Linux How Tos : Tutorials

Docker : Static Website

2017-03-07T23:48:00.001-08:00

Before moving forward make sure, you have up and running Docker instance

1) Run a static website in a container

docker run -d seqvence/static-site

So, what happens when you run this command?Since the image doesn't exist on your Docker host, the Docker daemon first fetches it from the registry and then runs it as a containerThe -d flag enables detached mode, which detaches the running container from the terminal/shell and returns your prompt after the container starts

2) Verify if container in running state

docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAME

Sb3b30fab0bc2 seqvence/static-site "/bin/sh -c 'cd /u..." 5 seconds ago Up 4 seconds 80/tcp, 443/tcp wizardly_hypatia

3) But running container like in step 1) will not expose ports running in container to host machine. So, we need mention following flags for mapping/publish container ports on Docker Host

-d will create a container with the process detached from our terminal

-P will publish all the exposed container ports to random ports on the Docker host

-e is how you pass environment variables to the container

--name allows you to specify a container name

AUTHOR is the environment variable name and Your Name is the value that you can pass

docker run --name static-site -e AUTHOR="Your Name" -d -P seqvence/static-site

4) Now run below command to see how ports are published on docker host

docker port static-site443/tcp -> 0.0.0.0:3276880/tcp -> 0.0.0.0:32769

5) Try running http://docker-host:32768

6) If we need to map/publish custom host port to the container web server. Try running site 2 at the same time with custom port

docker run --name static-site-2 -e AUTHOR="Manoj Kumar" -d -p 8888:80 seqvence/static-site

docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

c5d9d6bc66d1 seqvence/static-site "/bin/sh -c 'cd /u..." 3 seconds ago Up 3 seconds 443/tcp, 0.0.0.0:8888->80/tcp static-site-2

7) Try running http://docker-host:8888

NOTE: If you have stopped container and trying to start container again with different environment variable, if will through conflict as container already created and in stopped state. If you want to pass more/updated environment variables, 1st remove container and start again

Docker : failed to get default registry endpoint from daemon, permission denied

2017-02-28T05:22:00.002-08:00

If you are getting error while running docker commands by non root user like

Warning: failed to get default registry endpoint from daemon (Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.26/info: dial unix /var/run/docker.sock: connect: permission denied). Using system default: https://index.docker.io/v1/
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.26/images/create?fromImage=alpine&tag=latest: dial unix /var/run/docker.sock: connect: permission denied

Add the non-root-user to group docker by updating /etc/group file or by running following command

usermod -aG docker non-root-user

Docker Basic Commands

2017-02-28T05:21:00.004-08:00

Commands which are available to use in Docker to play with images or containers

## Download/Pull an image

docker pull alpine ## alpine is an images located in local or docker hub repository

## List Docker images available locally

docker images

## Run Docker images

docker run alpine ls -l #run command will look for image alpine locally if does not exist it will pull from docker hub, creates container and start/run a command in that container

docker run alpine echo "hello from alpine"

docker run alpine /bin/sh

Wait, nothing happened! Is that a bug? Well, no. These interactive shells will exit after running any scripted commands, unless they are run in an interactive terminal - so for this example to not exit, you need to docker run -it alpine /bin/sh

## List running containers

docker ps

## List all containers we ran

docker ps -a

## Run a container with attached tty

docker run -it alpine /bin/sh

This will drop you at /bin/sh shell in container (with tty) where you can run any command as similar to on OS

docker run -it alpine /bin/sh
/ # df -h

Filesystem Size Used Available Use% Mounted on

none 18.1G 1.8G 15.3G 11% /

tmpfs 496.2M 0 496.2M 0% /dev

tmpfs 496.2M 0 496.2M 0% /sys/fs/cgroup

/dev/mapper/dockertest--vg-root

18.1G 1.8G 15.3G 11% /etc/resolv.conf

/dev/mapper/dockertest--vg-root

18.1G 1.8G 15.3G 11% /etc/hostname

/dev/mapper/dockertest--vg-root

18.1G 1.8G 15.3G 11% /etc/hosts

shm 64.0M 0 64.0M 0% /dev/shm

tmpfs 496.2M 0 496.2M 0% /proc/kcore

tmpfs 496.2M 0 496.2M 0% /proc/timer_list

tmpfs 496.2M 0 496.2M 0% /proc/timer_stats

tmpfs 496.2M 0 496.2M 0% /proc/sched_debug

tmpfs 496.2M 0 496.2M 0% /sys/firmware

## Inspect any image/container. INSPECT will Return low-level information on a container or image in JSON format

docker inspect alpine

## Remove containers

get the Container ID

docker ps -a

##docker rm container-ID

docker rm 2db0a4bcb909

## Remove images

get the images IDs

docker images

## docker image rm image-ID # but make sure containers using this image should be removed first else they will be in unstable state if image is removed

docker image rm 48b5124b2768

Terminologies

Images - The file system and configuration of our application which are used to create containers
Containers - Running instances of Docker images — containers run the actual applications. A container includes an application and all of its dependencies. It shares the kernel with other containers, and runs as an isolated process in user space on the host OS
Docker daemon - The background service running on the host that manages building, running and distributing Docker containers
Docker client - The command line tool that allows the user to interact with the Docker daemon
Docker Hub - A registry of Docker images. You can think of the registry as a directory of all available Docker images

Docker Installation On Ubuntu 16.04

2017-02-28T05:21:00.001-08:00

This post is about installation of Docker on Ubuntu 16.04 (must be 64-bit version)

Pre-requisites:

1) Download Ubuntu 16.04 (http://releases.ubuntu.com/16.04/ubuntu-16.04.2-server-amd64.iso)

2) Install Ubuntu 16.04 (https://help.ubuntu.com/lts/installation-guide/amd64/install.en.pdf)

3) Internet connection available to update and install docker packages and its dependencies

Steps to install Docker:

apt-get update

apt-get install -y --no-install-recommends linux-image-extra-$(uname -r) linux-image-extra-virtual

