA 1675 Apr 12 16:02 id_rsa ß private key

-rw------- 1 userA userA 397 Apr 12 16:04 id_rsa.pub ß public key

-rw-r--r-- 1 userA userA 391 Apr 12 16:04 known_hosts

Chroot SFTP via SSH

2016-03-10T19:57:00.000+08:00

Edit sshd_config with options below to match with username. Restart to take effect.

Match User userA

ChrootDirectory /home/userA

ForceCommand internal-sftp

My CPU is 32bit or 64bit?

2016-03-10T19:53:00.000+08:00

Simply type the following command and if you see lm (Long Mode) in output, you have a 64 bit CPU based system.

$ grep flags /proc/cpuinfo | grep -i lm

$ if `grep flags /proc/cpuinfo | grep -i " lm " > /dev/null`; then echo "32-bit and 64-bit Architecture"; else echo "32-bit Architecture"; fi

CPU Modes:

lm flag means Long mode cpu - 64 bit CPU

Real mode 16 bit CPU

Protected Mode is 32-bit CPU

Why do "du" and "df" commands report different totals of used disk space?

2016-03-10T19:51:00.003+08:00

df (filesystem level) sees what is happening at filesystem level whereas du (userspace level) sees what is happening at file/directory level.

An inconsistent file system requiring fsck.
A process has an open file which does not exist in file system because the file has been deleted. The space used by this file is not reported by du but it is reported by df.
The mount point directory contains data.
The du command is being run as a non-root user and there are directories which restrict read permissions for that user.
The file system contains one or more storage checkpoints. Space used by storage checkpoints are not reported by du but it is reported by df.

add timestamp to bash history?

2016-03-10T19:50:00.001+08:00

wish to add timestamp to bash history?

$ echo 'export HISTTIMEFORMAT="%F %T "' >> /etc/bashrc

Logout and re-login, and you shall be able to see timestamp on your "history" command.

PAM rejected by account configuration[7]: Authentication failure

2016-03-10T19:46:00.000+08:00

one of the user can’t login to the system, even you have reset the password, account was not locked by observing the shadow file.

[root@stpdb log]# grep abc /etc/shadow

abc:$1$.6KFA6pB$Z7AgIDAF3nvMh0LX.lTPh.:16870:0:99999:14:7::

[root@stpdb log]# chage -l abc

Minimum: 0

Maximum: 99999

Warning: 14

Inactive: 7

Last Change: Mar 10, 2016

Password Expires: Never

Password Inactive: Never

Account Expires: Never

Then you found this

[root@stpdb pam.d]# grep -i pam_tally /var/log/messages

Mar 10 17:46:33 stpdb pam_tally[4865]: user afiza (786) tally 20, deny 5

[root@stpdb pam.d]# grep -i abc /var/log/secure

Mar 10 17:40:15 stpdb sshd[4648]: Failed password for abc from 172.20.42.249 port 3034 ssh2

Mar 10 17:40:15 stpdb sshd[4648]: Failed none for abc from 172.20.42.249 port 3034 ssh2

Mar 10 17:40:15 stpdb sshd[4648]: Failed keyboard-interactive for abc from 172.20.42.249 port 3034 ssh2

[root@stpdb log]# faillog

Username Failures Maximum Latest

root 64 0 Thu Apr 24 20:26:06 +0800 2014 on 172.30.5.10

abc 20 0 Thu Mar 10 19:16:15 +0800 2016 on 172.30.4.38

[root@stpdb pam.d]# grep pam_tally /etc/pam.d/system-auth

auth required /lib/security/pam_tally.so no_magic_root

account required /lib/security/pam_tally.so deny=5 reset no_magic_root

This case, the user has been locked because of the “deny 5” setting, as you can check from the “faillog” command. To reset the user failure count, use below:

[root@stpdb log]# pam_tally --user=afiza –reset

[root@stpdb log]# faillog

Username Failures Maximum Latest

root 64 0 Thu Apr 24 20:26:06 +0800 2014 on 172.30.5.10

abc 0 0 Thu Mar 10 19:16:15 +0800 2016 on 172.30.4.38