NOTE : linux-image-extra-* allow docker to use the aufs storage drivers

Ref AUFS -> http://www.thegeekstuff.com/2013/05/linux-aufs/

## Allow apt to use/communicate a repository over HTTPS

apt-get install -y --no-install-recommends apt-transport-https ca-certificates curl software-properties-common

## Add Docker official GPG Key

curl -fsSL https://apt.dockerproject.org/gpg | sudo apt-key add -

## Verify that the key ID is 58118E89F3A912897C070ADBF76221572C52609D

apt-key fingerprint 58118E89F3A912897C070ADBF76221572C52609D

## Add Docker stable repository

add-apt-repository "deb https://apt.dockerproject.org/repo/ubuntu-$(lsb_release -cs) main"

## Install Docker

## update repositories to get the latest packages available to install

apt-get update

## Installing Docker enginer

apt-get -y install docker-engine

## Verify docker is installed correctly

docker run hello-world

It's output should be like

docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
78445dd45222: Pull complete
Digest: sha256:c5515758d4c5e1e838e9cd307f6c6a0d620b5e07e6f927b07d05f6d12a1ac8d7
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
3. The Docker daemon created a new container from that image which runs the
executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
https://cloud.docker.com/

For more examples and ideas, visit:
https://docs.docker.com/engine/userguide/

Yay!! You are ready to go with Docker containerization :-)

How to install Perl modules on AIX Server?

2014-11-05T05:44:00.002-08:00

How to install Perl modules on AIX Server?

Download perl module from http://search.cpan.org

Execute following commands to install module

gunzip –d package-module.tar.gz

tar xvf package-module.tar

cd package-module

perl Makefile.PL

If perl is installed on different location i.e.; /home/user/perl. Then follow below command

/home/user/perl/bin/perl Makefile.PL

make

make test

make install

Check installed perl module version

/home/user/perl/bin/perl –Mpackage::name –le ‘print $package::name::version’

For example, for EMail-Simple module

/home/user/perl/bin/perl -MEmail::Simple -le 'print $Email::Simple::VERSION'

How to install IBM Java 7?

2014-11-05T04:47:00.002-08:00

If you want to run Java programs, then you should install JRE
If you want to develop Java programs, then you should install Java SDK (previously called as JDK). SDK also contains JRE

So, if someone ask you to install Java then install Java SDK

How to install Java 7 on AIX 7?

1st check what version of Java is compatible with AIX OS version

Refer : http://www.ibm.com/developerworks/java/jdk/aix/service.html

oslevel ### check AIX OS version

bootinfo -K ### AIX OS architecture 32bit or 64bit

Lets say it's 64bit, so we want to install 64bit java version

We must be registered with IBM with some login name and password to download Java SDK software

Once downloaded perform following steps to install:

Download Java and save in /tmp/ directory

mkdir /tmp/java7_64

cp /tmp/Java7r1_64.sdk.tar.gz /tmp/java7_64

cd /tmp/java7_64

gunzip -d Java7r1_64.sdk.tar.gz

tar xvf Java7r1_64.sdk.tar

inutoc .

smitty installp

Select "Install Software"

INPUT device / directory for software [./] ### Directory where java installer available
SOFTWARE to install [_all_latest]
PREVIEW only? (install operation will NOT occur) no
COMMIT software updates? yes
SAVE replaced files? no
AUTOMATICALLY install requisite software? yes
EXTEND file systems if space needed? yes
OVERWRITE same or newer versions? no
VERIFY install and check file sizes? no
Include corresponding LANGUAGE filesets? yes
DETAILED output? no
Process multiple volumes? yes
ACCEPT new license agreements? yes ### Use Tab to change No to Yes

Press enter to install

That's it!!

CentOS / RHEL 6 - Setup SELinux to work with Apache

2014-10-28T09:48:00.001-07:00

By default SeLinux is enabled and it will mark some labeling on each and every file and ports on OS based on Service.

SeLinux work on following parameters:

1) Context
2) Boolean

1) Context, we can say label. Commands chcon and semanage
2) Boolean, SeLinux having properties for each service like need to enable read or write access to directory, enable http with ftp or not etc.. Commands semanage, getseboolean, setseboolean

In our case we are going to setup SeLinux to work with Apache

Context

Port Settings

As per SeLinux, services can work on only assigned specific ports like

semanage port -l|grep -i mysql

mysqld_port_t tcp 1186, 3306, 63132-63164

semanage port -l|grep -i http_port_t

http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000

So, port given in above output, by default allowed for mysql and apache services

Lets, take an example and change following line in /etc/httpd/conf/httpd.conf

Listen *:2222

Save and restart httpd service

While httpd restart, this will show following:

service httpd restart
Stopping httpd: [FAILED]
Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 192.168.56.103 for ServerName
(13)Permission denied: make_sock: could not bind to address [::]:2222
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:2222
no listening sockets available, shutting down
Unable to open logs
[FAILED]

It's showing Permission denied: make_sock, that means SeLinux not allowing to create sock on 2222 port

As we want run Apache / httpd on 2222 port, execute following command to enable 2222 port for httpd service

semanage port -a -t http_port_t -p tcp 2222

semanage port -l|grep -i http_port_t

http_port_t tcp 2222, 80, 81, 443, 488, 8008, 8009, 8443, 9000

Now 2222 port has been assigned to http_port i.e.; http/apache service

Start http/apache service, you should not get any error this time

service httpd start
Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 192.168.56.103 for ServerName
[ OK ]

netstat -antp|grep http
tcp 0 0 :::2222 :::* LISTEN 1403/httpd

File/Folder Labeling

SeLinux keep labeling on each and every file which is as per service

ls -ldZ /var/www/

drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/

ls -ldZ /var/www/html/

drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/

ls -ldZ /etc/httpd/

drwxr-xr-x. root root system_u:object_r:httpd_config_t:s0 /etc/httpd/

ls -ldZ /etc/httpd/conf

drwxr-xr-x. root root system_u:object_r:httpd_config_t:s0 /etc/httpd/conf

ls -lZ /usr/sbin/httpd

-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd

Here (starting with http means its Domain for only httpd service):

httpd_config_t # http configuration
httpd_sys_content_t # http system content
httpd_exec_t # http executable

So, each and every called by httpd/apache service should have proper label.

Lets try to run httpd with different DocumentRoot with im-proper labeling on files and folders

mkdir /data/www -p

ls -ldZ /data/

drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /data/

ls -ldZ /data/www/

drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 /data/www/

cat > /data/www/index.html
this is test

ctrl+D

ls -lZ /data/www/index.html

-rw-r--r--. root root unconfined_u:object_r:default_t:s0 /data/www/index.html

Restart httpd service and access through your web browser http://server-IP:2222

You should get following error in web broweser:

Forbidden

You don't have permission to access / on this server.

and following in apache/httpd service error logs:

[Tue Oct 28 21:17:07 2014] [error] [client 192.168.56.1] (13)Permission denied: access to /index.html denied

How to recover from above error:

Change label of DocumentRoot i.e.; /data/www and its files

As this is going to be http content directory, we should change label to httpd_sys_content_t

chcon -t httpd_sys_content_t /data -R

for permanent changes

semanage fcontext -t httpd_sys_content_t /data
semanage fcontext -t httpd_sys_content_t /data/www

Now you should be able to access server pages without any error

Command to see running process context

ps auxZ # will provide process context too

Boolean

Commands to get or set Boolean variables

getsebool
setsebool

Some of the http/apache boolean variables

getsebool -a|grep http

httpd_enable_cgi --> on
httpd_enable_homedirs --> off
httpd_unified --> on
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off

If you do not want to disable apache/http to serve cgi files

setsebool httpd_enable_cgi off

Enable user's home directory to be used for data/pages serving for apache/http

setsebool httpd_enable_homedirs on

Enable Apache/http to use CIFS/NFS directory to serve pages

setsebool httpd_use_cifs off

setsebool httpd_use_nfs off

Other commands to use

Disable SeLinux

setenforce 0

modify /etc/sysconfig/selinux file and set

SELINUX=disabled

Reboot machine

Command to restore context

restorecon -Rv /data

Create /.autorelabel for allow OS to relabel complete system at next boot time

How to Install and Configure NTP Server and Client in RHEL/CentOS6?

2014-10-01T03:57:00.000-07:00

NTP Server

1) Install NTP package using yum

yum -y install ntp

2) Setup Restrict Values

vim /etc/ntp.conf # Add below given lines

# Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system.

restrict default kod nomodify notrap nopeer noquery

restrict -6 default kod nomodify notrap nopeer noquery

noquery prevents dumping status data from ntpd.
notrap prevents control message trap service.
nomodify prevents all ntpq queries that attempts to modify the server.
nopeer prevents all packets that attempts to establish a peer association.
Kod – Kiss-o-death packet is to be sent to reduce unwanted queries

The value -6 in the second line allows forces the DNS resolution to the IPV6 address resolution. For more information on the access parameters list, Please refer to documentation on “man ntp_acc”The value -6 in the second line allows forces the DNS resolution to the IPV6 address resolution.

3) Allow network / IP range for synchronizing time from this server

restrict 10.0.0.0 mask 255.255.255.0 nomodify notrap
restrict 127.0.0.1

4) Add local clock as backup

In case NTP server disconnected from internet, NTP server will provide time from its local system clock

server 127.127.1.0 # local clock

fudge 127.127.1.0 stratum 10

5) Specify log files

driftfile /var/lib/ntp/ntp.drift

logfile /var/log/ntp.log

6) Finally start NTP server

service ntpd start

NTP Client

1) Modify /etc/ntp.conf configuration file,

Sample entries, for internet servers :

server 0.centos.pool.ntp.org iburst

server 1.centos.pool.ntp.org iburst

server 2.centos.pool.ntp.org iburst

server 3.centos.pool.ntp.org iburst

iburst: After every poll, a burst of eight packets is sent instead of one. When the server is not responding, packets are sent 16s interval. When the server responds, packets are sent every 2s.

Edit your NTP.conf to reflect appropriate entries for your own NTP server.

server 10.0.0.1 prefer

prefer: If this option is specified that server is preferred over other servers.

2) Start NTP service

service ntpd start

3) Finally check NTP status

ntpq -p

4) Set date and time synchronized with desired server

ntpdate -u SERVER-NAME

5) Get the current status of ntpd:

ntpdc -c sysinfo

system peer: web10.hnshosting.com

system peer mode: client

leap indicator: 00

stratum: 3

precision: -24

root distance: 0.20857 s

root dispersion: 0.27481 s

reference ID: [120.88.46.10]

reference time: d7d65c1f.14c6b054 Wed, Oct 1 2014 16:25:27.081

system flags: auth monitor ntp kernel stats

jitter: 0.014099 s

stability: 0.000 ppm

broadcastdelay: 0.000000 s

authdelay: 0.000000 s

RHEL / CentOS 6 - How to setup iscsi target and initiator ?

2014-09-28T11:16:00.002-07:00

How to setup ISCSI Target?

Server Side

1) Install scsi-target-utils using yum

yum -y install scsi-target-utils

2) Edit iSCSI target configuration

vim /etc/tgt/targets.conf

initiator-address 192.168.56.102 ##Initiator IP/Name
incominguser myuser redhat ##Username = myuser and password = redhat

"iqn.2014-09.net.node1:server.target01" ##Can be anything

There are 2 types of storage devices:

backing-store - defines a virtual device on the target.


direct-store  - defines a direct mapped device with the same properties as the physical device (such as VENDOR_ID, SERIAL_NUM, etc.)

3) Start iSCSI target and on boot

service tgtd start

Start on boot

chkconfig tgtd on

4) Enable 3260 port at firewall

5) Check iSCSI target configuration

tgtadm --mode target --op show

6) Check if everything works as expected

tgt-admin -s

How to setup iSCSI initiator?

Client Side

1) Install iscsi-initiator-utils using yum

yum -y install iscsi-initiator-utils

2) Edit initiator configuration file

vim /etc/iscsi/initiatorname.iscsi

InitiatorName=iqn.2014-09.net.node1:san.initiator01

InitiatorAlias=node2

3) Edit iscsi client configuration /etc/iscsi/iscsid.conf

node.session.auth.authmethod = CHAP

node.session.auth.username = manoj

node.session.auth.password = redhat

4) Start iscsi client service

service iscsid start

5) Start iscsi client on boot

chkconfig iscsid on

6) Discovering targets in our iSCSI server

iscsiadm -m discovery -t st --portal Target-server-IP

7) Login with iSCSI LUN

iscsiadm -m node --targetname iqn.2014-09.net.node1:server.target01 --portal Target-Server-IP --login

8) Checking session status with the target

iscsiadm --mode session --op show

Thats it!!

Please do not forget to update with your feedback :-)

Encrypting Disks With LUKS (RHEL 6 / CentOS 6)

2014-09-26T06:13:00.003-07:00

LUKs a concept used to encrypt disks for securing data. Partitions will not be accessible without decrypting that device with an defined PASSPHRASE

How to setup encrypted disks with LUKs?

1) Install LUKs utilities

yum -y install crypt*

2) Load dm_crypt module

modprobe dm_crypt

3) Add dm_crypt in system, so that after reboot this should be loaded

cat > /etc/sysconfig/modules/dm_crypt.modules
#!/bin/bash
modprobe dm_crypt

save and exit with CTRL+D

chmod 755 /etc/sysconfig/modules/dm_crypt.modules

NOTE: dm_crypt.modules script created to loaod module

4) Lets say /dev/sdb is the disk to encrypt, First Create setup and format /dev/sdb with following command:

cryptsetup luksFormat /dev/sdb

This will ask for passphrase which will be used to decrypt/open this disk before using this disk

To mount or use /dev/sdb disk follow below given steps as at this point /dev/sdb will not be available to mount

5) Open LUKs disk/device by mapping/assigning an name, this will create and file/mapping in /dev/mapper

cryptsetup luksOpen /dev/sdb myluksdev_map

This will ask for passphrase to decrypt disk. Enter passphrase set in step number 4

NOTE : myluksdev_map given name can be anything as per your desire

6) As above command has opened/decrypted disk, now we can format with ext4

mkfs.ext4 /dev/mapper/myluksdev_map

7) Create an folder and mount /dev/sdb

mkdir /mnt/my_secret_dir

mount /dev/mapper/myluksdev_map /mnt/my_secret_dir

[Above /dev/mapper/myluksdev_map is name which is given at the time of opening/decrypting /dev/sdb device]

8) If we want to close encryption, have to follow given steps

umount /mnt/my_secret_dir
cryptsetup luksClose myluksdev_map

8) To make partition persistent or permanent after reboot we should add MOUNT entry in /etc/fstab but for mounting encrypted file system, we should decrypt disk/device. So, we should follow given steps to mount disks at the time of boot

a) Create a file /etc/crypttab
b) Update with given content

MAPname Device/path ------------------- example

In our case MAPname = myluksdev_map , Device Path = /dev/sdb

c) Content should be

cat /etc/crypttab
myluksdev_map /dev/sdb

d) Now update /etc/fstab file with below content

/dev/mapper/myluksdev_map /mnt/my_secret_dir ext4 defaults 0 0

Now reboot your server, this will ask for PASSPHRASE while mounting device /dev/mapper/myluksdev_map

To automatically unlock passphrase or avoiding asking password use below given steps:

a) Create an file, lets say /root/cpasswd which will store password

echo -n "password" > /root/cpasswd
chmod 600 /root/cpasswd

b) Now update /etc/crypttab like this

MAPNAME /DEVICE/PATH /PASSWORD/FILE

So, in our case this should be

myluksdev_map /dev/sdb /root/cpasswd

Now try rebooting your server, this should not ask for password.

Thats it!!!

Please comment with your feedback :-)

Troubleshooting Kdump error "Memory for crashkernel is not reserved"

2014-09-19T00:22:00.001-07:00

In case getting following error while starting kdump service

Memory for crashkernel is not reserved
Please reserve memory by passing "crashkernel=X@Y" parameter to the kernel

If your server is having more than 4GB of RAM then crashkernel=auto (in /etc/grub.conf line starting with kernel)will automatically Reserve memory else need to specify in following format:

crashkernel=0M-2G:128M,2G-6G:256M

If physical memory is 0MB to 2GB then 128MB of memory will be reserved
If physical memory is 2MB to 6GB then 256MB of memory will be reserved

Now REBOOT server for kdump changes to take effect (1st time after kdump installed, a new INITRD will be generated)

Thats it!!!

How To setup Kdump on Linux (Redhat/CentOS 6)?

2014-09-19T00:12:00.000-07:00

1) Install kdump package using YUM

yum -y install kexec-tools

2) Once installed, check /etc/init.d/kdump file/service should be available

ls -l /etc/init.d/kdump

3) Enable kdump at boot

chkconfig kdump on

4) Reboot server for kdump to take effect (new initrd will be generated)

5) Once rebooted kdump status should be Operational

service kdump status

if it's not Operational check error with

service kdump restart/start

If error is "Memory for crashkernel is not reserved" follow given link

http://linuxtroubleshoot.blogspot.in/2014/09/troubleshooting-kdump-error-memory-for.html

How to set QLogic HBA Adapter Speed?

2014-03-19T03:04:00.002-07:00

Here we are going to discuss steps which needs to follow for QLogic HBA Adapter

Reboot the server and go to Qlogic HBA BIOS by entering ctrl + Q when it appears on the screen.

1) Ctrl + Q

2) HBA BIOS, select the HBA port and press enter

3) Select "Configuration Settings"

4) Select "Data Rate"

5) Finally Select Speed as per requirement

Thats it!!

Linux login issue - Can not login: Resource temporarily not available

2013-12-30T13:24:00.002-08:00

Sometime we get following error while user login:

$su - username
Coud not login: Resource temporarily not available

Most of the times this is because of processes or number of files available to user is already used. So, could not arrange more files/processes to login, in this case we required to increase the limits for user in /etc/security/limits.conf (PAM module)

username        soft    nproc           3000
username        hard    nproc          4096
username        soft     nofile           6000
username        hard    nofile          8192

Set these values as per requirement else setting up these values higher may result in server inaccessible in case that particular uses all file descriptors, process and higher memory of server.

Linux Resize LUN Without Reboot

2013-12-02T03:41:00.000-08:00

Try running following commands

Check OS using what devices for attached LUNs:

multipath -l

mpath5 (360060.......................) dm-15

[size=100G][features=1 queue_if_no_path][hwhandler=1 emc][rw]

\_ round-robin 0 [prio=0][active]

\_ 1:0:0:14 sdb 66:192 [active][undef]

\_ 0:0:0:14 sdc 8:224 [active][undef]

\_ round-robin 0 [prio=0][enabled]

\_ 0:0:1:14 sdd 66:112 [active][undef]

\_ 1:0:1:14 sde 67:176 [active][undef]

Rescan all paths:

echo 1 > /sys/block/sdb/device/rescan
echo 1 > /sys/block/sdc/device/rescan

echo 1 > /sys/block/sdd/device/rescan

echo 1 > /sys/block/sde/device/rescan

Then run:

partprobe

multipathd -k

resize map mpath5

If LVM is used, also required following:

#pvscan

Check Disk Changes detected under LVM:

#pvs

#vgscan

Check VG Size is Increased:

#vgs

Now Extend the LV:

#lvextend -L +G

Finally Extend the File System

#resize2fs

Thats it!!!

Redhat Linux : Rollback RPMs

2013-02-08T07:46:00.001-08:00

RPM Rollback for Redhat 5.x versions

1) Create a file /etc/rpm/macros and put following

cat >> /etc/rpm/macros
%_repackage_all_erasures 1

2) Add following at the end of /etc/yum.conf

echo "tsflags=repackage" >> /etc/yum.conf

After above entries, we can rollback rpms installed using yum

3) Now update system with single rpm or complete using

yum update

4) Lets say we had update rpms 1 hour, 2 month and 1 day ago and wants to remove all those then use following commands:

rpm --rollback "1 day ago"
rpm --rollback "1hour ago"
rpm --rollback "2 month ago"

Will be posting for Redhat 6.x version soon.......

Redhat Device Mapper Multipathing

2013-02-08T05:10:00.003-08:00

REDHAT DEVICE MAPPER MULTIPATH

1) DM Software Installation

yum install device-mapper-multipath

2) Initialize /etc/multipath.conf file

mpathconf --enable

3) Start multipath service

service multipathd start

4) If you do not want to use user friendly name

mpathconf --enable --user_friendly_names n

5) Ignoring Local Disks when generating Multipath devices

multipath -v2 (shows local disk, /dev/sda, in the multipath map)

create: SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1 undef WINSYS,SF2372 size=33 GB features="0" hwhandler="0" wp=undef `-+- policy='round-robin 0' prio=1 status=undef
- 0:0:0:0 sda 8:0 [---------

device-mapper ioctl cmd 9 failed: Invalid argument device-mapper ioctl cmd 14 failed: No such device or address

create: 3600a0b80001327d80000006d43621677 undef WINSYS,SF2372 size=12G features='0' hwhandler='0' wp=undef `-+- policy='round-robin 0' prio=1 status=undef
- 2:0:0:0 sdb 8:16 undef ready running `- 3:0:0:0 sdf 8:80 undef ready running

create: 3600a0b80001327510000009a436215ec undef WINSYS,SF2372 size=12G features='0' hwhandler='0' wp=undef `-+- policy='round-robin 0' prio=1 status=undef
- 2:0:0:1 sdc 8:32 undef ready running `- 3:0:0:1 sdg 8:96 undef ready running

In order to prevent the device mapper from mapping /dev/sda in its multipath maps, edit blacklist section in /etc/multipath.conf

blacklist {

wwid SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1

}

6) After updating file reload the changes

service multipathd reload

7) Run following command to remove multipath device

multipath -f SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1

8) Now check if device removed from multipath

multipath

create: 3600a0b80001327d80000006d43621677 undef WINSYS,SF2372 size=12G features='0' hwhandler='0' wp=undef `-+- policy='round-robin 0' prio=1 status=undef
- 2:0:0:0 sdb 8:16 undef ready running `- 3:0:0:0 sdf 8:80 undef ready running

create: 3600a0b80001327510000009a436215ec undef WINSYS,SF2372 size=12G features='0' hwhandler='0' wp=undef `-+- policy='round-robin 0' prio=1 status=undef
- 2:0:0:1 sdc 8:32 undef ready running `- 3:0:0:1 sdg 8:96 undef ready running

...

....

...

9) Add storage that is not supported by default as a know multipath device lets say "Vendor is HP, Product Open-V"

To add information about the HP Open-V series the entry looks like this, where %n is the device name. Add following in /etc/multipath.conf file

devices {

device {

vendor "HP"

product "OPEN-V."

getuid_callout "/lib/udev/scsi_id --whitelisted --device=/dev/%n"

}

}

To be continued..............

GRUB Image Files

2012-04-20T04:03:00.000-07:00

GRUB consists of several images: a variety of bootstrap images for starting GRUB in various ways, a kernel image, and a set of modules which are combined with the kernel image to form a core image. Here is a short overview of them:

boot.img

On PC BIOS systems, this image is the first part of GRUB to start. It is written to a master boot record (MBR) or to the boot sector of a partition. Because a PC boot sector is 512 bytes, the size of this image is exactly 512 bytes.

The sole function of boot.img is to read the first sector of the core image from a local disk and jump to it. Because of the size restriction, boot.img cannot understand any file system structure, so grub-setuphardcodes the location of the first sector of the core image into boot.img when installing GRUB.

diskboot.img

This image is used as the first sector of the core image when booting from a hard disk. It reads the rest of the core image into memory and starts the kernel. Since file system handling is not yet available, it encodes the location of the core image using a block list format.

cdboot.img

This image is used as the first sector of the core image when booting from a CD-ROM drive. It performs a similar function to diskboot.img.

pxeboot.img

This image is used as the start of the core image when booting from the network using PXE. See Network.

lnxboot.img

This image may be placed at the start of the core image in order to make GRUB look enough like a Linux kernel that it can be booted by LILO using an ‘image=’ section.

kernel.img

This image contains GRUB's basic run-time facilities: frameworks for device and file handling, environment variables, the rescue mode command-line parser, and so on. It is rarely used directly, but is built into all core images.

core.img

This is the core image of GRUB. It is built dynamically from the kernel image and an arbitrary list of modules by the grub-mkimage program. Usually, it contains enough modules to access /boot/grub, and loads everything else (including menu handling, the ability to load target operating systems, and so on) from the file system at run-time. The modular design allows the core image to be kept small, since the areas of disk where it must be installed are often as small as 32KB.

Initrd.img

initrd (initial ramdisk) is a scheme for loading a temporary file system into memory in the boot process of the Linux kernel. initrd and initramfs refer to slightly different methods of achieving this. Both are commonly used to make preparations before the real root file system can be mounted.

How to password protect GRUB?

2012-04-20T03:26:00.001-07:00

There are only 3 steps to password protect users to edit grub properties while system booting:

1) Run following command to generate MD5 encrypted password:

root@localhost# grub-md5-crypt
Password:
Retype password:
$1$yAr5c0$ZYlcLULaS2rwOvry1B4gX/

2) Copy MD5 encrypted password of above command

3) Paste copied MD5 encrypted password in menu.list/grub.conf file :

default = 0
timeout=5
password --md5 $1$yAr5c0$ZYlcLULaS2rwOvry1B4gX/

Thats it!!!

Now whenever user's try to run GRUB commands or try to change booting parameters at the time of BOOT, above entered text password will be required!!

Linux : How To Recover From Bad SuperBlock Corrupted Ext3 File System??

2012-04-04T03:36:00.001-07:00

I was getting following error:

/dev/cciss/c0d0p1: Input/output error

mount: /dev/cciss/c0d0p1: can't read superblock

In case you are also facing the same error with superblocks, you can follow below given steps to recover superblock:

#### dumpe2fs /dev/cciss/c0d0p1|grep -i superblock

dumpe2fs 1.39 (29-May-2006)
Filesystem features: has_journal ext_attr resize_inode dir_index filetype needs_recovery sparse_super
Primary superblock at 1, Group descriptors at 2-2
Backup superblock at 8193, Group descriptors at 8194-8194
Backup superblock at 24577, Group descriptors at 24578-24578
Backup superblock at 40961, Group descriptors at 40962-40962
Backup superblock at 57345, Group descriptors at 57346-57346
Backup superblock at 73729, Group descriptors at 73730-73730

Above command output showing back'd up superblock. Now we need to restore from these superblocks

#### fsck -b 8193 /dev/cciss/c0d0p1

If still showing any error continue to restore with next Backup superblock i.e; 24577, 40961 etc....

After successful completion of above command i.e; output will be like this

Free blocks count wrong for group #362 (32254, counted=32248).
Fix? yes
Free blocks count wrong for group #368 (32254, counted=27774).
Fix? yes
..........

/dev/cciss/c0d0p1: ***** FILE SYSTEM WAS MODIFIED *****

 /dev/cciss/c0d0p1: 59586/30539776 files (0.6% non-contiguous), 3604682/61059048 blocks

Now mount your file system

##### mount /dev/cciss/c0d0p1 /mnt

Thats it!!!

How To Access GNU Screen Session Over SSH??

2012-04-03T02:13:00.003-07:00

We can attach a GNU SCREEN session remotely over SSH; in this example we'll open a GNU screen session on host1, and connect to it from host2.

First open and then detach a screen session on host1, named testscreen:

host1 ~ $ screen -S testscreen

Then detach from your screen session with the keyboard combination Ctrl+a+d:

[detached from 3829.testscreen]

Do not "exit" from shell only use Ctrl+a+d to detach from that session. One of the main feature I like about screen is that we can trace whatever user was doing last time (in case of script command a typescript file is created which show the complete working of user)

You can verify that it's still there with this command:

host1 ~ $ screen -ls

There is a screen on:
        3941.testscreen (03/18/2012 12:43:42 PM) (Detached)
1 Socket in /var/run/screen/S-host1.

Then re-attach to your screen session from host2 (because we just detached our session last time not exited, so this will start from the last point were we were detached from session):

host2 ~ $ ssh -t user@host1 screen -r testscreen

You don't have to name the `screen` session if there is only one :)

Ref: http://www.itworld.com/it-managementstrategy/261500/16-ultimate-openssh-hacks

Redhat/CentOS/Fedora Linux: How to Setup Chroot SSH/SFTP

2012-03-29T06:06:00.000-07:00

Find below given steps to setup chrooted SSH:

1) Create a group : groupadd sftpgroup

2) Create a user : useradd -g sftpgroup -d /home/mysftpuser -s /sbin/nologin mysftpuser

3) Open /etc/ssh/sshd_config file and comment following line

#Subsystem sftp /usr/libexec/openssh/sftp-server

4) Add following lines to /etc/ssh/sshd_config

Subsystem sftp internal-sftp
ChrootDirectory /home/%u

5) Save and exit from /etc/ssh/sshd_config file

6) Restart sshd service

7) Try to login from server/client machine

[nginx_test:main.LINUX5 ~]# sftp mysftp@127.0.0.1
Connecting to 127.0.0.1...
mysftp@127.0.0.1's password:
sftp>

sftp> pwd
Remote working directory: /

Thats it!!!

Script/Command To Authenticate Linux With Windows Active Directory Or Linux OpenLDAP

2012-02-10T21:31:00.000-08:00

For Authenticating with Windows AD:

In this lets assume windows domain name is win-pfb09prf78l.scvmm.local

#!/bin/bash

/usr/bin/authconfig --disablecache --enablewinbind --enablewinbindauth --smbsecurity=ADS --smbworkgroup=scvmm --smbrealm=scvmm.local --smbservers=win-pfb09prf78l.scvmm.local --enablewinbindusedefaultdomain --winbindtemplatehomedir=/home/%U --winbindtemplateshell=/bin/bash --enablekrb5 --krb5realm=SCVMM.LOCAL --krb5adminserver=win-pfb09prf78l.scvmm.local --krb5kdc=win-pfb09prf78l.scvmm.local --enablekrb5kdcdns --enablekrb5realmdns --enablelocauthorize --enablemkhomedir --enablepamaccess --update

echo "Comnet@12" | kinit administrator@SCVMM.LOCAL

net ads join -UAdministrator%Comnet@12 -S win-pfb09prf78l.scvmm.local

/bin/sed -i 's/idmap gid/#idmap gid/g' /etc/samba/smb.conf

/bin/sed -i 's/idmap uid/#idmap uid/g' /etc/samba/smb.conf

/bin/sed -i "/#idmap uid/i idmap config scvmm:backend = rid" /etc/samba/smb.conf

/bin/sed -i "/#idmap uid/i idmap config scvmm:base_rid = 500" /etc/samba/smb.conf

/bin/sed -i "/#idmap uid/i idmap config scvmm:range = 500-10000000" /etc/samba/smb.conf

For Authenticating with OpenLDAP:

/usr/bin/authconfig --enableldap --enableldapauth --ldapserver=10.17.138.6 --ldapbasedn=dc=domain,dc=myldap,dc=com --update --enablemkhomedir

Please correct if something missing or wrong :-)

What Are Unix/Linux Processes And Their Types.......

2012-02-10T09:19:00.000-08:00

A process is a running instance of a program. In this article we used two terms ‘program’ and ‘running instance’. Suppose we run a program simultaneously 5 times, then corresponding to each instance there will be a process running in the system. So we say that a process is a “running instance” of a program.

As you already know, you can use ps command to view the processes running on your system. For effective use of the ps command, refer to 7 Practical PS Command Examples for Process Monitoring.

1. Peeping Inside a Process

Now, since we are clear with what exactly a process is, lets dig a bit deeper to see what a process consists of. A Unix process can be thought of as a container which contains:

Program Instructions

Program instructions are kept in text segments which are executed by CPU. Usually for programs like text editors which are executed frequently the text segment is shared. This segment has read only privileges which means that a program cannot modify its text segment.

Data

Mostly the data is kept in data segment. Data segment can be classified into initialized data segment and uninitialized data segment. As the name suggest, initialized data segment contains those global variables which are initialized before hand while uninitialized data segment (also known as ‘BSS’ segment) contains uninitialized global variables. Also, static variables are stored in data segment.

Local variables which are local to functions are stored on stack. Stack is particular to a function and besides containing the information about local variables it also contains information about the address where the flow will return once the execution of function is done. Stack also contains information about the callers environment, like some of the machine registers are also stored on stack. A function which is called allocates memory for its local variables and temporary variables on stack itself. In case of recursive function an independent stack for each function call exists.

Then there is data which is stored on heap. This memory for this data is allocated on runtime on heap segment. Heap segment is not local to a process but shared across processes. This is the reason why C programmers worry a lot about memory leaks which are caused on heap segment and may affect other processes on the system.

Command line arguments and environment variables

A process also contains room for storing environment variables and the command line arguments that we pass to the program. Usually the vector containing the command line information is stored here and then the address of this vector of information and number of elements in vector is copied to ‘argv’ and ‘argc’ (the two arguments to ‘main()’ function).

Besides the above information, a process also contains information like

State of its I/O
Its priority and other control information

One of the most important control information for a process is the privileges. A process directly inherits all the privileges of the user who has triggered this process. For example a process triggered by user who does not have superuser privileges cannot do stuff that require root privileges while a process triggered by root can do any thing that it is programmed to do. An exception to the above rule is where a process can acquire greater privileges than the user who triggered it if the setuid or setgid bit is set for that particular process. But we will not go into much detail about it here(refer to the man pages of setuid and setgid for more information on this).

2. Background and foreground processes

As we already discussed that we can start a process by its name in Unix. Like some standard programs ‘ls’, ‘ps’ etc can be started by just typing their name on the shell prompt. There are two ways in which we can start a process

Starting in foreground
Starting in background

Suppose there is a utility that consumes some time and does a count. Lets say the the name of the utility is ‘count’ Now to trigger and run the program in foreground, I run the following command (where ‘count’ is the name of the binary from the code above) :

$ ./count
Counting done

So we see that, after running the binary ‘./count’, it took almost 10 seconds before the output was displayed on stdout and until then the shell was occupied by this process only. ie You could not perform any other operation on the same shell. Now, to trigger a process in background, add ‘&’ at the end of the command:

$ ./count &
[1] 4120

$ # Do some work on shell while the above program is working in the background

$ Counting done

The ampersand ‘&’ sign indicates that this process needs to be run as a background process. By running a background process, we can have access to the shell for doing any further operations. Like, in the output above, after running the binary ‘count’ in background, I used a couple of more commands on the same shell and when the binary ‘count’ was done with its processing, the output was thrown back on the same shell(the last line). So we can conclude that by default every process runs in foreground, receives input(if any) from keyboard and returns output to the user. While a background process is one which gets disconnected from the keyboard and user can use the same shell to do more operations.

For more information on foreground and background processes refer to: How to Manage UNIX Background Jobs

3. Types of process

So we see that process is a concept that is fundamental to an operating system. Almost every activity on an OS takes form of a process to do some stuff. There are different types of processes running on a system, some of them are :

Child processes

A process that is created by some other process during run-time. Usually child processes are created to execute some binary from within an existing process. Child processes are created using fork() system call. Normally process are made to run through shell/terminal. In that case the shell becomes the parent and the executed process becomes the child process. On Unix/Linux each process has a parent except the init process(we will learn about this later).

Daemon Processes

These are special processes that run in background. They are system related process that have no associated terminal. These processes run will root permissions and usually provide services to processes. As we already know that a daemon process does not have an attached terminal, well to achieve this the process has to be detached from the terminal. The ideal way on Linux/Unix to do this is to run a process through terminal and from within this process create another process and then terminate the parent process. Since the parent is terminated so now the child will become independent of the terminal and would be taken over by init process and hence would become a daemon process. A typical example would be a mail daemon that waits for the arrival of e-mails and notify when a mail is received.

Orphan processes

Usually a process creates a child process (as described above) and when the child process terminates, a signal is issued to the parent so that parent can do all the stuff that it is required to do when one of the child gets terminated. But there are situations when parent gets killed. In that case the child processes become orphan and then taken under by the init process. Though the init process takes the ownership of the orphan process but still these process are called as orphan as their original parents no longer exists.

Zombie process

When a child process gets terminated or completes its execution, then its entry in the process table remains until the parent process fetches the status information of the terminated child. So, until then the terminated process enters zombie state and is known as zombie process. When a process is terminated then all the memory and resources associated with the process are released but the entry of the process in process table exists. A signal SIGCHILD is send to the parent of the process (that just terminated). Typically, the handler of this signal in the parent executes a ‘wait’ call that fetches the exit status of the terminated process and then the entry of this zombie process from the process table is also removed.

4. The init process

As we discussed earlier, init process is the 5th stage in the 6 Stage of Linux Boot Process.

You would be cognizant of the famous ‘chicken and egg’ theory regarding who came first. In terms of processes, as each process has a parent process, the same question can be asked about parent or child process. Well, fortunately there is an answer here. The answer is the init process that is started as a first process during boot sequence. That means there is no parent of init process. Lets verify it, since PID of init is ’1′, we use the ps command :

So we see from the output that PPID is 0, which means that there is no parent for this process.

$ ps -l 1
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY        TIME CMD
4 S     0     1     0  0  80   0 -  5952 poll_s ?          0:00 /sbin/init

Reference : http://www.thegeekstuff.com/2012/02/unix-process-overview/

Shell Script To Add User, Password And Add User To Sudo

2012-02-09T02:44:00.000-08:00

Here's the Shell Script which required 2 parameters 1) UserName 2) Password.....

After setting up user name and password, script will ask you if you want to add user to Super User / Sudo or not....

#!/bin/bash

UCOM="/usr/sbin/useradd"

PCOM="/usr/bin/passwd"

DCOM="/usr/sbin/userdel"

GCOM="/bin/grep"

if [ "$#" != "2" ]

then

echo -e "\033[33m Required 2 Parameters : User Name and Password..."

exit;

else

$UCOM $1

( echo $2; echo $2 ) | $PCOM $1

if [ "$?" != "0" ]

then

$DCOM -r $1

else

echo -e "\033[35m User $1 Successfully Added To System"

echo -e "\033[0m"

echo -e "\033[33m Do You Want To Add User to Sudoers/Super User List (y/n)"

read choice

echo -e "\033[0m"

if [ "$choice" == "y" -o "$choice" == "Y" ]

then

$GCOM $1 /etc/sudoers

if [ "$?" == "0" ]

then

echo -e "\033[31m User $1 Already Added To Sudoers File"

echo -e "\033[0m"

else

echo "$1 ALL=(ALL) ALL" | cat >> /etc/sudoers

echo -e "\033[35m User $1 Successfully Added To Sudoers!!!"

echo -e "\033[0m"

elif [ "$choice" == "n" -o "$choice" == "N" ]

then

echo -e "\033[35m $1 User Not Added To Sudoers!!!"

echo -e "\033[0m"

else

echo -e "\033[37m Invalid Choice....User Not Added To Sudoers :-("

echo -e "\033[0m"

fi

That's it!!!

Please use and update your responses......waiting for your responses :)

Linux How Tos : Tutorials

Docker : Static Website

Docker : failed to get default registry endpoint from daemon, permission denied

Docker Basic Commands

Terminologies

Docker Installation On Ubuntu 16.04

How to install Perl modules on AIX Server?

How to install IBM Java 7?

CentOS / RHEL 6 - Setup SELinux to work with Apache

Context

Forbidden

Boolean

How to Install and Configure NTP Server and Client in RHEL/CentOS6?

RHEL / CentOS 6 - How to setup iscsi target and initiator ?

Encrypting Disks With LUKS (RHEL 6 / CentOS 6)

Troubleshooting Kdump error "Memory for crashkernel is not reserved"

How To setup Kdump on Linux (Redhat/CentOS 6)?

How to set QLogic HBA Adapter Speed?

Linux login issue - Can not login: Resource temporarily not available

Linux Resize LUN Without Reboot

Redhat Linux : Rollback RPMs

Redhat Device Mapper Multipathing

GRUB Image Files

How to password protect GRUB?

Linux : How To Recover From Bad SuperBlock Corrupted Ext3 File System??

How To Access GNU Screen Session Over SSH??

You don't have to name the screen session if there is only one :)

Redhat/CentOS/Fedora Linux: How to Setup Chroot SSH/SFTP

Script/Command To Authenticate Linux With Windows Active Directory Or Linux OpenLDAP

What Are Unix/Linux Processes And Their Types.......

1. Peeping Inside a Process

Program Instructions

Data

Command line arguments and environment variables

2. Background and foreground processes

3. Types of process

Child processes

Daemon Processes

Orphan processes

Zombie process

4. The init process

Shell Script To Add User, Password And Add User To Sudo

You don't have to name the `screen` session if there is only one :)